pre-con ed: five easy steps for migrating to ca directory

World®’16

FiveEasyStepsforMigratingtoCADirectoryGregVickery,PrincipalServicesConsultant,CATechnologies

SCX12E

SECURITY

2 ©2016CA.ALLRIGHTSRESERVED.@CAWORLD#CAWORLD

©2016CA.Allrightsreserved.Alltrademarksreferencedhereinbelongtotheirrespectivecompanies.

Thecontentprovidedinthis CAWorld2016presentationisintendedforinformationalpurposesonlyanddoesnotformanytypeofwarranty. The informationprovidedbyaCApartnerand/orCAcustomerhasnotbeenreviewedforaccuracybyCA.

ForInformationalPurposesOnlyTermsofthisPresentation


Abstract

JoinusforadiscussiononthestepsformigratingyourcurrentUserStoreorPolicyStoretoCADirectory. Wewilldiscussdiscoveryandprojectscoping,alongwithBuildingtheCADirectoryenvironment,Schema(DataType)migration,Dataclean-upandApplicationTeamsign-off.

GregVickery

CATechnologiesPrincipalServicesConsultant


Agenda

WHYMIGRATETOCADIRECTORY

DESIGNTHENEWDIRECTORY

GOLIVE!

LDAPTOCADIRECTORYTASKS

MIGRATINGDATABASETOCADIRECTORYTASKS

APPLICATIONTESTING

1

2

3

4

5

6


DirectoryReview

§ Applicationcommunicatingwithadatastore– Viaprotocol- LDAP

§ Datastoremaycontain:– policyinformation– AuthenticationInfo– AuthorizationInfo– orAnyotherData

Levelsettheconversation

ApplicationLayer

LDAP


WhyCADirectory

§ Performance– Replication– allDirectoriesaresynced

(oftenmeasuredinmilliseconds)

§ Smallfootprint– Verylargeenvironmentsw/fewerservers

§ Scalability– 50++millionisOK– OnlyLimitedbyhardware– Canhorizontallyscale(virtuallynolimits)

CAexperiencingalargermigrationtoCADirectory


WhyCADirectory

§ Monitoringmultipleways– Logfilesforaccuraterecordofactivity– Timelogtovalidateperformance– Real-timemonitoringwithSNMP

§ IncludingSNMPtool

§ OperationalAdvantages(easytomanage)– Dataandindexesneednotuning– Veryfastbackupandrestore– Fewmovingparts

CAexperiencingalargermigrationtoCADirectory


TypesofMigration

§ ExistingLDAPenvironmenttoCADirectory– MostcommonMigrationforUserStoreenvironments– Mayhaveveryshortprojectlengths(quick)

§ ExistingDatabaseenvironmenttoCADirectory– Generallyrequiresmoretasks– MoreBenefitsarerealized

§ Replicationindirectorymuchfasterthandatabases§ DatacentertoDatacenter(WAN)replicationiseasy

Twomigrationtypesfromthefield


5StepsofMigration

§ ArchitecttheNewCADirectoryenvironment

§ Schema(DataDefinition)Migration

§ DataMigration

§ ApplicationTesting

§ GoLive!

OverviewofTasks


MigratingExistingLDAPtoCADirectory


ArchitectingtheCADirectorysolution

§ CADirectoryArchitecture– TypicallyrequireslessserversthanLDAPServers– Don’tbeafraidtodesignforthestrengthsoftheCADirectory

§ OnetoOnereplacementcouldbebaddesign§ AND- Departurefromolddesignmyallowustooptimizethedesign

– HardwareRequirements(ServerSpecs)maychange§ CADirectoryisamemoryresidentdirectory§ ChangingO/Smaybeanoption

Viewasachancetooptimize


MigratingtheSchema

§ SchemaMigration– CADirectorytools

§ dxschemaldif - extractsschemafromexistingLDAPservers§ ldif2dxc – formatsLDIFtoCADirectoryconfiguration

– Focusisonyourcustomschema§ Althoughwehavehadtochangestandardschematosupportapps

– MostLDAPServershaverelaxedschema§ MayhavetextOID§ ToolswillsupplyvalidOIDsduringconversion

DefineTasks


MigratingtheData

§ ExportDataFromexistingLDAPServer– InmostcasesuseexistingLDAPServertoolstopullthedata– Someothervendortoolsmaybeabletoexcludeproprietarydata

§ CleanData– Couldbethemosttimeconsumingportionofmigration– Createoradaptexistingdatacleantool– RemoveLDAPServerspecificData(proprietarydata)

§ Import– Mayfindmoredataissueshere– Updatecleantoolandrunagain

Cleaningthedataforimport


MigratingtheData(continued)

§ Alargenumberofhourscouldbeinvolvedwiththisprocess– Ongoingprocess,toolmaybeupdatedseveraltimes.

§ Thedatacleanprocesswillberuninmultipleenvironments– Dev,QA,Staging,etc.beforeProduction(GoLive)– Eachenvironmentmayhaveuniquedataanomalies

§ Opportunitytore-organizeorremoveunwanteddata– Legacy/unusedattributescanberemoved– Oftenfindattributesthataremisused

§ Example:telephoneNumber (attribute)withavalueof‘outofthecountry’

CaseStudy(fieldexperiences)


MigratingtheData(continued)

§ Doyouplantosyncoldandnewenvironments?– “Onefootintheboat,onefootonthedock”– CADirectoryhassomelimitedabilitytosync(DXLink)– Syncmayintroduceannew(3rd)componenttotheenvironment

§ Mayrequireadditionalexpertise§ Willhaveperformanceimplications(slowingthenewenvironment)

– Synctoolmaybeslowerthannewdirectoryserver– Highlylikelytheoldenvironmentmaybeslowerthanthenewenvironment

§ Ifsyncprocessfails– isthiscauseforrollback?– Manualrecovery(rollback)maybefaster

OtherConsiderations


ApplicationVerification

§ IdentifyApplicationsfortestingandverification– Typicallysamplegroupofrepresentativeapplicationswillbeused

§ Developatestplanfortestingapplications

§ IdentifyRequiredResources(personnel)neededforrollout

§ Theprocessshouldberun(andrefined)inmultipleenvironmentsbeforeproduction– Timeallphases,cantheprocessbeexecutedwithinouroutagewindow

TestPlantoverifyapplicationsworkwithnewenvironment


GoLive

§ Pre-GoLive(sometimebeforeGOLive):– Transformthetestplanintorolloutscriptandchecklist(process)– Theprocessshouldberuninmultipleenvironmentsbeforeproduction– IncludeaRoll-backPlanincaseofissuesorunexpecteddisruptions– Verifythecorrectpersonnelareavailable

§ DirectoryTeam,Operations,Applicationowners,Vendors,etc.

§ Executerolloutscript– Success!- Meetthenextdaywiththeentireteamtoreview

CutovertoProduction


MigratingExistingDatabasetoCADirectory


MigratingDatabasetoCADirectory

§ UserStore– CADirectoryhasfasterreplication(DatacentertoDatacenter)

§ PolicyStore(CASSO)– VeryCosteffective

§ SessionStore(CASSO)– CADirectoryistheonlyDirectory/LDAPserversupportedassessionstore– DatacentertoDatacenterDatabasesynchronizationisexpensive

Advantagestomigratethedifferentenvironments



§ InvolvesmoretasksthanLDAPUserstoreconversion

§ CreateCADirectorySchema§ NoSchematoexport§ ConvertFieldstoattributes§ ConvertTablestoobjectClasses§ MaybeabletouseCADirectory‘Views’configurationtoreplacestoredprocedures

MigratingUserStoreFromDatabase



§ CADirectory‘Views’Configuration– ‘Views’configurationmaybeabletoreplacecertainstoredprocedures

§ Viewsarepre-definedsearcheswithmultiple‘phases’

§ Applicationconversion§ ApplicationswillneedtobeLDAPenabled§ DevelopasLDAPRequests(differentthanSQLRequests)§ Testingthefunctionality

– Startatbeginningofproject– Morecompletesetofusecases

MigratingUserStoreFromDatabase(continued)



§ StepsformigrationofPolicyStoreData– BuildCADirectoryServerenvironment(inCASSOGuide)

§ BuildDIT(Tree)structureforPolicyStoredata§ AddPolicyDataSchemafilestoCADirectory

– ExtractDatafromcurrentPolicyStore§ UsetheavailableCASSOToolstoexportthepolicies§ ThisprocessisthesamewhetherDatabaseorLDAPServer

– ConfigureCASSOPolicyServerfornewPolicyStore– ImportPoliciesintoCADirectory

§ UsingtheCASSOImporttool

CASSO(formerlySiteMinder)PolicyStore



§ StepsformigrationofSessionStoreData– AddSessionDataSchemafilestoCADirectory– Determineperformancerequirements:

§ Calculatenumberofconcurrentsessions§ Factorthesessiontimeout(oraveragesessionlife)

– CADirectoryasasessionstorehasspecializedconfiguration§ Documentationoutlinesthespecificsettings

– Hardwareintensiveforhighdemandenvironments§ ConsultCAforhardwareguidelines

– ConfigureCASSOPolicyServertouseCADirectory

CASSOSessionStore


ReviewofMigrationSteps

§ Architectthenewsolution– Don’tbeafraidtochangefromolddesign

§ SchemaMigration– UtilizeCADirectorytools

§ DataMigration– Maybetimeconsuming

§ TestApplication§ GOLive

QuickRecap


RecommendedSessions

SESSION# TITLE DATE/TIME

SCT45T HowFastisyourDirectory? 11/16/2016at4:30pm

SCX20SCARoadmap:AdvancedAuthentication,SingleSign-On,Directory 11/16/2016at1:45pm

SCT44T WAM&Federation(TechTalk) 11/17/2016at4:30pm


Don’tMissOurINTERACTIVESecurityDemoExperience!

SNEAKPEEK!



Questions?


Thankyou.

Stayconnectedatcommunities.ca.com

pre-con ed: five easy steps for migrating to ca directory

Technology