Common questions on using smobjexport and XPSExport

[Vijay Masurkar]

Tuesday Tip by Vijay Masurkar, Principal Support Engineer, for 7-26-2011

This brief note assumes that you’ve some experience with installation and/or configuration of the Site Minder r6.x and R12 environments.

Q1: In regards to the use of smobjexport & smobjimport commands and when to use XPSExport & XPSImport commands, does it make any difference which command should be used for exporting policy store data?

A1: Yes, it does. When there’s XPS added to (pre-R12) legacy schema (or when there is pure XPS, as in R12, you need to use XPSExport. And, if the exported file has XPS, XPSImport is needed for import. Also, the following is recommended. For upgrade from version r5.5 to r6.x of the policy store data, use smobjexport/import. For upgrade from r6.x to R12.x, use XPSExport/Import after importing the data definitions in r6.x with the XDDinstall commands.


Q2: Is the use of XPSSweeper in the context of above commands ever required if only one policy store is in use (i.e. when multiple policy servers pointing to a single policy store)?

A2: Yes, certainly; but note that it is also useful for synching after the use of legacy and current tools within one store.


Q3: It appears that smobjexport tool exports the entire policy store (in smdif format) and XPSExport will do the same exact thing in XML format.

A3: Yes, but there is a difference. There is another configuration specific file created with smobjexport; but, with XPSExport, only one “.xml” file is created which may have dependency information based on the exported policy. That’s why one needs to be careful how to use that information for the target environment. So, when moving SiteMinder policies from one environment to another, either as part of an upgrade or a policy migration, some objects that are environment–specific are included in the export file. Examples of these objects include:

-- Trusted hosts
-- HCO Policy Server settings
-- Authentication scheme URLs
-- Password services redirects
-- Redirect responses


For more details, refer to the CA Site Minder R12 Policy Server Installation, Administration and Upgrade Guides. When you’re ready to plan an upgrade or migration of an environment, it is recommended that you refer to the Upgrade Guide first to get an overview, and, subsequently, refer to the Installation and Administration Guides for details on any specific topics.

[Robert Maiello]

If I could ask; So for an R12 policy server should one use solely XPSexport to backup the policy store? Or a combination of smobjexport and XPSexport ?

Thanks.

[Vijay Masurkar]

You should use XPSExport for R12.

Thanks.

[Mario Rodrigues]

We are trying to export objects from 1 env to the other (both are r12sp3). Is smobjexport good enough? Do I need to then export keys separately?
Thanks

[Gene Howard]

Good morning mario,

With moving objects between R12 environments, you should be using Xpsexport and Xpsexport. Smobjexport and Smobjmport are really there for legacy transitions from R6 environments.
You question on keys is a little confusing what are you trying to accomplish?

Usually when moving objects between environments it would be from DEV to UAT to PROD type of situation. Usually these three environments would have their own unique key stores for that environment.

If you are trying to do SSO between environments than use the two environments would either have to share a keystore or you would have to export the keys and import the keys to enable SSO.

Any time you are moving keys between environments I always do them separately so the information can be easily verified.

Hope this helps

Gene

[Mario Rodrigues]

Gene_Howard wrote:

Good morning mario,

With moving objects between R12 environments, you should be using Xpsexport and Xpsexport. Smobjexport and Smobjmport are really there for legacy transitions from R6 environments.
You question on keys is a little confusing what are you trying to accomplish?

Usually when moving objects between environments it would be from DEV to UAT to PROD type of situation. Usually these three environments would have their own unique key stores for that environment.

If you are trying to do SSO between environments than use the two environments would either have to share a keystore or you would have to export the keys and import the keys to enable SSO.

Any time you are moving keys between environments I always do them separately so the information can be easily verified.

Hope this helps

Gene

Thanks Gene,

How do I find the Obj. XID? That seems to be the most commonly used value for most of the export params

[Gene Howard]

Hi mario,

The best tool for finding Obj. XID would be XPSExplorer.

Please see the following sections of the Policy Server Admin Guide:
Policy Server Guides › Policy Server Administration Guide › Policy Server Tools› XPSExplorer
Policy Server Guides › Policy Server Administration Guide › Policy Server Tools › XPSExplorer › Export a Subset of Policy Store Data
Policy Server Guides › Policy Server Administration Guide › Policy Server Tools › XPSExplorer › XCart Management › Export a Subset of Policy Store Data Using XCart
Policy Server Guides › Policy Server Administration Guide › Policy Server Tools › XPSExplorer › XCart Management

hope this helps

Gene

[Mario Rodrigues]

Thanks Gene. You've been a great help!

Is there a set of clear instructions on how to do get the XID's from the xpsExplorer, run xpsexport with those id's and then do the xpsImport?

I know I can go through each of the params in the xpsExp util and figure it out but I was wondering if there's a more concise set of steps available.

All we're trying to do is move a set of domains and their assoc. security data from 1 env to another

[Gene Howard]

Good afternoon Mario,

Please take a look at:

https://comm.support.ca.com/?legacyid=TEC499657

The above Kb is the only information that I know of besides the information I provided from the user guides.

Hope this helps.

gene

[Mario Rodrigues]

Thanks Gene. That helped.

[Anon Anon]

I am not sure my previous post was published, so retrying...

I have a policystore data dump (XPSExport all with replace) from which I just need to import 1 authsheme and a domain. Can you please help with the following?

1) Can I use this exportAll.xml and mention hte XIDs I would like imported from them?

2) Should I create a separate XML wiht the objects I want (copy the contents of <object>...</object> and try to import? If I choose this option, do I need to precede my object tags with the following lines too?

<?xml version="1.0"?>
<!--Created by Liquid XML 2006 (www.liquid-technologies.com) for Computer Associates-->
<XPS xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xs="http://www.w3.org/2001/XMLSchema-instance" TransferKey="{AESKW}eBGrYSzk6RiG65Uisijm19PmEDtQsdDlq72tKfjaIveTg+uck0VOLZ/inhNz6cBG">

<XPSVersion>0</XPSVersion>

<PolicyData IsDumpExport="true">

Thanks for the help,
Appreciate it.

[SKhurana]

Hi masvi,

 

I beg to differ on what you have mentioned in your post.

You have mentioned that smobjexport exports all the objects from the policy store and XPSExport also does the same <Afaik>

I personally have worked on the development of XPSImport/XPSExport tools. The behaviour is not the same what you have mentioned in your post.

 

smobjexport exports all the objects from the policy store, thats true. It also creates a CFG file where the configuration of existing policy store is written, If you want your new policy store should be exactly the same as existing one, don't change that cfg file, but f you want to change policies under your new enviornment, you need to modify the cfg file and keep that file while importing it thru smobjimport.

Now you have mentioned that you should use XPSExport when you have XPS store in place.  <Slightly Wrong Here>

Lets take the example of R12 sp3 only.

I would say that if you don't have any objects in your XPS store i.e. you are not using any EPM or XPS Object in your enviornment, then you are not always required to use XPSExport. Even if you expot it through SmObjExpot, it should be fine.

 

One more thing

SmObjExport exports all the objects from the policy store, but in case of XPSExport, only the root objects are exported. what i mean by this is, the objects which are referred in some other objects only a link to those will be exported (Not the whole Object).

For e.g. If you are exporting an Agent through XPSExport, it will not export the AgentTypes and AgentTypeAttr, only a link or reference to these object will be mentioned in XML file.

But if you will export an Agent from smobjexport, it wil export all the objects including Agent / AgentTypes/AgentTypeAttr.

 

I hope it make some sence to you here.

 

Best

Sandeep Khurana

[Robert Maiello]

We're running Siteminder 12.52.    There is no SmObjExport   or smobjexport command to use anymore..   One must use XPSExport as far as I know.