将预定义角色分配从一个环境复制到另一个环境

Windows

1. 通过复制以下脚本来创建 replicatepredefineroles.ps1。

   # Replicate predefined roles script
   
   param(
     [string]$epmusersource,
     [string]$epmpwdsource,
     [string]$epmurlsource,
     [string]$epmidentitydomainsource,
     [string]$epmusertarget,
     [string]$epmpwdtarget,
     [string]$epmurltarget,
     [string]$epmidentitydomaintarget,
     [string]$proxyserverusername,
     [string]$proxyserverpassword,
     [string]$proxyserverdomain,
     [string]$emailtoaddress
   )
   
   $roleassignmentreport="roleassignmentreport.csv"
   
   function replicateroles
   {
       # epmautomate login Source App as an IDM Admin
       echo "Logging into source application at ${epmurlsource}"
       epmautomate login ${epmusersource} ${epmpwdsource} ${epmurlsource} ${epmidentitydomainsource} ${proxyserverusername} ${proxyserverpassword} ${proxyserverdomain}
       echo "Creating role assignment report: ${roleassignmentreport}"
       epmautomate roleAssignmentReport ${roleassignmentreport}
       if (${emailtoaddress} -match "@") {
           epmautomate.bat sendMail $emailtoaddress "Role assignment report" Body="Role assignment report is attached." Attachments=$roleassignmentreport
       }
       echo "Downloading role assignment report"
       epmautomate downloadfile ${roleassignmentreport}
       epmautomate deletefile ${roleassignmentreport}
       epmautomate logout
   
       echo "Creating files to use with epmautomate assignRoles"
   
       Get-Content ${roleassignmentreport} | ForEach-Object {
           $user=$_.split(',')[0]
           $rolename=$_.split(',')[4]
   
           if ($rolename -like '*User' -And $rolename -notlike '*Power User') {
               $rolenamearray=$rolename.split(" ")
               $arraysize=$rolenamearray.count
               $rolename="User"
               if ($arraysize.count -le 2) {
                   echo "${user}" | Out-File -Append -Encoding "UTF8" "role-${rolename}.csv" 
               }
           }
           elseif ($rolename -like '*Viewer') {
               $rolenamearray=$rolename.split(" ")
               $arraysize=$rolenamearray.count
               $rolename="Viewer"
               if ($arraysize -le 2) {
                   echo "${user}" | Out-File -Append -Encoding "UTF8" "role-${rolename}.csv" 
               }
           }
           elseif ($rolename -like '*Power User') {
               $rolenamearray=$rolename.split(" ")
               $arraysize=$rolenamearray.count
               $rolename="Power User"
               if ($arraysize -le 3) {
                   echo "${user}" | Out-File -Append -Encoding "UTF8" "role-${rolename}.csv" 
               }
           }
           elseif ($rolename -like '*Service Administrator') {
               $rolenamearray=$rolename.split(" ")
               $arraysize=$rolenamearray.count
               $rolename="Service Administrator"
               if ($arraysize -le 3) {
                   echo "${user}" | Out-File -Append -Encoding "UTF8" "role-${rolename}.csv" 
               }
           }
           elseif ($rolename -like 'Planner') {
               echo "${user}" | Out-File -Append -Encoding "UTF8" "role-User.csv" 
           }
       }
   
       # Add header and format
       $rolefiles = Get-ChildItem "role-*.csv"
       foreach ($rolefile in $rolefiles) {
           $rolefilecontent = Get-Content "$rolefile" 
           $headerline='User Login'
           Set-Content $rolefile -value $headerline,$rolefilecontent
           $txt = [io.file]::ReadAllText("$rolefile") -replace "`r`n","`n"
           [io.file]::WriteAllText("$rolefile", $txt)
       }
   
       # epmautomate login Target App as an IDM Admin
       echo "Logging into target application at ${epmurltarget}"
       epmautomate login ${epmusertarget} ${epmpwdtarget} ${epmurltarget} ${epmidentitydomaintarget} ${proxyserverusername} ${proxyserverpassword} ${proxyserverdomain}
   
       $rolefiles = Get-ChildItem "role-*.csv"
       foreach ($rolefile in $rolefiles) {
           $rolenamecsv=$rolefile.BaseName.split('-')[1]
           $rolename=$rolenamecsv.split('.')[0]
           epmautomate deletefile "${rolefile}" | Out-Null
           echo "Uploading file ${rolefile}"
           epmautomate uploadfile "${rolefile}"
           echo "Assigning ${rolename} roles"
           epmautomate assignRole "role-${rolename}.csv" "${rolename}"
           epmautomate deletefile "role-${rolename}.csv"
       }
       epmautomate logout
       rm deletefile*.log | Out-Null
   }
   
   function init
   {
       # delete ${role}.csv files
       $rolefiles = Get-ChildItem "role-*.csv"
       foreach ($rolefile in $rolefiles) {
           $rolefileexists=Test-Path $rolefile
           if ($rolefileexists) {
               rm "${rolefile}"
           }
       }
   }
   
   echo "Replicate predefined roles script started"
   init
   replicateroles
   echo "Replicate predefined roles script completed"
   

2. 通过复制以下脚本来创建 replicatepredefineroles.bat。

   @ECHO OFF
   SET thisdir=%~dp0
   SET scriptpath=%thisdir%replicatepredefinedroles.ps1
   
   REM USER DEFINED VARIABLES
   REM -----------------------
   set epmusersource="<EPM USER FOR SOURCE ENVIRONMENT>"
   set epmpwdsource="<EPM PASSWORD FOR SOURCE ENVIRONMENT>"
   set epmurlsource="<EPM URL FOR SOURCE ENVIRONMENT>"
   set epmidentitydomainsource="<EPM IDENTITY DOMAIN FOR SOURCE ENVIRONMENT>"
   set epmusertarget="<EPM USER FOR TARGET ENVIRONMENT>"
   set epmpwdtarget="<EPM PASSWORD FOR TARGET ENVIRONMENT>"
   set epmurltarget="<EPM URL FOR TARGET ENVIRONMENT>"
   set epmidentitydomaintarget="<EPM IDENTITY DOMAIN FOR TARGET ENVIRONMENT>"
   set proxyserverusername="<PROXY SERVER USER NAME>"
   set proxyserverpassword="<PROXY SERVER PASSWORD>"
   set proxyserverdomain="<PROXY SERVER DOMAIN>"
   set emailtoaddress="<EMAIL_TO_ADDRESS>"
   REM -----------------------
   
   PowerShell -NoProfile -ExecutionPolicy Bypass -Command "& '%scriptpath%' -epmusersource '%epmusersource%' -epmpwdsource '%epmpwdsource%' -epmurlsource '%epmurlsource%' -epmidentitydomainsource '%epmidentitydomainsource%' -epmusertarget '%epmusertarget%' -epmpwdtarget '%epmpwdtarget%' -epmurltarget '%epmurltarget%' -epmidentitydomaintarget '%epmidentitydomaintarget%' -proxyserverusername '%proxyserverusername%' -proxyserverpassword '%proxyserverpassword%' -proxyserverdomain '%proxyserverdomain%' -emailtoaddress '%emailtoaddress%'"

3. 根据需要更新 replicatepredefineroles.bat。有关必须为此文件中的属性设置的值的信息，请参阅下表。

   更新 replicatepredefineroles.bat

   参数	说明
   epmusersource	在源环境中具有身份域管理员和服务管理员角色的用户的用户名。 示例： Windows：set epmusersource="jDoe" Linux/UNIX：epmusersource="jDoe"
   epmpwdsource	用户的密码或加密密码文件的绝对路径。 示例： Windows：set epmpwdsource="Example" Linux/UNIX：epmpwdsource="Example"
   epmurlsource	要从中复制用户的环境的 URL。 示例： Windows：set epmurlsource="https://example.oraclecloud.com" Linux/UNIX：epmurlsource="https://example.oraclecloud.com"
   epmidentitydomainsource	源环境使用的身份域的名称。 示例： Windows：set epmidentitydomainsource="example_source_dom" Linux/UNIX：epmidentitydomainsource="example_source_dom"
   epmusertarget	在目标环境中具有身份域管理员和服务管理员角色的用户的用户名。 示例： Windows：set epmusertarget="John.Doe" Linux/UNIX：set epmusertarget="John.Doe"
   epmpwdtarget	用户的密码或加密密码文件的绝对路径。 示例： Windows：set epmpwdtarget="Example1" Linux/UNIX：epmpwdtarget="Example1"
   epmurltarget	要在其中创建用户的环境的 URL。 示例： Windows：set epmurltarget="https://example.oraclecloud.com" Linux/UNIX：epmurltarget="https://example.oraclecloud.com"
   epmidentitydomaintarget	目标环境使用的身份域的名称。 示例： Windows：set epmidentitydomaintarget="example_target_dom" Linux/UNIX：epmidentitydomaintarget="example_target_dom"
   proxyserverusername	使用具有 Internet 访问控制权的代理服务器对安全会话进行身份验证的用户名。删除此属性的所有未使用的实例。 示例： Windows：set proxyserverusername="Example" Linux/UNIX：proxyserverusername="Example"
   proxyserverpassword	用于在代理服务器中对用户进行身份验证的密码。删除此属性的所有未使用的实例。 示例： Windows：set proxyserverpassword="examplePwd" Linux/UNIX：proxyserverpassword="examplePwd"
   proxyserverdomain	为代理服务器定义的域的名称。删除此属性的所有未使用的实例。 示例： Windows：set proxyserverdomain="exampleDom" Linux/UNIX：proxyserverdomain="exampleDom"
   emailtoaddress	（可选）要将角色分配报表发送到的电子邮件地址。仅当指定此值时，才会通过电子邮件发送报表。 示例：emailtoaddress=john.doe@example.com

Linux/UNIX

1. 通过复制以下脚本来创建 replicatepredefineroles.sh。

   #!/bin/sh
   
   # USER DEFINED VARIABLES
   #-----------------------
   javahome="<JAVA HOME>"
   epmautomatescript="<EPM AUTOMATE SCRIPT LOCATION>"
   epmusersource="<EPM USER FOR SOURCE ENVIRONMENT>"
   epmpwdsource="<EPM PASSWORD FOR SOURCE ENVIRONMENT>"
   epmurlsource="<EPM URL FOR SOURCE ENVIRONMENT>"
   epmidentitydomainsource="<EPM IDENTITY DOMAIN FOR SOURCE ENVIRONMENT>"
   epmusertarget="<EPM USER FOR TARGET ENVIRONMENT>"
   epmpwdtarget="<EPM PASSWORD FOR TARGET ENVIRONMENT>"
   epmurltarget="<EPM URL FOR TARGET ENVIRONMENT>"
   epmidentitydomaintarget="<EPM IDENTITY DOMAIN FOR TARGET ENVIRONMENT>"
   proxyserverusername="<PROXY SERVER USER NAME>"
   proxyserverpassword="<PROXY SERVER PASSWORD>"
   proxyserverdomain="<PROXY SERVER DOMAIN>"
   emailtoaddress="<EMAIL TO ADDRESS>"
   #-----------------------
   
   roleassignmentreport="roleassignmentreport.csv"
   
   export JAVA_HOME=${javahome}
   
   
   replicateroles()
   {
       # epmautomate login Source App as an DM Admin
       echo "Logging into source application at ${epmurlsource}"
       ${epmautomatescript} login ${epmusersource} ${epmpwdsource} ${epmurlsource} ${epmidentitydomainsource} ${proxyserverusername} ${proxyserverpassword} ${proxyserverdomain}
       echo "Creating role assignment report: ${roleassignmentreport}"
       ${epmautomatescript} roleAssignmentReport ${roleassignmentreport}
       if [[ "${emailtoaddress}" == *"@"* ]]
       then
           ${epmautomatescript} sendMail $emailtoaddress "Role assignment report" Body="Role assignment report is attached." Attachments=$roleassignmentreport
       fi
       echo "Downloading role assignment report"
       ${epmautomatescript} downloadfile ${roleassignmentreport}
       ${epmautomatescript} deletefile ${roleassignmentreport}
       ${epmautomatescript} logout
   
       echo "Creating files to use with epmautomate assignRoles"
       while read line
       do
           user=$(echo "${line}" | cut -d',' -f1)
           rolename=$(echo "${line}" | cut -d',' -f5)
   
           if [[ "$rolename" == *"User" ]] && [[ "$rolename" != "*Power User" ]]
           then
               count=$(echo "${rolename}" | wc -w);
               rolename="User"
               if [[ $count -le 2 ]]
               then
                   echo "${user}" >> "role-${rolename}.csv" 
               fi
           elif [[ "$rolename" == *"Viewer" ]] 
           then
               count=$(echo "${rolename}" | wc -w);
               rolename="Viewer"
               if [[ $count -le 2 ]]
               then
                   echo "${user}" >> "role-${rolename}.csv" 
               fi
           elif [[ "$rolename" == *"Power User" ]] 
           then
               count=$(echo "${rolename}" | wc -w);
               rolename="Power User"
               if [[ $count -le 3 ]]
               then
                   echo "${user}" >> "role-${rolename}.csv" 
               fi
           elif [[ "$rolename" == *"Service Administrator" ]] 
           then
               count=$(echo "${rolename}" | wc -w);
               rolename="Service Administrator"
               if [[ $count -le 3 ]]
               then
                   echo "${user}" >> "role-${rolename}.csv" 
               fi
           elif [[ "$rolename" == "Planner" ]] 
           then
                   echo "${user}" >> "role-User.csv" 
           fi
       done < ${roleassignmentreport}
   
       # write header line
       for f in role-*.csv
       do
           sed -i '1iUser Login' "$f"
       done
   
       # epmautomate login Target App as an IDM Admin
       echo "Logging into target application at ${epmurltarget}"
       ${epmautomatescript} login ${epmusertarget} ${epmpwdtarget} ${epmurltarget} ${epmidentitydomaintarget} ${proxyserverusername} ${proxyserverpassword} ${proxyserverdomain}
   
       for rolefile in role-*.csv
       do
           rolenamecsv=$(echo "$rolefile" | cut -d'-' -f2)
           rolename=$(echo "$rolenamecsv" | cut -d'.' -f1)
           ${epmautomatescript} deletefile "${rolefile}" > /dev/null 2>&1
           echo "Uploading file ${rolefile}"
           ${epmautomatescript} uploadfile "${rolefile}"
           echo "Assigning roles"
           ${epmautomatescript} assignrole "${rolefile}" "${rolename}"
           ${epmautomatescript} deletefile "${rolefile}"
       done
   
       ${epmautomatescript} logout
       rm deletefile*.log > /dev/null 2>&1
   }
   
   init()
   {
       # delete role-${role}.csv files
       for f in role-*.csv
       do
           rm "$f" > /dev/null 2>&1
       done
   }
   
   echo "Replicate predefined roles script started"
   init
   replicateroles
   echo "Replicate predefined roles script completed"
   

2. 更新 replicatepredefineroles.sh。有关必须指定的值的信息，请参阅上表。此外，必须为以下属性指定值：
   • javahome：要在其中安装 Java 的目录的绝对路径。
   • epmautomatescript：epmautomatescript.sh 的位置；例如，epmautomatescript="/home/user1/epmautomate/bin/epmautomate.sh"