Sun Java logo     Previous      Contents      Index      Next     

Sun logo
Sun Java System Portal Server 6 2004Q2 Migration Guide 

Chapter 2
Migrating LDAP Data

Note

All instances of the Sun™ ONE Portal Server 3.0 product refer to what were formerly known as the iPlanet™ Portal Server 3.0, Service Pack 3a, iPlanet™ Portal Server 3.0, Service Pack 4 products, and iPlanet™ Portal Server 3.0, Service Pack 5 products.

This chapter provides procedures to migrate LDAP data from Sun ONE Portal Server 3.0 to the Sun™ ONE Identity Server 6.2. In particular, migration of LDAP data includes the migration of Sun ONE Portal Server 3.0 domains, roles, and users to Sun ONE Identity Server organizations, suborganizations, and users respectively. This chapter contains the following sections:

Before beginning the migration process, ensure that you have installed the Sun™ ONE Portal Server 6.2 migration tools on your Sun ONE Portal Server 3.0 system and on your Sun ONE Portal Server 6.2 system. See the Sun ONE Portal Server 6.2 Installation Guide for instructions on installing both Sun ONE Portal Server 6.2 and the Sun ONE Portal Server 3.0 Data Migration Tool Suite.

Note

The authentication menu attribute provided by Sun ONE Identity Server 5.1 admin console is not supported in Sun ONE Identity Server 6.1 release. If you need to configure a menu of valid authentication modules, use the admin console to set each authentication module with the same level in the authentication level attribute. Users can access a page with all the authentication modules for a specific authentication level by specifying the authlevel in the login URL. For example, a user performs a login with the following syntax:

http://HOSTNAME:PORT/DEPLOY_URI/UI/Login?authlevel=N

Refer to the Sun ONE Portal Server 6.2 Administrator’s Guide for information on configuring authentication modules.

As described in Chapter 1, "Planning the Migration," there are three steps to the migration process. You will need to run the export tool, the conversion tool, and the import tool to migrate the LDAP data.

Using the Export Tool

The export tool, exportps, stores data from the Sun ONE Portal Server 3.0 system in an export directory. To migrate LDAP data, you need to begin by running the export tool to gather the LDAP data and store it to disk.

To Run the Export Tool

  1. On the Sun ONE Portal Server 3.0 system, change to the migration tool directory:

    2. cd BaseDir/SUNWps/migration/bin/

  2. Run the exportps command:

    3. ./exportps [-a] [-p LDAP passphrase] [ExportDir]

    Table 2-1 describes the options available for exporting LDAP data. This two-column table lists the options in the first column and their descriptions in the second column.

    Table 2-1  Options Available for Exporting LDAP Data

    Option

    Description

    -a

    Runs all modules without a menu.

    To choose to export only LDAP data from the export menu, do not use the -a option.

    -p LDAP passphrase

    Sets the LDAP passphrase in order to avoid the LDAP passphrase prompt. If you do not use the -p LDAP passphrase option with the -a option, the tool will prompt you for the LDAP passphrase.

    ExportDir

    Specifies the directory where the information is to be saved. If you do not use the ExportDir option, the tool prompts you for the export directory.

  3. The system displays a message similar to the following:

    4. Which directory should be created to store the Portal Server system? [/tmp/psExport]

    You see this prompt only if you do not specify the output directory on the command line. You can choose the default directory /tmp/psExport or type the export directory.

    Type the directory and press Enter.

  4. The system displays a message similar to the following:

    5. Delete the directory /tmp/psExport?

    You see this message only if there is already exported data in the ExportDir directory. If you have not already exported the LDAP database, you can keep the export directory without risking any conflicts in the data. If you have already exported the LDAP database, you should delete the directory to avoid conflicts.

  5. The system displays a message similar to the following:

    6. Found iPS version 3.0sp3a

    Begin export process at Tue Jul 9 10:10:04 PDT 2003

    Error file: /tmp/psExport/logs/error.7644

    Report file: /tmp/psExport/logs/report.7644

    Metrics file: /tmp/psExport/logs/export_metrics.7644

    Export Menu:

    1) LDAP Database

    2) Desktop

    3) Certificate Databases

    4) All of the above

    5) Exit

    Select one of the listed options to export:

    You see the export menu only if you do not specify the -a option.

  6. Type 1 and press Enter to export LDAP data only.
  7. The system displays the following message:

    8. Enter the LDAP admin passphrase :

    You see this prompt only if you select a full export using the -a option and you do not specify the -p LDAP passphrase option.

    Type the LDAP admin passphrase and press Enter.

    You see output similar to the following:

    Dumping the ldap database

    organizationalPerson

    user

    role

    domain

    application

    Dumping xml

    .....................

    Successful completion of export process at Tue Jul 9 10:21:25 PDT 2003

  8. Change to the export directory you specified in Step 2 or Step 3. For example:

    9. cd ExportDir

    Substitute the export directory for ExportDir. If you used the default export directory, for example, use /tmp/psExport.

    Type ls to see the directories created by the export tool.

    Table 2-2 shows the directories created by the export tool. This two-column table lists the directories in the first column and their descriptions in the second column.

    Table 2-2  Directories Created by the Export Tool When Exporting LDAP Data 

    Directory

    Description

    ExportDir/config

    Contains exported configuration data

    ExportDir/ldif

    Contains exported LDIF files

    ExportDir/logs

    Contains error.PID, export_metrics.PID, and report.PID files (where PID is the process ID)

    ExportDir/xml

    Contains exported XML data

    After the export has completed, or if you run into problems, check the ExportDir/logs directory for the report.PID, error.PID, and export_metrics.PID files (where PID is the process ID). The report.PID file contains actions the export tool has or has not taken. The error.PID file contains warnings or errors so that you can correct any problems. The export_metrics.PID file contains metrics detailing when various elements of the export tool started, stopped, and the total time it took to export the data. You can look at the stdout header to know which log and report files to examine for the exportps command you are running.

  9. Examine the exported data and manually change, before converting the data, all instances of the name of the Sun ONE Portal Server 3.0 system to the name of the Sun ONE Portal Server 6.2 system. If the port numbers on the two systems are different, you must change these manually as well.

    10. If you are performing a single-system migration, server names will be the same, but port numbers will be different. You need to change port numbers manually before converting the data.

    Note

    The migration tools do not modify server names and port numbers.

    For example, in the following extract of the exported data in the ExportDir/config/platform.config file, you need to change manually all instances of host1.siroe.com, which is the name of the Sun ONE Portal Server 3.0 system, to the name of the Sun ONE Portal Server 6.2 system if the systems use different names. If the systems use different port numbers, you need to change them as well.

    ips.defaultDomain=siroe.com

    ips.server.protocol=http

    ips.server.host=host1.siroe.com

    ips.server.port=8080

    ips.profile.host=host1.siroe.com

    ips.profile.port=8080

    ips.gateway.protocol=https

    ips.gateway.host=host1.siroe.com

    ips.gateway.port=443

    ips.gateway.trust_all_server_certs=false

    ips.virtualhost=host1.siroe.com 192.18.66.42

    ips.naming.url=http://host1.siroe.com:8080/namingservice

    ips.notification.url=http://host1.siroe.com:8080/
    notificationservice

Using the Conversion Tool

The conversion tool, convertps, enables you to select which data to convert from the data exported from a valid installation of Sun ONE Portal Server 3.0. Because the conversion tool runs on the Sun ONE Portal Server 6.2 system, you need to move the export directory from the Sun ONE Portal Server 3.0 system to the Sun ONE Portal Server 6.2 system.

To Run the Conversion Tool

  1. On the Sun ONE Portal Server 3.0 system, change to the directory above the export directory containing the data output by the export tool.

    2. For example, if you used the default directory (/tmp/psExport) for exporting the Desktop, you would type:

    cd /tmp

  2. Save the export directory using the tar command. For example:

    3. tar cvf export.tar psExport

  3. Use an FTP program to transfer the export.tar file to the Sun ONE Portal Server 6.2 system.
  4. On the Sun ONE Portal Server 6.2 system, extract the files from export.tar using the tar command. For example:

    5. tar xvf export.tar

  5. On the Sun ONE Portal Server 6.2 system, change to the migration tool directory:

    6. cd BaseDir/SUNWps/migration/bin

  6. Run the convertps command:

    7. ./convertps [-a] [-f] [-i ExportDir] [-o ImportDir]

    Table 2-3 describes the options available for the convertps command. This two-column table lists the options in the first column and their descriptions in the second column.

    Table 2-3  Options Available for Converting LDAP Data 

    Option

    Description

    -a

    Runs all modules without a menu.

    To choose to convert only the LDAP database from the conversion menu, do not use the -a option.

    -f

    Converts Sun ONE Portal Server 3.0 roles to Sun ONE Identity Server roles and places users under the organization. This option retains the multiple role to user assignment similar to Sun ONE Portal Server 3.0, but does not retain the hierarchical role functionality. All roles are created under the organization and are not prioritized. The display profile documents are prioritized and merged accordingly. To see if the roles have been migrated to roles, view the roles under the organization in the admin console.

    If you do not use the -f option, the conversion tool converts Sun ONE Portal Server 3.0 roles to Sun ONE Identity Server suborganizations and places users under the suborganization. Without the -f option, the conversion tool retains the hierarchical functionality and customizations from Sun ONE Portal Server 3.0. The disadvantage is that it is difficult to move users from one suborganization to another. To see if the roles have been migrated to suborganizations, view the hierarchy in the admin console.

    -i ExportDir

    Specifies the input directory for the conversion. The input directory is the directory which contains the exported data created by the export tool. The conversion tool searches for export data in /tmp/psExport unless you specify a different input directory using the -i ExportDir option.

    If you specify a directory which does not contain data exported with the export tool, the conversion tool notifies you that the directory does not have export data and prompts you to enter a valid export directory.

    -o ImportDir

    Specifies the output directory for the conversion tool. The output directory is the directory used by the import tool.

    If you choose an import directory that already contains converted data, the conversion tool notifies you that modifying an existing migration may render import data unusable and prompts you to delete the import directory.

  7. The system displays the following messages:

    8. Found Portal Server version 6.2

    Enter Identity Server Internal LDAP Authentication User password:

    Type in a valid password.

    Which directory should be created to store the converted data? [/tmp/psImport]

    You see this prompt only if you do not specify the output directory using the -o ImportDir option. You can choose the default directory or type another import directory.

    Import directory /tmp/psImport already exists.

    Modifying an existing migration may render import data unusable.

    Delete the directory /tmp/psImport?

    You see the message about an existing import directory only if the import directory already contains converted data. If you have already converted LDAP data, you should delete the directory to avoid conflicts.

  8. After you choose the output directory, or if you specified the output directory using the -o ImportDir option on the command line, you see output similar to the following:

    9. Begin conversion process at Wed Jul 10 13:23:14 PDT 2003

    Error file: /tmp/psImport/logs/error.16125

    Report file: /tmp/psImport/logs/report.16125

    Metric file: /tmp/psImport/logs/convert_metrics.16125

    Conversion Menu

    1) LDAP Database

    2) Gateway Rules to Rewriter Rules

    3) Desktop

    4) Certificate Databases

    5) All of the above

    6) Exit

    Select one of the listed options to convert:

    You see the conversion menu only if you do not specify the -a option.

  9. Type 1 and press Enter to convert only the LDAP database.

    10. The system displays messages similar to the following:

    Warning - Template data not found in /tmp/psExport

    *****

    Begin LDAP conversion process at Wed Jul 10 13:27:51 PDT 2003

    *** Creating display profile ***

    Warning - No templates tar found, some locale information will not be included in the display profile

    Converting provider and channel display profile.

    Warning: Cannot open locale directory, skipping locale printing for iwtAppProvider

    Warning: Cannot open locale directory, skipping locale printing for iwtBookmarkProvider

    Warning: Cannot open locale directory, skipping locale printing for iwtIPInfoProvider

    Warning: Cannot open locale directory, skipping locale printing for iwtLoginProvider

    Warning: Cannot open locale directory, skipping locale printing for iwtMailCheckProvider

    Warning: Cannot open locale directory, skipping locale printing for iwtNetletProvider

    Warning: Cannot open locale directory, skipping locale printing for iwtPostitProvider

    Warning: Cannot open locale directory, skipping locale printing for iwtSampleJSP

    Warning: Cannot open locale directory, skipping locale printing for iwtSampleRss

    Warning: Cannot open locale directory, skipping locale printing for iwtTabProvider

    Warning: Cannot open locale directory, skipping locale printing for iwtUserInfoProvider

    Converting domain desktop preferences.

    Converting role desktop preferences.

    Converting user desktop preferences.

    *** Converting LDAP data ***

    Converting domain xml data

    siroe.com

    Converting role xml data

    siroe.com/defaultRole

    siroe.com/AdminRole

    Converting domain/role level attributes

    Converting user ldif data

    processed 5 entries

    Converting ldap user ldif data

    Converting component xml data

    iwtGateway

    Converting Auth Component xml data

    End LDAP conversion process at Wed Jul 10 13:28:11 PDT 2003

    Successful completion of conversion process at Wed Jul 10 13:28:11 PDT 2003

    You see the warnings about the templates not being found because only LDAP data was exported. If you export Desktop data in addition to LDAP data or if you choose to export all data using exportps -a, you will not see these warnings.

    If the locale data is unavailable, locale customizations to channel title and descriptions will not be migrated. If you have installed language packs it is highly recommended that you use a full export to ensure your locale information will not be lost in the migration.

  10. Change to the import directory making sure to substitute the import directory that you selected in Step 7. For example:

    11. cd ImportDir

    Substitute the import directory for ImportDir. If you used the default import directory, for example, use /tmp/psImport.

  11. Type ls to see the directories created by the conversion tool when converting LDAP data.

    12. Table 2-4 shows the directories created by the conversion tool when converting LDAP data. This two-column table lists the directories in the first column and their descriptions in the second column.

    Table 2-4  Directories Created by the Conversion Tool When Converting LDAP Data 

    Directory

    Description

    ImportDir/dp

    Contains display profile data to be imported

    ImportDir/ldif

    Contains converted LDIF files to be imported

    ImportDir/logs

    Contains error.PID, convert_metrics.PID, and report.PID files (where PID is the process ID)

    ImportDir/xml

    Contains converted XML data to be imported

    After the conversion has completed, or if you run into problems, check the ImportDir/logs directory for the report.PID, error.PID, and convert_metrics.PID files (where PID is the process ID). The report.PID file contains actions the conversion tool has or has not taken and also alerts you to any customizations which you need to convert manually. The error.PID file contains warnings or errors so that you can correct any problems. The convert_metrics.PID file contains metrics detailing when various elements of the conversion tool started, stopped, and the total time it took to convert the data. You can look at the stdout header to know which log and report files to examine for the convertps command you are running.

  12. If you run the convertps tool again in order to convert data other than LDAP data, the tool will prompt you to delete the import directory. Type no if you wish to keep the LDAP data you have already converted.

Using the Import Tool

The import tool, importps, enables you to import the data exported and converted using the export and conversion tools to an Sun ONE Portal Server 6.2 system. The import tool searches for a directory containing valid data created by the conversion tool.

To Run the Import Tool

  1. On the Sun ONE Portal Server 6.2 system, change to the import tool directory. For example:

    2. cd BaseDir/SUNWps/migration/bin

  2. Run the importps command:

    3. ./importps [-a] [-k] [-m] [ImportDir]

    Table 2-5 describes the options available for importing LDAP data. This two-column table lists the options in the first column and their descriptions in the second column.

    Table 2-5  Options Available for Importing LDAP Data 

    Option

    Description

    -a

    Runs all modules without a menu.

    To choose to import only the LDAP database from the import menu, do not use the -a option.

    -k

    Specifies that the tool does not overwrite existing users.

    When you run importps without the -k option, if it encounters a conflict with an existing user, it will delete the existing user and import the new user entry defined in ImportDir/ldap/user.ldif.

    If you run importps -k, if it encounters a conflict with an existing user, it leaves the existing user and places the rejected user entry in ImportDir/ldap/rejected_users.ldif.

    If the user has a display profile document in the ImportDir/dp/user/ directory, the display profile file may change. The -k option does not affect importing user display profile documents. The -k option only affects whether an existing LDAP user’s LDIF record is updated. The updates to the LDIF record include everything except display profile updates.

    -m

    Merges display profile documents.

    When you run importps without the -m option, it overwrites any existing display profile documents it finds. This means that the root suffix, organization, suborganization, and user level display profile documents, if they exist, are overwritten.

    If you run importps -m, when the tool encounters a conflict with an existing display profile document it will merge it.

    ImportDir

    Specifies the directory where the converted data is located. If the directory does not exist or if the directory does not contain valid converted data, the import tool prompts you to enter a directory containing the converted data to be imported. If you do not specify an import directory, the import tool will search /tmp/psImport.

  3. The system displays a message similar to the following:

    4. Found Portal Server version 6.2

    Enter Identity Server Internal LDAP Authentication User password:

    Type in a valid password.

    Enter Appserver Administrator password.

    You see this prompt only if you are migrating onto a Sun ONE Application Server web container.

    Begin import process at Fri Jul 12 10:04:43 PDT 2003

    Error file: /tmp/psImport/logs/importerror.17206

    Report file: /tmp/psImport/logs/importreport.17206

    Metric file: /tmp/psImport/logs/import_metrics.17206

    Import Menu:

    1) LDAP Database

    2) Rewriter Rules

    3) Desktop

    4) Certificate Databases

    5) All of the above

    6) Exit

    Select one of the listed options to import:

    You see the import menu only if you do not specify the -a option.

  4. Type 1 and press Enter to import only the LDAP database.

    5. The system displays messages similar to the following:

    Importing Organization xml

    siroe.com

    Success 0: Successfully completed.

    Importing Organization Updates xml

    Success 0: Successfully completed.

    Success 0: Successfully completed.

    Success 0: Successfully completed.

    Importing Role xml

    siroe.com/defaultRole

    Success 0: Successfully completed.

    siroe.com/AdminRole

    Success 0: Successfully completed.

    Importing Component xml

    iwtGateway

    Success 0: Successfully completed.

    Importing user ldif into ldap database

    adding new entry uid=root,ou=People,o=AdminRole,o=siroe.com,o=isp

    adding new entry uid=authentication,ou=People,o=AdminRole,o=siroe.com,o=isp

    adding new entry uid=anonymous,ou=People,o=defaultRole,o=siroe.com,o=isp

    adding new entry uid=user1,ou=People,o=defaultRole,o=siroe.com,o=isp

    adding new entry uid=gateway-default,ou=People,o=defaultRole,o=siroe.com,o=isp

    Any existing users will not be added. /tmp/psImport/ldif/rejected_users.ldif

    has all of the existing users. Please manually use

    /usr/ldap/shared/bin/ldapmodify to modify the existing users attributes

    You see this information about existing users not being added only if you use the -k option.

    Importing user ldif modifications into ldap database

    Moving PS 6.2 defaultOrg anonymous user to installAnonymous

    adding new entry uid=installAnonymous,ou=People,o=siroe.com,o=isp

    deleting entry uid=anonymous,ou=People,o=siroe.com,o=isp

    Importing dp xml

    SUCCESS!

    Redeploying portal web application

    Deploying to instance host1.siroe.com...

    Successful completion of import process at Fri Jul 12 10:20:04 PDT 2003

    After the import has completed, or if you run into problems, check the ImportDir/logs directory for the importreport.PID, importerror.PID, and import_metrics.PID files (where PID is the process ID). The importreport.PID file contains actions the import tool has or has not taken and also alerts you to any customizations which you need to import manually. The importerror.PID file contains warnings or errors so that you can correct any problems. The import_metrics.PID file contains metrics detailing when various elements of the import tool started, stopped, and the total time it took to import the data. You can look at the stdout header to know which log and report files to examine for the importps command you are running.

If the role migration type is role to suborganization:

If the role migration type is role to role:

The Sun ONE Portal Server 6.2 installation creates an anonymous user at the default organization level, where the default organization is the Sun ONE Portal Server 6.2 installation organization. The Sun ONE Portal Server 6.2 anonymous user has its own customizations, including a display profile document.

For role to suborganization migrations, the migration tools migrate and place the Sun ONE Portal Server 3.0 anonymous users under a suborganization. This means that the Sun ONE Portal Server 6.2 anonymous user will always be used before the Sun ONE Portal Server 3.0 anonymous user. Therefore, during migration the migration tools rename the Sun ONE Portal Server 6.2 anonymous user to installAnonymous. This solves the conflict problem and uses the migrated anonymous user for the anonymous Desktop.

For role to role migrations, the migration tools migrate and place the Sun ONE Portal Server 3.0 anonymous user under the organization. The migration tools, therefore, rename the Sun ONE Portal Server 6.2 anonymous user before importing the Sun ONE Portal Server 3.0 anonymous user.

Writing Data Migration Modules

See Appendix B, "Sun ONE Portal Server 3.0 Data Migration Module Author's Guide" for information on writing your own data migration modules.

Setting the Sun ONE Portal Server 6.2 Organization to the Sun ONE Portal Server 3.0 Domain

If you want to change the Sun ONE Portal Server 6.2 default organization to the domain used in your Sun ONE Portal Server 3.0, you follow these four steps:

  1. Identify the 3.0 default Domain value.

    2. If you are unsure of the Sun ONE Portal Server 3.0 default domain, open the ExportDir/ldif/application.ldif file and search for the attribute iwtPlatform-defaultDomain-at.

  2. Using the Sun ONE Identity Server admin console, create an administrative user under the organization you want to have as the default organization. For information on creating users, see the Sun ONE Portal Server 6.2 Administrator’s Guide.
  3. Edit the BaseDir/SUNWam/lib/AMConfig.properties file and replace the com.iplanet.am.defaultOrg value with the new default organization name.
  4. Restart the server using /etc/init.d/amserver start.

Post-Migration Issues and Tasks

After migrating LDAP data from Sun ONE Portal Server 3.0 to Sun ONE Portal Server 6.2, you may find that you receive an Authentication Failed error message and are unable to log in to the admin console. This section describes two possible causes for the problem, the pre-migration and post-migration conditions for each cause, and the solutions to the problem.

Cause 1

The Sun ONE Portal Server 3.0 default domain that corresponds to the Sun ONE Portal Server 6.2 default organization has LDAP authentication customized to authenticate against an external LDAP server. The Sun ONE Portal Server 6.2 amAdmin user will be unable to authenticate to the admin console after migration.

Pre-Migration Conditions

Post-Migration Condition

Solution

The amAdmin user cannot authenticate because it is trying to authenticate against an External LDAP server and the amAdmin UID does not exist in the External LDAP server. To resolve the problem, follow these steps:

  1. Authenticate with the amAdmin user's full dn. For example:

    2. login: uid=amAdmin,ou=People,o=defaultorg,o=rootsuffix|dc=defaultorg, dc=rootsuffix passwd: passwd

    where

    • default organization = response to the Sun ONE Portal Server 6.2 installation question:

      • What is the organization name? [host1.siroe.com] siroe.com

    • root suffix = response to the Sun ONE Portal Server 6.2 installation question:

      • What is the root suffix of the directory tree? [o=isp]

    • passwd = response to the Sun ONE Portal Server 6.2 installation question:

      • What is the passphrase for this server? Again?

      With the answers to the installation questions, the login might look like:

      login: uid=amAdmin,ou=People,o=siroe.com,o=isp passwd: adminpassword

      or if the domain container naming attributes were used

      login: uid=amAdmin,ou=People,dc=siroe,dc=com passwd: adminpassword

  2. Configure the admin super user. Note that this step is customer dependent.

    3. The easiest approach would be to add the amAdmin user userid to the external LDAP server.

Another approach would be to create an admin user under a suborganization of the default organization. For example, you could create a suborganization under the default organization for the super admin user:

  1. Select the organization.
  2. Select New to create a new suborganization.
  3. Enter a name. For example, enter admin.
  4. Select Create.
  5. Select the suborganization. For example, select admin.
  6. Select Services from the choice menu.
  7. Select Register.
  8. Select Core, LDAP, and Register in same view.
  9. Select Core properties and then select Create.
  10. Select LDAP properties and then select Create.
  11. Select Users from the choice menu.
  12. Select New.
  13. Enter the following information, as you prefer. For example:
    • User Id = sadmin
    • password = sadmin
  14. Select Create.
  15. Select root suffix from Location in top frame, for example ‘isp’.
  16. Select Roles from the choice menu.
  17. Select Top-level Admin Role.
  18. Select Add.
  19. Enter sadmin in User Id field.
  20. Select Search.
  21. Select sadmin checkbox.
  22. Select Submit.
  23. Select Logout.
  24. Access the admin console with http://host:port/amconsole/login?org=admin

    25. The admin user will only authenticate with this URL.

  25. Enter sadmin/sadmin.

Cause 2

The Sun ONE Portal Server 3.0 default domain that corresponds to the Sun ONE Portal Server 6.2 default organization has the authentication admin authenticator customized. The Sun ONE Portal Server 6.2 amAdmin user may be unable to authenticate to the admin console after migration.

Pre-Migration Conditions

Post-Migration Condition

The Sun ONE Portal Server 6.2 admin console authentication type is not LDAP.

Solution

When trying to authenticate to the admin console, if the authenticator type is not LDAP, then you can set it to LDAP by using the amadmin utility:

BaseDir/SUNWam/bin/amadmin -u "uid=amAdmin,ou=People,o=defaultorg,o=rootsuffix|dc=defaultorg, dc=rootsuffix" -w "adminpassphrase" -t changeAdminAuth.xml

For example, if the base directory is /opt, the domain is siroe.com, the organization naming attribute is o=, and the admin passphrase is passphrase, the command would be:

/opt/SUNWam/bin/amadmin -u "uid=amAdmin,ou=People,o=siroe.com,o=isp" -w "passphrase" -t changeAdminAuth.xml

where changeAdminAuth.xml is:

<?xml version="1.0" encoding="ISO-8859-1"?>

<!DOCTYPE Requests PUBLIC "-//Sun ONE//iDSAME 5.0 Admin CLI DTD//EN " "file:/opt/SUNWam/dtd/amAdmin.dtd">

<Requests>

<OrganizationRequests DN="o=siroe.com,o=isp">

<ModifyServiceTemplate serviceName="iPlanetAMAuthService" schemaType="Organization">

<AttributeValuePair>

<Attribute name="iplanet-am-auth-admin-auth-module"/>

<Value>LDAP</Value>

</AttributeValuePair>

</ModifyServiceTemplate>

</OrganizationRequests>

</Requests>

In this example, replace siroe.com with your organization and isp with your root suffix.

This will set amAdmin's admin authentication module to LDAP. You will need to restart the server by issuing the following command for the change to take effect:

/etc/init.d/amserver start

Please refer to Cause 1 if you still have problems authenticating.



Previous      Contents      Index      Next     

Copyright 2004 Sun Microsystems, Inc. All rights reserved.