How to fill via command line ADS containers for AD Policy in Provisioning server?

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

When trying etautil command with much huge number of containers to update reading from a file as example:

UPDATE 'eTADSPolicyContainerName=Active Directory Policies,eTNamespaceName=CommonObjects' eTADSPolicy eTADSPolicyName='AT_AD My Company' eTAccountContainer='(eTCustomField02=01000000);eTADSOrgUnitName=User,eTADSOrgUnitName=Diretores My Company,eTADSOrgUnitName=My Organization Unit;... (more Ads containers - hundreds).

This can have the error:

ETA_E_1204, End of file reached while expecting a value

This could be necessary to use another different tool than etautil.

 

How to update the ADS Policy containers from Account Templates using another tool different of etautil?

The  ETAUTIL will not do any checking for you. So either way, you'll have to sanitize your data before importing. 

There is a limitation on the ETAUTIL that my exist on components that Admin depends on. This will not be a quick fix as multiple products would need to 
be checked/modified.

How to make it in another tool different of etautil ?

Environment

Symantec Identity Manager 14.5.1 CHF01

Resolution

Please, test an LDAPMODIFY script that performs the same import and and providing it as-is 

---------------------------------------------------------------------------- 
REM ====================== Begin Sript ==================================== 
REM Notice that some lines may have wrapped due to the ticket system. 
REM 
REM Please replace the parameters with ***** with values for your systems. 
REM ____________________________________________________________ 
@echo off 
cls 
YourDomain = *****PutYourAdminDomainHere***** 
YourServer = *****PutYourAdminServerHere***** 
set BASEDN="eTADSPolicyContainerName=Active Directory Policies,eTNamespaceName=CommonObjects,dc=%YourDomain%,dc=eta" 
set D="eTGlobalUserName=etaadmin,eTGlobalUserContainerName=Global Users,eTNamespaceName=CommonObjects,dc=%YourDomain%,dc=eta" 
set W=*****YourPassword***** 
set H=%YourServer% 
set P=20389 
"%ProgramFiles%\CA\CA Identity Manager\Provisioning Server\bin\ldapmodify.exe" -h %YourServer% -p 20389 -D %d% -w %w% -v -f YourTextFile.txt 

REM ====================== End Sript ==================================== 

In YourTestFile.txt: 
--------------------- 
dn: eTADSPolicyName=TESTPOLICY,eTADSPolicyContainerName=Active Directory Policies,eTNamespaceName=CommonObjects,dc=im,dc=eta 
changetype: modify 
replace: eTAccountContainer 
eTAccountContainer: (eTOffice=Halifax Office);eTADSOrgUnitName=Users,eTADSOrgUnitName=Donald Trump Office;........ 
......... = the rest of the filters. 
Do not put quotes around the filter set. 
-----------------------------------------------------------------------------

PS: In case of special characters you may need to convert the ldif file to base64 

Example:

Organization unit named as “<Org Name>” inside of eTAccountContainer (eTADSOrgUnitName=<Org Name>,eTADSSOrgUnitName=LatinAmerica;) need be converted to base64. After convertion this is a example of ldif file:

dn: eTADSPolicyName=test1,eTADSPolicyContainerName=Active Directory Policies,eTNamespaceName=CommonObjects,dc=im,dc=eta
objectClass: eTADSPolicy
eTAccountContainer:: KGVUQ3VzdG9tRmllbGQ5OT0qKTtlVEFEU09yZ1VuaXROYW1lPVPDo28
 gU2ViYXN0acOjbyxlVEFEU09yZ1VuaXROYW1lPUxhdGluQW1lcmljYTtlVEdsb2JhbFVzZXJOYW
 1lPSo7ZVRBRFNDb250YWluZXJOYW1lPVVzZXJzOw==

To convert one way is juse a 3rd party tool Like Jxplorer and export the LDIF to file; One another way using a 3rd party online converter as

 

https://www.base64encode.org/

 

Additional Information

Disclaimer: (CA Support does not provide or support custom scripts)