Quest One Identity Manager 6.0. Pre-Upgrade Instructions for Quest One Identity Manager 5.0 before starting the migration

Transcription

1 Quest One Identity Manager 6.0 Pre-Upgrade Instructions for Quest One Identity Manager 5.0 before starting the migration

2 2012 Quest Software, Inc. ALL RIGHTS RESERVED. This document contains proprietary information protected by copyright. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose without the written permission of Quest Software, Inc. ( Quest ). The information in this document is provided in connection with Quest products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Quest products. EXCEPT AS SET FORTH IN QUEST'S TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, QUEST ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL QUEST BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF QUEST HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Quest makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. Quest does not make any commitment to update the information contained in this document. If you have any questions regarding your potential use of this material, contact: Quest Software World Headquarters LEGAL Dept 5 Polaris Way Aliso Viejo, CA legal@quest.com Refer to our Web site ( for regional and international office information. Patents This product includes patent pending technology. Trademarks Quest, Quest Software, the Quest Software logo ActiveRoles, Data Governance, Password Manager, Quest One Identity Manager, Quick Connect and Webthority are trademarks and registered trademarks of Quest Software, Inc in the United States of America and other countries. For a complete list of Quest Software s trademarks, please see Other trademarks and registered trademarks are property of their respective owners. Third Party Contributions Quest One Identity Manager contains some third party components (listed below). Copies of their licenses may be found at COMPONENT LICENSE OR ACKNOWLEDGEMENT.NET logging library 1.0 Copyright , The Regents of the University of California. All rights reserved. BSD 4.4 License. Dojo Toolkit 1.6 Copyright , The Dojo Foundation All Rights Reserved. BSD Simple License. Google Open Sans 1.0 Copyright January 2004 ( Apache 2.0 License. 2

3 JQuery Copyright 2011, John Resig. MIT License. JQuery UI Copyright 2011, John Resig. MIT License. Mono.Security Copyright 2004 Novell, Inc. ( MIT License. Novell.Directory.LDAP Copyright 2003 Novell, Inc. ( MIT License. SharpZipLib Copyright Mike Krueger, John Reilly. SharpZipLib License. spin.js Copyright 2011 Felix Gnass [fgnass at neteye dot de]. MIT License. ZLib.NET Copyright 2006, ComponentAce ( All rights reserved. ZLib.NET License notice Copyright (c) 2006, ComponentAce All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. Neither the name of ComponentAce nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Updated July

4 1 Table of Content 1 Table of Content Pre-Upgrade Instructions Before you begin Clean Up Unintended Permission Assignments Reasoning To Do Expected Issues Clean Up Helper Resources for Requesting Business Roles Reasoning To Do Expected Issues

5 2 Pre-Upgrade Instructions Here are some instructions for tasks that you must carry out in Quest One Identity Manager 5.0 to ensure a successful upgrade to the new from Quest One Identity Manager version Before you begin Please create a backup of your current database. 2.2 Clean Up Unintended Permission Assignments Reasoning Role based authorization in Quest One Identity Manager was implemented in an earlier version. Do do this, we introduced: - New authentication modules for role based authorization - A set of new permissions groups in Quest One Identity Manager (names starting with vi_4_) Those new permissions groups were intended for use with role based authentication modules only and therefore not intended to be assigned to a standard system user. Therefore, permissions groups must only be assigned to system users with the Dynamic user flag (technical name IsDynamicUser ) containing the value 1 not 0. In Quest One Identity Manager 5.0 the Dynamic user flag was not checked when permissions were assigned, which resulted in error messages. To avoid these errors these assignments are not allowed, starting with Quest One Identity Manager 6.0 and are actively denied To Do Check for Unintended Assignments Run the following statement if you are using Microsoft SQL Server: select u.username, g.groupname from DialogUserInGroup uig and g.groupname like 'vi[_]4[_]%' Run the following statement if you are using Oracle: select u.username, g.groupname from DialogUserInGroup uig and upper(g.groupname) like 'VI\_4\_%' escape '\'; If you have found assignments, please save or copy the result list to a file. 5

6 Execute Clean Up Statement Run the following statement if you are using Microsoft SQL: delete DialogUserInGroup from DialogUserInGroup uig and g.groupname like 'vi[_]4[_]%' Run the following statement if you are using Oracle: delete DialogUserInGroup where (UID_DialogUser, UID_DialogGroup) in (select uig.uid_dialoguser, uig.uid_dialoggroup from DialogUserInGroup uig and upper(g.groupname) like 'VI\_4\_%' escape '\'); Expected Issues As most of the assigned permissions have had no effect, there are no expected issues. If you are facing issues, create a custom permissions group with the required permissions and assign this new group to your users. 2.3 Clean Up Helper Resources for Requesting Business Roles Reasoning The delegation module was introduced in an earlier version. As part of that module we implemented so called assignment resources (identified by having value 1 in the column IsAssignmentRessource in table Ressource ). The delegation module requires the helper resource model for requesting group memberships to be switched to using assignment resources. Using the earlier model will lead to unexpected behavior and unintended removal from business roles. Therefore, all resources of type helper resource need to be changed to assignment resources To Do Check for Resources to be Changed Run the following statement if you are using Microsoft SQL Server: join Ressource r on pwo.objectkeyordered = r.xobjectkey and r.connectiontable = 'Org' join PersonHasRessourceTotal phr on phr.uid_person = pwo.uid_personordered and phr.uid_ressource = r.uid_ressource go join Ressource r on pwo.objectkeyordered = r.xobjectkey and r.connectiontable = 'Org' where r.isassignmentressource = 0 go join Ressource r on pwo.objectkeyordered = r.xobjectkey and r.connectiontable = 'Org' where isnull(pwo.objectkeyassignment, N'') <> dbo.vid_getobjectkey2('personinorg', 'UID_Org', isnull(r.connectionpath, N''), N'UID_Person', pwo.uid_personordered ) go 6

7 Run the following statement if you are using Oracle: from personwantsorg pwo join Ressource r on pwo.objectkeyordered = r.xobjectkey join PersonHasRessourceTotal phr on phr.uid_person = pwo.uid_personordered where phr.uid_ressource = r.uid_ressource and upper(r.connectiontable) = 'ORG'; join Ressource r on pwo.objectkeyordered = r.xobjectkey where r.isassignmentressource = 0 and upper(r.connectiontable) = 'ORG'; join Ressource r on pwo.objectkeyordered = r.xobjectkey where nvl(pwo.objectkeyassignment, N' ') <> vid_getobjectkey2('personinorg', 'UID_Org', nvl(r.connectionpath, N' '), N'UID_Person', pwo.uid_personordered ) and upper(r.connectiontable) = 'ORG'; If you have found resources, please save or copy the result list to a file Execute Clean-Up Statement For the clean-up of resources two steps are required: 1. Add a new stored procedure to your Quest One Identity Manager 5.0 database. 2. Use the stored procedure for migrating resources to assignment resources. If you are using Microsoft SQL Server: 1. Go to the install set of Quest One Identity Manager 6.0. You will find a file SDK_MigToAssignmentResource.sql in the folder \SDK\SQLSamples\MSSQL2K. Add the stored procedure SDK_MigToAssignmentResource to your database by running the sql code provided with that file. 2. For each of the resources found, run the statement: If you are using Oracle: exec SDK_MigToAssignmentResource '<UID_Ressource>' Replace <UID_Ressource> with the real value of the field UID_Ressource. 1. Go to the install set of Quest One Identity Manager 6.0. You will find a file SDK_MigToAssignmentResource.sql in the folder \SDK\SQLSamples\Oracle9I. Add the stored procedure SDK_MigToAssignmentResource to your database by running the sql code provided with that file. 2. For each of the resources found, run the statement: begin SDK_MigToAssignmentResource('<UID_Ressource>'); end; Replace <UID_Ressource> with the real value of the field UID_Ressource Expected Issues In earlier versions of Quest One Identity Manager, a process for assigning/removing the person to/from the business role related with the resource was triggered and executed when assigning or removing an assignment of type helper resource to/from a person in the default configuration. No issues are expected here as long as no other process or process step has been added to this event during customization. For verification use the Quest One Identity Manager Designer to check the process chains related to the events Insert and Delete of the table PersonHasRessourceTotal. 7