Symantec Privileged Access Management

Expand all | Collapse all

Tech Tip - CA Privileged Identity Manager: How to resubscribe a DH to a DMS in PIM 12.8+

  • 1.  Tech Tip - CA Privileged Identity Manager: How to resubscribe a DH to a DMS in PIM 12.8+

    Broadcom Employee
    Posted Jun 30, 2015 03:37 AM

    CA PIM Tuesday Tip by Miquel Gilibert, Principal Support Engineer, June 30, 2015

     

    In PIM versions 12.8 and above, communication between a DMS and children DH is handled through TIBCO.

     

    The ac_server_to_server_broadcast(DH) TOPIC queue is subscribed to the DMS, and the different DH are getting the information from that queue and not from the DMS directly.

     

    There are several situations where a subscription of a a given DH to its DMS needs to be recreated. For instance, if there is a consistent failure to synchronize data across DH, or if there is some kind of corruption in the databases, or in case of slow networks when DH and DMS have fallen off synch. There were documented steps to do this in versions 12.7 and below.

     

    Since this is a new organization not present in previous versions of the product, the procedures for recreating manually a subscription of a child DH to the parent DMS have varied. If the procedure employed in previous versions of PIM is used, one will end up with an incorrect direct subscription of the DH at the same level as the ac_server_to_server_broadcast topic. So a new procedure needs to be devised.

     

    The following procedure should be applied

     

    Connect to the machine with the DH__ which requires to be resubscribed to the DMS and issue there the following commands

     

    1. Export the DH database with dbmgr -e -l -f dh.txt (the database will have to be stopped first). This is to have a copy of the database in case something went wrong.

     

    2. Delete the DH with dbmgr -remove -dh DH__

     

    3. Create new DH

     

    dmsmgr -create -dh DH__

     

    the command automatically will create DH__WRITER as well

     

    4. Subscribe DH  to DMS by using sepmd -smq DH__WRITER -predefined ServerToServer -destination DMS

     

    5. Sync DH with DMS

     

    dmsgr -sync self

     

     

    dmsmgr -create -dh DH__  command adds ac_server_to_server queue as subscriber.There is no need to run sepmd -smq DH__WRITER -predefined ServerToServer -destination DMS.

     

    The DH  does not know about what DMS it is subscribed and it sends messages to ServerToServer queue , as it did before removing .

     

    Since dmsmgr does not change TIBCO configuration (routing, brigdes, queues), all should work as before creating the new DH. In fact, since communications take place always between DMS and DH through the TIBCO queue DMS__ doesn't know if its DH is rebuilding. While the DH is rebuilding, other DH will get updates from DMS and will handle it's requests. In the present 12.8+ configuration, the DMS sends, but it doesn't care which exactly DH will handle the request.



  • 2.  Re: Tech Tip - CA Privileged Identity Manager: How to resubscribe a DH to a DMS in PIM 12.8+

    Posted Oct 20, 2016 03:46 AM

    Hi  Miquel,

    Can you please help me out how to implement CA Controlminder(PIM)12.9 activites just i was installed CA PIM12.9 on windows it means basic tasks for beginner level with screen oriented

    Regards,

    Navin