Migrating Sun Java Directory Server to HP-UX Directory Server White Paper

ManualsBrandsHP ManualsSoftwareHP-UX Directory Server

Migrating Sun Java System Directory

Server to HP-UX Directory Server

Technical White Paper

Table of contents

Introduction ......................................................................................................................................... 2

Summary......................................................................................................................................... 2

Introducing the HP-UX Directory Server ............................................................................................... 2

Comparing HPDS and SJDS .............................................................................................................. 3

Terms and Conventions Used in this White Paper ................................................................................ 5

Migration Overview ............................................................................................................................. 6

Migration Process for a Single SJDS Instance ....................................................................................... 6

Migration Process for Multiple SJDS Instances ...................................................................................... 6

Planning the Migration ......................................................................................................................... 6

System Resources ............................................................................................................................. 6

Encryption Usage ............................................................................................................................. 8

Replication Considerations .................................................................................................................... 9

Migrating Replicated Instances .......................................................................................................... 9

Replication Interoperability ................................................................................................................ 9

Installing HPDS and Creating an Instance ............................................................................................. 10

Installing the Product Package ......................................................................................................... 10

Instance Creation ........................................................................................................................... 10

Certificate Migration .......................................................................................................................... 11

Configuring the Instance ..................................................................................................................... 12

Suffixes and Database Back Ends .................................................................................................... 13

Schema ........................................................................................................................................ 14

Configuration Migration ..................................................................................................................... 15

Replication Configuration ................................................................................................................... 15

Data Migration .................................................................................................................................. 17

Validation ......................................................................................................................................... 19

Appendix A: Migration Checklist ......................................................................................................... 20

Appendix B: sjdsmig.pl Script ........................................................................................................ 21

Script Options ............................................................................................................................... 21

Script Dependencies ....................................................................................................................... 21

Data Migration Mode ..................................................................................................................... 22

Configuration Migration Mode ........................................................................................................ 25

For More Information ......................................................................................................................... 28

Call to Action .................................................................................................................................... 28

Summary of content (28 pages)

PAGE 1
Migrating Sun Java System Directory Server to HP-UX Directory Server Technical White Paper Table of contents Introduction ......................................................................................................................................... 2 Summary......................................................................................................................................... 2 Introducing the HP-UX Directory Server ................................................................
PAGE 2
Introduction Summary Current industry events have caused some organizations to re-evaluate their data center strategies. Today, directory servers are commonly incorporated in enterprise data centers. The recent merger of Sun and Oracle makes unclear what directory server they are offering as their go-to product, given the availability of the traditional Sun Java Directory Server (SJDS) along with the newer OpenDS and competing Oracle Internet Directory (OID) products.
PAGE 3
Figure 1: Evolution of the HP-UX Directory Server Comparing HPDS and SJDS Because of HP-UX Directory Server’s common heritage with Sun Java Directory Server, most of the major features of the servers are the same or very similar. For example, both directory servers support multi-master replication. Experienced SJDS users will be familiar with the features of HPDS, including the methods and utilities used for managing the server. Table 1 lists some of the main features shared by both products.
PAGE 4
Table 1: HPDS and SJDS feature comparison Feature Description and Notes Multi-master replication Allows for multiple writable directory servers for ultimate high-availability, including across wide area networks. HPDS and SJDS use the same protocol and similar configuration data. Note: The configuration interfaces differ. Attribute encryption Both products support encryption of specific attributes in the database. Management and types of encryption differ.
PAGE 5
Terms and Conventions Used in this White Paper Table 2: Terms and conventions Term Definition ACI Access Control Instruction, used to provide or restrict access to entries, attributes, or values in the directory tree. Attribute The label for an element of information that is stored in an LDAP entry. Class of Service (CoS) A method of inserting virtual attributes into a set of entries. Consumer replica A read-only replica instance that does not allow LDAP clients to perform updates.
PAGE 6
Term Definition slapd A conventional name for the directory server daemon. “ns-slapd” is the actual process name that will be used by a running slapd. SSL/TLS Protocols used for secure network communication. Suffix Top-level entry for a directory tree. For every suffix, at least one database serves data under that directory tree.
PAGE 7
calculating the disk space required for HPDS. In the following example, the disk space used by the SJDS instance directory is calculated as approximately 448 MB: # du -ks /export/instance1 448104 /export/instance1 Note: The file system paths for the database can be customized. If the default locations are not used, then you should query each path in addition to the instance directory.
PAGE 8
Encryption Usage A self-signed certificate is automatically configured for SJDS instances, but the certificates are not necessarily used. Configure certificates for HPDS if any of the following are true: LDAP clients are using SSL/TLS Determine whether clients are connecting using SSL/TLS, or using the Start TLS extended operation to upgrade connections to use TLS. The following example shows how to check for usage of SSL/TLS in the access logs: − # egrep -i "conn=.* op=.* msgid=.
PAGE 9
Replication Considerations One of the core features of HPDS is replication, the origin of which dates back to the heritage shared with SJDS. Today, the replication features provided by HPDS and SJDS continue to be very similar, but there are some differences, as noted in sections to follow. Migrating Replicated Instances The process for migrating a replicated instance is basically the same as that for migrating a nonreplicated instance.
PAGE 10
In addition, certain differences in the replication process implemented either in HPDS or SJDS, and other differences (such as in password policy management), might impact the ability to properly replicate between the two topologies. If both the SJDS and HPDS replication topologies need to stay active and synchronized, consider a Meta Directory product such as LDSU, which is offered by HP Services.
PAGE 11
LDAP. To enumerate and perform administrative tasks on the directory servers in the managed topology, each instance needs to be registered with the Configuration Directory Server. The Configuration Directory Server in a multi-instance environment can be dedicated to maintaining registration/configuration data (similar to how SJDS maintains its DSCC data), while other directory server instances (known as user directory servers) are dedicated to maintaining user data.
PAGE 12
SJDS instance on host1.example.com, then the subject DN of the server certificate would normally contain “CN=host1.example.com”. An LDAP client attempting to connect to host2.example.com might then refuse to complete the connection if the certificate’s subject DN still contains host1.example.com. In short, if the SJDS instance uses certificates that include the FQDN in the subject, and if the HPDS host name differs from the SJDS host name, then HP recommends generating new certificates for HPDS.
PAGE 13
Suffixes and Database Back Ends Suffix and Database Back End Creation A suffix and its associated database are automatically created when the HPDS instance is created. Create additional suffixes if more than one suffix will be migrated from SJDS to HPDS. The database backend created for the suffix selected during setup is automatically assigned the identifier userRoot. When creating additional suffixes, each must specify a different database backend identifier.
PAGE 14
Schema The schemas should be migrated before the data, or else schema violations could cause entries to be skipped during the import process. Both SJDS and HPDS provide bundled schema to support common directory server usage and schema used by directory server subsystems. Both support extension of schema by adding additional files with schema definitions and by adding schema to a designated, user-defined schema file. Numerous differences exist between schema bundled with SJDS and HPDS.
PAGE 15
Configuration Migration Part of the migration of general configuration settings is a manual process. The sjdsmig.pl script provides some automated migration, but some settings cannot automatically be migrated by the script because of the need for additional input. Creating the DSE Change File The sjdsmig.pl script can read a dse.ldif file from SJDS and output an LDIF file that contains change operations applicable to HPDS to activate some settings. After copying the SJDS instance’s dse.
PAGE 16
migrated from SJDS (as described in the “Data migration” section), or data that has been exported from another HPDS replica. Note: For synchronizing replicated HPDS instances, this white paper describes a method that involves importing the LDIF. This method is the easiest and most straightforward. There are two additional methods for initializing a replica.
PAGE 17
Table 3: Checklist for configuring replication Step Written notes  Determine the replica role: singlemaster, multi-master, hub, or consumer Role: Single-Master / Multi-Master / Hub / Consumer  For a Multi-Master, Hub, or Consumer type replica, create a supplier bind entry to allow other replicas to update data on this instance Supplier DN (incoming):  If the replica is to be configured as a Master or Hub (that is, it will transmit updates to another replica), configure a changelog Changelog ena
PAGE 18
Step 1: Exporting to LDIF Data from the Legacy SJDS Instance for each Suffix Exporting the SJDS suffixes by using the dsadm tool with the following syntax: # dsadm export --no-repl -f not-folded-output instance suffix targetfile For example: # dsadm export --no-repl -f not-folded-output /export/instance1 dc=example,dc=com /export/example.ldif The --no-repl option prevents replication state information from being exported.
PAGE 19
To convert the exported data for HPDS compatibility, run the sjdsmig.pl script with the appropriate input files and output file specified. For example: # sjdsmig.pl data -i example_export.ldif -s /tmp/searched.ldif -d dse.ldif -o example_converted.ldif For details on the conversions made by the sjdsmig.pl script, see “Appendix A: Migration checklist”. Step 4: Importing the Converted LDIF File into the HPDS Instance Use the ldif2db command to import LDIF to the HPDS instance.
PAGE 20
Appendix A: Migration Checklist Table 4 provides a checklist of the main steps to follow in order to migrate a directory server.
PAGE 21
Appendix B: sjdsmig.pl Script The sjdsmig.pl script automates certain migration tasks that would otherwise be time-consuming to perform by hand. It can run in one of two modes: either data migration or configuration migration. Once you have installed HP-UX Directory Server B.08.10.02 (or later), you can obtain a copy of the sjdsmig.pl script from /opt/dirsrv/contrib on your system. Script Options sjdsmig.pl data -i -s -d -o [-l ] [-p] [-v] sjdsmig.
PAGE 22
Data Migration Mode In data migration mode, the sjdsmig.pl script converts SJDS ACI and password policy information for compatibility with HPDS. ACI Conversion The conversions for ACIs are relatively simple. If an ACI grants or denies the rights import or export, the script removes those rights because they are only used with the MODDN operation, which is not supported with HPDS.
PAGE 23
SJDS setting HPDS setting Conversion “off. The migration script renames the setting name to its new HPDS name, and translates “true” and “1” to “on”, and “false” and “0” to “off”. pwdMinLength passwordMinLength The script renames the setting name to its new HPDS name. pwdFailureCountInterval passwordResetFailureCou nt The script renames the setting name to its new HPDS name. pwdLockout passwordLockout HPDS global password policy requires Booleans to be “on” or “off.
PAGE 24
SJDS setting HPDS setting Conversion if the pwdReset value was true; otherwise, it is skipped. pwdHistory (multi-value) passwordHistory (multi-value) The script renames the setting name to its new HPDS name. pwdFailureTime (multi-value) passwordRetryCount SJDS maintains a list of timestamps of failed authentication attempts. HPDS uses a single counter. The script renames the setting name to its new HPDS name, and sets the value to the number of failed authentication timestamps found.
PAGE 25
SJDS setting HPDS setting Conversion The script renames and sets the value to the result of adding the configured maximum age to the password change timestamp. If the timestamp in the SJDS pwdChangedTime cannot be parsed, the starting time of the migration is used instead. Additionally, HPDS uses the passwordExpirationTime attribute with a special value to indicate that a password has been reset by an administrator.
PAGE 26
Table 7: Configuration parameters included in migration Configuration area Attributes Notes Access log nsslapd-accesslog-logbuffering nsslapd-accesslog-logexpirationtime The nsslapd-accesslog-permissions parameter is renamed to nsslapd-accesslogmode.
PAGE 27
Configuration area Attributes Notes Misc nsslapd-certmap-basedn All migrated as is.
PAGE 28
For More Information For the latest information about HP-UX Directory Server, including current release notes, complete product documentation, technical notes, and white papers, as well as other HP Internet and Security products, see the following website: http://www.hp.com/go/hpux-security-docs Call to Action HP welcomes your input. Please give us comments about this white paper, or suggestions for related documentation, through our technical documentation feedback website: http://www.hp.