Getting the errors "Assert failed: Attr" and "Assert failed: Domain" when importing a Policy Store export with XPSImport

Document ID : KB000004629
Last Modified Date : 14/02/2018
Show Technical Document Details
Issue:

When importing Policy Store export from old R12.0 environment to new R12.52 SP1 environment, the following errors appear during the XPSImport validation step:

(ERROR) : [CA-SM-Assert] CA.SM::Rule@0b-f1a9a857-bbfb-1032-8cc1-84d3c46cfd8a(MyRule): Assert failed: Attr
(ERROR) : [CA-SM-Assert] CA.SM::RuleGroup@0c-4997105c-bc11-1032-8cc1-84d3c46cfd8a(MyRuleGroup): Assert failed: Domain

How could I fix this?

Environment:
Policy Server R12.52 SP1
Importing data from R12.0 SP3 Policy Store
Cause:

In the sample given, the "Assert failed: Domain" means that for that Rule and RuleGroup,

CA.SM::Rule@0b-f1a9a857-bbfb-1032-8cc1-84d3c46cfd8a(MyRule)

CA.SM::RuleGroup@0c-4997105c-bc11-1032-8cc1-84d3c46cfd8a(MyRuleGroup)

the Domainlink property is missing or have a value for a missing Domain in the Policy Store. The Domainlink data is causing this issue actually.

Resolution:

Those objects should be checked individually to see what is causing the error. The data correction should be done in the R12.0 SP3 Policy Store using the XPSTools from the Policy Server R12.0 SP3, and then export again the objects. By running XPSExplorer tool, you could check those objects and the value of the DomainLink attribute.

If DomainLink attribute is not correct (should point to a valid Domain XID), it may mean that the objects were corrupted or not removed correctly, and this would need to be addressed manually in order to be imported successfully in the new Policy Store.

To lead a Policy Store integrity check, another option is to install a R12.6 (or higher) Policy Server to use the built-in integrity tools to repair those objects from the Policy Store 12.0SP3