Migrating Lost Identities from AD to MIM

Setting up a new identity system from scratch is so easy.. but we know that kinda never happens… we are always migrating from an old system to new or changing an existing system due to business changes.

We went through the same process whereby we went from an OpenLDAP (ODSEE) being our primary source to FIM/MIM pushing out to AD. We were syncing identities manually from ODSEE to AD via Perl scripts in the old days..

So after the original migration done we have a lot of identities in AD not joined to MIM i.e. Disconnectors as we know them. This was because as per our policy we always added / modified from ODSEE -> AD but never a delete. Thus it left a lot of users and groups in AD which never came across in the initial migration.

So once the migration was complete, the big mammoth task came to migrate the unknowns from AD -> MIM and then join the identities in AD.

Using few wonderful tools suite called Lithnet written by @RyanLNewington

NOTE: Always remember, my script are as-is and have lots of rules and logics specific to my environment and business needs. Its there to give a basic understanding on what can be done. You will obviously have to modify it for your environment and needs.

REQUIREMENTS

  • Migrate AD Disconnectors to MIM Service
  • Join them to AD
  • Make sure no existing values are overwritten in AD like sAMAccountName, DN, DisplayName etc
  • Make sure membership (member) is not lost. memberOf is not cared for atm as that will take care of itself (Point 4 below).
  • Sync Engine SHOULD NOT be provisioning. Stop the syncs (not service itself)

LOGIC

I wrote two different scripts – one to migrate users and one to migrate groups. There are some things to note here

  1. We have our own business rules engine called ACMA to which we provision all our identities which then generates all the required attribute values according to our business rules. So you will see each object being written to both FIMService and ACMA DB (SQL). Do have a look at it.. Its powerful yet so simple… Must have…
  2.  We have a unique ID which is pushed to all system called monashObjectID which is basically a random guid which is generated in ACMA DB. We use this to have a constant ID between all system and thus later helpful to join ID etc.
  3. Due to the above point, my script assumes that all objects in AD , if they have monashObjectID means they are connected to FIM/MIM. Thus, on reverse, if they don’t have it means they have to be migrated.
  4. Simplification of OUs: Due to our previous messy environment we have over 100-200 OU’s in AD where all these objects exist. In the new age, we have simplified it and MIM only manages 8-10 OU’s. Therefore according to the “Type” of the object being migrated they are moved to the respective new OU in AD prior to migration (you need rights to do so in AD if you migration account doesn’t so already). Again you can comment out the whole function if its not required.
  5. Groups gets tricky. As they can be member of another group and if they group doesn’t already exist in MIM, it will loose membership once imported, I decided to get around it by scripting a check that if the group has members and if all of those members have monashObjectID then dump them in a CSV file. Thus this migration is run multiple times.
    1. Create 1st batch of CSV for those groups who don’t have members or which all members exist in MIM (by checking their monashObjectID as that comes from MIM)
    2. Migrate them
    3. Export to AD – this will write out monashObjectID for the newly migrated groups
    4. Repeat step a-c till all are done.

USER MIGRATION SCRIPT

Will start will user migrations as they can be members of a group. Again remember, loads of logic for our environment.

CSV Requirements

The CSV requires the following fields

  • Name: sAMAccountName of the user to be migrated
  • Type: We have accounttypes in our environment like person / service / custom etc. Need to mention that (or modify code to remove it)
  • OrgUnit: We need to mention an OrgUnit DisplayName for each user to which it belongs to (our environment specific again)
  • Owners: This is to mention the owner / supervisor of the user. They are sAMAccountName of already existing users in MIM. They can be multiple with ; separating them.
Script

Rundown
  • Script records everything via transcript command so you can set and forget, come back later and see what broke or potentially could break (loss of membership my main concern). Saves it to D:\ADUserMigration-{CSVFileName}.log
  • Asks for CSV file on run.
  • If the  “Type” is missing in CSV it will skip that user (MUST in our logic)
  • Moves the account to respective OU in AD as per the account type.
  • Checks if the user doesn’t have monashObjectID – thus good to migrate.
  • Creates the object in FIMService using LithnetRMA
    • Depending on the type either we set expiry date to never (9999-12-31) or two years from date of migration
    • Checks the owner if its a person or a group and then looks it up if it exits in MIM and adds it as owner.
    • If no owner then we set a default account we have as owner
    • Checks OrgUnit and if found it adds it to the object else sets a default OrgUnit.
  • Checks if the memberOf exists in MIM and adds the user to those groups in MIM.
  • Creates the object in ACMA
  • Repeats the steps above for all users in the CSV
  • Sync the identities in MIM via MIIS Powershell
    • Disables MRE Provisioning
    • DI the FIMService
    • DS / Commit just the ones which were migrated into MV (as its prod others could come in from Portal which needs MRE rules and thus excluding them)
    • DI ACMA MA
    • DS / Commit just the ones which were migrated into MV – this should join them due to our join rules looking for same fimserviceobjectID which was written to ACMA DB during create
    • DI AD MA – all moved objects will now show in correct OU in CS
    • DS / Commit just the ones which were migrated into MV – this will join due to our join rules looking for same sAMAccountName.
    • Enable provisioning
    • DS all of them again to make sure MRE rules apply to those objects for any provisioning if required.

Done..

Speed

Can’t remember to be honest but was quite quick (had nearly none to do for accounts)

GROUP MIGRATION SCRIPT

Remember, loads of logic for our environment.

CSV Requirements

The CSV requires the following fields

  • Name: sAMAccountName of the group to be migrated
  • Type: We have account types in our environment like UserGroup / ServiceManagedGroup / IdMAuthZGroup etc. Need to mention that (or modify code to remove it)
  • ServiceID: For our environment – mandatory.
  • Owners: This is to mention the owner / supervisor of the user. They are sAMAccountName of already existing users in MIM. They can be multiple with ; separating them.
  • OrgUnit: We need to mention an OrgUnit DisplayName for each user to which it belongs to (our environment specific again.

Script

Rundown
  • Script records everything via transcript command so you can set and forget, come back later and see what broke or potentially could break (loss of membership my main concern). Saves it to D:\ADGroupMigration-{CSVFileName}.log
  • Asks for CSV file on run.
  • If the  “serviceID” is missing in CSV for a ServiceManagedGroup it will skip that user (MUST in our logic)
  • Moves the group to respective OU in AD as per the account type.
  • Checks if the group doesn’t have monashObjectID – thus good to migrate.
  • Creates the object in FIMService using LithnetRMA
    • Depending on the type either we set expiry date to never (9999-12-31) or two years from date of migration
    • Sets all as Security and Global groups.
    • Checks the owner if its a person or a group and then looks it up if it exits in MIM and adds it as owner.
    • If no owner then we set a default account we have as owner
    • Checks OrgUnit and if found it adds it to the object else sets a default OrgUnit.
    • Checks each member of the group and if they exist then adds them – else will spit out a warning that they will loose membership in AD (good to have logs eh?)
  • Checks if the memberOf exists in MIM and adds the user to those groups in MIM.
  • Creates the object in ACMA
  • Repeats the steps above for all users in the CSV
  • Sync the identities in MIM via MIIS Powershell
    • Disables MRE Provisioning
    • DI the FIMService
    • DS / Commit just the ones which were migrated into MV (as its prod others could come in from Portal which needs MRE rules and thus excluding them)
    • DI ACMA MA
    • DS / Commit just the ones which were migrated into MV – this should join them due to our join rules looking for same fimserviceobjectID which was written to ACMA DB during create
    • DI AD MA – all moved objects will now show in correct OU in CS
    • DS / Commit just the ones which were migrated into MV – this will join due to our join rules looking for same sAMAccountName.
    • Enable provisioning
    • DS all of them again to make sure MRE rules apply to those objects for any provisioning if required.

Done..

Speed

This has varied for me. It really depends on number of members for the group.. about 3-5 groups / min .. I did about 1500 groups with 90% of them having 0-10 members but the last few having upto 1100 members in 6.5 hrs.

 

Hopefully this will help someone and see what can be done by  combination of various tools out there.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.