How to migrate the Provisioning Directory?

Products

CA Identity Suite

Issue/Introduction

We recently upgraded vApp from version 14.5 on CentOS 8 to version 14.5 on CentOS 9. After the migration, we observed that no data was transferred to the new provisioning directory from the old provisioning directory nodes. The user store data was migrated successfully and it is present in the new user store.

We still have the CentOS 8 server available and can see all the .db files with the correct data. We need your assistance to migrate the data from the CentOS 8 server to the CentOS 9 server.

Environment

Release : 14.5
Component : CA Identity Suite Virtual Appliance

Resolution

Migrate the Provisioning Directory:

1. Back up custom schema files by copying %DXHOME%/config/schema directory from the existing Provisioning Directory, to the same directory on the new system. Note that the custom schema files are created in the following scenarios:
- The COSX (etrust_cosx.dxc) has been modified.
- The LDA connector (etrust_lda.dxc) is installed.
- A custom C++ connector schema has been created

2. Stop the provisioning DSAs on the existing system.
dxserver stop existing_system_hostname-impd-notify
dxserver stop existing_system_hostname-impd-main
dxserver stop existing_system_hostname-impd-inc
dxserver stop existing_system_hostname-impd-co

3. Dump the provisioning data from the existing system into the ldif files.
dxdumpdb -f hostname-impd-notify.ldif -v existing_system_hostname-impd-notify
dxdumpdb -f hostname-impd-main.ldif -v existing_system_hostname-impd-main
dxdumpdb -f hostname-impd-inc.ldif -v existing_system_hostname-impd-inc
dxdumpdb -f hostname-impd-co.ldif -v existing_system_hostname-impd-co

Note: -v is for verbose mode. Exercise caution when using this option as it displays output on the screen and posts the output to your ldif file. This task can slow down the process, especially for very large DSAs. Remove this option if you are facing performance issues with the dxdumpdb command.

4. Stop the provisioning DSAs and Provisioning Server on the new system (on all nodes)
dxserver stop new_system_hostname-impd-notify
dxserver stop new_system_hostname-impd-main
dxserver stop new_system_hostname-impd-inc
dxserver stop new_system_hostname-impd-co

5. Load the provisioning data into the DSAs of the new system (on all ndes)
dxloaddb -s new_system_hostname-impd-notify hostname-impd-notify.ldif
dxloaddb -s new_system_hostname-impd-main hostname-impd-main.ldif
dxloaddb -s new_system_hostname-impd-inc hostname-impd-inc.ldif
dxloaddb -s new_system_hostname-impd-co hostname-impd-co.ldif

6. Start the DSAs and Provisioning Server on the new system (on all ndes)
dxserver start new_system_name-impd-notify
dxserver start new_system_name-impd-main
dxserver start new_system_name-impd-inc
dxserver start new_system_name-impd-co

Post Migration Tasks:

Perform the following post-migration tasks.
Task 1: Post-migration, the new system still contains references to the old Provisioning Directory. Follow the given steps to update them with the new provisioning entries.

Connect to the new Provisioning Directory using any LDAP tool. Connect using the following connection details:
port: 20391
bind DN: eTDSAContainerName=DSAs,eTNamespaceName=CommonObjects,dc=im,dc=etadb
Update the following Provisioning Directory entries. They contain attributes (eTDSADbHost, eTDSAHost) with old system names.
eTDSAName=im,eTDSAContainerName=DSAs,eTNamespaceName=CommonObjects,dc=etadb
eTDSAName=im,eTDSAContainerName=DSAs,eTNamespaceName=CommonObjects,dc=im,dc=etadb
Remove entries representing old provisioning system from eTConfigParamFolderName=Servers,eTConfigParamContainerName=Parameters,eTConfigContainerName=Configuration,eTNamespaceName=CommonObjects,dc=im,dc=etadb
Remove entries representing old provisioning system from dc=notify,dc=etadb

Task 2: After you migrate the Provisioning Directory, ensure that the new Provisioning Server points to the new Connector Server. You can check and add a new Connector Server to the Provisioning Server, either using the Command Line or Connector Xpress.

Using Command Line
Given is an example to add a new Connector Server to the Provisioning Server using csfconfig. For details about the command, see csfconfig.
Example:
To check, run the following command:
csfconfig list auth="etaadmin"
To add the new Connector Server, run the following command:
csfconfig add auth="etaadmin" br-add="PeopleSoft" host="testhostname" usetls="yes" pass="c:\pass.txt"

Using Connector Xpress
To add the new Connector Server to the Provisioning Server using Connector Xpress, follow the given steps:
Log in to the Connector Xpress.
Connect to the migrated Provisioning Server.
Navigate to <Provisioning Server Host>, im, CS Configs.
Right-click CS Configs, and select New CS Config.
In the New Connector Server Configuration window, configure the following:
Descriptive Name: Enter a name for the new Connector Server.
Connector Server Host Name: Enter the migrated Connector Server host name.
Provisioning Server : Enter the migrated Provisioning Server host name.
Select Make this the default CS.
Click OK.
Next, delete the old Connector Server from CS Config.

Task 3: Update Inbound Notification URL to point to the new Identity Manager Server.

Log in to the Provisioning Manager.
Navigate to System, Identity Manager Setup.
Replace the old Identity Manager Server details with the new one.
Click Apply.

High Availability Configurations
In a High Availability environment, you must change the hostname of the alternate Provisioning Directories in the <Provisioning Directory_Install_DIR>/_uninst/archive_upgrade.dat file.
To update the hostname in the DSAs referred by the Provisioning Directory, update the address field with the new hostname in the following configuration files under <Directory_Intall_DIR>/dxserver/config/knowledge.
<hostname>-impd-co.dxc
<hostname>-impd-inc.dxc
<hostname>-impd-main.dxc
<hostname>-impd-notify.dxc
<hostname>-impd-router.dxc