Security Migration from Access Manager to Active directory

[tushar.patil49]

Hi,

We currently use Access Manager to maintain our security and we would like to change the namespace to use an Active Directory security model.  Is there an easy way to migrate the users and security from one namespace to another?  We are currently using Cognos 8 with an Access Manager namespace/security model and will be moving to Cognos 10.2 using Active Directory security model.

I have gonethorough the document

Handling Change to Cognos 8 Security

http://www.ibm.com/developerworks/data/library/cognos/page402.html

This has not helped me for a solution.

How do I migrate the users to the new security model?

[MMcBride]

Companies like Brightstar Partners and Motio offer services for this type of activity.

However if you cannot afford to bring in a third party to help you there are a few things you can do on your own.

There are some fairly large "negatives" to doing this yourself - such as users losing their schedules...

But at a very high level here are the steps:

1 - Work with your Active Directory group to recreate the Access Manager groups you have today
2 - Create a new Namespace within Cognos that is plugged into AD (I recommend doing this on Development or something as users will be prompted to select the Namespace)
3 - Go into Cognos Security and create groups that you will map to your AD groups.
4 - Once your Cognos AD groups are created and mapped to the AD groups (AD groups members of the COgnos AD groups...)
5 - Go through your environment invluding Capabilities and map the new Cognos AD groups to match your old Access Manager Groups.

Once this is done you now should have Mirror image security for your Access Manager and AD Namespaces.
You can test this by having users log into Cognos using their AD user id and passwords

Then turn off the AM Namespace forcing everyone to use the AD security.

I am not detailing each individual task as these can vary greatly - but this is an overall grand plan.
As I stated users with Scheduled will have to Take Ownership of their old schedules with their new ID's
Additionally you will need to Manually Migrate their "My FOlders" Content - this can be accomplished by having an Administrator logging into both Namespaces at the same time - then browsing one namespace in the security tab - searching for the user in question - then selecting "More" and then "Copy this users profile" - then browse the new namespace search for the user - and select to copy everything over.

The only downside again is the inability to change schedules ownership from one user to another.

I understand this is very high level, but I hope it gives you an idea on the tasks necessary
Let me know if you have questions on the details
though I can tell you up front I cannot help you map your AD namespace - that is going to depend on how your AD is set up.

I migrated over 1000 users from Access Manager to 5 different AD domains this way and have spent the last year migrating them from the 5 different domains to a single Domain as we consolodate our AD environment down to a single Master Domain.

It's not perfect but it is cheap and easily managed.