Migrate Endpoint Account Templates between environments - CA Identity Manager

Products

• CA Identity Suite
• CA Identity Manager

Issue/Introduction

Account templates are not part of the IM object store and are not exported in the roles.xml file. These objects exist at the provisioning layer. There is no automated tool to migrate Account Templates.

Environment

Release: ALL Product: CA Identity Manager, CA Identity Suite

Resolution

The following approach is provided as-is. Test this procedure in a non-production environment before implementation.

In the existing (e.g., Development) environment:

1. Dump the account template from the Provisioning Server (port 20389) via Jxplorer.
2. Remove the eTID values for each Account Template in the LDIF file.
3. Adjust attributes (e.g., endpoint name) as needed for the target environment.

In the new environment: 4. Import the role definitions on the Identity Manager (IM) console to recreate all provisioning roles. 5. Import the LDIF to the new Identity Management Provisioning Server (IMPS) on port 20389 via Jxplorer. Ensure endpoints are already acquired/explored. 6. Manually associate the Provisioning Role and the Account Templates. Role-to-Template and Template-to-Endpoint mappings are handled via special inclusion objects and are not part of the Template LDIF file.

Use the etautil tool to assist with re-linking. Execute commands in the following format: etautil -u USER -p PWD -f INPUT.txt

Example INPUT.txt commands:

add 'eTNamespaceName=ActiveDirectory' eTADSDirectory eTADSDirectoryName='My_Endpoint' in 'eTADSPolicyContainerName=Active Directory Policies,eTNamespaceName=CommonObjects' eTADSPolicy eTADSPolicyName='My_Template';

add 'eTRoleContainerName=Roles,eTNamespaceName=CommonObjects' eTRole eTRoleName='My_Role' in 'eTADSPolicyContainerName=Active Directory Policies,eTNamespaceName=CommonObjects' eTADSPolicy eTADSPolicyName='My_Template';