I need to copy several hundred access-roles objects from one domain to another one (running within the same MDM server). As there is no pre-built solution to copy objects between domains (as far as I know) I wanted to accomplish this via the management api.
In order to do this I was planning to perform the following steps:
> execute the "show access roles" command within a loop in order to obtain the uid of each access role object that exists
> take the uid of the previous command and parse it into the "show access-role uid <id>" command + obtain the object information via a jq parsing in the following style:
mgmt_cli show access-role uid $line --format json -s login.id > json_role_data.tmp
cat json_role_data.tmp | jq -r '[.uid, .name, .users.name] | @csv' >> access_role_objects.csv
This is also working fine (please note, that I only require the users.name fields, as we work with LDAP groups only, the machine or network information is not relevant for now. Now to the reason for this thread ... how can I import/create new access role objects with the information that I have already obtained?
The API documentation regarding the "add access role" command mentions the following requirements in order to write a new access-role object via users parameter:
Parameter name Value Description
|string||Active Directory name or UID or Identity Tag or Internal User Groups or LDAP groups or Guests.|
|string||Name or UID of an object selected from source.|
I honestly do not understand what this is meaning, as I am also unable to find any example.
Is the "source" the ldap path while the "selection" is equal to the actual group name? If yes it seems to be impossible to accomplish my task of copying the objects via the api as I am just able to read the group name but not the full ldap path (which is visible via the SmartConsole object manager).
Edit: Via "details-level" I am able to see more details (for example the LDAP DN) but still not the values "source" and "selection" which are required in order to create new objects.
Edit 2: I just found out that "users.source" is the LDAP server which is getting querried, e.g. ldap.my.dc while "users.selection" is the actual name of the ad group (or user) on the specific ldap server. Once you add the group to the access role object it is getting saved and display as "ad_group_<groupname>" where <groupename> is the actual group name/value of the "users.selection" parameter (aka the actual group name as defined per ldap). Thus I need to export the following things...
> access role object name
> user/group name
> dn information ("ldap path")
Afterwards I need to remove the "ad_group" part from the exported group name in order to receive the name that is getting querried [input for the add access role command]. Finally I also need to split the "DN" information in order to rebuild the LDAP server name which is also required for the creation of an access role. And in the end I need a way to bulk create the objects which have a different amount of ad groups attached to them (csv bulk import is not possible I guess, as the "csv header" length is kinda variable due to the just mentioned different amount of ad groups per access role object).
Is there any other way to accomplish this task without having to reformat every single exported value as the import expects different information? I would also be fine with different solutions that do not rely on the API but a different tool.
I am sure that I am missing something...
Thanks in advance for any hint!