When you are using Oracle Identity Management solution with oracle applications, you always have need to migrate groups from one instance to another for different reasons


1. To migrate security groups from Development to UAT or Production

2. To Sync non-PROD security groups from PROD

3. Compare security groups between environments   


Solution


Step1 : Export the security from source OID


ldapsearch command is used for exporting.

ldapsearch -help

-h : ldap hostname (OID source)

-p : ldap port (3060 default)

-D : OID administrator (cn=orcladmin)

-w : OID admin password

-L : Print entries in LDIF format

-s : This defines scope of search (one for us)

 base: For searching only the base entry.

 one : For searching only the children of the base entry.

 sub : For searching the base entry and all its descendants.

-b : base DN for search (cn=Groups, dc=com,dc=ae)

"(objectclass=*)" : Search based on all object classes that groups are associated to

  

Export Shell Script (bi_all_group_export.sh)

#!/bin/bash

export MW_HOME=/oracle/app/product/oidfmw

export ORACLE_HOME=/oracle/app/product/oidfmw

export WLS_HOME=$MW_HOME/wlserver

export WL_HOME=$WLS_HOME

export DOMAIN_HOME=$MW_HOME/user_projects/domains/oid_domain

export JAVA_HOME=/oracle/app/java


echo "Enter orcladmin password"

read -s password

ldapsearch -p 3060 -h  source_oid_server.domain -D "cn=orcladmin" -w $password -L -s one -b "cn=Groups, dc=com,dc=ae" "(objectclass=*)" "*" > bi_oid_source_groups.ldif

echo "BI ALL Group exported successfully : bi_oid_source_groups.ldif"

grep dn bi_oid_source_groups.ldif |grep FILTER | sed 's/dn: //g' > bi_oid_source_FILTER_dn_delete.ldif

echo "BI FILTER Group DN list extracted successfully : bi_oid_source_FILTER_dn_delete.ldif"


Run script on source OID server

sh bi_all_group_export.sh

Enter orcladmin password

BI ALL Group exported successfully : bi_oid_source_groups.ldif

BI FILTER Group DN list extracted successfully : bi_oid_source_FILTER_dn_delete.ldif


Step2: Backup security groups on target OID


# copy bi_oid_source_groups.ldif and bi_oid_source_FILTER_dn_delete.ldif to target OID

sh bi_all_group_export.sh

Enter orcladmin password

BI ALL Group exported successfully : bi_oid_target_groups.ldif

BI FILTER Group DN list extracted successfully : bi_oid_target_FILTER_dn_delete.ldif


Step3: Delete security groups from target OID


Delete Shell Script (bi_filter_group_delete.sh)

#!/bin/bash

export MW_HOME=/oracle/app/product/oidfmw

export ORACLE_HOME=/oracle/app/product/oidfmw

export WLS_HOME=$MW_HOME/wlserver

export WL_HOME=$WLS_HOME

export DOMAIN_HOME=$MW_HOME/user_projects/domains/oid_domain

export JAVA_HOME=/oracle/app/java


echo "Enter orcladmin password"

read -s password

ldapdelete -p 3060 -h  target_oid_server.domain -D "cn=orcladmin" -w $password -c -v -f bi_oid_target_FILTER_dn_delete.ldif

echo "BI FILTER Groups deleted successfully : bi_oid_target_FILTER_dn_delete.ldif"


Verify target ODSM to verify: http://target_oid_server.domain:7005/odsm


Step4: Import the security groups to terget OID


ldapadd command is used for import.

usage: ldapadd [options]

    list of operations are read from stdin or

    from the file with -f file option.

options:

    -D binddn   bind DN

    -w passwd   bind password (for simple authentication)

    -h host     LDAP server

    -p port     port on LDAP server

    -W wurl     wallet location for SSL connection(one-way or two-way)

    -P wpasswd  wallet password for SSL connection(one-way or two-way)

    -U SSLAuth  SSL Authentication Mode ("1" no-auth,"2" one-way,"3" two-way)

    -f file     perform sequence of operations listed in `file'

    -X dsmlfile perform sequence of operations from xml file `dslmfile'

    -b          for binary attrs read values from file specified in attrval

    -c          continous operation (do not stop on error)

    -F          force all changes records to be used

    -E charset  encoding character set

    -M          send ManageDsaIT control to server

    -i          bind as current user for chasing Referrals

    -O refhop   set referral hop limit to `refhop'

    -V version  version of LDAP protocol

    -n          print the operations but don't actually do them

    -d level    set LDAP debugging level to `level'

    -o logfile  log messages will be written to `logfile'

    -v          turn in verbose mode (diagnostics to standard output)

    -q          prompt for simple bind password

    -Q          prompt for SSL wallet password

  

Import Shell Script (bi_all_group_import.sh)

#!/bin/bash

export MW_HOME=/oracle/app/product/oidfmw

export ORACLE_HOME=/oracle/app/product/oidfmw

export WLS_HOME=$MW_HOME/wlserver

export WL_HOME=$WLS_HOME

export DOMAIN_HOME=$MW_HOME/user_projects/domains/oid_domain

export JAVA_HOME=/oracle/app/java


echo "Enter orcladmin password"

read -s password

ldapadd -p 3060 -h   target_oid_server.domain -D "cn=orcladmin" -w $password -c -v -f bi_oid_source_groups.ldif

echo "BI ALL Group imported successfully"


Verify target ODSM to verify: http://target_oid_server.domain:7005/odsm


References

http://onlineappsdba.com/index.php/2011/01/11/exporting-and-importing-groups-to-oid/

https://docs.oracle.com/cd/B14099_19/idmanage.1012/b15883/syntax_datamngmnt013.htm 

https://docs.oracle.com/cd/E19450-01/820-6169/ldapsearch-examples.html 


About Me

I have 20 years of thorough experience in the Information Technology industry, specializing in Oracle Database, Fusion Middleware, OBIEE, Oracle E-Business Applications, Hyperion, UPK, Oracle Cloud & Virtualization Administration using Oracle Development / Administration / Management / Training tools on different platforms across industry, including C&IP (Manufacturing, Supply Chain Planning), HCM, Financials, and TMT, with knowledge in Project Management, Application Strategy, Software Development Lifecycle (SDLC), and Application Testing (Unit, System, Integration, UAT, and Performance). I worked on number of projects, implementing custom and ERP/CRM Oracle applications and used AIM/ Macro-scope methodology Project Documentation and version control. I used IT Service Management (ITSM) guidelines and ITIL framework on projects to manage Oracle Infrastructure.


Feedback, Comments, Questions?

Please provide your valuable feedback/comments and let me know if any questions? Feel free to contact me for any ORACLE technology assistance.

Contact: +91-9930920689 | Amit.Garg@redcircle.in | Linkedin