As a part of Shared Services backup, we’ll discuss about taking the backup of Shared Services Provisioning information.
Hyperion Shared Services comes with a utility called CSSImportExport, which helps in taking the backup of all Provisioning information.
To use this utility unzip cssimportexport.zip located in %HYPERION_HOME%commonutilitiesCSSImportExportUtility
This will give you 3 bat files,
- CSSExport.bat
- CSSImport.bat
- CSSValidate.bat
A properties file is used to perform import and export options. A Sample importexport.properties file is given and is located in
%HYPERION_HOME%commonutilitiesCSSImportExportUtilitycssimportexportimportexportsamples
You need to modify importexport.properties to perform an export or import. I’ll try to explain the areas that are important to perform an export or import.
CSS file location
importexport.css=file:/hyperion/Hyperion/deployments/WebSphere6/SharedServices9/config/CSS.xml
This is the place where you’ll mention the CSS file location. This xml file has the information about external directories.
I’ll advice to use the ‘http’ option, because with the arrival of System 11 code line, this information is stored in hit registry and ‘getCSSConfigFile’ will be the most suitable option.
importexport.css=http://Server:<port>/interop/framework/getCSSConfigFile
Keep in mind to include ‘interop’ (sample importexport.properties file doesn’t have interop in it.)
Specify File format
export.fileformat=csv or xml
import.fileformat=csv
Specify file names
import.file=importonlineuser.csv
export.file=exportonlineusers.csv
Specify filters
export.user.filter=*
export.group.filter=GR_WA_FR*
The above given option will make sure that all the users and all the groups that start with GR_WA_FR are exported.
To export provisioning information
Use CSSExport.bat file.
This is under assumption that importexport.properties and CSSExport.bat are in the same location.
To Import Users
Use CSSImport.bat.
This is under assumption that importexport.properties and CSSExport.bat are in the same location.
Sample import file
#group,,,,
id,provider,name,description,
GR_HSS_Train,Native Directory,GR_HSS_Train,Online Users Training Group,
#group_children,,,,
id,group_id,group_provider,user_id,user_provider
GR_HSS_Train,,,37817,LDAP
GR_HSS_Train,,,32799,LDAP
#provisioning,,,,,,,
project_name,application_name,role_id,product_type,user_id,user_provider,group_id,group_provider
Analytic Servers:ceratechsoftess:1,Analytic Servers:ceratechsoftess:1,Server Access,ESB-9.3.1,,,GR_HSS_Train,Native Directory
Analytic Servers:ceratechsoftess:1,PXS,Read,ESBAPP-9.3.1,,,GR_HSS_Train,Native Directory
#provisioning,,,,,,,
project_name,application_name,role_id,product_type,user_id,user_provider,group_id,group_provider
Hyperion System 9 BI+,Hyperion System 9 BI+:ceratechsoftapp:6800::1,Explorer,HAVA-9.3.1,,,GR_HSS_Train,Native Directory
Here I’m creating a group called GR_HSS_Train and adding two LDAP users (37817, 32799) to that group.
I’m using the same file to Provision the group to have Essbase Server access, Read access to an Essbase application and Explorer access to Workspace.
Useful tips:
I always prefer csv than xml, because it is easier to edit 🙂
Try to keep the file to be imported (For importing user provisioning information) in the same folder where CSSImport.bat file resides.
Change import.maxerrors=0 to import.maxerrors=2000 to avoid any issues with error logging.
You can also use this tool to delete users, only modify import.operation=CREATE to import.operation=DELETE. Here your import file should contain the names of users/groups that need to be deleted.
Hope this helps you to take user provisioning backups. Next I’ll try to cover how to automate the creation of Users and provisioning using SQL and bat files.
Hi
I had do do this exersise for the first time today and found your article informative and yet simple
Thanks for posting
PD
Will you be updasting this for 11.1.2.4?
I created a utility to perform this, you can use LCM to do it else download the utility called "NUMSys" from here
Hi Thanks, so the import doesn't work as this was we used to import the users and groups that changed from our active directory account in batch mode.
do you see a why to do this in batch mode using lcm or your other tool?
If you look at 11.1.2.x code line there is no CSS* utilities. You can either use LCM or API to do it.
My tool uses the API and you've LCM
Thanks, thne I will need to see what your tool can d, can it run in batch?
How can I dowen load it, I on't see any links to download 🙁
It doesn't have a batch mode, I'm working on it. meanwhile try LCM utility, you can use that to automate
Have you figured out a way to delete users/groups en mass in PBCS?
Unfortunately no Gary. There is a mass import, however no delete. This goes to OID and I don’t think there is a command line interface to that one (or it is another undocumented feature)
That’s what I thought. I’m beating on Support to address this. Seems like there should be a way when exporting LCM to modify and import back in with a flag. For on-prem we had the importexport.properties file. If they had a flag in the Import.xml within the LCM zip it would seem that would do it.
Someone imported 500 groups to my pbcs instance and now we don’t need them. Right now the only way to remove them is one at a time in the GUI!!!!
Thanks
Welcome to the queue Gary. I’ve asked DEV team to give me an option in epmautomate where I can clear security and a command line util to load/delete users.
What I heard is we soon might get a (sort of) CSV type of file load for Security than the XML way.
More interesting issue is you cannot clear and load security. You’ll have to manually change the removed user to a none (or update in the xml file)
OK so I just stumbled on this
http://docs.oracle.com/cloud/latest/epm-common/EPMSS/lcm_import_options.htm#EPMSS-GUID-E26D7732-A17F-46AE-8BDB-AA8A47DFBB60
Have to test it out to see if it works by selecting ‘Delete’ import option.
I think that is going to work for groups only.