Getting the errors "Assert failed: Attr" and "Assert failed: Domain" when importing a Policy Store export with XPSImport

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On SOA Security Manager (SiteMinder)
• CA Single Sign-On

Issue/Introduction

When importing Policy Store export from old R12.0 environment to new R12.52 SP1 environment, the following errors appear during the XPSImport validation step:

(ERROR) : [CA-SM-Assert] CA.SM::[email protected](MyRule): Assert failed: Attr
(ERROR) : [CA-SM-Assert] CA.SM::[email protected](MyRuleGroup): Assert failed: Domain

How could I fix this?

Environment

Policy Server R12.52 SP1
Importing data from R12.0 SP3 Policy Store

Cause

In the sample given, the "Assert failed: Domain" means that for that Rule and RuleGroup,

CA.SM::[email protected](MyRule)

CA.SM::[email protected](MyRuleGroup)

the Domainlink property is missing or have a value for a missing Domain in the Policy Store. The Domainlink data is causing this issue actually.

Resolution

Those objects should be checked individually to see what is causing the error. The data correction should be done in the R12.0 SP3 Policy Store using the XPSTools from the Policy Server R12.0 SP3, and then export again the objects. By running XPSExplorer tool, you could check those objects and the value of the DomainLink attribute.

If DomainLink attribute is not correct (should point to a valid Domain XID), it may mean that the objects were corrupted or not removed correctly, and this would need to be addressed manually in order to be imported successfully in the new Policy Store.

To lead a Policy Store integrity check, another option is to install a R12.6 (or higher) Policy Server to use the built-in integrity tools to repair those objects from the Policy Store 12.0SP3