Enterprise Administration Guide › Using UNAB › How You Control Host Access and Configure UNAB › Resolve Migration Conflicts

Resolve Migration Conflicts

UNAB logs conflicts that are found during the migration process in the conflicts file. This file details the cause of the conflicts that prevented the migration of users and groups from the local host to Active Directory.

You export the conflicts file into a CSV file, download the spreadsheet to your computer, review, and resolve the conflicts. You can later upload the modified spreadsheet back into CA ControlMinder Enterprise Management, which sends it to the Message Queue. UNAB retrieves the file and restarts the migration process to migrate the users and groups that were not previously migrated.

Note: If you migrate a host group, you cannot download the conflicts file. However, you can upload a corrected conflicts file to resolve conflicts in the migration process.

Follow these steps:

1. In CA ControlMinder Enterprise Management, click Policy Management, UNIX Authentication Broker, Host, or Host Group.
2. Perform one of the following, as appropriate:
   • Click Resolve Host Migration Conflicts.

     The Resolve Host Migration Conflicts: Host Search screen appears.

   • Click Resolve Host Group Migration Conflicts.

     The Resolve Host Group Migration Conflicts: Host Group Search screen appears.

3. Type in the name of the host or host group you want to resolve conflicts for and click Search.

   A list of hosts or host groups that match the filter criteria appear.

4. Select the host or host group for which you want to resolve conflicts and click Select.

   The UNAB Migration: HostName or UNAB Migration: HostGroupName page appears.

5. (Optional) Download the conflicts file for a host migration and resolve the conflicts, as follows:
   1. Select the Export and Download link in the Download UNAB Migration Conflicts Details section.

      A dialog window opens.

   2. Navigate to the location to save the file and select Save.

      The CSV file downloads to the specified location.

   3. Open the CSV file, resolve the conflicts that are reported in the file, then save and close the file.
6. (Optional) Create and save a CSV file that resolves the conflicts for a host group migration.
7. Upload a CSV file that resolves the conflicts for a host or host group migration, as follows:
   1. Select the Browse button in the Upload UNAB Migration Solution section.

      A dialog window opens.

   2. Browse for the file and click Open.
   3. Click Upload.

      The file is uploaded.

8. Click Submit.

   CA ControlMinder Enterprise Management sends the file to the Message Queue. UNAB retrieves the file from the queue and restarts the migration process, attempting to migrate the resolved accounts and groups.

9. Review the conflicts file again after the migration ends to verify that the user accounts and groups that were previously reported in the file were successfully migrated.

Note: You cannot migrate a user or group if a user or group with the same name exists in Active Directory. For example, if you try to migrate a group named g1, but a user named g1 exists in Active Directory, UNAB cannot migrate the group.

Example: The UNAB Conflicts File Output

The following example is an extract of the UNAB conflicts file output that was created during the migration process:

*** Conflict Details as found by the CA Access Control UNAB Migration tool at 12/29/10 10:49 ***

***  CRITICAL Conflicts:                                                                                                                                                ***
***     The next found  conflicts prevent the user/group migration and need the intervention    ***
***     of the system administrator as they cannot be solved by the migration tool.                          ***

User 'John' conflicts: 
    User 'John' from domain 'development.computer.com' is assigned id '47670' and Unix id is '300821' 
    User 'John' from domain 'development.computer.com' is assigned primary group '47670' and Unix primary group is '1011' 
    User 'John' from domain 'development.computer.com' is assigned home directory '/home/aletestu' and Unix home directory is '/home/john1' 
    User 'John' from domain 'development.computer.com' is assigned shell '/sbin/nologin' and Unix shell is '/bin/bash' 

***  AUTOMATIC Conflicts:                                                                                                                                                 ***
***     Migration tool will try to solve the next found conflicts when run in "administrative mode", 
***
***      if not solved this conflicts will prevent the user/group migration                                                 
Group 'alegcheck' conflicts: 
    Cannot add members to Active Directory group 'dev_users' because UNIX group 'dev_users' contains member[s] that do not exist in domain 'development.computer.com'.
      UNIX group 'alegcheck' members: aleucheck1;aleucheck2 
User 'John1' conflicts: 
    User 'John1' from domain 'development.computer.com' has no UNIX attributes.

***  IGNORED Conflicts:                                                                                                                                                    ***
***     The next found Conflicts are shown for informational purpose,  they will be ignored for       
***      while migration the user/group                                                                                                                        ***

User 'John' conflicts: 
    User 'John' from domain 'development.computer.com' is assigned gecos '' and Unix gecos is 'gecos of John' 
    User 'John' primary group '1011' was not migrated 

In this example UNAB reported on the following critical conflicts:

• The user 'john' is missing the following attributes:
  • The user id (47670) conflicts with the UNIX user id (300821)
  • The user primary group (47670) conflicts with the Active Directory group (1011)
  • The user home UNIX directory (home/john1) conflicts with the Active Directory home directory settings (/home/john)
  • The user UNIX shell (/bin/bash) conflicts with the Active Directory shell attribute (/sbin/nologin)

UNAB reported on the following conflicts that UNAB will attempt to resolve the next time the migration process runs:

• The UNIX group (dev_users) does not exist in Active Directory
• UNIX attributes are not configured for user 'john1'

<una> reported on the following minor conflicts that it will ignore during the migration process:

• The user gecos ("") conflicts with the UNIX assigned gecos (gecos for john)
• The user primary group (1011) was not migrated

Example: The UNAB Conflicts Resolution File

The following example is an extract of the UNAB conflicts resolution CSV file you create to resolve the conflicts that UNAB reported in the conflicts file. You use CA ControlMinder Enterprise Management to submit the CSV file to the UNAB host:

In this example, the conflicts resolution CSV file contains the following:

• Solution Entity Type—USER
• Solution Entity Name—superuser
• Solution AD Mapping Name—root
• Conflicts—The user group that is not found in Active Directory
• UID—1
• Home Directory—/home/superuser/
• GID—1

Note: For more information about migrating users, see the Implementation Guide.

More information:

Migrate UNIX Users and Groups to Active Directory

The UNAB Conflicts File