將應用程式角色指派從某個環境複製到另一個環境

使用本節中的指令碼可將應用程式角色指派從某個環境移轉至另一個環境。執行這些指令碼的使用者必須同時在這兩個環境中具有服務管理員角色。

註：

如果您使用本文件的 PDF 版本：為了避免因為斷行和頁尾資訊而無法使用這些指令碼，請從本主題的 HTML 版本複製指令碼。

Windows

  1. 複製下列指令碼以建立 replicatepredefinedroles.ps1。 
    # Replicate application roles script
$inputproperties = ConvertFrom-StringData(Get-Content ./input.properties -raw)
$epmusersource="$($inputproperties.epmusersource)"
$epmpwdsource="$($inputproperties.epmpwdsource)"
$epmurlsource="$($inputproperties.epmurlsource)"
$epmidentitydomainsource="$($inputproperties.epmidentitydomainsource)"
$epmusertarget="$($inputproperties.epmusertarget)"
$epmpwdtarget="$($inputproperties.epmpwdtarget)"
$epmurltarget="$($inputproperties.epmurltarget)"
$epmidentitydomaintarget="$($inputproperties.epmidentitydomaintarget)"
$proxyserverusername="$($inputproperties.proxyserverusername)"
$proxyserverpassword="$($inputproperties.proxyserverpassword)"
$proxyserverdomain="$($inputproperties.proxyserverdomain)"
$emailtoaddress="$($inputproperties.emailtoaddress)"
$roleassignmentreport="roleassignmentreport.csv"
function replicateroles
{
    # epmautomate login Source App as an IDM Admin
    echo "Logging into source application at ${epmurlsource}"
    epmautomate login ${epmusersource} ${epmpwdsource} ${epmurlsource} ${epmidentitydomainsource} ${proxyserverusername} ${proxyserverpassword} ${proxyserverdomain}
    echo "Creating role assignment report: ${roleassignmentreport}"
    epmautomate roleAssignmentReport ${roleassignmentreport}
    if (${emailtoaddress} -match "@") {
        epmautomate.bat sendMail $emailtoaddress "Role assignment report" Body="Role assignment report is attached." Attachments=$roleassignmentreport
    }
    echo "Downloading role assignment report"
    epmautomate downloadfile ${roleassignmentreport}
    epmautomate deletefile ${roleassignmentreport}
    epmautomate logout
    echo "Creating files to use with epmautomate assignRoles"
    Get-Content ${roleassignmentreport} | ForEach-Object {
        $user=$_.split(',')[0]
        $rolename=$_.split(',')[4]
        if ($rolename -like '*User' -And $rolename -notlike '*Power User') {
            $rolenamearray=$rolename.split(" ")
            $arraysize=$rolenamearray.count
            $rolename="User"
            if ($arraysize.count -le 2) {
                echo "${user}" | Out-File -Append -Encoding "UTF8" "role-${rolename}.csv" 
            }
        }
        elseif ($rolename -like '*Viewer') {
            $rolenamearray=$rolename.split(" ")
            $arraysize=$rolenamearray.count
            $rolename="Viewer"
            if ($arraysize -le 2) {
                echo "${user}" | Out-File -Append -Encoding "UTF8" "role-${rolename}.csv" 
            }
        }
        elseif ($rolename -like '*Power User') {
            $rolenamearray=$rolename.split(" ")
            $arraysize=$rolenamearray.count
            $rolename="Power User"
            if ($arraysize -le 3) {
                echo "${user}" | Out-File -Append -Encoding "UTF8" "role-${rolename}.csv" 
            }
        }
        elseif ($rolename -like '*Service Administrator') {
            $rolenamearray=$rolename.split(" ")
            $arraysize=$rolenamearray.count
            $rolename="Service Administrator"
            if ($arraysize -le 3) {
                echo "${user}" | Out-File -Append -Encoding "UTF8" "role-${rolename}.csv" 
            }
        }
        elseif ($rolename -like 'Planner') {
            echo "${user}" | Out-File -Append -Encoding "UTF8" "role-User.csv" 
        }
    }
# Add header and format
    $rolefiles = Get-ChildItem "role-*.csv"
    foreach ($rolefile in $rolefiles) {
        $rolefilecontent = Get-Content "$rolefile" 
        $headerline='User Login'
        Set-Content $rolefile -value $headerline,$rolefilecontent
        $txt = [io.file]::ReadAllText("$rolefile") -replace "`r`n","`n"
        [io.file]::WriteAllText("$rolefile", $txt)
    }
# epmautomate login Target App as an IDM Admin
    echo "Logging into target application at ${epmurltarget}"
    epmautomate login ${epmusertarget} ${epmpwdtarget} ${epmurltarget} ${epmidentitydomaintarget} ${proxyserverusername} ${proxyserverpassword} ${proxyserverdomain}
    $rolefiles = Get-ChildItem "role-*.csv"
    foreach ($rolefile in $rolefiles) {
        $rolenamecsv=$rolefile.BaseName.split('-')[1]
        $rolename=$rolenamecsv.split('.')[0]
        epmautomate deletefile "${rolefile}" | Out-Null
        echo "Uploading file ${rolefile}"
        epmautomate uploadfile "${rolefile}"
        echo "Assigning ${rolename} roles"
        epmautomate assignRole "role-${rolename}.csv" "${rolename}"
        epmautomate deletefile "role-${rolename}.csv"
    }
    epmautomate logout
    rm deletefile*.log | Out-Null
}

function init
{
    # delete ${role}.csv files
    $rolefiles = Get-ChildItem "role-*.csv"
    foreach ($rolefile in $rolefiles) {
        $rolefileexists=Test-Path $rolefile
        if ($rolefileexists) {
            rm "${rolefile}"
        }
    }
}

echo "Replicate application roles script started"
init
replicateroles
echo "Replicate application roles script completed"
  2. 複製下列指令碼以建立 input.properties 檔案。 
    epmusersource=EPM USER FOR SOURCE ENVIRONMENT
epmpwdsource=EPM PASSWORD FILE FOR SOURCE ENVIRONMENT
epmurlsource=EPM URL FOR SOURCE ENVIRONMENT
epmidentitydomainsource=EPM IDENTITY DOMAIN FOR SOURCE ENVIRONMENT
epmusertarget=EPM USER FOR TARGET ENVIRONMENT
epmpwdtarget=EPM PASSWORD FILE FOR TARGET ENVIRONMENT
epmurltarget=EPM URL FOR TARGET ENVIRONMENT
epmidentitydomaintarget=EPM IDENTITY DOMAIN FOR TARGET ENVIRONMENT
proxyserverusername=PROXY SERVER USER NAME
proxyserverpassword=PROXY SERVER PASSWORD FILE
proxyserverdomain=PROXY SERVER DOMAIN
emailtoaddress=EMAIL_TO_ADDRESS
  3. 視需要更新 input.properties。查看下列的表格以瞭解您必須在此檔案中指定之特性值的資訊。

    更新 input.properties

    參數 描述
    epmusersource 在來源環境中具有識別網域管理員與服務管理員角色的使用者名稱。

    範例：

    Windows：set epmusersource="jDoe"

    Linux/UNIX：epmusersource="jDoe"
    epmpwdsource 使用者的密碼或加密密碼檔案的絕對路徑。

    範例：

    Windows：set epmpwdsource="Example"

    Linux/UNIX：epmpwdsource="Example"
    epmurlsource 要複製使用者的來源環境 URL。

    範例：

    Windows：set epmurlsource="https://example.oraclecloud.com"

    Linux/UNIX：epmurlsource="https://example.oraclecloud.com"
    epmidentitydomainsource 來源環境使用的識別網域名稱。

    範例：

    Windows：set epmidentitydomainsource="example_source_dom"

    Linux/UNIX：epmidentitydomainsource="example_source_dom"
    epmusertarget 在目標環境中具有識別網域管理員與服務管理員角色的使用者名稱。

    範例：

    Windows：set epmusertarget="John.Doe"

    Linux/UNIX：set epmusertarget="John.Doe"
    epmpwdtarget 使用者的密碼或加密密碼檔案的絕對路徑。

    範例：

    Windows：set epmpwdtarget="Example1"

    Linux/UNIX：epmpwdtarget="Example1"
    epmurltarget 要建立使用者的環境 URL。

    範例：

    Windows：set epmurltarget="https://example.oraclecloud.com"

    Linux/UNIX：epmurltarget="https://example.oraclecloud.com"
    epmidentitydomaintarget 目標環境使用的識別網域名稱。

    範例：

    Windows：set epmidentitydomaintarget="example_target_dom"

    Linux/UNIX：epmidentitydomaintarget="example_target_dom"
    proxyserverusername 用於驗證代理伺服器 (控制網際網路存取) 之安全階段作業的使用者名稱。刪除這個特性出現的所有地方 (若未使用)。

    範例：

    Windows：set proxyserverusername="Example"

    Linux/UNIX：proxyserverusername="Example"
    proxyserverpassword 使用代理伺服器驗證使用者的密碼。刪除這個特性出現的所有地方 (若未使用)。

    範例：

    Windows：set proxyserverpassword="examplePwd"

    Linux/UNIX：proxyserverpassword="examplePwd"
    proxyserverdomain 為代理伺服器定義的網域名稱。刪除這個特性出現的所有地方 (若未使用)。

    範例：

    Windows：set proxyserverdomain="exampleDom"

    Linux/UNIX：proxyserverdomain="exampleDom"
    emailtoaddress (選擇性) 要傳送角色指派報表的目標電子郵件地址。只有當指定這個值的時候，才會透過電子郵件傳送報表。

    範例： emailtoaddress=john.doe@example.com

Linux/UNIX

  1. 複製以下指令碼來建立 input.properties 檔案： 
    javahome=JAVA HOME
epmautomatescript=EPM AUTOMATE SCRIPT LOCATION
epmusersource=EPM USER FOR SOURCE ENVIRONMENT
epmpwdsource=EPM PASSWORD FILE FOR SOURCE ENVIRONMENT
epmurlsource=EPM URL FOR SOURCE ENVIRONMENT
epmidentitydomainsource=EPM IDENTITY DOMAIN FOR SOURCE ENVIRONMENT
epmusertarget=EPM USER FOR TARGET ENVIRONMENT
epmpwdtarget=EPM PASSWORD FILE FOR TARGET ENVIRONMENT
epmurltarget=EPM URL FOR TARGET ENVIRONMENT
epmidentitydomaintarget=EPM IDENTITY DOMAIN FOR TARGET ENVIRONMENT
proxyserverusername=PROXY SERVER USER NAME
proxyserverpassword=PROXY SERVER PASSWORD FILE
proxyserverdomain=PROXY SERVER DOMAIN
emailtoaddress=EMAIL_TO_ADDRESS
  2. 更新 input.properties。請參閱表格 3-*以瞭解您必須指定之值的資訊。此外，您必須指定這些特性的值：
    • javahome：安裝 Java 之目錄的絕對路徑。
    • epmautomatescript：epmautomatescript.sh 的位置，例如 epmautomatescript="/home/user1/epmautomate/bin/epmautomate.sh"
  3. 複製下列指令碼以建立 replicatepredefinedroles.sh。 
    #!/bin/sh
. ./input.properties

roleassignmentreport="roleassignmentreport.csv"
export JAVA_HOME=${javahome}

replicateroles()
{
    # epmautomate login Source App as an DM Admin
    echo "Logging into source application at ${epmurlsource}"
    ${epmautomatescript} login ${epmusersource} ${epmpwdsource} ${epmurlsource} ${epmidentitydomainsource} ${proxyserverusername} ${proxyserverpassword} ${proxyserverdomain}
    echo "Creating role assignment report: ${roleassignmentreport}"
    ${epmautomatescript} roleAssignmentReport ${roleassignmentreport}
    if [[ "${emailtoaddress}" == *"@"* ]]
    then
        ${epmautomatescript} sendMail $emailtoaddress "Role assignment report" Body="Role assignment report is attached." Attachments=$roleassignmentreport
    fi
    echo "Downloading role assignment report"
    ${epmautomatescript} downloadfile ${roleassignmentreport}
    ${epmautomatescript} deletefile ${roleassignmentreport}
    ${epmautomatescript} logout
    echo "Creating files to use with epmautomate assignRoles"
    while read line
    do
        user=$(echo "${line}" | cut -d',' -f1)
        rolename=$(echo "${line}" | cut -d',' -f5)
        if [[ "$rolename" == *"User" ]] && [[ "$rolename" != "*Power User" ]]
        then
            count=$(echo "${rolename}" | wc -w);
            rolename="User"
            if [[ $count -le 2 ]]
            then
                echo "${user}" >> "role-${rolename}.csv" 
            fi
        elif [[ "$rolename" == *"Viewer" ]] 
        then
            count=$(echo "${rolename}" | wc -w);
            rolename="Viewer"
            if [[ $count -le 2 ]]
            then
                echo "${user}" >> "role-${rolename}.csv" 
            fi
        elif [[ "$rolename" == *"Power User" ]] 
        then
            count=$(echo "${rolename}" | wc -w);
            rolename="Power User"
            if [[ $count -le 3 ]]
            then
                echo "${user}" >> "role-${rolename}.csv" 
            fi
        elif [[ "$rolename" == *"Service Administrator" ]] 
        then
            count=$(echo "${rolename}" | wc -w);
            rolename="Service Administrator"
            if [[ $count -le 3 ]]
            then
                echo "${user}" >> "role-${rolename}.csv" 
            fi
        elif [[ "$rolename" == "Planner" ]] 
        then
                echo "${user}" >> "role-User.csv" 
        fi
    done < ${roleassignmentreport}

    # write header line
    for f in role-*.csv
    do
        sed -i '1iUser Login' "$f"
    done
    # epmautomate login Target App as an IDM Admin
    echo "Logging into target application at ${epmurltarget}"
    ${epmautomatescript} login ${epmusertarget} ${epmpwdtarget} ${epmurltarget} ${epmidentitydomaintarget} ${proxyserverusername} ${proxyserverpassword} ${proxyserverdomain}
    for rolefile in role-*.csv
    do
        rolenamecsv=$(echo "$rolefile" | cut -d'-' -f2)
        rolename=$(echo "$rolenamecsv" | cut -d'.' -f1)
        ${epmautomatescript} deletefile "${rolefile}" > /dev/null 2>&1
        echo "Uploading file ${rolefile}"
        ${epmautomatescript} uploadfile "${rolefile}"
        echo "Assigning roles"
        ${epmautomatescript} assignrole "${rolefile}" "${rolename}"
        ${epmautomatescript} deletefile "${rolefile}"
    done
    ${epmautomatescript} logout
    rm deletefile*.log > /dev/null 2>&1
}
init()
{
    # delete role-${role}.csv files
    for f in role-*.csv
    do
        rm "$f" > /dev/null 2>&1
    done
}
echo "Replicate application roles script started"
init
replicateroles
echo "Replicate application roles script completed"
  4. 更新 replicatepredefineroles.sh。查看前面的表格以瞭解您必須指定之值的資訊。此外，您必須指定這些特性的值：
    • javahome：安裝 Java 之目錄的絕對路徑。
    • epmautomatescript：epmautomatescript.sh 的位置，例如 epmautomatescript="/home/user1/epmautomate/bin/epmautomate.sh"