Moving policy objects configuration to other environments

[saboobaker]

Currently, we use the following process to move policy objects:

1. Create an object xml file using the cart from xpress series.

2. Create the export file using xpress export using the cart file.

3. Make some manual modifications to some of the properties of the resulting xml file.

4. Import the objects file using xpress import.

 

Is there a way to automate step 1? Not sure if there is a scripting language support to search objects by name and get the ID for the object to script the cart functionality.

 

Thank you for your help.

[Sandra Green]

Hi Sohail,

 

There is a Perl CLI that can be used to manage Policy Server objects.  It is included with the Policy Server.  Please see the Perl documentation at Programming in Perl - CA Single Sign-On - 12.52 SP1 - CA Technologies Documentation

 

Also, there are the Java and C++ Policy Management APIs that can also manage policy server objects.  See the SiteMinder Programming References and Guides. The SDK is a separate install from the Policy Server.

 

There are samples of all of these included with either the Policy Server or SDK.

[saboobaker]

Thank you for your reply.

Is this the correct API.

Netegrity::PolicyMgtAgentConfig->Name([Name])

 

to search the object by name?

[Ujwol]

Not really.

 

Depending on what object you want to search you will need to use combination of one or more APIs.

The most import API is CLI Session API :

• GetAdmin Method Retrieves Administrator
• GetAffDomain Method Retrieves Affiliate Domain
• GetAgent Method Retrieves Agent
• GetAgentConfig Method Retrieves Agent Configuration Object
• GetAgentGroup Method Retrieves Agent Group
• GetAgentType Method Retrieves Agent Type
• GetAllAdmins Method Retrieves List of All Administrators
• GetAllAffDomains Method Retrieves List of All Affiliate Domains
• GetAllAgentConfigs Method Retrieves List of All Agent Configuration Objects
• GetAllAgentGroups Method Retrieves List of All Agent Group Objects
• GetAllAgents Method Retrieves List of All Agents
• GetAllAuthAzMaps Method Retrieves List of All AuthAz Maps
• GetAllAuthSchemes Method Retrieves List of Authentication Schemes
• GetAllCertMaps Method Retrieves List of Certificate Mapping Objects
• GetAllDomains Method Retrieves List of All Domains
• GetAllGlobalPolicies Method Retrieves List of Global Policy Objects
• GetAllGlobalResponses Method Retrieves List of All Global Response Objects
• GetAllGlobalRules Method Retrieves List of All Global Rule Objects
• GetAllHostConfigs Method Retrieves List of All Host Configuration Objects
• GetAllODBCQuerySchemes Method Retrieves List of All ODBC Query Schemes
• GetAllPwdPolicies Method Retrieves List of All Password Policies
• GetAllRegSchemes Method Retrieves List of All Registration Schemes
• GetAllSAMLAffiliations Method Retrieves List of All SAML 2.0 Affiliations
• GetAllSAMLSchemeAttributes Method Retrieves List of All Requester Attributes
• GetAllTrustedHosts Method Retrieves List of All Trusted Host Objects
• GetAllUserDirs Method Retrieves List of All User Directories
• GetAllVariableTypes Method Retrieves List of All Variable Type Objects
• GetAuthScheme Method Retrieves Authentication Scheme Object
• GetCertMap Method Retrieves Certificate Mapping Object
• GetDomain Method Retrieves Domain Object
• GetGlobalPolicy Method Retrieves Global Policy Object
• GetGlobalResponse Method Retrieves Global Response Object
• GetGlobalRule Method Retrieves Global Rule Object
• GetHostConfig Method Retrieves Host Configuration Object
• GetODBCQueryScheme Method Retrieves ODBC Query Scheme Object
• GetPwdPolicy Method Retrieves Password Policy Object
• GetRegScheme Method Retrieves Registration Scheme Object
• GetSAMLAffiliation Method Retrieves SAML 2.0 Affiliation Object
• GetSAMLAffiliationById Method Retrieves SAML 2.0 Affiliation Object by ID
• GetSharedSecretPolicy Method Retrieves Shared Secret Policy Object
• GetTrustedHost Method Retrieves Trusted Host Object
• GetUserDir Method Retrieves User Directory Object
• GetVariableType Method Retrieves Variable Type Object

 

Then , if you want to drill down to further down, you will need to use the corresponding API.

For re.g once you retrieve Domain object using Session-->GetDomain(<domainname>) API, you will use the Domain object to further retrieve any other object of your interest as below :

 

To get objects related to domain using domain API :

 

• GetAllPolicies Method Retrieves All Policies Associated with the Domain
• GetAllRealms Method Retrieves All Top-level Realms in the Domain
• GetAllResponseGroups Method Retrieves All the Response Groups Associated with the Domain
• GetAllResponses Method Retrieves All Responses Associated with the Domain
• GetAllRuleGroups Method Retrieves All Rule Groups Associated with the Domain
• GetPolicy Method Retrieves a Policy in the Domain
• GetRealm Method Retrieves a Top-level Realm in the Domain
• GetResponse Method Retrieves a Response Associated with the Domain
• GetResponseGroup Method Retrieves the Specified Response Group
• GetRuleGroup Method Retrieves the Specified Rule Group
• GetUserDirSearchOrder Method Retrieves User Directory Objects Associated with the Domain
• GlobalPoliciesApply Method Determines whether the Domain Is Enabled for Global Policies

Sample script :

#Initialize the Policy Management API use Netegrity::PolicyMgtAPI;   $policyapi = Netegrity::PolicyMgtAPI->New();   print "Step 1. Log in the admin and create an API session.\n"; $session = $policyapi->CreateSession("adminid", "adminpwd");   print "Step 2. Select the domain for the new realm.\n"; $domain=$session->GetDomain("engineering");   #Get the realm's agent and authorization scheme info.\n"; $agent=$session->GetAgent("agent1"); $authscheme=$session->GetAuthScheme("Basic"); print "Step 3. Create and configure the realm.\n"; $realm=$domain->CreateRealm("documentation",                             $agent,                             $authscheme,                             "Source files for manuals",                             "/mysite/docs/*" );   print "Step 4. Confirm the creation of the realm.\n"; if ($realm == undef) {          print "Realm creation failed.\n";    }    else {          print "Realm creation succeeded.\n"; }

 

Hope this helps.

 

Regards,

Ujwol Shrestha

[saboobaker]

Now, that we know that we can find objects and their properties using the name, is following a viable approach to move policy objects in an automated fashion?

a. Create a list of object names that are required to be exported.

b. Pass the list to a program which uses the API to get the object Ids.

c. Use the xpress export to create the export file.

Is it worth creating a script to move these objects through environments?

[Ujwol]

Yup, the logic looks perfectly fine to me.

A small correction, it is "XPSExport"not "Xpress Export"