Symantec IGA

  • 1.  Using dxsearch, perl, and base64 to view the CA Identity Suite dynamic connector xml

    Posted Jul 20, 2018 07:56 PM

    Team,

     

    Instead of using the tools of IM Config Xpress, imagine using this process to version control your CX source code from current production environment.

     

    Background:   When CX UI is used to push/store its configuration to the IM Provisioning Server, this XML information is stored on the Endpoint Type for this connector as an ldap attribute labeled eTMetaData.   Due to the size and UTF-8 characters, this data when exported, is shown as base64 encoded, e.g.  double colon (after the ldap attribute).

     

    To view this data, we can use the Linux/Unix command line tool of base64 with the -d switch to decode.

     

     

    Example below for namespace "Zendesk".    See the base64 data in eTMetaData.

     

     

     

    To view this data, combine a ldapseach/dxsearch query, use perl to force a no-wrap of the ldif export; then use awk/grep to streamline the data for using base64 to decode the data.

     

     

     

    Example:

     

    dxsearch -LLL -h `hostname` -p 20396 -c -x -D "eTDSAContainerName=DSAs,eTNamespaceName=CommonObjects,dc=etadb" -w "Password01" -b "eTNamespaceName=Zendesk - WSL7,dc=im,dc=etadb" eTMetaData | perl -p00e 's/\r?\n //g' | awk '{print $2}' | grep -v "eTNamespaceName=Zendesk" | grep -v "eTDYNPolicyContainerName=DYN" | grep -v "eTDYNPolicyName=DefaultPolicy,eTDYNPolicyContainerName=DYN" | base64 -d

     

     

    Output:

     

    The above file may be re-directed to a new output file with a time-date-stamp.

     

     

     

    Hint:

    When using the above command, run it first in parts, to identify which strings to grep/remove prior to using base64 decode.



  • 2.  Re: Using dxsearch, perl, and base64 to view the CA Identity Suite dynamic connector xml

    Broadcom Employee
    Posted Jul 22, 2018 01:22 AM

    Alan_Baugher, Did you try using Softerra LDAP Administrator to extract the data? It seems to handle base64 quite well.

    Of course, this tool will not always be available.



  • 3.  Re: Using dxsearch, perl, and base64 to view the CA Identity Suite dynamic connector xml

    Posted Jul 23, 2018 07:29 PM

    Hi Gil,

     

    I believe that is another workable process.   

     

    I have noticed that dxsearch/ldapsearch or dxdump will return UTF-8 characters as base64 objects, but SoftTerra LDAPbrowser/administrator appears to extract and leave the data as-is, and viewable after export (non-base64).

    -  Appears to be the interpretation of SAFE CHAR of RFC2849 

     

     

    http://www.ldapadministrator.com/resources/english/help/la20152/ch11s04.html

     

    Testing with the CLI tool:

     

    C:\Program Files\Softerra\LDAP Browser 4> laimex /d LDIF /f d:\main-impd.ldif /s 192.168.242.146:30394  /mech SIMPLE /r "dc=IDENTITY_MANAGER,dc=etadb"  /p SUB  /cf "dc=IDENTITY_MANAGER,dc=etadb" /ct "dc=im,dc=etadb"