Migrating users and groups
Begin by migrating users and groups from the Windows NT® domains in which they were created to new Active Directory domains.
To migrate Rational® ClearCase® users
and groups:
- Use the procedures defined by Microsoft to migrate users and groups
from the Windows NT domains to the Active Directory domains. Include the Rational ClearCase users
group and, if they exist, the Rational ClearCase administrators
group and clearcase_albd account in the migration.
- Ensure uninterrupted VOB access. In
many migration scenarios, there is a period when users logged on to the Active
Directory domain access the same VOBs as users logged on to a Windows
NT domain. To ensure access to VOBs by users in either type of domain,
do one of the following:
- Add the domain-qualified name of the Rational ClearCase users
group that has been migrated to the Active Directory domain to the VOB’s supplemental
group list. For example, you can use the cleartool protectvob command
as shown here to add the clearusers group in the Active Directory domain
AD-DOMAIN to the group list of the VOB with storage on the VOB server host
at C:\vobstg\srcs.vbs:
cleartool protectvob –add_group AD-DOMAIN\clearusers C:\vobstg\srcs.vbs
- Ask users who are logged on to an Active Directory domain to set their
CLEARCASE_PRIMARY_GROUP environment variable to the string representation
of the SID of the Rational ClearCase users
group in the Windows NT domain. To find the SID string, run
the creds command on a computer that is a member of the Windows
NT domain or a domain that trusts the Windows NT domain. For example:
ccase-home-dir\etc\utils\creds –g NT-DOMAIN\clearusers. . .
ClearCase group info:
Name: NT-DOMAIN\clearusers
GID: 0x100423 SID credentials S-1-5-21-103034363-981818062-1465874335-1064
In
this case, the user must set CLEARCASE_PRIMARY_GROUP to the value S-1-5-21-103034363-981818062-1465874335-1064
- Adjust CLEARCASE_GROUPS environment variables as needed. Because migrated accounts include SID history, user accounts in the
Active Directory domain include twice as many group memberships as they had
in the Windows NT domain. (Each user’s group list includes
groups from both domains.) Users who are members of multiple groups in a Windows
NT domain and find that their group list includes more than 32 groups
after migration should set the CLEARCASE_GROUPS environment variable to include
the SID string that represents the Rational ClearCase users
group in the Windows NT domain, and the name of
the Rational ClearCase users
group in the Active Directory domain. For example:
CLEARCASE_GROUPS=AD-DOMAIN\clearusers;S-1-5-21-103034363-981818062-1465874335-1064
Step 2 explains
how to use creds to obtain the SID string. For more information
about the CLEARCASE_GROUPS environment variable, see Limitations when a user belongs to more than 32 groups.