Pre-Con Ed: Five Easy Steps for Migrating to CA Directory

World®
’16
Five Easy Steps for Migrating
to CA Directory
Greg Vickery, Principal Services Consultant, CA Technologies
SCX12E
SECURITY

2 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
© 2016 CA. All rights reserved. All trademarks referenced herein belong to their respective companies.
The content provided in this CA World 2016 presentation is intended for informational purposes only and does not form any type of
warranty. The information provided by a CA partner and/or CA customer has not been reviewed for accuracy by CA.
For Informational Purposes Only
Terms of this Presentation

Abstract
Join us for a discussion on the steps for migrating your current User Store or Policy Store to CA
Directory. We will discuss discovery and project scoping, along with Building the CA Directory
environment, Schema (Data Type) migration, Data clean-up and Application Team sign-off.
Greg Vickery
CA Technologies
Principal Services
Consultant

Agenda
WHY MIGRATE TO CA DIRECTORY
DESIGN THE NEW DIRECTORY
GO LIVE!
LDAP TO CA DIRECTORY TASKS
MIGRATING DATABASE TO CA DIRECTORY TASKS
APPLICATION TESTING
1
2
3
4
5
6

Directory Review
§ Application communicating
with a data store
– Via protocol - LDAP
§ Data store may contain:
– policy information
– Authentication Info
– Authorization Info
– or Any other Data
Level set the conversation
Application Layer
LDAP

Why CA Directory
§ Performance
– Replication – all Directories are synced
(often measured in milliseconds)
§ Small footprint – Very large environments w/ fewer servers
§ Scalability – 50++ million is OK
– Only Limited by hardware
– Can horizontally scale (virtually no limits)
CA experiencing a larger migration to CA Directory

Why CA Directory
§ Monitoring multiple ways
– Log files for accurate record of activity
– Time log to validate performance
– Real-time monitoring with SNMP
§ Including SNMP tool
§ Operational Advantages (easy to manage)
– Data and indexes need no tuning
– Very fast backup and restore
– Few moving parts
CA experiencing a larger migration to CA Directory

Types of Migration
§ Existing LDAP environment to CA Directory
– Most common Migration for User Store environments
– May have very short project lengths (quick)
§ Existing Database environment to CA Directory
– Generally requires more tasks
– More Benefits are realized
§ Replication in directory much faster than databases
§ Datacenter to Datacenter (WAN) replication is easy
Two migration types from the field

5 Steps of Migration
§ Architect the New CA Directory environment
§ Schema (Data Definition) Migration
§ Data Migration
§ Application Testing
§ Go Live!
Overview of Tasks

Migrating Existing LDAP to CA Directory

Architecting the CA Directory solution
§ CA Directory Architecture
– Typically requires less servers than LDAP Servers
– Don’t be afraid to design for the strengths of the CA Directory
§ One to One replacement could be bad design
§ AND - Departure from old design my allow us to optimize the design
– Hardware Requirements (Server Specs) may change
§ CA Directory is a memory resident directory
§ Changing O/S may be an option
View as a chance to optimize

Migrating the Schema
§ Schema Migration
– CA Directory tools
§ dxschemaldif - extracts schema from existing LDAP servers
§ ldif2dxc – formats LDIF to CA Directory configuration
– Focus is on your custom schema
§ Although we have had to change standard schema to support apps
– Most LDAP Servers have relaxed schema
§ May have text OID
§ Tools will supply valid OIDs during conversion
Define Tasks

Migrating the Data
§ Export Data From existing LDAP Server
– In most cases use existing LDAP Server tools to pull the data
– Some other vendor tools may be able to exclude proprietary data
§ Clean Data
– Could be the most time consuming portion of migration
– Create or adapt existing data clean tool
– Remove LDAP Server specific Data (proprietary data)
§ Import
– May find more data issues here – Update clean tool and run again
Cleaning the data for import

Migrating the Data (continued)
§ A large number of hours could be involved with this process
– Ongoing process, tool may be updated several times.
§ The data clean process will be run in multiple environments
– Dev, QA, Staging, etc. before Production (Go Live)
– Each environment may have unique data anomalies
§ Opportunity to re-organize or remove unwanted data
– Legacy /unused attributes can be removed
– Often find attributes that are misused
§ Example: telephoneNumber (attribute) with a value of ‘out of the country’
Case Study (field experiences)

Migrating the Data (continued)
§ Do you plan to sync old and new environments?
– “One foot in the boat, one foot on the dock”
– CA Directory has some limited ability to sync (DXLink)
– Sync may introduce an new (3rd) component to the environment
§ May require additional expertise
§ Will have performance implications (slowing the new environment)
– Sync tool may be slower than new directory server
– Highly likely the old environment may be slower than the new environment
§ If sync process fails – is this cause for rollback?
– Manual recovery (rollback) may be faster
Other Considerations

Application Verification
§ Identify Applications for testing and verification
– Typically sample group of representative applications will be used
§ Develop a test plan for testing applications
§ Identify Required Resources (personnel) needed for rollout
§ The process should be run (and refined) in multiple
environments before production
– Time all phases, can the process be executed within our outage window
Test Plan to verify applications work with new environment

Go Live
§ Pre-Go Live (sometime before GO Live):
– Transform the test plan into rollout script and check list (process)
– The process should be run in multiple environments before production
– Include a Roll-back Plan in case of issues or unexpected disruptions
– Verify the correct personnel are available
§ Directory Team, Operations, Application owners, Vendors, etc.
§ Execute rollout script
– Success! - Meet the next day with the entire team to review
Cutover to Production

Migrating Existing Database to
CA Directory

Migrating Database to CA Directory
§ User Store
– CA Directory has faster replication (Datacenter to Datacenter)
§ Policy Store (CA SSO)
– Very Cost effective
§ Session Store (CA SSO)
– CA Directory is the only Directory / LDAP server supported as session store
– Datacenter to Datacenter Database synchronization is expensive
Advantages to migrate the different environments

§ Involves more tasks than LDAP User store conversion
§ Create CA Directory Schema
§ No Schema to export
§ Convert Fields to attributes
§ Convert Tables to objectClasses
§ May be able to use CA Directory ‘Views’ configuration to replace stored
procedures
Migrating User Store From Database

§ CA Directory ‘Views’ Configuration
– ‘Views’ configuration may be able to replace certain stored procedures
§ Views are pre-defined searches with multiple ‘phases’
§ Application conversion
§ Applications will need to be LDAP enabled
§ Develop as LDAP Requests (different than SQL Requests)
§ Testing the functionality
– Start at beginning of project
– More complete set of use cases
Migrating User Store From Database (continued)

§ Steps for migration of Policy Store Data
– Build CA Directory Server environment (in CA SSO Guide)
§ Build DIT (Tree) structure for Policy Store data
§ Add Policy Data Schema files to CA Directory
– Extract Data from current Policy Store
§ Use the available CA SSO Tools to export the policies
§ This process is the same whether Database or LDAP Server
– Configure CA SSO Policy Server for new Policy Store
– Import Policies into CA Directory
§ Using the CA SSO Import tool
CA SSO (formerly SiteMinder) Policy Store

§ Steps for migration of Session Store Data
– Add Session Data Schema files to CA Directory
– Determine performance requirements:
§ Calculate number of concurrent sessions
§ Factor the session timeout (or average session life)
– CA Directory as a session store has specialized configuration
§ Documentation outlines the specific settings
– Hardware intensive for high demand environments
§ Consult CA for hardware guidelines
– Configure CA SSO Policy Server to use CA Directory
CA SSO Session Store

Review of Migration Steps
§ Architect the new solution
– Don’t be afraid to change from old design
§ Schema Migration
– Utilize CA Directory tools
§ Data Migration
– May be time consuming
§ Test Application
§ GO Live
Quick Recap

Recommended Sessions
SESSION # TITLE DATE/TIME
SCT45T How Fast is your Directory? 11/16/2016 at 4:30 pm
SCX20S
CA Roadmap: Advanced Authentication, Single Sign-On,
Directory
11/16/2016 at 1:45 pm
SCT44T WAM & Federation (Tech Talk) 11/17/2016 at 4:30 pm

Don’t Miss Our INTERACTIVE
Security Demo Experience!
SNEAK
PEEK!

Questions?

Thank you.
Stay connected at communities.ca.com

Pre-Con Ed: Five Easy Steps for Migrating to CA Directory

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (18)

Similar to Pre-Con Ed: Five Easy Steps for Migrating to CA Directory

Similar to Pre-Con Ed: Five Easy Steps for Migrating to CA Directory (20)

More from CA Technologies

More from CA Technologies (20)

Recently uploaded

Recently uploaded (20)

Pre-Con Ed: Five Easy Steps for Migrating to CA Directory