Changing the Namespace on a Siteminder User Directory

Products

• SITEMINDER

Issue/Introduction

The Siteminder User Directory object class has 4 possible Namespace values:

LDAP:  Used for LDAP Connections to non Active Directory user stores.  It is also used for connections to an Active Directory user store from a Policy Servers running on Linux hosts.  Supported on both Windows and Linux.

AD: Used to connect Policy Servers hosted on Windows Server to Active Directory user stores.  Supported on Windows Server only

ODBC: Supports connection to ODBC user stores using a DSN.

Custom: Supports custom libraries for user store connection.

Once a User Directory is defined, the Namespace attribute cannot be modified.  In the AdminUI the Namespace field is greyed out. 

Environment

PRODUCT: Symantec Siteminder

COMPONENT: Policy Server

VERSION: Any

OPERATING SYSTEM: Any

Cause

When a User Directory is initially created, the Namespace will dictate which specific attributes are added to the object.  Each namespace has some unique attributes which are not defined on user user directories with a different namespace.

LDAP:  Contains the following attributes which are not defined on user directories with the ODBC or Custom Namespace

UserLookupStart

UserLookupEnd

AD: Contains the following attributes which are not defined on user directories with the ODBC or Custom Namespace

UserLookupStart

UserLookupEnd

ODBC:  Contains the following attributes which are not defined on user directories with any other Namespace

ODBCQueryLink

 

The specific attributes are added to the CA.SM::UserDirectory object at the time of creation.  In order to change the namespace, the process is not just changing the value in the "namespace" field it would need to remove the inappropriate metadata (attributes) from the user directory object and add new metadata (attributes) appropriate for the new data.  While that may work when migrating between LDAP and AD namespaces, it create complications when attempting to migrate between OBC and anything else.   

 

Resolution

You will need to create a new User Directory if you want to modify the Namespace.

1) Create a new User Directory

2) Add the new user directory to the Domain

3) Create a User Policy with the Policy.

4) Test that users can authenticate and authorize

5) Remove the old User Policy from the Policy

6) Remove the old user directory from the Domain