Jorge's Quest For Knowledge!

All About Identity And Security On-Premises And In The Cloud – It's Just Like An Addiction, The More You Have, The More You Want To Have!

Archive for the ‘Forefront Identity Manager (FIM) Portal’ Category

(2019-10-31) Microsoft Identity Manager 2016 Service Pack 2 (build 4.6.34.0) Has Been Released

Posted by Jorge on 2019-10-31


Microsoft has released Microsoft Identity Manager 2016 Service Pack 2! It is available for download as an ISO for fresh installs (available through Visual Studio Downloads), and as an MSI for updating existing environments.

Please find below what has been fixed and/or improved.

I particularly like the TLS 1.2 only support DURING installation of the MIM components. Previously it supported TLS 1.2 during runtime, but not during installation/updating. You always had to decrease the security level to TLS 1.0 to be able to install/update. And in addition I also like the gMSA support! Gone try both and blog about it regarding experiences.

Issues fixed and improvements added in this update

MIM Client add-ons

  • Added support for MIM Outlook add-in to be loaded into the Microsoft Office 365 Outlook Click-To-Run version.

Service and Portal

  • Added support for MIM Service and Portal to be installed on Windows Server 2019, and to use SQL 2017, Exchange Server 2019, SharePoint 2019, System Center Service Manager Data Warehouse 2019.
  • Enabled MIM Service and Portal installation in TLS 1.2 only environments.
  • Enabled installation for MIM Service, Password Reset and Password Registration websites to use group-managed service accounts.
  • New installer parameter "keepSQLjobs" introduced to keep existing SQL Agent MIM related jobs untouched (keep ownership and schedule), for example, "msiexec /p ‘MIMService_KB4512924.msp’ keepSQLjobs=true."
  • Added an additional step to MIM SQL Server Agent temporal jobs to skip execution on secondary SQL Always-On Availability Group replicas.
  • Added a code to handle "ExplicitMember.Add" and "ExplicitMember.Remove" virtual attributes in RCDC forms for custom object types.
  • MIM Service MA schema refresh no longer causes synchronization rules corruption.
  • Accessibility improvements for customers by using MIM Portal together with a screen reader.

Synchronization Service

  • Added support for MIM Synchronization Service to be installed on Windows Server 2019, and to use SQL Server 2017, Exchange Server 2019.
  • Enabled installation in TLS 1.2-only environments.
  • Enabled installation for MIM Synchronization Service to use a group managed service account.
  • Added "Use MIMSync account" option for MIM Service Management Agent to use Synchronization Service’s group-managed service account credentials to connect to MIM Service and MIM Service Database.
  • Accessibility improvements for customers by using MIM Synchronization Service Client together with a screen reader.

Privileged Access Management

  • PowerShell cmdlet "Get-PAMRequest" returns an additional property.
  • Enabled installation for PAM Monitoring Service, PAM Component Service to use group-managed service accounts.

More Information: Microsoft Identity Manager 2016 Service Pack 2 (build 4.6.34.0) Update Rollup is available

Cheers,

Jorge

————————————————————————————————————————————————————-
This posting is provided "AS IS" with no warranties and confers no rights!
Always evaluate/test everything yourself first before using/implementing this in production!
This is today’s opinion/technology, it might be different tomorrow and will definitely be different in 10 years!
DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
————————————————————————————————————————————————————-
########################### Jorge’s Quest For Knowledge ##########################
####################
http://JorgeQuestForKnowledge.wordpress.com/ ###################
————————————————————————————————————————————————————-

Posted in Forefront Identity Manager (FIM) bHold, Forefront Identity Manager (FIM) PCNS, Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Microsoft Identity Manager (MIM), Updates, Updates, Updates, Updates, Updates | 1 Comment »

(2017-06-23) Adding A Link To The SSPR Page In The ADFS FBA Page

Posted by Jorge on 2017-06-23


When users use Windows Integrated Authentication against ADFS through their Windows desktop/laptop the users are authenticated based upon the credentials they used to logon with onto that Windows desktop.laptop. If those users needed to reset their password or unlock their account, a link would need to be provided within the logon screen to point to the SSPR page or users would need to use some kind of kiosk PC.

However, when hitting the Forms Based Authentication page within ADFS, it would be nice if you could display a link on that same page if users needed to reset their password or unlock their account when for example on a mobile device. Something similar to the following:

image 

Figure 1: A Link To The SSPR Page On The FBA Page

If you want to do this, you can use the following steps

[Step 1]

Clone the current active ADFS web theme to a new ADFS web theme

First determine the current web theme

Get-ADFSWebConfig

Clone the current active web theme to a new web theme

New-AdfsWebTheme -Name <New Web Theme Name> -SourceName <Active Web Theme Name>

[Step 2]

Export the cloned web theme to a folder on the file system

Export-AdfsWebTheme -Name <New Web Theme Name> -DirectoryPath <Some Folder On The File System>

[Step 3]

Edit the file “onload.js” in the folder “<Some Folder On The File System>\Script” and add the following piece of code to the end of the file to show the link to the SSPR page in AAD on the FBA page (NOTE: you can use any other SSPR page if you want, such as the FIM/MIM SSPR page)

// Add link for password reset, if we find the forms authentication element in the page
var formsAuthArea = document.getElementById("formsAuthenticationArea");
if (formsAuthArea) {
    //Create the hyperlink
    var pwdResetLink = document.createElement(‘a’);
    var linkText = document.createTextNode("Click Here For Password Reset Or Account Unlock");
    pwdResetLink.appendChild(linkText);
    pwdResetLink.title = "Click Here For Password Reset Or Account Unlock";
    pwdResetLink.href = "
";’>";’>https://passwordreset.microsoftonline.com/?whr=<Your Domain In AAD>";
    pwdResetLink.target = "_blank";
    document.body.appendChild(pwdResetLink);

    //append to the authArea
    var authNArea = document.getElementById("authArea");
    authNArea.appendChild(pwdResetLink);
}

[Step 4]

Import the new edited “onload.js” file

Set-AdfsWebTheme -TargetName <New Web Theme Name> -AdditionalFileResource @{Uri=’/adfs/portal/script/onload.js’;path="<Some Folder On The File System>\script\onload.js"}

[Step 5]

Activate the new web theme

Set-AdfsWebConfig -ActiveThemeName <New Web Theme Name>

Now access an application and make sure to use the FBA page. The FBA page is used when coming from a mobile device on an external network or when not using WIA

Cheers,
Jorge

 

————————————————————————————————————————————————————-
This posting is provided "AS IS" with no warranties and confers no rights!
Always evaluate/test everything yourself first before using/implementing this in production!
This is today’s opinion/technology, it might be different tomorrow and will definitely be different in 10 years!
DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
————————————————————————————————————————————————————-
########################### Jorge’s Quest For Knowledge ##########################
####################
http://JorgeQuestForKnowledge.wordpress.com/ ###################
————————————————————————————————————————————————————-

Posted in Active Directory Federation Services (ADFS), Forefront Identity Manager (FIM) Portal, Forms Based AuthN, Self Service Password Reset, Self-Service Password Reset, Windows Azure Active Directory | 3 Comments »

(2017-06-04) User Verification Feature For FIM 2012 R2 And MIM 2016 (SP1)

Posted by Jorge on 2017-06-04


Ryan Newington released a new add-on for the FIM/MIM Portal some time ago. This add-on allows for the service desk to easily verify the identity of a person calling the service desk. At a high level, the user tells the service desk his/her account name which is looked up by the service desk. The service desk then generates a one-time code which is send through SMS to the previously registered mobile number of the calling user. The user receives the one-time code on his/her mobile phone through SMS and tells the service desk the one-time code that was received. If there is a match the service desk has successfully verified the identity of the calling user.

If the users are already registered for SMS-based SSPR, then this add-on is ready to use. You just need to install it and make it accessible through the user RCDC.

In my case I have adjusted the user view/edit RCDC to include the “Verify This User Using An SMS Token” link on the General TAB

image

Figure 1: The “Verify This User Using An SMS Token” Link On The General TAB Of The User Account Requiring Identification

After clicking on that link, the screen as shown in figure 2 opens where it presents some details of the user and a button [Send Code] to generate a one-time code and send it to the registered mobile number.

image

Figure 2: The Add-On In Action And Ready To Generate And Send A One-Time Code To The User

After clicking the [Send Code] button the generated one-time code is displayed as shown to the service desk in figure 3 and also send to the registered mobile phone number of the user

image

Figure 3: The Add-In In Action After Generating And Sending A One-Time Code To The User

If needed the service desk can send a new code or close the window.

The user receives the one-time code through SMS and tells the service the code to verify his/her identity

SNAGHTML3e901ed4

Figure 4: The One-Time Code Received By The User

This is so simple and yet so powerful to help those people calling the service desk for which their identity needs to be verified.

More details in the following blog post: http://blog.lithiumblue.com/2017/02/user-verification-add-on-for-fimmim.html

FIM/MIM add-on available through: https://github.com/lithnet/resourcemanagement-ui-userverification

Cheers,
Jorge

 

————————————————————————————————————————————————————-
This posting is provided "AS IS" with no warranties and confers no rights!
Always evaluate/test everything yourself first before using/implementing this in production!
This is today’s opinion/technology, it might be different tomorrow and will definitely be different in 10 years!
DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
————————————————————————————————————————————————————-
########################### Jorge’s Quest For Knowledge ##########################
####################
http://JorgeQuestForKnowledge.wordpress.com/ ###################
————————————————————————————————————————————————————-

Posted in Forefront Identity Manager (FIM) Portal, User Verification | Leave a Comment »

(2017-05-31) FIM Calendar Has Been Updated For MIM 2016 SP1

Posted by Jorge on 2017-05-31


In the past “https://github.com/pieceofsummer” provided the FIM calendar on github for FIM 2010 (R2). With the release of MIM 2016 (SP1), “https://github.com/ryannewington” updated the FIM Calendar to also work with MIM 2016 (SP1).

image

Figure 1: The FIM Calendar Updated For MIM 2016 (SP1)

Just follow the instructions in Ryan’s Github page for the FIM Calendar and it will work for you!

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Calendar, Forefront Identity Manager (FIM) Portal, RCDC | 1 Comment »

(2017-05-11) A Hotfix Rollup Package (Build 4.4.1459.0) Is Available for Microsoft Identity Manager 2016 SP1

Posted by Jorge on 2017-05-11


Microsoft released a new hotfix for MIM 2016 SP1 with build 4.4.1459.0. What it fixes can be found in this blog post. For additional or detailed info see MS-KBQ4012498. If you have installed build build 4.4.1237.0 you cannot install this package. Build 4.4.1237.0 was a fresh MIM 2016 SP1 install and this hotfix enables the upgrade to SP1 without the need to uninstall first and reinstall.

Download link

Issues that are fixed or improvements that are added in this update

MIM Service

Issue 1

Authentication workflow fails with "The semaphore time out period has expired" after custom client requests AuthN token.

After you install the update, the request will complete as expected, and a clear message about a communications error is thrown into the event log.

Issue 2

Under a heavy load, there may be race condition situation when two MIM Service instances try to process the same workflow at the same time. This may cause workflow processing to fail.

After you install this update, this problem no longer occurs.

Issue 3

Set partitioning may not work if a set criteria contains a sub-condition. After you install this update, set partitioning works correctly.

Issue 4

Over time, some processing data accumulates in the MIM Service database, which may cause performance issues. This causes a problem when many Object IDs are retained in the FIM.Objects table. The SQL Server Agent job runs stored procedure FIM_DeleteExpiredSystemObjectsJob and removes expired system objects by collecting all the requests and any object references, and puts their object IDs into the ExpiredObjectKeys table.

Next, all values in the ObjectValue* tables are removed for each ID number in the ExpiredObjectKeys table. Finally, if the values in the ObjectValue* tables have indeed all been deleted, the matching row in the ExpiredObjectKeys table is also deleted. However, the object ID itself is never deleted from the fim.Objects table.

After you install the update, a new stored procedure in the debug namespace is added to clean up the database of these objects.

Stored Procedure Name: debug.DeleteObjectRemainders
Syntax: exec debug.DeleteObjectRemainders

Issue 5

After MIM SP1 clean installation, MIM Reporting or MIM Service Partitioning may not work correctly. After you install this update, both MIM Service reporting and partitioning are installed and function correctly.

Issue 6

If the FIMService database compatibility level is set to 120, SQL deadlocks may occur. After you install this update, these deadlocks no longer occur.

Improvement 1

Verbose trace logging in the MIM Service can now be enabled without forcing a restart of the service.

One new section is added to the Microsoft.ResourceManagement.Service.exe.config file to support this functionality. After you install this update, this new section is now present.

<dynamicLogging mode="true" loggingLevel="Critical" />

Logging can be set to any level between Critical and Verbose.

Two output files will be written to the installation folder for the MIM Service. It is important for the MIM Service account to have write permissions to this folder.

Folder location:

%programfiles%\Microsoft Forefront Identity Manager\2010\Service

Files written:

Microsoft.ResourceManagement.Service_tracelog.svclog

Microsoft.ResourceManagement.Service_tracelog.txt

Improvement 2

Support for System Center 2016 Service Manager and Data Warehouse is added for MIM Service Reporting.

Before this update, MIM Reporting could not install and perform with System Center 2016 Service Manager Console.

After you install this update, MIM Reporting can be installed and perform without a need to pre-install SCSM console, for any supported version of SCSM.

Synchronization Service

Issue 1

If the FIM Service management agent exports an object deletion but does not receive a confirmation of the deletion, that same object may be partly recreated in the FIMService.

After you install this update, an error will be displayed in the error list of the export run, and the recreation does not occur.

Issue 2

When the DN of an object is also the anchor, it cannot be renamed. Instead, you receive the following exception:

Unexpected-error

“The dimage has a different anchor or primary object class from what is on the hologram.”

After you install this update, the rename is processed as expected.

Issue 3

The Encryption Key Management Key (miiskmu.exe) tool may not abandon keys because of a time-out caused by a database lock.

After you install this update, the keys are processed without encountering the time-out.

Issue 4

When you run a synchronization profile step, periodic performance issues are encountered.

A fix was made to the mms_getprojected_csrefguids_noorder stored procedure to help improve performance.

Issue 5

Under certain circumstances, filter-based sync rules are applied even when they should not be.

After you install this update, the sync rule is applied only if it should be.

Issue 6

On Export for the Generic LDAP Connector, if the creation of an Audit Log file has been configured, the export run profile stops without posting a BAIL error.

After you install this update, an Export run profile step will run properly on the Generic LDAP Connector when the Audit Log File creation option is enabled.

MIM Password Reset Portal

Issue 1

When you reset a password by using the SMS authentication gate, an incorrect message is displayed to the user:

You need to click Next once you completed this call" and in next line "Call Verified:

After you install this update, the incorrect string, “Call Verified:” is removed from that dialog box.

MIM Identity Management Portal

Issue 1

Drag-and-drop users into the Remove box to delete or remove a member for group membership does not work in all circumstances.

After you install this fix, users can drag-and-drop users into the Remove box when you manage manual group memberships.

Issue 2

Local Date/Time settings being ignored for English (Australia).

After you install this update, the local date/time format settings are applied.

Issue 3

Custom controls are not initialized if we have custom event parameters in the Resource Control Display Configuration (RCDC).

After you install this fix, the custom controls are initialized as expected.

Issue 4

Error handling in the Resource Control Display Configuration is sometimes unclear.

In this update, error notifications are customized to describe the error more clearly.

Issue 5

When you use a copied link to a custom object in the Identity Management Portal, the object does not display as expected.

After you install this update, the custom object displays as expected from the copied link.

Issue 6

When you try to install the Identity Management Portal on SharePoint 2016 after you uninstall or during an update, the Portal is not installed. Additionally, you receive the following exception:

Timeout expired and error in Sharepoint log: Package name does not exist in the solution store.

Installing this update, setup will restart the SharePoint timer service to retry the failed SharePoint jobs, so setup can now complete.

Issue 7

The Approval View RCDC has incorrect symbols and displays an error.

After you install this fix, the approval view RCDC is displayed as expected, and does not throw an exception.

Issue 8

The membership buttons if custom group objects do not work correctly.

After you install this fix, the group membership buttons work as expected.

Issue 9

When you view the MIM Identity Management Portal by using the Firefox browser, object list-views, such as Users and Distribution Groups, do not display properly.

After you install this update, object list-views display as expected when you use the Firefox browser.

Issue 10

When you view the MIM Identity Management Portal by using the Internet Explorer browser, object list-views headings may not be left-aligned in the column.

After you install this update, object list-view headings display left aligned as expected.

Issue 11

When you run the MIM Portal in SharePoint 2016, the Join, Leave, Add Member, and Remove Member buttons do not work as expected on custom group object types.

After you install this update, these buttons work as expected against custom group object types.

Improvement 1

To address the fact that the default value of a Group Scope cannot be set, two optional properties were added to the UoCDropDownList and the UocRadioButtonList.

  • DefaultValue
    • This is an optional property. Use this property to define a default value for the control if the control is used to create new data

For example:

   <my:Control my:Name="My UocDropDownList" my:TypeName="UocDropDownList"
        …
         <my:Properties>
          ...
           <my:Property my:Name="DefaultValue" my:Value="MyDefault" />
  • Condition
    • Condition is optional attribute in property and it is used to specify the condition when the property is applied. The control can have several properties that use the same name but disjoint conditions
    • The syntax for condition is as follows:
      • my:Condition="[left part] [condition] [right part]
    • Notes
      • [left part] has the following options:
        • Binding Source and path
        • Simple value
      • [condition] has the following options:
        • ==
        • !=
      • [right part] has the following options:
        • Binding Source and path
        • Simple value

Example of creation different defaults for different types of group:

<my:Control my:Name="My UocDropDownList" my:TypeName="UocDropDownList"
        …
         <my:Properties>
          ...
           <my:Property my:Name="DefaultValue" my:Value=" MyDefautltForDistributionGroups" my:Condition="{Binding Source=object, Path=Type} == Distribution" />
          <my:Property my:Name="DefaultValue" my:Value=" MyDefautltForSecurityGroups " my:Condition="{Binding Source=object, Path=Type} == Security" />
-

Improvement 2

The name for all activity types that you created through Portal is authenticationGateActivity. After you install this update, all new ActivityType objects that are created, will have the following activity name values, according to type:

  • Authentication: authenticationActivity1… authenticationActivityN
  • Authorization: authorizationActivity1… authorizationActivityN
  • Action: actionActivity1… actionActivityN

Improvement 3

Requestor or Approver has no means to provide Justification upon creating the request or Approving/Rejecting pending request.

With this update, a justification field is added to the Create Request view, and new justification request/workflow data can be used. The following attributes are added [//Request/Justification] and [//WorkflowData/Reason] parameters.

Certificate Management

Issue 1

When enrolling for a virtual smart card, entering a pin with fewer than 8 characters returns a misleading error.

After you install this update, a relevant error is returned to the user.

Issue 2

When renewing a smartcard, a user can be caught in an infinite renew loop.

The following steps will cause this issue:

  1. The current smartcard profiles enter the renew window:
    • User receives an email from FIM CM Service asking him to complete a renew request
  2. User successfully executes the renew request and retrieves all certs renewed.
  3. Several hours later, user receives a second email from FIM CM Service.
    • This is not expected as the profile has already been renewed.
  4. The user will end in an infinite renew loop if he executes all the requests FIM CM Service creates.

After you install this update, only the correct requests are created, and there is no infinite loop.

Issue 3

If the Delta CRLs are disabled on a Certification Authority used by MIM Certificate Management, the exception ERROR_FILE_NOT_FOUND will be thrown by MIM CM.

After you install this update, no exception is thrown.

Issue 4

MIM CM does not support NonAdmin mode when you work with virtual cards. Virtual smart card could be only created by the MIM CM Client during enrollment. It is also required to have local admin rights to create a virtual smart card. So, only local admins can enroll for a new virtual smart card through MIM CM Portal.

After you install this hotfix, a new registry key will configure the MIM CM client to run in non-admin mode. Notice that the virtual smart card must be pre-created before the user can enroll their virtual smart card under the non-Admin mode settings.

To enable NonAdmin mode, change or create DWORD value NonAdmin=1 under the following registry key on a client computer:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\CLM\v1.0\SmartCardClient

Issue 5

When you use the MIM CM REST API to change the smart card status to “Disabled”, an Error 501 (NotImplemented) is returned.

After you install this update, this same code will successfully disable the smart card.

PUT …/api/v1.0/requests/{reqID}/smartcards/{smartcardID}
{
   “status” : “Disabled”
}

For more information, see the Update Smartcard Status topic on the Microsoft website.

Issue 6

MIM CM Server version 4.3.1999.0 or a later version (until current hotfix) cannot work with older version of CM Clients (FIM 2010R2 and MIM).

After you install this update, MIM CM Server will work with older MIM and FIM 2010R2 CM Clients (FIM 2010R2 Clients version 4.1.3508.0 and later versions were tested).

Issue 7

"OfflineUnblock" request could not be created by using the following call from the MIM CM REST API:

https://docs.microsoft.com/en-us/microsoft-identity-manager/reference/create-request

After you install this update, this same code will successfully submit the OfflineUnblock request.

Issue 8

There is no possibility to use smart card id as a parameter when you create a "Disable"(or any other type) request by using the following call from MIM CM REST API:

https://docs.microsoft.com/en-us/microsoft-identity-manager/reference/create-request

Only the "profile" parameter is available.

For example:

POST api/v1.0/requests
    {
        "target":"e5008CDD9E614F9BBEDC45EEEE6776F0",
        "comment":"any comment",
        "type":"Disable",
        "profiletemplateuuid":"7860DEBB-771D-464E-AAC5-2F093282CE66",
        "datacollection":[],
        "priority":"1",
        "smartcard":"49BFE09C-5590-4CC4-8A21-FB4289F4F6C8"  
     }

After you install this update, you can use the smart card id as a parameter.

Notice that the smart card id is not the same as that of the smart card serial number. Smart card id is created by the MIM CM for each active smart card.

Issue 9

MIM CM Client tracing does not log datetime. After you install this update, the date time data will be included in the client trace log.

Issue 10

Cancelling a user in the existing virtual smart cards modal dialog box can lead to an unusal and confusing error message instead of simply cancelling the operation.

After you install this update, the operation cancels the user.

Issue 11

Retire flow stops responding for TPM virtual smart cards when the NonAdmin option is set in the registry.

Issue 12

Duplicate Revocation Settings under Replace policy does not apply to a duplicated profile. After you install this update, the flow works as expected. The revocation delay is successfully copied to the duplicated profile.

Issue 13

MIM Certificate Management does not log web service exception data. After you install this update, CM now logs all web service exception data.

Improvement 1

Before this update, the only options for PIN rules in the MIM CM Modern App is MinimumPinLength.

After you install this update, the following validation settings are now available:

  • Digits
  • LowercaseLetters
  • MaxLength
  • MinLength
  • SpecialCharacters
  • UppercaseCharacters

MIM Add-in for Outlook

Issue 1

The 32-bit MIM Add-in dlls (for example, OfficeintegrationShim2010.dll) are unsigned after you apply the MIM SP1 MSP update (4.4.1302.0 build).

In this update, all files are signed as expected.

Cheers,

Jorge

———————————————————————————————

* This posting is provided "AS IS" with no warranties and confers no rights!

* Always evaluate/test yourself before using/implementing this!

* DISCLAIMER: https://jorgequestforknowledge.wordpress.com/disclaimer/

———————————————————————————————

############### Jorge’s Quest For Knowledge #############

######### http://JorgeQuestForKnowledge.wordpress.com/ ########

———————————————————————————————

Posted in Forefront Identity Manager (FIM) bHold, Forefront Identity Manager (FIM) Certificate Management, Forefront Identity Manager (FIM) PCNS, Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Microsoft Identity Manager (MIM), Updates, Updates, Updates, Updates, Updates, Updates | 1 Comment »

(2017-05-11) A Hotfix Rollup Package (Build 4.4.1302.0) Is Available for Microsoft Identity Manager 2016

Posted by Jorge on 2017-05-11


Microsoft released a new hotfix for MIM 2016 with build 4.4.1302.0. What it fixes can be found in this blog post. For additional or detailed info see MS-KBQ3201389. If you have installed build build 4.4.1237.0 you cannot install this package. Build 4.4.1237.0 was a fresh MIM 2016 SP1 install and this hotfix enables the upgrade to SP1 without the need to uninstall first and reinstall.

Issues that are fixed in this update

Microsoft Identity Manager 2016

Issue 1

When you try to upgrade to Microsoft Identity Manager SP1, you may have to uninstall and reinstall previous versions of Microsoft Identity Manager.

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Forefront Identity Manager (FIM) bHold, Forefront Identity Manager (FIM) Certificate Management, Forefront Identity Manager (FIM) PCNS, Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Updates, Updates, Updates, Updates, Updates | 1 Comment »

(2016-11-23) Microsoft Identity Manager (MIM) 2016 Service Pack 1 Packages

Posted by Jorge on 2016-11-23


Somewhere in September Microsoft released SP1 for MIM  2016 as you can read here. The first package was MIM 2016 with SP1 already included. If you wanted to install SP1 on your current deployment you had to uninstall first and reinstall with MIM 2016 with SP1 included where you would reuse all DBs. This procedure is described here. However, for some customers uninstalling everything and reinstalling it is a little bit too much. The impact and downtime is not acceptable. Because of that Microsoft has also released a SP1 update package that can be deployed on existing MIM 2016 deployments.

There is a subtle different of which you must be aware:

  • MIM 2016 with SP1: build 4.4.1237.0
  • SP1 update package: 4.4.1302.0

As you can see the builds are different! Please be aware you cannot apply the SP1 update package to a deployment already running MIM 2016 with SP1. You can only apply it when running MIM 2016 RTM.

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Forefront Identity Manager (FIM) bHold, Forefront Identity Manager (FIM) Certificate Management, Forefront Identity Manager (FIM) PCNS, Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Microsoft Identity Manager (MIM), Updates, Updates, Updates, Updates, Updates, Updates | 1 Comment »

(2016-10-09) How To Clear A Value (NULLing It) From An Attribute On An Object In The FIM/MIM Portal?

Posted by Jorge on 2016-10-09


It might be the case you want to flow a NULL value into some attribute, or in other words clearing an attribute value, when meeting some condition.

In the sync rules a "Null()" function exists, which might give you the idea that it flows a NULL value. Au contraire, mon ami! The "Null()" function basically means "do nothing". One of the examples of using that function is in combination with the "IIF()" function. The "IIF()" function translates into "If…Then…Else". Sometimes, you just want to have "If…Then" and you do not care about the “Else”, and that’s when you use the "Null()" function when using the “IIF()” function.

For example:

IIF(Eq(X,"1"),Y,Null()) ==> Z

means…..

If X=1 then Z=Y

So, how do you clear a value in the FIM/MIM Portal? It is not possible by default, therefore you need a custom workflow activity to do that for you.

On codeplex you will find Soren Granfeldt’s "FIM 2010 Granfeldt Workflow Activity Library". This Activity Library is a collection of generic custom workflows for use with FIM 2010 R1/R2 and MIM 2016. The purpose of this collection of workflow activities is to have activities that can solve the most common tasks in a traditional FIM installation – in one library.

As you can read in the documentation, it now supports an activity to clear an attribute value from the specified attribute. However, when downloading the activity, the old activity that does support this is still targeted for download. A workaround for this is to use the Code Run activity.

After adding the “Code Run” activity to the workflow:

  • Enter something in the “Title” field explaining what it does
  • In the “References (DLL’s)” field enter: System.dll
  • No need to specify anything in the “Parameters” field
  • In the “Code” field specify the following code:

using System;
public class FIMDynamicClass
{
            public static object FIMDynamicFunction()
            {
                    return null;
            }
}

  • In the “Destination” field specify the targeted attribute for which its value must be cleared using the format: [//Target/<Attribute>] where <Attribute> is replaced with the attribute you need to be cleared

image

Figure 1: Clearing An Attribute Using The Code Run Activity In Soren Granfeldt’s "FIM 2010 Granfeldt Workflow Activity Library"

You can also use the MIM WAL activity to do the same which is available on Github. The MIMWAL is a Workflow Activity Library (WAL) solution for configuring complex Workflows in the Microsoft Identity Manager (MIM) 2016 and Forefront Identity Manager (FIM) 2010 R2 solution.

After adding the “Update Resources” activity to the workflow:

  • Enter something in the “Activity Display Name” field explaining what it does
  • No need to use the advanced features of the activity
  • In the “Value Exprssion” field specify 2 quotes ""
  • In the “Target” field specify the targeted attribute for which its value must be cleared using the format: [//Target/<Attribute>] where <Attribute> is replaced with the attribute you need to be cleared
  • Make sure to check “Allow Null”

image

Figure 2: Clearing An Attribute Using The Update Resources Activity In The MIMWAL (MIM Workflow Activity Library)

Have fun!

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Activities, Forefront Identity Manager (FIM) Portal, Workflow | Leave a Comment »

(2016-09-25) FIM/MIM Configuration Export Scripts

Posted by Jorge on 2016-09-25


When upgrading FIM or MIM to a newer version, you may need to uninstall the previous version first before installing the newer version. During the installation of the new version you need to reenter all the required information. But where do you get that data from? Either you have some installation/configuration guide or you make sure you make a copy (copy, export, backup) of the previous configuration so that you can look it up easily.

Making a copy of the previous configuration manually can take quite some time to finish and if unlucky you might even forget something!

Yes, you guessed it, PowerShell to the rescue! Smile

With the upcoming SP1 for MIM 2016 you may need this script.

Please provide feedback through the comments section OR you the contact page

DISCLAIMER (READ THIS!):

  • I wrote this script, therefore I own it. Anyone asking money for it, should NOT be doing that and is basically ripping you off!
  • The script is freeware, you are free to use it and distribute it, but always refer to this website (https://jorgequestforknowledge.wordpress.com/) as the location where you got it.
  • This script is furnished "AS IS". No warranty is expressed or implied!
  • I have NOT tested it in every scenario nor have I tested it against every Windows and/or AD version and/or FIM/MIM version and/or SQL version
  • Always test first in lab environment to see if it meets your needs!
  • Use this script at your own risk!
  • I do not warrant this script to be fit for any purpose, use or environment!
  • I have tried to check everything that needed to be checked, but I do not guarantee the script does not have bugs!
  • I do not guarantee the script will not damage or destroy your system(s), environment or whatever!
  • I do not accept liability in any way if you screw up, use the script wrong or in any other way where damage is caused to your environment/systems!
  • If you do not accept these terms do not use the script in any way and delete it immediately!

SYNTAX:

<PoSH Script File> [-allConfig] [-mainConfig] [-fimSyncConfig] [-fimSvcConfig] [-fimPortalConfig] [-fimPwdRegPortalConfig] [-fimPwdResetPortalConfig] [-backupDBs] [-mainBackupFolder <Folder To Backup/Export To>]

This PoSH script exports FIM/MIM configuration as a quick backup method. If applicabel, the following configuration components are exported:

  • FIM/MIM Main Configuration;
  • FIM/MIM Sync Configuration;
  • FIM/MIM Service Configuration;
  • FIM/MIM Portal Configuration;
  • FIM/MIM Registration Portal Configuration;
  • FIM/MIM Reset Portal Configuration;
  • SQL Server Database

I have NOT added support for:

  • FIM/MIM PCNS Configuration;
  • FIM/MIM CM Configuration;
  • FIM/MIM Reporting Configuration

Currently there is no import script. You will have to do it manually

Get the export script from HERE

When upgrading, you only need to the [-mainConfig option on every FIM server and the [-backupDBs] option on the SQL server! For example:

  • Everything on one server (incl. SQL server)? –> <PoSH Script File> -mainConfig -backupDBs -mainBackupFolder <Folder To Backup/Export To>
  • FIM/MIM servers without SQL –> <PoSH Script File> -mainConfig -mainBackupFolder <Folder To Backup/Export To>
  • SQL server without FIM/SQL –> <PoSH Script File> –backupDBs -mainBackupFolder <Folder To Backup/Export To>

REMARK: the installation of a newer version against an existing database WILL upgrade the database. Make sure to have a backup of your FIM/MIM DBs!!!

PARAMETER allConfig

Exports All The Configuration Of FIM/MIM. This is basically all the options combined.

PARAMETER mainConfig

Exports Only The Main Configuration Of FIM/MIM. This should be the option to use when upgrading FIM/MIM.

PARAMETER fimSyncConfig

Exports Only The FIM Sync Specific Configuration

PARAMETER fimSvcConfig

Exports Only The FIM Service Specific Configuration

WARNING: This export might take some considerabel amount of time!!!

PARAMETER fimPortalConfig

Exports Only The FIM Portal Specific Configuration

PARAMETER fimPwdRegPortalConfig

Exports Only The FIM Password Registration Portal Specific Configuration

PARAMETER fimPwdResetPortalConfig

Exports Only The FIM Password Reset Portal Specific Configuration

PARAMETER backupDBs

Backup Only The Databases In Use By FIM

PARAMETER mainBackupFolder

Main Backup Folder To Store The Backup

image

Figure 1: Exporting The FIM/MIM Configuration Before The Upgrade

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Backup/Export, Backup/Export, Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Microsoft Identity Manager (MIM) | 2 Comments »

(2016-07-21) A Hotfix Rollup Package (Build 4.3.2266.0) Is Available for Microsoft Identity Manager 2016

Posted by Jorge on 2016-07-21


Microsoft released a new hotfix for MIM 2016 with build 4.3.2266.0. What it fixes can be found in this blog post. For additional or detailed info see MS-KBQ3171342

Download link

Issues that are fixed and features that are added in this update

Privileged Access Management (PAM)

Issue 1

When you create a PRIV ONLY PAM user, the PAM monitor service throws the following warning message when it tries to update the PAM users email in active directory and the value already exists:

System.Exception: Set PAM object dictionary already contain attribute ‘Email’.

FIM add-ins and extensions

Issue 1

SSPR windows clients on systems that use a high DPI setting have an incorrect scaling of the final page (the Password Reset Flow page) in which the radio buttons are overlapped.

Issue 2

SSPR windows clients have text messages that overlap after a password reset if the resulting message (success or error) contains more than three lines.

FIM Certificate Management

Issue 1

The ExecuteOperations.Disable operation from the Microsoft.Clm.BusinessLayer.Shared.dll public library does not work correctly and returns an error because of incorrect object initialization.

Issue 2

A smart card search takes 3.5 minutes on an idle server. Additionally, the search never ends if the server is stressed.

Issue 3

There is a redundant space in the "Profile Summary" string on the Request Complete page for some languages.

Issue 4

The Duplicate Revocation Settings policy is replaced because some users could not set it.

Issue 5

A certificate in the Certificate Management portal may use the LDAP CN name instead of DisplayName when it calls REST.

Issue 6

For ZH-Hans and some other languages, link underlining in the Certificate Management portal is misplaced (stroke instead of an underline) because of a font issue.

FIM Synchronization Service

Issue 1

Under certain conditions, the file selection dialog box does not appear on the MA configuration wizard pages.

Issue 2

Error messages are logged in the event log (such as Event ID 6313). Additionally, performance counters don’t work.

Issue 3

The Sync Service crashes when you run a Full Synchronization process that has Equal Precedence set for attributes that exist in IAF or EAF.

Issue 4

When an incorrect page size (either less than the minimum or more than the maximum) is used for the run profile of the ECMA2 management agent, the page size value quietly changes to the minimum or the maximum after you click Finish.

Issue 5

An error message from the Management Agent cannot be parsed if it contains some special symbols. Therefore, the error message doesn’t appear in the error list as expected, and a non-informative error window appears.

Issue 6

You receive a "Reference to undeclared entity ‘qt’" error message when you run the history process and the history text contains the "greater than" (>) symbol.

Issue 7

New Functionality: The ability to skip the Management Agent during the import of a server configuration is added. A new -Skip parameter is added to the Import-MIISServerConfig cmdlet.
The names of MAs to skip should be delimited by a semicolon (;), as in the following example:

Import-MIISServerConfig -Path "C:\exported" -Skip "FIMMA;ADMA"

Note If you do not use the -Skip parameter, the default behavior occurs.

Issue 8

A "MEMORY_ALLOCATION_FAILURE" error occurs in the Performance Monitoring tool when the performance data .dll file cannot open the process.

FIM Portal

Issue 1

Multivalued labels are displayed incorrectly in a single line in the UI.

Issue 2

When you upload Resource Control Display Configurations (RCDC), the xml-format is not verified.

Issue 3

You cannot drag-and-drop a user to the Remove box to delete the user or to remove the user from a group membership.

Issue 4

Local date and time settings are ignored for the Australian English (en-AU) locale.

Issue 5

This update enables customizations that have controls that are shown or hidden based on the state of the email-enabling check box.

An additional attribute to RCDCs configuration data is included in this update. The Now Event element may have a Parameters attribute. For Group RCDC for the OnChangeEmailEnabling event, the element should contain a comma-separated, case-sensitive list of controls to show or hide.

Example

<my:Control my:Name="EmailEnabling" my:TypeName="UocCheckBox"
 my:Caption="%SYMBOL_EmailEnablingCaption_END%"
 my:Description="%SYMBOL_EmailEnablingDescription_END%"
 my:AutoPostback="true" my:RightsLevel="{Binding Source=rights,
 Path=Email}">
        <my:Properties>
         <my:Property my:Name="Text" my:Value="%SYMBOL_EmailEnablingValue_END%"/>
        </my:Properties>
        <my:Events>

Note If the Parameters attribute is not included, the default behavior occurs.

FIM Service

Issue 1

In SharePoint Server 2013 and later versions, if you edit a workflow or update an email template by using the FIM Portal, the version is automatically updated to 4.0.0.0. This causes a system error message during processing.

BHOLD

Issue 1

When you add a user to an organizational unit (OU) that has some incompatible permissions in the OUs role, all the incompatible permissions are assigned.

Issue 2

Some issues are fixed for attribute-based authorization (ABA) roles that are assigned to a user when the roles have incompatible permissions.

Issue 3

When you use Access Management Connector to provision new OUs with a parent OU, all the parent OU roles are inherited but are also disabled.

Issue 4

An error occurs in BHOLD during installation in Internet Information Services (IIS) 10.

Issue 5

If two or more roles that are assigned to a user who has the same permissions as the roles, and the roles use the endDate attribute, you cannot extract a user permission that has the latest date.

Issue 6

An email alias is truncated if it is longer than 30 characters.

Cheers,

Jorge

———————————————————————————————

* This posting is provided "AS IS" with no warranties and confers no rights!

* Always evaluate/test yourself before using/implementing this!

* DISCLAIMER: https://jorgequestforknowledge.wordpress.com/disclaimer/

———————————————————————————————

############### Jorge’s Quest For Knowledge #############

######### http://JorgeQuestForKnowledge.wordpress.com/ ########

———————————————————————————————

Posted in Forefront Identity Manager (FIM) bHold, Forefront Identity Manager (FIM) Certificate Management, Forefront Identity Manager (FIM) PCNS, Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Updates, Updates, Updates, Updates, Updates | Leave a Comment »