Checking the data dependencies of a security domain in RSA Authentication Manager 8.x

[#1]

Article Number

000037903

Applies To

RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.2 and higher

Issue

When an administrator deletes a security domain, the following message is seen:

Cannot delete a security domain that includes objects. Before you delete a security domain, you must move or delete all associated objects, such as
users, groups, and administrative roles.
Image description

Task

An administrator needs to further investigate which data objects are associated with the security domain being deleted.

RSA Customer Support has a shell script called Check_SecDom.sh (attached to this article) which can generate a report on the data dependencies of a security domain and, where necessary, move the data from the lower level security domain to SystemDomain (the top-level security domain).

Before moving the data from the security domain, please generate a backup of the Authentication Manager database.

 

Installation

1. Launch an SSH client, such as PuTTY.
2. Login to the primary Authentication Manager server as rsaadmin and enter the operating system password.

Note that during Quick Setup another user name may have been selected. Use that user name to login.

3. Copy the Check_SecDom.sh shell script into the /tmp folder on the Authentication Manager primary instance.  You may need to Enable Secure Shell on the Appliance to copy the shell script to /tmp.
4. Update the file permissions on the shell script:

chmod 755 /tmp/Check_SecDom.sh

5. Ensure the owner and group is rsaadmin: 

chown rsaadmin:rsaadmin /tmp/Check_SecDom.sh

​Usage

1. Logon to the Authentication Manager primary instance using the rsaadmin account.

Note that during Quick Setup another user name may have been selected. Use that user name to login.

2. Change the account privileges using the command:

sudo su -

3. Navigate to /tmp:

cd /tmp

4. Run the shell script :

./Check_SecDom.sh

This example shows that a security domain called Obsoleted has data dependencies from tables am_attr_definitions, am_token and ims_principal_data. The parent security domain is BWO and no sub-security domains were found:
 

am84p:/tmp # ./Check_SecDom.sh
Checking OC credentials....missing OC credentials!

Please enter OC Administrator username: <enter Operations Console administrator name>
Please enter OC Administrator password: <enter Operations Console administrator password>
OC credentials validated... redirecting to menu..

RSA Customer Support (Asia Pacific)

Security Domain program..

1) Check the dependencies of a Security Domain
2) Generate a dependency report on a Security Domain
3) Move objects from a Security Domain to SystemDomain (top-level)
9) Exit

Please select an option
1

Enter Security Domain name: Obsoleted
Checking for data dependencies for Security Domain: Obsoleted
-----START-----
::am_agent::
::am_ctkip_authcode::
::am_attr_definitions::
44b501862e1f3e0a441744e45af9476e,000000000000000000002001f0020003,STRING,token_attribute_01,0,string01,,f,f,test,
2019-08-28 04:27:57.711,scadmin,0,38483d4d2e1f3e0a17558a9f12ade947,f
::am_eap32_peppers::
::am_file_data::
::am_legacy_realm::
::am_offline_authn_policy::
::am_principal_attr_values::
::am_radius_clients::
::am_radius_policies::
::am_radius_profiles::
::am_remote_groups::
::am_remote_principal_att_values::
::am_remote_principal_data::
::am_token::
93a0b9d82e1f3e0a6e4df12856ca84db,c7356f1e2e1f3e0a7d7d850a2241a428,4,softid.rsa_generic_software_token,16,000008888980,8,30,t,,challange,f,t,t,,,f,
2026-07-06 00:00:00,2006-07-11 00:00:00,f,f,0,2019-08-26 02:39:45.487,
2019-08-26 02:39:45.487,000000000000000000002000f0026001,2019-08-26 02:38:04.663,f,,0,,0,,f,f,0,t,f,-1610612735,0,0,
2019-08-26 02:38:04.663,AAAAAqlCO60H/F2mXZBB5NBk7+TSYqEvkrVURQ4AwXHZ3c2SSwCStj09u4jxFG4DfQuuaqhSWUPJ9PnQXL9c7BI/
SVKiJA3asqssbae1UpDyOHfS6ePgiZBubLe3WljGT6JJ6GgxIfVF7nzqZFNeM6qdwm8=,AAAAARTyMvkcPz0UKP+Kw2FoQAC94IPgSENgX1V1N4j83DUlosGkwGwPq/
O9c3Wfq6GC1I41g6z1Lts3HCNzE0L4Bdc=,AAAAAbD2W+q1do2GbKLg2FntRowLeT/0k11nG8CHk6QVP4F6U6YEUQi9lVdEOA5P48tYDQbfVWIeul/ZvxSaU40YFcVfSs6/A3yNogBJoAEO2l/z,
AAAAAX1l556gsXPsnhudivJQww2CzfeL2IlK8DcHFFNTII6skreRATCVEjcCuZEV+pu1IgOXkjmYTOxZE8Z683sna04=,AAAAASS7ZA9XBjaNHZeQcrFsgGXJP/DaO9/
68cZ1ZKoSK96Qedcw+ekFrFJFrxjaxDbSoLEEWsIDnNQ1gMNWkMcpqFM=,0,scadmin,scadmin,
2019-03-31 23:04:45.12,,,,,,,,000000000000000000002001f0050014,,0,f,,,f,6,scadmin,
2019-08-28 04:27:22.907,,38483d4d2e1f3e0a17558a9f12ade947,,0,,,
::am_token_attr_values::
::am_token_attribute::
::am_token_policy::
::ims_admin_role::
::ims_authn_ea_policy::
::ims_authn_lockout_policy::
::ims_authn_password_policy::
::ims_authn_policy::
::ims_authn_ques_policy::
::ims_group_data::
::ims_principal_data::
c7356f1e2e1f3e0a7d7d850a2241a428,1566966397579,2,scadmin,
2019-08-28 04:26:37.579,000000000000000000001000d0011000,c6791b752e1f3e0a01a2753510103431,38483d4d2e1f3e0a17558a9f12ade947,
2019-08-26 02:37:00.812,,t,rsatest,t,f,f,0,,0,,f,2019-08-26 02:37:55.893,f,,f,,,1001000,f,,,3,,,,5,,-1,f,,
::ims_trusts::
-----END-----
Parent security domain: BWO
No dependent sub_security domains found.

Back to menu? (Y/N):