Dumping and Loading Security Definitions (lsdump, lsload, lsinteg)

Creating a dump file of security profiles

You can dump specific profiles or all profiles. The command syntax is:

lsdump -f filename PROFILE profileID

where filename is the name of the XML output file

and where profileID is the name of the profile

If you want the dump to go to standard output, omit "-f" and the file name. If you want to dump all profiles, omit the profile ID.

Creating a dump file of security class data

You can dump specific security classes within a profile or all classes within a specific profile.

To dump a specific security class, the command syntax is:

lsdump -f filename SECCLASS profileID [security_class_names]

where filename is the name of the XML output file

and where profileID is the name of the profile

and where, optionally, security_class_names separated by commas, lists the names of classes you want to dump.

If you want to dump all classes, omit security class names. If you want the dump to go to standard output, omit -f and the file name.

Creating a dump file of a role

You can dump only one role file at a time, but you can specify the security classes that are assigned to the role that you want to dump.

The command syntax is:

lsdump [-f filename] ROLE rolename [-p profileid] [-s secclassname1,secclassname2,...]

where filename is the name of the XML output file

and where profileID is the name of the profile

and where, optionally, secclassname1, secclassname2,... separated by commas, lists the names of classes you want to dump.

If you want the dump to go to standard output, omit -f and the file name. If you want to dump all security classes assigned to a role, omit -s and the security class names.

Run lsinteg to validate the integrity of dump files

Any securable objects that do not have rules assigned to them will not be loaded into LDAP through the lsload command.

The lsinteg utility validates the dump files you create using lsdump. The lsinteg utility identifies securable objects that have not been assigned a rule.

The lsinteg command has the following syntax:

lsinteg -f DumpFilename

If lsinteg encounters an object that does not have a rule, it prompts you to:

• Create a rule by selecting "All access" or "no access" to each object that has no rule.

• Assign a name to the new dump file that will be created.

• Skip and continue with the analysis.

  You might choose the Skip option if, for example, you were planning to fix the problems manually using the Security Administrator or, if the error is not a problem at your site (because, for example, a securable object is not used and does not need to have rules).

  Skipped objects will not be added to the new dump file created by lsinteg.

  If this is what you want (because you do not use the object at your site), then you do not need to take additional action.

  If you need to take additional action on a skipped object (for example, because you want to assign a rule other than NO ACCESS or ALL ACCESS), you can do so using the security administration tool.

  Note: If you have expertise with XML and are knowledgeable about the structure of security data, you could edit the output file directly rather than use through the security administrator tool.

• If you received error messages that you intend to correct, it is good practice to run lsdump/ lsinteg again before running lsload.

When the lsinteg command completes, it creates a new dump file that contains any updates you made when you responded to error messages from the command. (If there were no error messages, your new dump file will be the same as the original.)

When you have run lsinteg with no errors, you are ready to import the dump file using lsload.

Loading security profile data from an XML file to the Resource Management repository in LDAP

Use the following command to load a file of security profile data. You might do this, for example, if you want a security profile that has been created on a test environment to be available on a production environment.

The command syntax is:

lsload PROFILE filename [-p newProfileId]

where filename is the name of the name of the dump file created with the lsdump command

and where newProfileId is the name of the profile that you are creating from the dump file. If you want to keep the existing profile name, you can omit newProfileId.

Loading security class data from an XML file to the Resource Management repository in LDAP

To load security class data from a dump file, the command syntax is:

lsload SECCLASS filename [-p newProfileID] [-s newSecClass]

where filename is the name of the name of the dump file created with the lsdump command

and where newProfileID is the name of the profile that you are creating from the dump file

and where newSecClass is the new name of the security class. If the dump file contains more than one security class, you will be prompted to provide new names for the other files.

Loading role data from a dump file to the Resource Management repository in LDAP

This section describes how to load role data from a dump file to a new location. The command syntax is:

lsload ROLE filename [-r NewRoleName] [-p NewProfileID]

where filename is the name of the name of the dump file created with the lsdump command

and where, optionally, NewRoleName is the new name for the role you are loading

and where, optionally, NewProfileID is the new name of the profile that you are loading.