Getting the errors "Assert failed: Attr" and "Assert failed: Domain" when importing a Policy Store export with XPSImport

book

Article ID: 4629

calendar_today

Updated On:

Products

CA Single Sign On Secure Proxy Server (SiteMinder) AXIOMATICS POLICY SERVER CA Single Sign On SOA Security Manager (SiteMinder) CA Single Sign-On

Issue/Introduction

When importing Policy Store export from old R12.0 environment to new R12.52 SP1 environment, the following errors appear during the XPSImport validation step:

(ERROR) : [CA-SM-Assert] CA.SM::[email protected](MyRule): Assert failed: Attr
(ERROR) : [CA-SM-Assert] CA.SM::[email protected](MyRuleGroup): Assert failed: Domain

How could I fix this?

Cause

In the sample given, the "Assert failed: Domain" means that for that Rule and RuleGroup,

CA.SM::[email protected](MyRule)

CA.SM::[email protected](MyRuleGroup)

the Domainlink property is missing or have a value for a missing Domain in the Policy Store. The Domainlink data is causing this issue actually.

Environment

Policy Server R12.52 SP1
Importing data from R12.0 SP3 Policy Store

Resolution

Those objects should be checked individually to see what is causing the error. The data correction should be done in the R12.0 SP3 Policy Store using the XPSTools from the Policy Server R12.0 SP3, and then export again the objects. By running XPSExplorer tool, you could check those objects and the value of the DomainLink attribute.

If DomainLink attribute is not correct (should point to a valid Domain XID), it may mean that the objects were corrupted or not removed correctly, and this would need to be addressed manually in order to be imported successfully in the new Policy Store.

To lead a Policy Store integrity check, another option is to install a R12.6 (or higher) Policy Server to use the built-in integrity tools to repair those objects from the Policy Store 12.0SP3