Linking Identities in Bulk

If you manage both the identity provider and service provider, you can link accounts in bulk by using the ssoadm bulk federation commands.

Before you can run the bulk federation commands, first establish the relationship between accounts, set up the providers as described in Configuring IDPs, SPs, and CoTs, and install the ssoadm tool. See Setting Up Administration Tools.

To understand the relationships between accounts, consider an example where the identity provider is at www.idp.com and the service provider is at www.sp.com. A demo user account has the Universal ID id=demo,ou=user,dc=idp,dc=com on the identity provider. That maps to the Universal ID id=demo,ou=user,dc=sp,dc=com on the service provider.

The ssoadm command requires a file that maps local user IDs to remote user IDs, one per line, separated by the vertical bar (|) character. Each line of the file appears as follows:

local-user-ID|remote-user-ID

In the example, starting on the service provider side, the line for the demo user reads as follows:

id=demo,ou=user,dc=sp,dc=com|id=demo,ou=user,dc=idp,dc=com

All the user accounts mapped in your file must exist at the identity provider and the service provider when you run the commands to link them.

Link the accounts using the ssoadm bulk federation commands:

Prepare the data with the ssoadm do-bulk-federation command.

The following example starts on the service provider side:

$ cat /tmp/user-map.txt

id=demo,ou=user,dc=sp,dc=com|id=demo,ou=user,dc=idp,dc=com

$ ssoadm do-bulk-federation \
  --metaalias /sp \
  --remoteentityid https://www.idp.com:8443/openam \
  --useridmapping /tmp/user-map.txt \
  --nameidmapping /tmp/name-map.txt \
  --adminid uid=amAdmin,ou=People,dc=openam,dc=forgerock,dc=org \
  --password-file /tmp/pwd.txt \
  --spec saml2

Bulk Federation for this host was completed.
To complete the federation, name Id mapping file should be loaded to remote provider.

Copy the name ID mapping output file to the other provider:

$ scp /tmp/name-map.txt openam@www.idp.com:/tmp/name-map.txt

openam@www.idp.com's password: ********
name-map.txt 100% 177 0.2KB/s 00:00

Import the name ID mapping file with the ssoadm import-bulk-fed-data command.

The following example is performed on the identity provider side:

$ ssoadm import-bulk-fed-data \
  --adminid uid=amAdmin,ou=People,dc=openam,dc=forgerock,dc=org \
  --password-file /tmp/pwd.txt \
  --metaalias /idp \
  --bulk-data-file /tmp/name-map.txt

Bulk Federation for this host was completed.

At this point the accounts are linked.