Hi All,

We are in process of evaluating how to migrate TFIM 6.2.2 to ISAM 9.  We have over 300 service providers and manually creating their SP metadata into ISAM is not practically possible, hence we are thinking to write some program to read fed.xml and keystore to read all TFIM metadata information then using REST API create SP into ISAM.

I have one basic question that whether fed.xml has all the relevant info for creating SP metadata into ISAM9, is this approach correct or do we have any other approach?

I could not find any proper documentation on this migration, so any help with any documentation, link would be appreciated.

Thanks,
Amitesh

------------------------------
Amitesh Singh
------------------------------

Hi Amitesh,

I do think all information is included in feds.xml, however, I'm quite sure it's not the recommended way to parse that xml file directly.
In stead, IBM provides an interface for the wsadmin cli tool to extract info about a federation or it's partners. The info you can extract through that interface should give you all the info you need.

See https://www.ibm.com/support/knowledgecenter/en/SSZSXU_6.2.2.7/com.ibm.tivoli.fim.doc_6227/admin/reference/manageItfimDomain.html for more information.

Kind regards

------------------------------
Kristof Goossens
------------------------------

Hi Kristof,

Thanks for your reply and suggestion.

I believe extracting SP info via wsadmin cli tool may be better if we have few SP (10-20 metadata). The thing is that we have two federation prod environments and each has around 300+ SP metadata. In this case we thought writing XML parsing code would be easier than wsadmin.

What do you think would be better approach?

Thanks,
Amitesh

------------------------------
Amitesh Singh
------------------------------

Original Message:
Sent: Mon July 22, 2019 01:12 AM
From: Kristof Goossens
Subject: TFIM to ISAM Migration - Fed.xml

Hi Amitesh,

I do think all information is included in feds.xml, however, I'm quite sure it's not the recommended way to parse that xml file directly.
In stead, IBM provides an interface for the wsadmin cli tool to extract info about a federation or it's partners. The info you can extract through that interface should give you all the info you need.

See https://www.ibm.com/support/knowledgecenter/en/SSZSXU_6.2.2.7/com.ibm.tivoli.fim.doc_6227/admin/reference/manageItfimDomain.html for more information.

Kind regards

------------------------------
Kristof Goossens
------------------------------

Hi Amitesh and Kristof,

Accessing feds.xml directly is not the recommended way to export the feds / partners config meta data, reasons are: feds.xml is designed to be consumed by TFIM runtime program, instead of for end users; it contains some internal properties as well; it contains some obfuscated values (e.g. SOAP binding user password); keys certs and mapping rules are not stored in feds.xml, they needs to be migrated separately.

I'd think the way Kristof suggested above could used to migrate the SP partners one by one.

Best Regards

Chen Yongming

------------------------------
Yongming Chen
------------------------------

Original Message:
Sent: Tue July 23, 2019 02:20 AM
From: Amitesh Singh
Subject: TFIM to ISAM Migration - Fed.xml

Hi Kristof,

Thanks for your reply and suggestion.

I believe extracting SP info via wsadmin cli tool may be better if we have few SP (10-20 metadata). The thing is that we have two federation prod environments and each has around 300+ SP metadata. In this case we thought writing XML parsing code would be easier than wsadmin.

What do you think would be better approach?

Thanks,
Amitesh

------------------------------
Amitesh Singh
------------------------------


Original Message:
Sent: Mon July 22, 2019 01:12 AM
From: Kristof Goossens
Subject: TFIM to ISAM Migration - Fed.xml

Hi Amitesh,

I do think all information is included in feds.xml, however, I'm quite sure it's not the recommended way to parse that xml file directly.
In stead, IBM provides an interface for the wsadmin cli tool to extract info about a federation or it's partners. The info you can extract through that interface should give you all the info you need.

See https://www.ibm.com/support/knowledgecenter/en/SSZSXU_6.2.2.7/com.ibm.tivoli.fim.doc_6227/admin/reference/manageItfimDomain.html for more information.

Kind regards

------------------------------
Kristof Goossens

Hi Amitesh,

We are currently in the migration from TFIM to ISAM too and we have about 600 integrations in our TEST environment and another 400'ish in PROD. I feel your pain ;-)

We decided to use the wsadmin tool and here is our motivation:
I can see the appeal of parsing feds.xml, but the big advantage of using a supported interface (being wsadmin) is that there is documentation available as to what fields mean what.
Bypassing wsadmin and parsing feds.xml will probabely be faster, but you'll loose time to figure out exactly how the different XML nodes map to the options you can specify in the ISAM9 interface, in my opinion.
On top of that, in such migrations, even if the wsadmin tool would be several hours slower, it would not even matter in the total time the project takes (in my opinion).

That being said, wsadmin is a cli tool, so you should be able to completely script the extraction of information from tfim. You could also leverage ISAM9's REST API to automate the migration end2end.

Kind regards

------------------------------
Kristof Goossens
------------------------------

Original Message:
Sent: Tue July 23, 2019 02:20 AM
From: Amitesh Singh
Subject: TFIM to ISAM Migration - Fed.xml

Hi Kristof,

Thanks for your reply and suggestion.

I believe extracting SP info via wsadmin cli tool may be better if we have few SP (10-20 metadata). The thing is that we have two federation prod environments and each has around 300+ SP metadata. In this case we thought writing XML parsing code would be easier than wsadmin.

What do you think would be better approach?

Thanks,
Amitesh

------------------------------
Amitesh Singh
------------------------------


Original Message:
Sent: Mon July 22, 2019 01:12 AM
From: Kristof Goossens
Subject: TFIM to ISAM Migration - Fed.xml

Hi Amitesh,

I do think all information is included in feds.xml, however, I'm quite sure it's not the recommended way to parse that xml file directly.
In stead, IBM provides an interface for the wsadmin cli tool to extract info about a federation or it's partners. The info you can extract through that interface should give you all the info you need.

See https://www.ibm.com/support/knowledgecenter/en/SSZSXU_6.2.2.7/com.ibm.tivoli.fim.doc_6227/admin/reference/manageItfimDomain.html for more information.

Kind regards

------------------------------
Kristof Goossens

Hi Yongming & Kristof,

Thanks for your suggestions.

I understand recommended way is to use wsadmin to extract all the partners config metadata, hence, we will look into creating wsadmin based script.

Thanks a lot for advising on it.


------------------------------
Amitesh Singh
------------------------------

Original Message:
Sent: Tue July 23, 2019 03:22 AM
From: Kristof Goossens
Subject: TFIM to ISAM Migration - Fed.xml

Hi Amitesh,

We are currently in the migration from TFIM to ISAM too and we have about 600 integrations in our TEST environment and another 400'ish in PROD. I feel your pain ;-)

We decided to use the wsadmin tool and here is our motivation:
I can see the appeal of parsing feds.xml, but the big advantage of using a supported interface (being wsadmin) is that there is documentation available as to what fields mean what.
Bypassing wsadmin and parsing feds.xml will probabely be faster, but you'll loose time to figure out exactly how the different XML nodes map to the options you can specify in the ISAM9 interface, in my opinion.
On top of that, in such migrations, even if the wsadmin tool would be several hours slower, it would not even matter in the total time the project takes (in my opinion).

That being said, wsadmin is a cli tool, so you should be able to completely script the extraction of information from tfim. You could also leverage ISAM9's REST API to automate the migration end2end.

Kind regards

------------------------------
Kristof Goossens
------------------------------


Original Message:
Sent: Tue July 23, 2019 02:20 AM
From: Amitesh Singh
Subject: TFIM to ISAM Migration - Fed.xml

Hi Kristof,

Thanks for your reply and suggestion.

I believe extracting SP info via wsadmin cli tool may be better if we have few SP (10-20 metadata). The thing is that we have two federation prod environments and each has around 300+ SP metadata. In this case we thought writing XML parsing code would be easier than wsadmin.

What do you think would be better approach?

Thanks,
Amitesh

------------------------------
Amitesh Singh


Original Message:
Sent: Mon July 22, 2019 01:12 AM
From: Kristof Goossens
Subject: TFIM to ISAM Migration - Fed.xml

Hi Amitesh,

I do think all information is included in feds.xml, however, I'm quite sure it's not the recommended way to parse that xml file directly.
In stead, IBM provides an interface for the wsadmin cli tool to extract info about a federation or it's partners. The info you can extract through that interface should give you all the info you need.

See https://www.ibm.com/support/knowledgecenter/en/SSZSXU_6.2.2.7/com.ibm.tivoli.fim.doc_6227/admin/reference/manageItfimDomain.html for more information.

Kind regards

------------------------------
Kristof Goossens

Hi Amitesh,

maybe this can help speeding up the process a bit.
I have a simple  script that will dump all the federations and the partners belonging to them into xml files, into separate directories. It's written for windows but can probably be easily converted to run on Unix/Linux.
I originally used as a simple tracking/backup function


------------------------------
SACHA RIGBY
------------------------------

Original Message:
Sent: Tue July 23, 2019 03:39 AM
From: Amitesh Singh
Subject: TFIM to ISAM Migration - Fed.xml

Hi Yongming & Kristof,

Thanks for your suggestions.

I understand recommended way is to use wsadmin to extract all the partners config metadata, hence, we will look into creating wsadmin based script.

Thanks a lot for advising on it.


------------------------------
Amitesh Singh
------------------------------


Original Message:
Sent: Tue July 23, 2019 03:22 AM
From: Kristof Goossens
Subject: TFIM to ISAM Migration - Fed.xml

Hi Amitesh,

We are currently in the migration from TFIM to ISAM too and we have about 600 integrations in our TEST environment and another 400'ish in PROD. I feel your pain ;-)

We decided to use the wsadmin tool and here is our motivation:
I can see the appeal of parsing feds.xml, but the big advantage of using a supported interface (being wsadmin) is that there is documentation available as to what fields mean what.
Bypassing wsadmin and parsing feds.xml will probabely be faster, but you'll loose time to figure out exactly how the different XML nodes map to the options you can specify in the ISAM9 interface, in my opinion.
On top of that, in such migrations, even if the wsadmin tool would be several hours slower, it would not even matter in the total time the project takes (in my opinion).

That being said, wsadmin is a cli tool, so you should be able to completely script the extraction of information from tfim. You could also leverage ISAM9's REST API to automate the migration end2end.

Kind regards

------------------------------
Kristof Goossens


Original Message:
Sent: Tue July 23, 2019 02:20 AM
From: Amitesh Singh
Subject: TFIM to ISAM Migration - Fed.xml

Hi Kristof,

Thanks for your reply and suggestion.

I believe extracting SP info via wsadmin cli tool may be better if we have few SP (10-20 metadata). The thing is that we have two federation prod environments and each has around 300+ SP metadata. In this case we thought writing XML parsing code would be easier than wsadmin.

What do you think would be better approach?

Thanks,
Amitesh

------------------------------
Amitesh Singh


Original Message:
Sent: Mon July 22, 2019 01:12 AM
From: Kristof Goossens
Subject: TFIM to ISAM Migration - Fed.xml

Hi Amitesh,

I do think all information is included in feds.xml, however, I'm quite sure it's not the recommended way to parse that xml file directly.
In stead, IBM provides an interface for the wsadmin cli tool to extract info about a federation or it's partners. The info you can extract through that interface should give you all the info you need.

See https://www.ibm.com/support/knowledgecenter/en/SSZSXU_6.2.2.7/com.ibm.tivoli.fim.doc_6227/admin/reference/manageItfimDomain.html for more information.

Kind regards

------------------------------
Kristof Goossens

Hi Sacha,

Thanks a lot. I really appreciate your help on script. It will save my lot of time on figuring out extraction.

Thanks,
Amitesh

------------------------------
Amitesh Singh
------------------------------

Original Message:
Sent: Wed July 24, 2019 05:25 AM
From: SACHA RIGBY
Subject: TFIM to ISAM Migration - Fed.xml

Hi Amitesh,

maybe this can help speeding up the process a bit.
I have a simple  script that will dump all the federations and the partners belonging to them into xml files, into separate directories. It's written for windows but can probably be easily converted to run on Unix/Linux.
I originally used as a simple tracking/backup function


------------------------------
SACHA RIGBY
------------------------------


Original Message:
Sent: Tue July 23, 2019 03:39 AM
From: Amitesh Singh
Subject: TFIM to ISAM Migration - Fed.xml

Hi Yongming & Kristof,

Thanks for your suggestions.

I understand recommended way is to use wsadmin to extract all the partners config metadata, hence, we will look into creating wsadmin based script.

Thanks a lot for advising on it.


------------------------------
Amitesh Singh


Original Message:
Sent: Tue July 23, 2019 03:22 AM
From: Kristof Goossens
Subject: TFIM to ISAM Migration - Fed.xml

Hi Amitesh,

We are currently in the migration from TFIM to ISAM too and we have about 600 integrations in our TEST environment and another 400'ish in PROD. I feel your pain ;-)

We decided to use the wsadmin tool and here is our motivation:
I can see the appeal of parsing feds.xml, but the big advantage of using a supported interface (being wsadmin) is that there is documentation available as to what fields mean what.
Bypassing wsadmin and parsing feds.xml will probabely be faster, but you'll loose time to figure out exactly how the different XML nodes map to the options you can specify in the ISAM9 interface, in my opinion.
On top of that, in such migrations, even if the wsadmin tool would be several hours slower, it would not even matter in the total time the project takes (in my opinion).

That being said, wsadmin is a cli tool, so you should be able to completely script the extraction of information from tfim. You could also leverage ISAM9's REST API to automate the migration end2end.

Kind regards

------------------------------
Kristof Goossens


Original Message:
Sent: Tue July 23, 2019 02:20 AM
From: Amitesh Singh
Subject: TFIM to ISAM Migration - Fed.xml

Hi Kristof,

Thanks for your reply and suggestion.

I believe extracting SP info via wsadmin cli tool may be better if we have few SP (10-20 metadata). The thing is that we have two federation prod environments and each has around 300+ SP metadata. In this case we thought writing XML parsing code would be easier than wsadmin.

What do you think would be better approach?

Thanks,
Amitesh

------------------------------
Amitesh Singh


Original Message:
Sent: Mon July 22, 2019 01:12 AM
From: Kristof Goossens
Subject: TFIM to ISAM Migration - Fed.xml

Hi Amitesh,

I do think all information is included in feds.xml, however, I'm quite sure it's not the recommended way to parse that xml file directly.
In stead, IBM provides an interface for the wsadmin cli tool to extract info about a federation or it's partners. The info you can extract through that interface should give you all the info you need.

See https://www.ibm.com/support/knowledgecenter/en/SSZSXU_6.2.2.7/com.ibm.tivoli.fim.doc_6227/admin/reference/manageItfimDomain.html for more information.

Kind regards

------------------------------
Kristof Goossens