How to migrate the users from Symantec Unified Authentication One-Time Password (UA-OTP) to Symantec Validation & ID Protection (VIP) with a different VIP Username (Cloud ID)?

Products

• Symantec Products

Issue/Introduction

The customer currently uses Symantec Unified Authentication One-Time Password (UA-OTP) solution for strong authentication and plans to migrate to Symantec Validation & ID Protection (VIP) for multi-factor authentication. After the migration, the customer requires a different user name (for example, userPrincipalName) to be stored on the VIP (VIP Cloud) instead of an existing user name attribute (for example, sAMAccountName).

Resolution

 

1.      Launch VIP Enterprise Gateway Configuration Console.

2.      Complete the following steps to modify the user search criteria:

a.        In the User Stores page, in the User Store table, click Edit from the Action column of the User Store.

b.        In the Edit User Store page, click the Search Criteria tab and click Edit to modify the information.

c.        Modify the LDAP attribute in User Filter from (<existing LDAP attribute>=%s) to (<required VIP User Name attribute>=%s).

 For example modify (sAMAccountName=%s) to (userPrincipalName=%s).

d.        Click Save.    

3.      Restart the VIP Enterprise Gateway service.

4.      Complete the migration of existing users from UA OTP to VIP by referring the following document.

a.        Login to VIP Manager.

b.        Click the Account tab. On the right navigation panel, under Links, click Download Files.

c.        Click Enterprise Gateway > User_Migration_Tool > VIPUserMigrationTool_AdminGuide.pdf.

 

5.      Complete the following steps to revert the user search criteria modified in Step 2 and configuring the VIP User Name Attribute:

a.        In the User Stores page, in the User Store table, click Edit from the Action column of the User Store.

b.        In the Edit User Store page, click the Search Criteria tab and click Edit to modify the information.

c.        Modify the LDAP attribute in User Filter from (<required VIP User Name attribute>=%s) to (<existing LDAP attribute>=%s).

For example modify (userPrincipalName=%s) to (sAMAccountName=%s).

d.        Select the Edit Default VIP User Name Attribute check box.

e.        Enter the same VIP User Name attribute as specified in Step 2.c. For example “userPrincipalName”.

f.         Click Save.

6.      Log in to VIP Enterprise Gateway Configuration console and restart the depended services such as LDAP Sync, Validation Servers, SSP IDP, and VIP Manager IDP.

7.      Log in to VIP Manager. Navigate to Users and ensure that all users are stored using the VIP User Name attribute value as specified in Step 2.