Jorge's Quest For Knowledge!

All about Windows Server, ADDS, ADFS & FIM (It Is Just Like An Addiction, The More You Have, The More You Want To Have!)

Archive for the ‘Identity Lifecycle Manager (ILM)’ Category

(2011-10-25) Stripping Diacritics From String Values

Posted by Jorge on 2011-10-25


I found the following posts about stripping diacritics from string values when using either the FIM Portal and/or the ILM/FIM Sync Engine:

-

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
http://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Identity Lifecycle Manager (ILM) | Leave a Comment »

(2010-08-17) ILM/FIM Sync Engine Terminology

Posted by Jorge on 2010-08-17


The past week I delivered the FIM 2010 Foundation course that is made available by Oxford Computer Group. One of the things I noticed is that people struggle with all the terms and abbreviations. Because of that I promised my attendees to create a nice picture and include explanations. So here goes!

The picture below shows all possible actions that can be execute through one or more Run Profiles which have one or more steps.

image

MA = Management Agent

CS = Connector Space

MV = Metaverse

INBOUND ATTRIBUTE FLOW [1]: This flow is either caused by executing a Full Sync (touching all objects in the CS) or a Delta Sync (touching only changed objects in the CS) on a certain MA. This is the flow of data from a connector space object to a metaverse object. This only applies to CS objects that are in the same MA as for which the Run Profile was executed.

OUTBOUND ATTRIBUTE FLOW [2]: This flow is either caused by executing a Full Sync (touching all objects in the CS and corresponding MV objects) or a Delta Sync (touching only changed objects in the CS and corresponding MV objects) on a certain MA. This is the flow of data from a metaverse object to a connector space object in any affected MA. This applies to CS objects that are in the same MA as for which the Run Profile was executed and all other MAs that are affected by the inbound attribute flow from the MA as for which the Run Profile was executed.

PROJECTION [3]: This is the creation of a metaverse object based upon a connector space object when executing a Full Sync (touching all objects in the CS) or a Delta Sync (touching only changed objects in the CS). This only occurs when at least one projection rule has been configured in the MA and/or Sync Rule and when no joining rule was satisfied and when the connector filter in the MA is not met. This only applies to CS objects that are in the same MA as for which the Run Profile was executed. After projection, provisioning and inbound/outbound attribute flow may occur.

PROVISIONING [4]: This is the creation of a connector object based upon a metaverse object when executing a Full Sync (touching all objects in the CS and corresponding MV objects) or a Delta Sync (touching only changed objects in the CS and corresponding MV objects). This only occurs when provisioning is enabled in the metaverse and when either a Provisioning Rules Extension exists with provisioning code for one or more MAs or when an Outbound Sync Rule has been configured for one or more MAs with the option to create a resource in the target system. This only applies to MV objects that were "touched" because of the execution of Full/Delta Sync Run Profile on a certain MA.

JOINING [5]: This is the matching of connector space object with a metaverse object based upon certain (unique) identity data (e.g. employeeID) when executing a Full Sync (touching all objects in the CS) or a Delta Sync (touching only changed objects in the CS). This only occurs when at least one join rule has been configured in the MA and/or Sync Rule and when the connector filter in the MA is not met. This only applies to CS objects that are in the same MA as for which the Run Profile was executed. After joining, inbound/outbound attribute flow may occur.

IMPORT: This is the import of scoped data from a connected data source into the corresponding connector space. Either a Full Import or a Delta Import cam be performed. A Full Import just asks for all scoped data, whether or not it is new or has changed, and the sync engine determines new objects and/or changes by comparing it against existing CS objects. A Delta import asks the connected data source for the changes (assuming it can provide those) and the sync engine processes those changes.

EXPORT: This is the export of new/changed data (pending exports – adds, updates, deletes) from the connector space into the connected data source. Exports are always delta. Some connected data sources may want or expect a Full Export and it that case you would need to create your own MA for those connected data sources that expect it.

-

UPDATE 2013-01-15:

-

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
http://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Forefront Identity Manager (FIM) Sync, Identity Lifecycle Manager (ILM) | 3 Comments »

(2010-03-10) Provisioning Mailboxes In Exchange 2007/2010 By ILM/FIM

Posted by Jorge on 2010-03-10


MS-KBQ275636 explains which attributes are required (at a minimum) to provision a mailbox into an Exchange 2007 (E2K7) environment. For an Exchange 2010 (E2K10) environment the game is a little different. Let’s have a look at the HOW and WHY.

The mailbox needs an identifier and needs a location where it should be stored. The identifier can be split into two parts, being the "Alias" to identify the mailbox itself as a minimum to generate the mail address if no custom e-mail address policy has been specified, or when one has been specified to use the Alias AND to generate the legacyExchangeDN. For the GAL, the identifier of the mailbox is the "Display Name" and it is required by Exchange. It is not required by AD. When creating a user in AD, you only need to/must specify the Full Name (a.k.a. CN or RDN), but not the Display Name. If you use Active Directory Users and Computers the Display Name is derived from the Full Name. When creating a mailbox in Exchange whereas there is no Display Name, the Display Name will still be populated and is derived from the Full Name. With regards to the location you need to at least specify an Exchange Server and preferably a mailbox database on that Exchange Server. If you do not specify a mailbox database, Exchange will select a mailbox database randomly. In this case I personally do not like the random stuff, therefore I’d rather specify both the Exchange Server and the mailbox database. Other attributes such homeMTA and msExchHomeServerName are derived from the specified value for homeMDB. Let’s have a look at the small differences between E2K7 and E2K10.

Provisioning Exchange 2007 Mailboxes

When provisioning mailboxes in Exchange 2007 you need to at least (the minimum) specify the following attributes:

  • mailNickname
  • homeMDB (e.g.: CN=Mailbox Database,CN=First Storage Group,CN=InformationStore,CN=RFSRWDC1,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=MAIL-ORG,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=ADCORP,DC=LAB)

REMARK: The assumption is made here the Display Name was already specified during the creation of the user in AD.

REMARK: Note the fact that homeMDB in Exchange 2007 contains both the Mailbox Database Name and the Exchange Server Name (the bold parts)

In addition to specifying the minimum required attributes, you need to configure the ADDS MA as follows/shown:

image

PS.: I have no clue what the option "Exchange 2007 RUS Server" is used for. The weird thing is that there is no RUS anymore in Exchange 2007. The RUS existed in Exchange 2000/2003.

UPDATE 11-03-2010: According to my MVP friend, Brian Desmond, "Actually RUS still exists in Exchange 2007, it’s just a synchronous thing inside the System Attendant which the cmdlets make an RPC call to for it to do its’ work. SP2 added a parameter (the same as the optional option in the ADDS MA) to the various cmdlets to specify which Exchange server the cmdlet should call out to for RUS. I would leave it blank unless you have a good reason not to"

Exchange Server 2007 Mailbox Provisioning requires at least the following to be installed on the ILM/FIM Server:

  • PowerShell v1.0 (or PowerShell v2.0) for the execution of local PowerShell CMDlets.
  • Exchange Management Console providing the required CMDlets

For Exchange Server 2007, in AD the attributes look like:
dn:CN=Albert Einstein,OU=Users,OU=HISTORY1,OU=Org-Users,DC=ADCORP,DC=LAB
>mailNickname: AEinstein
>homeMDB: CN= Mailbox Database,CN=First Storage Group,CN=InformationStore,CN=RFSRWDC1,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=MAIL-ORG,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=ADCORP,DC=LAB
>msExchHomeServerName: /o=MAIL-ORG/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=RFSRWDC1

Provisioning Exchange 2010 Mailboxes
When provisioning mailboxes in Exchange 2010 you need to at least (the minimum) specify the following attributes:

  • mailNickname
  • homeMDB (e.g.: CN=Mailbox Database 1627792968,CN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=MAIL-ORG,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=ADCORP,DC=LAB)
  • msExchHomeServerName (e.g. /o=MAIL-ORG/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=RFSRWDC1)

REMARK: The assumption is made here the Display Name was already specified during the creation of the user in AD.

REMARK: Note the fact that homeMDB in Exchange 2010 only contains the Mailbox Database Name and NOT the Exchange Server Name. The Exchange Server Name is stored in the value for the attribute called msExchHomeServerName

In addition to specifying the minimum required attributes, you need to configure the ADDS MA as follows/shown:

image

PS.: For the option "Exchange 2010 RPS URI" you need to specify a URL in the form as shown of an Exchange Server that is hosting the "Client Access Server Role" so that the ILM/FIM server can use remote PowerShell CMDlets against it.

Exchange Server 2010 Mailbox Provisioning requires at least the following to be installed on the ILM/FIM Server:

  • PowerShell v2.0 for the execution of remote PowerShell CMDlets.

REMARK: Provisioning of Exchange 2010 mailboxes does not require the Exchange Management Console to be installed on the ILM/FIM server as remote PowerShell CMDlets are used!

For Exchange Server 2010, in AD the attributes look like:
dn:CN=Albert Einstein,OU=Users,OU=HISTORY1,OU=Org-Users,DC=ADCORP,DC=LAB
>mailNickname: AEinstein
>homeMDB: CN=Mailbox Database 1627792968,CN=Databases,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=MAIL-ORG,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=ADCORP,DC=LAB
>msExchHomeServerName: /o=MAIL-ORG/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=RFSRWDC1

UPDATE 11-03-2010: I had a discussion with my friend on the "darkside", Tomek, about the information above. We discussed that the flow of the attributes as mentioned is required when using the Synchronization Rules in the FIM Portal. However you can still use "the old fashioned" Export Attribute Flow in the ADDS MA if you want to. Another way to provision mailboxes is to use the function "ExchangeUtils.CreateMailbox" in a Rules Extension DLL. Whatever the case, you really need to be careful when just flowing attributes. For example, the flow of the Mailbox Database and Exchange Server should only occur initially, meaning at the moment when creating the mailbox. It should therefore not be flowed anymore _after_ the creation of the mailbox, unless you would like to have issues! Smile

Also see:

-

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
http://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Exchange Server, Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Identity Lifecycle Manager (ILM) | Leave a Comment »

(2009-11-12) New hotfix Rollup Package Has Been Released For ILM 2007 FP1 (Build 3.3.1118.02)

Posted by Jorge on 2009-11-12


Hotfix rollup package (build 3.3.1118.02) is available for Microsoft Identity Lifecycle Manager (ILM) 2007 Feature Pack 1 (FP1).

INTRODUCTION

IMPORTANT WARNING BEFORE YOU TRY TO INSTALL THIS HOTFIX, YOU MUST READ THE INSTALLATION INFORMATION SECTION.

List of issues fixed

This hotfix rollup package includes all the previous hotfixes that are described in the following articles in the Microsoft Knowledge Base:

This hotfix rollup package also fixes the following issues that were not previously documented in a Microsoft Knowledge Base article:

Fixes that involve the ILM Certificate Management component (previously named CLM)

Note If you apply the ILM Certificate Management part of this hotfix rollup package and you previously used a build earlier than 3.3.1067.2,how ILM Certificate Management accesses Active Directory is changed. For more information about how ILM Certificate Management accesses Active Directory, click the following article number to view the article in the Microsoft Knowledge Base:

952327  (http://support.microsoft.com/kb/952327/ ) A hotfix rollup package (build 3.3.1067.2) is available for Identity Lifecycle Manager 2007 Feature Pack 1

  1. Access is now allowed based on membership in built-in Active Directory groups.
  2. Error message after you enter a one-time password when you use the CLM Kiosk mode: "Value does not fall within the expected range."
  3. Error message when you request a certificate: "Security ID structure is invalid."
  4. You receive an "Out of Memory" error message when you use Smartcard Application Management (AMS).
  5. You receive a "Data Type not supported" error message when you call the ExecuteOperations.SetProposedAdminPin method.
  6. When you perform online updates on a primary card and on a duplicate card, CLM generates the same authentication certificate on both cards. However, CLM generates different encryption certificates.

Fixes that involve the ILM Synchronization component (previously named MIIS)

  1. The Management Agent (MA) for eDirectory now supports version 8.8 of Novell eDirectory.
  2. The Galsync.dll file is not updated when you upgrade from the release version of ILM 2007 to ILM 2007 FP1.
  3. Metaverse values are not populated after an object was deprovisioned and then rejoined.
  4. Multivalued attributes are not imported from a Microsoft SQL Server MA if there are Unicode characters in the anchor field.
  5. When you import attributes from an Active Directory MA, empty lines are added to the ma_custom_data_xml field in the mms_partition table.
  6. Microsoft Identity Integration Server crashes when you perform an Active Directory export operation.

MORE INFORMATION

Hotfix informationA supported hotfix is available from Microsoft. However, this…

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, submit a request to Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support (http://support.microsoft.com/contactus/?ws=support)

Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Installation information

When you install this hotfix rollup package on a Windows Server 2008-based computer, you must run the installation package (.msp) from an Administrative command prompt. The following is the command to run the installation package:

msiexec /update FileName.msp

Upgrade vs. Reinstall Considerations

The original release of ILM 2007 FP1 (3.3.0118.2) included an invalid system file that affected both the Certificate Management and Synchronization components. The steps to correct this situation are described in the following sections.

ILM Certificate Management Component
If you are running a build of the ILM Certificate Management component earlier than 3.3.1087.2, then before you install this hotfix rollup, you must uninstall the program and run a full installation of build 3.3.1087.2 from a build that is available from Microsoft Customer Support. We will make all the necessary files and documentation publicly available, and we will update this article with the corresponding links when they are published.

You can verify your current build by looking at the version of one of the Microsoft.Clm.*.dll files in the Microsoft Certificate Lifecycle ManagerBin folder and the Microsoft Certificate Lifecycle ManagerwebBin folder. If the version of a Microsoft.Clm.*.dll file is earlier than 3.3.1087.2, you must uninstall the previous installation and then run a full installation of build 3.3.1087.2.
ILM Synchronization Component
To install the ILM Synchronization component, you must uninstall the previous installation on the computer, and then reinstall build 3.3.1087.2 from a package that is available from Microsoft Customer Support. This article will be updated when that package is available for public download.

Hotfix Uninstall or Rollback

The Certificate Management (CLM) part of the update can be rolled back by using Add / Remove programs in Control Panel. If you do this, you must back up the Web.config file before you uninstall the update, and then restore it after the uninstall process is completed.

Prerequisites

To apply this hotfix, you must have Identity Lifecycle Manager 2007 Feature Pack 1 installed on the computer.

Restart requirement

You do not have to restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix rollup package includes all previous hotfixes for ILM 2007 FP1.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Certificate Lifecycle Manager (CLM)



Collapse this tableFile name

File version

File size

Date

Time

Platform

Clm_2007_fp1_bulkclient_deved_kb969742.msp

3.3.1118.2

413,696

23-Jun-2009

12:47

x86

Clm_2007_fp1_bulkclient_full_kb969742.msp

3.3.1118.2

413,696

23-Jun-2009

12:47

x86

Clm_2007_fp1_client_deved_kb969742.msp

3.3.1118.2

76,800

23-Jun-2009

12:47

x86

Clm_2007_fp1_client_full_kb969742.msp

3.3.1118.2

76,800

23-Jun-2009

12:47

x86

Clm_2007_fp1_deved_kb969742.msp

3.3.1118.2

3,573,760

23-Jun-2009

12:47

x86

Clm_2007_fp1_full_kb969742.msp

3.3.1118.2

1,774,080

23-Jun-2009

12:47

x86

Identity Lifecycle Manager (ILM)

Collapse this tableExpand this table



File name

File version

File size

Date

Time

Platform

Ilm_2007_fp1_ent_kb969742.msp

3.3.1118.2

771,072

23-Jun-2009

12:47

x86

Ilm_2007_fp1_msdn_kb969742.msp

3.3.1118.2

771,072

23-Jun-2009

12:47

x86

Back to the top

Detailed information about the issues that are resolved in the ILM Certificate Management component

  • Access is now allowed based on membership in built-in Active Directory groups.

    Because of the changes to the access-checking methodology that were introduced in the hotfix that is described in Microsoft Knowledge Base (KB) article 952327, some CLM operations, such as the results returned from a user search, no longer work in the same manner.

    When a user performs a search operation, the user must have the Active Directory read permission for all objects that are returned by an LDAP search that is generated by CLM. For simplicity, we will refer to this user as "the Manager." If the search results include a user for whom the Manager does not have the Active Directory read permission, that user is not displayed in the search results.

    However, earlier builds of CLM did not correctly evaluate the Manager’s membership in built-in groups such as the Everyone group or the Authenticated Users group. Therefore, if the Manager has the Active Directory read permission for a certain user, and that read permission was granted to the Manager because the Manager is a member of a built-in group, CLM denies access to the user object. As a result, the user object does not appear in the search result.

    Before the current build, you could avoid this problem by setting the domain to the Windows Server 2003 functional level or to a later functional level. To do this, you had to add the following setting to the CLM Web.config file:

  • <appSettings>
    

  •     <add key="Microsoft.Clm.Security.Authorization.UseS4Flag" value="true" />
    

  • </appSettings>
    

    However, the current build correctly evaluates read permissions that are granted because the Manager is a member of a built-in group.

  • Error message after you enter a one-time password when you use the CLM Kiosk mode: "Value does not fall within the expected range."

    When you use the CLM kiosk mode and you enroll in a profile template that requires a one-time password, you receive the following error message:


    Value does not fall within the expected range

    Additionally, the following exception information is logged in the log file:


    Exception Type: System.ArgumentException

    Message: Value does not fall within the expected range.

    ParamName: NULL

    Data: System.Collections.ListDictionaryInternal

    TargetSite: Void ThrowExceptionForHRInternal(Int32, IntPtr)

    HelpLink: NULL

    Source: mscorlib

    This problem occurs because CLM does not use the correct user account for Anonymous access in Internet Information Services (IIS).

  • Error message when you request a certificate: "Security ID structure is invalid."

    Consider the following scenario:

    • The CLM server, the domain controller, and the client application are on different computers.

    • IIS is configured for Windows Authentication.

    • On the client computer, you enable Integrated Windows Authentication in Internet Explorer.

    • The domain is at Windows Server 2003 functional level or to a later functional level.

    • The domain controller security setting for Network access Allow anonymous SID/name translation is disabled. This setting is located in Security Options under Local Policies.

    • In the constrained delegation configuration, the CLM server’s machine account is trusted for delegation to the rpcss service on the certification authority (CA) server.

    • In the constrained delegation configuration, the clmWebpool account is trusted for delegation to the HOST service on the CA server.

    In this scenario, when you request a certificate, you receive the following error message:


    Security ID structure is invalid.

    This problem occurs because, when CLM contacts a domain controller, CLM does not impersonate the clmAuthAgent account.

  • You receive an "Out of Memory" error message when you use Smartcard Application Management (AMS).

    When you use Smartcard Application Management (AMS) together with a Hardware Security Module (HSM) and P11 cards, you may receive "Out of Memory" error messages. These "Out of Memory" error messages occur because the P11 Library maintains a Session Pool of active sessions in the HSM. However, after a session stops, CLM does not correctly recycle the session. Because of this behavior, the session stays as an active object in the HSM until IIS is reset on the CLM Server. Therefore, if you establish multiple consecutive AMS sessions, the HSM eventually runs out of memory.

  • You receive a "Data Type not supported" error message when you call the ExecuteOperations.SetProposedAdminPin method.

    Consider the following scenario. You have a Smartcard Profile Template that uses a provider other than the Microsoft Smart Card Base CSP provider. The Administrative PIN character set is set to ASCII. When you call the ExecuteOperations.SetProposedAdminPin method in the CLM Provisioning API, you receive the following error message:


    Data Type not supported

    This problem occurs even though all characters in the AdminPIN parameter are valid ASCII characters.

    This problem occurs because the CLM ASCII character set does not contain all the characters in the ASCII standard character set. To address this situation, a new custom character set is available in this build. This custom character set enables you to specify your own character set. This custom character set can contain any characters that have decimal ASCII codes from 32 to 126 (inclusive).

  • When you perform online updates a primary card and on a duplicate card, CLM generates the same authentication certificate on both cards.

    However, the CLM generates different encryption certificates. Therefore, you cannot decrypt data that was encrypted by using these cards before you performed the online update.

    This problem was partly addressed in the hotfix that is described in KB article 960765. However, the current build addresses the following two additional problems:

    • The server-side check for online updates does not correctly detect sibling cards.

    • The client-side processing of P11 cards does not correctly recognize that the two cards should be updated.

Back to the top

Detailed information about the issues that are resolved by the ILM Synchronization component

  • The management agent for Novell eDirectory now supports version 8.8 of Novell eDirectory.

    To enable this, you have to add the following registry entry:



Collapse this tableKey

HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/miiserver/Parameters/eDirectoryMASupportedServers

Type

Multi-String (Reg_multi_sz)

Value

LDAP Agent for Novell eDirectory 8.8 SP2 (20216.43)

Note You must enter the correct version and build number when you add the registry entry.

  • The Galsync.dll file is not updated when you upgrade from the release version of ILM 2007 to ILM 2007 FP1.

    By default, every upgrade installation and hotfix rollup installation should update the Galsync.dll file and all .dll files that were installed by ILM in the Extensions folder. However, in earlier hotfix rollup packages, this behavior was inconsistent.

    Important Note If you have a customized the GalSync.dll file and then recompiled it, you should rename the file, and then reconfigure the management agent and Provisioning Rules Extensions to prevent the replacement of the customized GalSync.dll file.

  • Metaverse values are not populated after an object was deprovisioned and then rejoined.

    Consider the following scenario:

    • A user has two connectors. One connector is a projected connector which contributes the anchor attribute. The second connector is joined on the anchor attribute and contributes additional attributes. For example, the projected connector contributes the employeeID attribute. Then, the second connector is joined on the employeeID attribute.

    • In the Deprovisioning tab of the management agent configuration, the Do not recall attributes contributed by objects from this management agent when disconnected check box is not checked.

    • A new object is created in the data source of the second connector that has the same employeeID attribute. However, the object has a different DepartmentNumber value.

    • The provisioning code is configured to disconnect the current joined object and join the new object for the second connector.

    In this scenario, a synchronization operation from the second connector’s data source invokes the provisioning code and the attribute flow. The expected result is that the metaverse object is joined to the new Connector Space object and the metaverse object should contain the DepartmentNumber value. However, the actual result is that the join operation occurs but the DepartmentNumber attribute has no value. To correctly populate the DepartmentNumber value in the metaverse you have to perform a second full synchronization operation.. In the current build, the join operation, the attribute recall operation, and the repopulation operation occur on a single synchronization run.

  • Multivalued attributes are not imported from a Microsoft SQL Server management agent if there are Unicode characters in the anchor field.

    You have a SQL Server management agent that uses a primary table and a secondary table to supply multivalued attributes. If the anchor field in the primary table contains a Unicode character, the values from the secondary table are not imported.

    For example, the primary table contains a list of groups, and the group name is used as the anchor attribute. The secondary table has a list of group members. If the group name contains a "č" character, the group object will be imported. However, the members will not be imported.

  • When you import attributes from an Active Directory management agent, empty lines are added to the ma_custom_data_xml field in the mms_partition table.

    Every full or delta import operation on an Active Directory management agent incorrectly adds an empty line to the ma_custom_data_xml field in the mms_partition table in the MicrosoftIdentityIntegrationServer database. In most cases, this has no noticeable effect on ILM. However, after you run lots of Import operations, this issue causes a "stopped-out-of-memory" error.

    In the current build, the additional lines are no longer written to the table. Also, existing blank lines are removed when you run the first Import operation after you install this hotfix.

  • Microsoft Identity Integration Server crashes when you perform an Active Directory export operation.

    The Active Directory management agent Export operation calls the DSBindWithCred API. If this call fails, the management agent Export code does not handle the error that is returned from the API. This issue occurs very rarely and is not reproducible on demand. In the current build, ILM returns the following error message when this issue occurs:


    Failed to bind with credentials

For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:

824684  (http://support.microsoft.com/kb/824684/ ) Description of the standard terminology that is used to describe Microsoft software updates

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

For more information please see: MS-KBQ969742_A hotfix rollup package (build 3.3.1118.02) is available for Identity Lifecycle Manager 2007 Feature Pack 1

 

Cheers,

Jorge

———————————————————————————————

* This posting is provided "AS IS" with no warranties and confers no rights!

* Always evaluate/test yourself before using/implementing this!

* DISCLAIMER: http://jorgequestforknowledge.wordpress.com/disclaimer/

———————————————————————————————

############### Jorge’s Quest For Knowledge #############

######### http://JorgeQuestForKnowledge.wordpress.com/ ########

———————————————————————————————

Posted in Identity Lifecycle Manager (ILM) | Leave a Comment »

(2009-10-04) Upgrading ILM 2007 To FIM 2010 – What To Do?

Posted by Jorge on 2009-10-04


SOURCE: http://social.technet.microsoft.com/Forums/en-US/ilm2/thread/b47c5545-b066-45bd-9e21-9601f5a7fa86

In the ILM 2 Forum the following question was asked:

What’s the upgrade path to go from MIIS/ILM 2007 to FIM 2010? Will FIM 2010 just use your current configuration? Also, how’s the timing of the FIM release? If you were implementing Identity Management now – is it best to implement it on ILM or FIM?

Bob Tucker from Oxford Computer Group answered:

  1. The upgrade path from ILM 2007 to FIM 2010 involves several steps, but generally will not be terribly difficult. You would need to accomplish the following:
  2. Stand up a test environment that represents your production environment
  3. Upgrade your SQL database to 2008 if not already there
  4. Recompile all code using .Net 3.5 (Visual Studio 08)
  5. Perform complete end to end testing
  6. Verify you have x64 versions for any third party apps required on the ILM server (Oracle client, Notes client, etc)
  7. Build Windows 2008 x64 and install FIM 2010 sync engine – pointing to the SQL 2008 version of the ILM database
  8. Perform complete end to end testing
  9. Consider installing FIM 2010 portal
  10. Consider migrating some of the codeless capabilities and group management to FIM 2010
  11. Perform complete end to end testing

As you can see from above – FIM 2010 can make use of your existing design, but it is not a point and click upgrade (one is 32 bit only, the other 64 bit only).

Timing of the release of FIM 2010 can best be answered by some of the MS guys – they have the latest information.

As for which one to use – if you are just now getting into the process of implementing an identity management solution, you should start with determining systems involved, gathering requirements, developing a design, etc. If you absolutely require the use of a portal to allow user participation, then you may want to wait on FIM 2010 (or look at designing your own); if you are looking to deploy in the immediate future, you will have to decide whether or not you can use release candidate software in a production environment. With the release of RC1 of FIM 2010, you may be able to participate in TAP/RDP programs if desired.

As you can see from the migration path; if you decide to start with ILM 2007, you can still migrate the capabilities to FIM 2010 without too much work, though it may involve some rework to move some of the design into the portal.

David Lundell from Ensynch answered additionally:

In step 3 You will need to change some of your references to use 64-bit editions of the new Microsoft.metadirectoryservicesex.dll that was introduced with the hotfix referenced below: http://support.microsoft.com/default.aspx/kb/946797.

I can’t understate the importance of following Bob’s advice in Step 5. 64 bit editions of the items needed is critical. For example the Host Access Management Agents are not yet available for 64-bit use since they depend on Host Integration Server 2006 which won’t install on Windows Server 2008 x64. So if connect to mainframes you will need to consider how to do that:

  1. using ILM 2007 as a bridge
    OR
  2. using a 3rd party MA
    OR
  3. writing your own MA

My personal comments:

With regards to "timing release", the known official release date/period is Q1 2010.

Should you use ILM 2007 or FIM 2010? Basically what ILM 2007 is able to do, FIM 2010 is also able to do. Big thing you need to take into account is the architecture. ILM 2007 is 32 bit only and FIM 2010 is 64 bit only. Any dependency on THAT needs to be investigated. As already mentioned, if you need additional client software for an MA (Oracle, Notes, SAP, etc.) to work and you want to use FIM 2010, make sure 64 bit client software is available!

If you need portal functionality, such as users need to interact with ILM/FIM for whatever reason (e.g. self-service password reset, other self-service stuff, group management, etc.) you are better in using FIM 2010. It does not mean it is not possible to do it with ILM 2007. What it does mean is that ILM 2007 itself cannot do it, but you need s solution external to ILM for those features.

The sync engine in FIM 2010 differs from ILM 2007 in the following ways:

  • Supports both scripted provisioning and codeless provisioning
  • Supports both inbound/outbound attributes flows and inbound/outbound sync rules
  • Automatic hierarchical provisioning (creating directory structures if they do not exist) (ILM 2007 support this also, but rather in code)
  • Equal precedence (meaning "last sync wins" and allowing the merger of multi-valued attributes such as the member attribute in group objects)

With regards to licensing, for the Sync Engine you just need a server CAL, but if you want to use the features of the Portal you need user CALs in addition.

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
http://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Forefront Identity Manager (FIM) Sync, Identity Lifecycle Manager (ILM), Migration/Upgrade | 1 Comment »

(2009-06-19) Provisioning To AD And OCS Through ILM 2007

Posted by Jorge on 2009-06-19


To provision IM-enabled AD accounts this is what you can do in your provisioning code for the AD MA… (example code snippet from my test/demo environment)

If mventry("im").Value.ToLower = "yes" Then Dim strSIPDomain As String Dim strSIPHomeServer As String strSIPDomain = AD_DS_Production_USERS_MA_Params("sipdomain") strSIPHomeServer = AD_DS_Production_USERS_MA_Params("siphomeserver") AD_DS_Production_USERS_CsEntry("msRTCSIP-PrimaryUserAddress").Value = "sip:" & Replace(mventry("displayName").Value, " ", ".") & strSIPDomain AD_DS_Production_USERS_CsEntry("msRTCSIP-PrimaryHomeServer").Value = strSIPHomeServer AD_DS_Production_USERS_CsEntry("proxyAddresses").Values.Add("sip:" & Replace(mventry("displayName").Value, " ", ".") & strSIPDomain) AD_DS_Production_USERS_CsEntry("msRTCSIP-OptionFlags").Value = "256" AD_DS_Production_USERS_CsEntry("msRTCSIP-ArchivingEnabled").Value = "0" AD_DS_Production_USERS_CsEntry("msRTCSIP-UserEnabled").BooleanValue = True End If

Sipdomain and siphomeserver are values stored as parameters in an XML file. Another thing to note is that "msRTCSIP-PrimaryHomeServer" needs a DN to an OCS pool, but it is NOT a reference attribute. It is a string attribute!

Cheers,

Jorge

———————————————————————————————

* This posting is provided "AS IS" with no warranties and confers no rights!

* Always evaluate/test yourself before using/implementing this!

* DISCLAIMER: http://jorgequestforknowledge.wordpress.com/disclaimer/

———————————————————————————————

############### Jorge’s Quest For Knowledge #############

######### http://JorgeQuestForKnowledge.wordpress.com/ ########

———————————————————————————————

Posted in Identity Lifecycle Manager (ILM), OCS/Lync Server | Leave a Comment »

(2009-06-12) ILM 2007 FP1 And Hyper-V

Posted by Jorge on 2009-06-12


At the moment Microsoft does not support ILM 2007 FP1 in ANY virtual environment.

I have not seen an official statement yet on some Microsoft page, but I have read here that ILM 2007 FP1 now is supported to run on Hyper-V. If you want to run it on VMware, check out these KB articles from Microsoft about that:

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
http://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Identity Lifecycle Manager (ILM), Virtualization | Leave a Comment »

(2009-06-06) ILM 2007 FP1 And SQL Server 2008

Posted by Jorge on 2009-06-06


At the moment ILM 2007 FP1 officially supports:

  • SQL Server 2000 SP3a (and higher) Standard or Enterprise (x86/x64)
  • SQL Server 2005 SP1 (and higher) Standard or Enterprise (x86/x64)

I have not seen an official statement yet on some Microsoft page, but I have read here that SQL Server 2008 it supported by ILM Sync Engine, ILM Certificate Management, but also as a connected data source. For another MSFT employee I heard that SQL Server 2008 will most likely work with ILM 2007 FP1 RTM, but tests were validated with builds 3.3.11xx.x

UPDATE:

If you install SQL 2008 and then try to install ILM 2007 FP1 you may get the following error: "Install the correct SQL version or SP"

Believe it or not, but the resolution to this is:

  • Install SQL 2005 + latest SPs
  • Install ILM 2007 FP1
  • Upgrade SQL 2005 to SQL 2008

Source: http://social.technet.microsoft.com/Forums/en-US/identitylifecyclemanager/thread/d2892a5d-c4b9-43cc-b375-6ae0dd81cf68

 

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
http://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Identity Lifecycle Manager (ILM), SQL Server | Leave a Comment »

(2009-06-06) High Availability For ILM 2007 Sync Engine With Clustering

Posted by Jorge on 2009-06-06


When using ILM 2007 Sync Engine and you would like to have high availability you need to think about the all components of the solution. In the case of ILM 2007 Sync Engine those would be:

  • Windows Server
  • ILM 2007 Sync Engine
  • SQL Server
  • ILM Datastore

Windows Server and SQL Server can be made high available through Microsoft Clustering Services.

ILM Datastore can be made high available by putting it on a SAN/NAS/Shared Storage/Whatever, as long as you use a redundant set of disks, or in other words some RAID configuration such as RAID1 (mirroring), RAID5 (disk striping with parity) or RAID10 (mirroring and striping).

OK, but how about the ILM 2007 Sync Engine? For ILM 2007 Sync Engine you have following possibilities:

  • Operational Instance: the ILM instance which is actually running by importing, exporting and synching data between connected data sources (ILM server license needed)
  • HOT Standby Instance: the ILM instance which is NOT running (service = stopped and disabled), but for which its Windows Server is up and running (additional ILM server license needed). For a guide on how to implement this go here.
  • COLD Standby Instance: the ILM instance which is NOT running (service = stopped and disabled), but for which its Windows Server is ALSO NOT up and running (NO additional ILM server license needed)

So, when the Operational Instance dies for whatever reason, use need to use the available standby instance (for the COLD standby instance you need to start the server first of course) and activate it by using the MIISACTIVATE tool with the Encryption Keys created by the first ILM instance that was installed for the solution. If you are using password synchronization (PCNS) you need to reconfigure the PCNS object in AD to target the new ILM instance. As you can see that is a manual process. Can you automate it? That depends if you are using something that can automatically switch over to the standby instance.

Is ILM 2007 Sync Engine cluster-aware? Nope, it is not!

Can you install the Operational Instance of ILM 2007 Sync Engine on a Cluster (e.g. the active node) and is it supported by MSFT? Yes, it can be installed on the active cluster node and that is also supported by MSFT.

Can you install the Standby Instance of ILM 2007 Sync Engine on a Cluster (e.g. the passive node) and is it supported by MSFT? Yes, it can be installed on the passive cluster node and that is also supported by MSFT.

Even on a cluster you need to manually switch to the standby instance on the passive node by activating it if the operational instance on the active node fails or becomes unavailable.

Can this be automated, so that when the active cluster node dies, ILM automatically switches over to the passive node and would that be supported by MSFT? Yes it is possible to automatically failover ILM by using the script which can be found here. But, is this supported? Unfortunately, it is NOT supported by MSFT! Also take this post into account.

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
http://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Identity Lifecycle Manager (ILM), SQL Server | Leave a Comment »

(2009-06-05) Exporting Multi-valued Attribute To SQL Table

Posted by Jorge on 2009-06-05


Based upon my post about "Multiple Authoritative Sources For Group Memberships And How About Precedence In ILM", a technology partner and I were setting up and test/demo environment. The idea was as follows.

The MGMT app is authoritative for groups and group memberships, which then flow into AD. Group Membership is established on business logic like for example:

  • Everyone with "JobTitle=Admin" and "Department=ICT" becomes a member of the group "R1Grp_EMPLOYEES_JOB_ICT_ADMIN"
  • Everyone with "employeeType=EMPLOYEES" becomes a member of the group "R1Grp_EMPLOYEES"
  • Etc.

However, in AD it must be possible to adjust/establish group memberships that do not follow the business logic. For example, a contractor is added to the group "R1Grp_EMPLOYEES". That new group membership flows (import) from AD to the MV through the "ADDS-Group-IMP" MA. From the MV it flows (export) to the SQL Database (multi-valued table) through the "MGMT-Group-EXP" MA.

When a group membership is established in the MGMT APP the following flags should be set in the SQL multiple valued tabled: MGMT=YES & IDM=NO (as properties of that specific group membership)

When a group membership is established in the MGMT APP the following flags should be set in the SQL multiple valued tabled: MGMT=NO & IDM=YES (as properties of that specific group membership)

This way the MGMT APP can check on eventual business conflicts by checking the flags and report on it!

So as a test we wanted to test this by adding a contractor person to the "R1Grp_EMPLOYEES" group. Initially the group "R1Grp_EMPLOYEES" contained 32 employee persons and after the change an extra contractor person was added to it.

What was the expect end result?

  • 32 employee group memberships with the flags MGMT=YES & IDM=NO
  • 1 contractor group membership with the flags MGMT=NO & IDM=YES

So I imported the group membership from AD into ILM and exported it to the SQL database.

What was the REAL end result?

  • 32 employee group memberships with the flags MGMT=NO & IDM=YES
  • 1 contractor group membership with the flags MGMT=NO & IDM=YES

What the heck?!?! Why are the flags of ALL group memberships for the group "R1Grp_EMPLOYEES" changed as if they were exported? I expect only one INSERT into the table and not 33 INSERTS.

The way to find out is to use SQL Server Profiler and check what’s happening under the hood! So let’s do this.

Before exporting to ILM I checked the ILM statistics. See picture below.

image

After exporting I checked the SQL Server Profiler Trace and saw the following…

image

Let’s take a look at this trace

  • Yellow marked text: Delete all existing group memberships for the group "R1Grp_EMPLOYEES"
  • Green marked text: Add the new group membership for the new member (the one established in AD)
  • Blue marked text: Add the new group membership for the previously existing members (the ones established in MGMT APP)

I wonder WHY ILM works this way…Anyone from the Product Group care to explain? Please do so!

-

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
http://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Identity Lifecycle Manager (ILM), SQL Server | Leave a Comment »

 
%d bloggers like this: