Avatier Identity Management Suite Migrating AIMS Configuration and Audit Log Data To Microsoft SQL Server Version 9 2603 Camino Ramon Suite 110 San Ramon, CA 94583 Phone: 800-609-8610 925-217-5170 FAX: 925-217-0853 Email: support@avatier.com Page 1
Table of Contents 1 AIMS 9.0 INSTALLATION OR UPGRADING FROM A PREVIOUS VERSION OF AIMS... 3 2 PREPARING THE AIMS SERVER FOR MICROSOFT SQL SERVER... 4 2.1 RUNNING THE AIMSSQLSERVER SCRIPT TO CREATE THE AIMS CONFIGURATION DATABASES.. 4 3 CONFIGURING AIMS TO USE THE MICROSOFT SQL SERVER DATABASES... 7 3.1 FOR AUDIT LOG DATA... 7 3.2 FOR USERID MAPPING DATA... 8 3.3 FOR AIMS CONFIGURATION DATA... 9 3.4 FOR AIMS DIRECTORY SHADOW REPOSITORY (DSR) DATA... 10 3.5 FOR AIMS GROUP ENFORCER DATA... 11 3.6 TESTING THE CONNECTIONS... 11 4 MIGRATING THE VISTADB FILES TO MS SQL SERVER... 12 4.1 TO MIGRATE THE MAPPED IDS DATA... 12 4.2 MIGRATING AIMS CONFIGURATION, DSR, GROUP ENFORCER, AND AUDIT LOG DATA... 13 4.2.1 When the services are stopped... 13 4.2.2 When the migration is complete... 13 Page 2
1 AIMS 9.0 Installation or Upgrading From a Previous Version of AIMS On a default AIMS 9.0 installation, AIMS configuration and audit data is stored locally on the AIMS server in VistaDB format. VistaDB is a lightweight database engine that supports both 32 bit and 64 bit versions of AIMS 9.0. AIMS versions prior to version 8.0 used Microsoft Access database files. Microsoft Access files cannot be accessed by AIMS 9.0, therefore, VistaDB has been selected as the default local database engine for AIMS 9.0 providing the most flexibility in meeting the varying needs of Avatier's customers. If you are upgrading from a previous version of AIMS that stored its configuration data in Microsoft Access file format, the data will automatically be converted to the VistaDB format during the upgrade process. Page 3
2 Preparing the AIMS Server for Microsoft SQL Server The following are the requirements for using MS SQL Server as the database repository for AIMS Configuration and Audit Log data: Port 1433 must be opened between the AIMS server and the MS SQL Server. The Microsoft SQL Server must be running in Mixed (hybrid) Mode, meaning it needs to accept both Windows and SQL Server Logons. You must be running AIMS Version 9.0. 2.1 Running the AIMSSQLSERVER Script to Create the AIMS Configuration Databases In the aims/admin directory (default path = c:\inetpub\wwwroot\aims\admin) is a file called AIMSSQLSERVER.SQL. Have your SQL DBA review the contents of this file and make any needed changes to database names that will be created during the execution of this script. Have the SQL DBA access the MS SQL Server with an account that has the privileges to create databases on the server, and copy the contents of the AIMSSQLSERVER.SQL file into a query window inside of SQL Management Studio. Execute the query to create the AIMS databases. By default, the script creates the following databases: Database AIMSAUDIT AIMSCONFIG AIMSDSR AIMSGE AIMSMAPIDS Comments AIMS Audit Log database and tables AIMS Configuration database. Note: Only the database is created. The schema will be created when SQLSERVERMIGRATE /AIMS is run from the command line. Collected data from target systems for orphaned accounts, Identity Enforcer managed user cache, and Identity Analyzer product. Note: Only the database is created. The schema will be created when SQLSERVERMIGRATE /DSR is run from the command line. AIMS Group Enforcer database. Note: Only the database is created. The schema will be created when SQLSERVERMIGRATE /GROUPENFORCER is run from the command line. User Mapping database and tables Create a SQL Logon that will be used for all five databases o Access The SQL Management Studio s Object Browser o Expand the tree o Expand Security o Right Click on Logins and select New Login from the menu Page 4
o Enter a new login name, enable the SQL Server Authentication radio button, enter the password and confirm password values, then uncheck the Enforce password policy checkbox. The reason for overriding the SQL password policy, is Microsoft's SQL password policy expires the password on first use. Since the SQL login name and password will be used in the configuration of the repository page on the AIMS server, you do not want subsequent connections to fail after the initial connection is made. Go back to the SQL Management Studio Object Browser and expand Databases. o Expand AIMSAudit o Expand Security Page 5
o Right Click on Users and select New User from the menu. o o o o o Enter the SQL Login name you created in the User name field, and in the Login name field. Under the Owned Schemas section, enable the db_owner checkbox. Under the Database role membership section, enable the db_owner checkbox. Click the OK button. Repeat the assignment of the database user and db_owner database role and owned schema for the AIMSCONFIG, AIMSDSR, AIMSGE, and AIMSMAPIDS databases. Page 6
3 Configuring AIMS to Use The Microsoft SQL Server Databases Prior to converting the existing AIMS configuration data and AIMS Audit Log data to be written to the Microsoft SQL Server databases you created, you must configure the AIMS Repository settings to those databases. Access the main AIMS configuration screen, and click on the Repository option in the center pane. 3.1 For Audit Log Data Enable the Log system activity to Microsoft SQL Server radio button Enter the fully qualified domain name or the IP address of your MS SQL Server. If you are using a named SQL instance, specify the address as SQLSerrverName\InstanceName. Enter the name of the Audit Log database. By default, this is AIMSAUDIT. Enter the SQL Login name for the database. Enter the SQL Login password. Page 7
3.2 For UserID Mapping Data Export your Mapped IDs from AIMS / User Mapping. Save the file on the AIMS server in a temporary directory. Enable the Use Data in MS SQL Server radio button. Enter the fully qualified domain name or the IP address of your MS SQL Server. If you are using a named SQL instance, specify the address as SQLSerrverName\InstanceName. Enter the name of the Mapped ID database. By default, this is AIMSMAPIDS. Enter the SQL Login name for the database. Enter the SQL Login password. Page 8
3.3 For AIMS Configuration Data Enable the Log system activity to Microsoft SQL Server radio button Enter the fully qualified domain name or the IP address of your MS SQL Server. If you are using a named SQL instance, specify the address as SQLSerrverName\InstanceName. Enter the name of the Identity Enforcer configuration database. By default, this is AIMSCONFIG. Enter the SQL Login name for the database. Enter the SQL Login password. Page 9
3.4 For AIMS Directory Shadow Repository (DSR) Data Enable the "Store data in Microsoft SQL Server radio button Enter the fully qualified domain name or the IP address of your MS SQL Server. If you are using a named SQL instance, specify the address as SQLSerrverName\InstanceName. Enter the name of the DSR configuration database. By default, this is AIMSDSR. Enter the SQL Login name for the database. Enter the SQL Login password. Page 10
3.5 For AIMS Group Enforcer Data Enable the "Store data in Microsoft SQL Server radio button Enter the fully qualified domain name or the IP address of your MS SQL Server. If you are using a named SQL instance, specify the address as SQLSerrverName\InstanceName. Enter the name of the Group Enforcer configuration database. By default, this is AIMSGE. Enter the SQL Login name for the database. Enter the SQL Login password. 3.6 Testing the Connections At the bottom of the Repository configuration page is a Test Connections button. When you have configured the repository sections for AIMS Configuration, Audit, MapIDs, and AIMSDSR the connections should show Connection Succeeded. If you receive your success confirmation, press the save button at the top of the screen to save your configuration settings, then press the Restart button to restart the web application. Page 11
4 Migrating the VistaDB files to MS SQL Server Data contained in the VistaDB files created during a default installation of AIMS can now be migrated to the Microsoft SQL Server databases. To accomplish this, you must use a combination of utilities dependant on the data you are migrating. 4.1 To migrate the Mapped IDs Data Access the AIMS / User Mapping configuration page Click on the Browse button Locate the exported MapIDs file you created earlier and select the file. Click the Add Entries button and the data will be imported into the MS SQL Server AIMSMAPIDS database. Page 12
4.2 Migrating AIMS Configuration, DSR, Group Enforcer, and Audit Log Data AIMS comes with a command line utility to migrate the AIMS configuration and audit data from the c:\inetpub\wwwroot\aims\admin directory to the AIMSCONFIG, AIMSDSR, AIMSGE, and AIMSAUDIT databases on MS SQL Server. In order to use this utility, you must stop the following services on the AIMS server: Avatier Identity Management Suite IIS Admin Service (Stopping IIS Admin will also stop the World Wide Web Publishing Service and the HTTP SSL service) 4.2.1 When the services are stopped Open a command line on the AIMS server and change directories to c:\inetpub\wwwroot\aims\bin From the command line type SQLServerMigrate.exe /AIMS The utility will first create the tables in the AIMSCONFIG database on the Microsoft SQL Server, then migrate the configuration information contained in the AIMS.vdb3 file. From the command line type SQLServerMigrate.exe /DSR The utility will first create the tables in the AIMSDSR database on the Microsoft SQL Server, then migrate the configuration information contained in the AIMSDSR.vdb3 file. From the command line type SQLServerMigrate.exe /GROUPENFORCER The utility will first create the tables in the AIMSGE database on the Microsoft SQL Server, then migrate the configuration information contained in the AIMSGE.vdb3 file. From the command line type o SQLServerMigrate.exe /AUDITREPLACE o Or SQLServerMigrate.exe /AUDITADD The utility migrates data from AIMSAUDIT.vdb3 on the AIMS Server to the AIMSAUDIT database on the Microsoft SQL Server. AUDITREPLACE will drop the destination table and replace it with the contents of AIMSAUDIT.vdb3. AUDITADD will append the records from AIMSAUDIT.vdb3 to the SQL AIMSAUDIT database. Please note: Using AUDITADD may create duplicate records in the SQL AIMSAUDIT database if run multiple times. 4.2.2 When the migration is complete Start the IIS Admin Service Start the World Wide Web Publishing Service (starting this service automatically starts the HTTP SSL service) Start the Avatier Identity Management Suite service Access the AIMS Configuration Screens and test your configuration. o Access the audit logs and make sure items are being recorded to the Microsoft SQL Server o Access your licensed AIMS product modules and validate the configuration settings Page 13