roles from a development to a test Informatica domain. Use the ... As a best
practice, organize Informatica access control by groups and roles to simplify user
...
Migrating Domain Objects to Another Informatica Domain
© 2011 Informatica
Abstract You can migrate native users, native groups, roles, and connections between different domains on version 9.1.0. You can migrate native users and native groups from a version 9.0.1 domain to a version 9.1.0 domain. After migrating the objects, you must reassign roles and permissions in the destination domain.
Supported Versions ¨ Informatica 9.1.0
Table of Contents Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Migrating Users, Groups, Roles, and Connections Between Version 9.1.0 Domains. . . . . . . . . . . . . . . . . . . . . 3 Step 1. Create an Export Control File (Optional). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Step 2. Export the Domain Objects. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Step 3. Review Object Properties in the Export File (Optional). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Step 4. Create an Import Control File (Optional). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Step 5. Import the Domain Objects. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Step 6. Assign Roles and Permissions to Groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Migrating Users and Groups from a Version 9.0.1 Domain to a Version 9.1.0 Domain. . . . . . . . . . . . . . . . . . . . 6
Overview You can migrate objects between different Informatica domains. For example, you might need to migrate users, groups, and roles from a development to a test Informatica domain. Use the infacmd command line program to migrate objects between Informatica domains. The commands that you use depend on the versions of the Informatica domains. You can migrate objects between the following domain versions: Between version 9.1.0 domains Use the infacmd isp ExportDomainObjects and ImportDomainObjects commands to migrate native users, native groups, roles, and connections between version 9.1.0 domains. From a version 9.0.1 domain to a version 9.1.0 domain Use the infacmd isp ExportUsersAndGroups and ImportUsersAndGroups commands to migrate all native users and native groups from a version 9.0.1 domain to a version 9.1.0 domain. These commands do not migrate roles and connections. After importing users and groups, you must reassign roles and permissions in the destination domain. As a best practice, organize Informatica access control by groups and roles to simplify user management and create a more secure environment. This article assumes that you have organized Informatica access control by groups and roles. You can migrate users to another Informatica domain when access control is organized by users and privileges. However, the steps to reassign privileges and permissions are more tedious. Note: If the domain contains LDAP users and groups, configure the destination domain to synchronize with the same LDAP directory service. Complete the LDAP synchronization before you create application services in the destination domain. After synchronization, you must reassign all roles and permissions in the destination domain.
2
Migrating Users, Groups, Roles, and Connections Between Version 9.1.0 Domains To export and import domain objects between different domains on version 9.1.0, use the following infacmd isp commands: ¨ ExportDomainObjects. Exports native users, native groups, roles, and connections from an Informatica domain to
an export file. ¨ ImportDomainObjects. Imports native users, native groups, roles, and connections from an export file into an
Informatica domain. You can use an infacmd control file to filter the objects during the export or import. A control file is an XML file based on an export or import schema file. You can use the following control files with infacmd: ¨ Export control file. Use an export control file to specify the objects to export from the original domain to an export
file. ¨ Import control file. Use an import control file to specify the objects to import from the export file into the destination
domain. You can also use the infacmd xrf generateReadableViewXML command to generate a readable XML file from the export file. Review the readable XML file to determine if you need to filter the objects that you want to import into the destination domain. Complete the following steps to migrate users, groups, roles, and connections to another domain of the same version: 1.
Optionally, create an export control file to filter the objects that are exported.
2.
Export the domain objects.
3.
Optionally, review object properties in the export file to determine if you need to filter the objects that you want to import.
4.
Optionally, create an import control file to filter the objects that are imported.
5.
Import the domain objects.
6.
Assign roles and permissions to groups.
Step 1. Create an Export Control File (Optional) By default, the infacmd isp ExportDomainObjects command exports all native users, native groups, roles and connections from the domain. Create an export control file to filter the domain objects to export. You can filter domain objects by type, time, or name. 1.
Create an XML file based on the exportControl.xsd schema file located in /isp/ bin.
2.
In the beginning of the XML file, include an XML declaration and the location of the hosted schema file in the exportParams root element. Include the following lines in the file: ...
3.
Include the remaining elements and attributes in the XML file based on the objects that you want to export. For a complete list of export control file parameters, see the Informatica Command Reference.
4.
Save the export control file using the following naming convention: ecf_.xml.
Example to Filter Objects by Type You want to export all users, groups, and roles but not connections from a domain. You might create the following control file to filter the exported objects by type:
3
You might name the export control file ecf_UsersGroupsRoles.xml. Example to Filter Objects by Time You want to export users, groups, and roles created after 2010-12-25 10:00:00 +0530. You do not want to export connections. You might create the following control file to filter the exported objects by type and time:
You might name the export control file ecf_UsersGroupsRolesAfter2010_12_25.xml.
Step 2. Export the Domain Objects When you run the infacmd isp ExportDomainObjects command, you can specify an export control file to filter the objects that the command exports. By default, infacmd does not export user and connection passwords. You can choose to export an encrypted version of the password when you run the command. If you do not export passwords, you must reset the passwords after you import the objects into the destination domain. If you did not create an export control file, run the infacmd isp ExportDomainObjects command in the original domain using the following syntax: infacmd isp ExportDomainObjects -DomainName -UserName -Password ExportFile -RetainPassword
If you created an export control file, run the infacmd isp ExportDomainObjects command in the original domain using the following syntax: infacmd isp ExportDomainObjects -DomainName -UserName -Password ExportFile -ExportControlFile -RetainPassword
Step 3. Review Object Properties in the Export File (Optional) You can use infacmd to generate a readable XML file from the export file. Review the readable XML file to determine if you need to filter the objects that you import. 1.
In the original domain, run the infacmd xrf generateReadableViewXML command to generate a readable XML file. Use the following syntax: infacmd xrf generateReadableViewXML -SourceExportFile -TargetFile
2.
Use a text editor to open the readable XML file.
3.
Review the objects in the readable XML file to determine if you need an import control file to filter the objects that you import into the destination domain.
4
Step 4. Create an Import Control File (Optional) By default, the infacmd isp ImportDomainObjects command imports all native users, native groups, roles and connections in the export file into the destination domain. Create an import control file to filter the objects to import. You can filter domain objects by type or name. If you used an export control file to filter the domain objects that infacmd exported, you probably do not need to filter the export file. However, if you are importing the export file into multiple destination domains, you might need to filter the objects that infacmd imports. 1.
Create an XML file based on the importControl.xsd schema file located in /isp/ bin.
2.
In the beginning of the XML file, include an XML declaration and the location of the hosted schema file in the importParams root element. Include the following lines in the file: ...
3.
Include the remaining elements and attributes in the XML file based on the objects that you want to import. For a complete list of import control file parameters, see the Informatica Command Reference.
4.
Save the import control file using the following naming convention: icf_.xml.
Example to Filter Objects by Name You want to import the users, groups, and roles exported from the original domain into two destination domains. You want to import all users and groups but only some of the roles into one of the destination domains. You might create the following control file to filter the imported roles by name:
You might name the import control file icf_UsersGroupsDevAnalystRoles.xml.
Step 5. Import the Domain Objects When you run the infacmd isp ImportDomainObjects command, you can specify an import control file to filter the objects that the command imports. If you did not create an import control file, run the infacmd isp ImportDomainObjects command in the destination domain using the following syntax: infacmd isp ImportDomainObjects -DomainName -UserName -Password ImportFilePath -ConflictResolution
If you created an import control file, run the infacmd isp ImportDomainObjects command in the destination domain using the following syntax: infacmd isp ImportDomainObjects -DomainName -UserName -Password ImportFilePath -ImportControlFile -ConflictResolution
5
Step 6. Assign Roles and Permissions to Groups After migrating users, groups, and roles, you must reassign roles and permissions in the destination domain. 1.
In the destination domain, create other domain objects such as application services.
2.
Assign roles to the migrated groups for each application service.
3.
Assign permission on domain objects to the migrated groups.
4.
If you did not export user and connection passwords, reset the passwords.
Migrating Users and Groups from a Version 9.0.1 Domain to a Version 9.1.0 Domain You can export all native users and native groups from a version 9.0.1 domain to an export file. You can import all native users and native groups in the export file into a version 9.1.0 domain. For example, you might want to migrate users to a domain of a different version if you want to perform an upgrade without altering the production environment. To migrate users and groups from a version 9.0.1 domain to a version 9.1.0 domain, use the following infacmd isp commands: ¨ ExportUsersAndGroups. Exports all native users and native groups from an Informatica domain to an export file. ¨ ImportUsersAndGroups. Imports all native users and native groups from an export file into an Informatica domain.
These commands do not migrate roles and connections. You must create roles and connections in the destination domain. 1.
In the original domain, run the infacmd isp ExportUsersAndGroups command to export the users and groups to an export XML file. Use the following syntax: infacmd isp ExportUsersAndGroups -DomainName -UserName -Password ExportFile
2.
In the destination domain, run the infacmd isp ImportUsersAndGroups command to import the exported XML file. Use the following syntax: infacmd isp ImportUsersAndGroups -DomainName -UserName -Password -ExportFile -ReuseDomainUsersAndGroups
3.
In the destination domain, create other domain objects such as application services.
4.
Create roles for the migrated groups if the roles do not exist in the destination domain.
5.
Assign the roles to the migrated groups for each application service.
6.
Assign permission on domain objects to the migrated groups.
Author Alison Taylor Technical Writer
Acknowledgements The author would like to acknowledge the Informatica Quality Assurance team and the Informatica Development team for their contributions to this article.
6
