Select Page

The Easy Button: Fixing Security Issues When Migrating EPBCS to Production

Author: Dave Shay | | September 12, 2017

When we migrate EPBCS/PBCS from the Test instance to the Production instance, security doesn’t migrate correctly because Oracle uses different naming conventions between Test & Prod for the security groups.

Test                                                                       Production                          

planning-test Service Administrator         planning Service Administrator

planning-test PowerUser                            planning PowerUser

and so on…

When you import your Test snapshot into Production, you do not get any kind of notification that security provisioning was rejected. For example, if you do not want “planning Viewer” to have access to the Workforce accounts, that access assignment is rejected because it was imported as “planning-test Viewer” and we are none the wiser.

Traditionally, we’d either manually redo the security setup directly in Production, and hope we remembered everything we did in Test (Seriously, don’t do this). Or, we would crawl through the snapshot and edit the various .csv and .xml files, and certain files would also have to be renamed. Been there, done that.

I proudly present…. The Easy Button.

Download this:


Unzip it and save it in a place you can find it later when you need it. To ensure you’re paying attention, this download link expires in 30 days.


1. One time only, copy and paste this command to a command prompt on your computer (it doesn’t matter what folder you’re in) and press ENTER:

powershell.exe Set-ExecutionPolicy Unrestricted

2. When it is time to migrate, download the snapshot from the Source instance to your computer and unzip it using 7-zip from Regular Windows unzip will bark about the long paths inside Reporting & Analysis. Unzip the snapshot to a path and folder name that does not contain any spaces anywhere within the fully-qualified path.

3. Copy the contents of the zip file you downloaded from my link above into the topmost folder of the extracted snapshot, like this:

4. If you are migrating from Test to Prod, double-click TestToProd.bat. If you are migrating from Prod to Test, double-click ProdToTest.bat. The script completes in less than 1 minute.

5.Use 7-zip to zip up your snapshot. Upload it to the target instance, and import it according to then-current best practices.

What the three highlighted files above do is search for and replace the instance-specific roles and also rename the instance-specific group files. You now have a repeatable process.

If we have a similar migration issue with FCCS, ARCS, and other Cloud products that have different group names between Test & Prod, this process could be adapted for them. Inspect the two .bat files and you should be able to figure it out. The .ps1 file should not need to be changed.


How to Solve the Oracle Error ORA-12154: TNS:could not resolve the connect identifier specified

The “ORA-12154: TNS Oracle error message is very common for database administrators. Learn how to diagnose & resolve this common issue here today.

Vijay Muthu | February 4, 2021

Data Types: The Importance of Choosing the Correct Data Type

Most DBAs have struggled with the pros and cons of choosing one data type over another. This blog post discusses different situations.

Craig Mullins | October 11, 2017

How to Recover a Table from an Oracle 12c RMAN Backup

Our database experts explain how to recover and restore a table from an Oracle 12c RMAN Backup with this step-by-step blog. Read more.

Megan Elphingstone | February 2, 2017

Subscribe to Our Blog

Never miss a post! Stay up to date with the latest database, application and analytics tips and news. Delivered in a handy bi-weekly update straight to your inbox. You can unsubscribe at any time.

Work with Us

Let’s have a conversation about what you need to succeed and how we can help get you there.


Work for Us

Where do you want to take your career? Explore exciting opportunities to join our team.