IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  TAM to Verify Access migration

    Posted Mon July 13, 2020 07:52 AM
    Planning a big step -- migrating from TAM (TDS 6.1, WebSphere 6.1.1, TAM 6.1.04)
    to the latest and greatest i.e ver 10 in a kubernetes cluster.
    The  question for now concerns the TDS, can we 'just' do an ldif export of the current ldap subtrees DEFAULT, IBMPOLICIES and our user space suffix DC=XXX,DC=YYY, import these ldifs to a 'virgin' TDS 6.4 and ("pipe-dream" warning here) expect it to work?
    Or is there a better migration policy to follow?

    Rgds

    ------------------------------
    Anders Domeij
    CGI Sweden AB
    ------------------------------


  • 2.  RE: TAM to Verify Access migration

    Posted Wed July 15, 2020 06:12 PM

    Hi Anders,

    Check your TDS 6.1 instance to see if you have any schema customizations. Compare V3* files from instance's etc folder such as (/home/ldapdb2/idsslapd-ldapdb2/etc/) against the product provided V3* files from /opt/[IBM/ibm]/ldap/V6.1/etc/SchemaV6.1/ folder.
    If the V3* files from instance's etc folder are same as that of product provided files, then you can simply take exports of the data branches of your interest using idsdb2ldif from 6.1 instance and import them into a new 6.4 instance.

    If any of the V3* files are different between those two folders, then you must go through migration path. Refer to our 6.4 upgrade presentation for remote system migration method: https://www.ibm.com/support/pages/node/607073

    With 6.4 migration tool, idsimigr, you can only migrate from V6.2 or later. So you need to an intermediate version V6.3 or V6.3.1 to migrate the schema files. So you'll have to get the schema files migrated from 6.1 to 6.3 or 6.3.1 and then from 6.3 or 6.3.1 to 6.4.

    If you need more detailed assistance, please feel free to open a case with Directory Server support team.

    Thanks,



    ------------------------------
    Ramamohan Reddy
    ------------------------------

    Original Message


  • 3.  RE: TAM to Verify Access migration

    Posted Thu July 16, 2020 08:26 AM
    Thanks for the info,

    No such luck then....

    Output from diff:

    Files /opt/ibm/ldap/V6.4/etc/SchemaV6.4/V3.config.at and /usr/local/drift/users/wmandom/etc/SchemaV6.1/V3.config.at differ
    Files /opt/ibm/ldap/V6.4/etc/SchemaV6.4/V3.config.oc and /usr/local/drift/users/wmandom/etc/SchemaV6.1/V3.config.oc differ
    Files /opt/ibm/ldap/V6.4/etc/SchemaV6.4/V3.ibm.at and /usr/local/drift/users/wmandom/etc/SchemaV6.1/V3.ibm.at differ
    Files /opt/ibm/ldap/V6.4/etc/SchemaV6.4/V3.ibm.oc and /usr/local/drift/users/wmandom/etc/SchemaV6.1/V3.ibm.oc differ
    Files /opt/ibm/ldap/V6.4/etc/SchemaV6.4/V3.modifiedschema and /usr/local/drift/users/wmandom/etc/SchemaV6.1/V3.modifiedschema differ
    Files /opt/ibm/ldap/V6.4/etc/SchemaV6.4/V3.system.at and /usr/local/drift/users/wmandom/etc/SchemaV6.1/V3.system.at differ
    Files /opt/ibm/ldap/V6.4/etc/SchemaV6.4/V3.system.oc and /usr/local/drift/users/wmandom/etc/SchemaV6.1/V3.system.oc differ
    Files /opt/ibm/ldap/V6.4/etc/SchemaV6.4/V3.user.at and /usr/local/drift/users/wmandom/etc/SchemaV6.1/V3.user.at differ
    Files /opt/ibm/ldap/V6.4/etc/SchemaV6.4/V3.user.oc and /usr/local/drift/users/wmandom/etc/SchemaV6.1/V3.user.oc differ
    :-)

    ------------------------------
    Anders Domeij
    CGI Sweden AB
    ------------------------------

    Original Message


  • 4.  RE: TAM to Verify Access migration

    Posted Thu July 16, 2020 09:51 AM

    Hi Anders,
    Schema files are definitely different, but you are comparing product provided V6.1 files against V6.4 files.

    Instead please compare the files from 6.1 instance's etc folder (e.g.: /home/ldapdb2/idsslapd-ldapdb2/etc/V3*) against the 6.1 product provided files (/opt/ibm/ldap/V6.1/etc/SchemaV6.1/V3*). This will help you determine if your 6.1 instance have any schema customizations.
    To find your instance:
    /opt/ibm/ldap/V6.1/sbin/idsilist -a

    Note down the Name and Location of the instance - then your instance's etc folder is: <Location>/idsslapd-<Name>/etc

    I hope this helps.
    Thanks,



    ------------------------------
    Ramamohan Reddy
    ------------------------------

    Original Message


Related Content