Import or export of directory entries

Edit online

You can use the procedure defined here for import or export of directory entries.

Procedure

Exporting data from Security Verify Directory to z/OS® IBM® Security Directory Server:
Security Verify Directory includes certain suffixes, such as cn=configuration, cn=ibmPolicies, and cn=localhost, that contain special entries used to manage LDAP configuration, policies, and replication. z/OS IBM Security Verify Directory only supports some of these special entries.
1. You must remove the other special entries from the LDIF or use db2ldif–s <subtreeDN> -x to avoid unloading these suffixes. The cn=configuration suffix contains entries that are used to configure advanced replication support. When the server is first started, the following advanced replication configuration entries under the cn=configuration suffix are automatically created:
  - cn=configuration
  - cn=Replication,cn=configuration
  - cn=Log Management,cn=Configuration
  - cn=Replication,cn=Log Management,cn=Configuration
  See Enabling advanced replication under Advanced replication of the IBM Security Verify Directory Administration and Use for z/OS section of the IBM Security Verify Directory documentation for more information about the special entries in z/OS IBM Security Verify Directory.
2. User passwords must be in clear text, SHA, or CRYPT. Other forms are not compatible with z/OS IBM Security Verify Directory.If using CRYPT, make sure to specify pwCryptCompat off in the z/OS IBM Security Verify Directory's configuration file.
3. z/OS IBM Security Verify Directory does not support the use of filtered ACLs in aclEntry attribute values (ibm-filterAclEntry attribute).You must remove these before importing to z/OS IBM Security Verify Directory.
Exporting data from z/OS IBM Security Verify Directory to Security Directory Server:
1. For Security Verify Directory, aclEntry and entryOwner attribute values must begin with the following format: “access-id:|group:|role:”This is not required for z/OS IBM Security Verify Directory, therefore, it might need to be added to these attribute values before importing to Security Verify Directory. Always specify these on z/OS IBM Security Verify Directory to avoid this issue.
2. User passwords must be in clear text, SHA, or CRYPT. Other forms are not compatible with Security Verify Directory.If using CRYPT, make sure to specify pwCryptCompat off in the z/OS IBM Security Verify Directory's configuration file.Use ds2ldif –t to unload passwords in the tagged format used by Security Directory Server.