Import or export of directory entries

Edit online

You can use the procedure defined here for import or export of directory entries.

Procedure

  1. Exporting data from Verify Directory to z/OS® IBM® Security Directory Server:
    Verify Directory includes certain suffixes, such as cn=configuration, cn=ibmPolicies, and cn=localhost, that contain special entries used to manage LDAP configuration, policies, and replication. z/OS IBM Verify Directory only supports some of these special entries.
    1. You must remove the other special entries from the LDIF or use db2ldif–s <subtreeDN> -x to avoid unloading these suffixes. The cn=configuration suffix contains entries that are used to configure advanced replication support. When the server is first started, the following advanced replication configuration entries under the cn=configuration suffix are automatically created:
      • cn=configuration
      • cn=Replication,cn=configuration
      • cn=Log Management,cn=Configuration
      • cn=Replication,cn=Log Management,cn=Configuration
      See Enabling advanced replication under Advanced replication of the IBM Verify Directory Administration and Use for z/OS section of the IBM Verify Directory documentation for more information about the special entries in z/OS IBM Verify Directory.
    2. User passwords must be in clear text, SHA, or CRYPT. Other forms are not compatible with z/OS IBM Verify Directory.If using CRYPT, make sure to specify pwCryptCompat off in the z/OS IBM Verify Directory's configuration file.
    3. z/OS IBM Verify Directory does not support the use of filtered ACLs in aclEntry attribute values (ibm-filterAclEntry attribute).You must remove these before importing to z/OS IBM Verify Directory.
  2. Exporting data from z/OS IBM Verify Directory to Security Directory Server:
    1. For Verify Directory, aclEntry and entryOwner attribute values must begin with the following format: “access-id:|group:|role:”This is not required for z/OS IBM Verify Directory, therefore, it might need to be added to these attribute values before importing to Verify Directory. Always specify these on z/OS IBM Verify Directory to avoid this issue.
    2. User passwords must be in clear text, SHA, or CRYPT. Other forms are not compatible with Verify Directory.If using CRYPT, make sure to specify pwCryptCompat off in the z/OS IBM Verify Directory's configuration file.Use ds2ldif –t to unload passwords in the tagged format used by Security Directory Server.