Shawn's MIIS/ILM/FIM Tricks, PKI Hints, and Résumé Writing Prevention Tips

FIM/ILM tricks: 13 months later... FIM 2010 observations and other useful information (maybe)

2009-12-23T21:54:00Z

Hello Everyone!

I have had an interesting time the last 13 months or so. I last posted about trying to create a Fantasy Football engine with ILM "2" and I was trying to get a live feed from a statistics engine to work with. Needless to say, that never worked out. Live statistics services are very expensive. I still want to revisit the concept with fictional data one of these days, however, I have been working with some more practical uses of the product formerly known as ILM "2" and currently known as FIM 2010 (Forefront Identity Manager) and I want to share some of the experiences here.

So in the last 13 months, I have worked with ILM "2" and ILM 2007 and FIM 2010 in various projects and I have been kept very busy. I have seen ILM "2" evolve into FIM 2009 and then 2010 and I am definitely happy with the work the FIM product group has done. They took some extra time getting some things right and I feel the end result will a very solid product.

A few observations:

The FIM Synchronization Service and Synchronization Manager are nearly identical to the MIIS Service in MIIS 2003/ILM 2007 with some performance improvements. Any previous configuration created in MIIS 2003/ILM 2007 should translate nicely into the FIM Sync Service, including rules extensions.
The FIM Portal takes a while to get used to, especially if you are not versed in IIS or Sharepoint but the resources available on TechNet definitely make up for someone (like me) who is a specialist in MIIS/ILM making the transition to FIM
READ THE RELEASE NOTES!! Trust me. Also, while you read the Getting Started pages, don't skip steps.

So also during my time away from the Blogosphere, I got to work on some interesting projects, including the Microsoft Retail Stores, where I created a management agent for Dynamics AX using the Extensible Connectivity Management Agent and the Dynamics AX Business Connector. I will post more details about the Dynamics AX management agent on my MSDN blog soon.

Definitely more to come, hopefully this time it won't be 13 months later.

--Shawn

This posting is provided "AS IS" with no warranties, and confers no rights.

ILM FFL - I haven't forgotten about it

2008-11-25T19:34:00Z

Hello Everyone,

Long time no type. I got super busy and the blog is unfortunately the first thing to lapse. I haven't forgotten about the ILM FFL and I intend on finishing this concept.

A couple of changes:

ILM "2" will be used instead of ILM 2007 FP1.

Until I find a suitable (free) feed of statistics, flat files will be used to import statistics. We'll work out the format later. I've been doing some work on the back end to try to get statistics feeds. Live data is not cheap.

Hopefully more to come later.

--Shawn

This posting is provided "AS IS" with no warranties, and confers no rights.

ILM Tricks: ILM FFL Specification (part 1)

2008-08-14T20:07:00Z

Hello Everyone!

On my last post I proposed we use Identity Lifecycle Manager 2007 with Feature Pack 1 as a Fantasy Football engine. This post will serve as part 1 for the initial specification for the engine. Thoughts are not in any particular order. The direct ILM implications are bolded.

-->Typical outside Fantasy Football Leagues (FFLs) have of anywhere from 8-16 Individual Teams (ITs) where a team is set up by the Fantasy Team Owner (FTO). Since the initial rules specified in the first TechNet post that we would have a Hybrid College/Pro League and our depth of players is greater, we're going to design the league to enable leagues of up to 64 ITs. We'll set the minimum at 2 to leave the possibility of a head-to-head league open.

-->Units: Pro Football Player (Pro), College Football Player (CP), Fantasy League Owner (FLO), Fantasy Team Owner (FTO), Individual Team (IT), Individual Leagues (IL). Each will have a unique identifier.

-->A FLO must always be a FTO. A FTO can own many ITs, but only one IT per IL. Pros and CPs are available for each IL and can only be used once per IL on an IT.

-->Metaverse object types will be created for Pros, CPs, FTOs, ITs and ILs.

-->FTOs that are FLOs will have a reference attribute for the IL that that they are the FLO for.

-->ILs will have a reference attribute listing the ITs

-->Pros and CPs positions that will be considered for league use are Quarterback (QB), Fullback/Tailback/Runningback (RB), Wide Receiver (WR), Tight End (TE), Team offensive line (OL), Kicker (K), Team Defense + Special Teams (D/ST), Interception Specialists (IS), Tackling Specialists (TS), Sack Specialists (SS), Kick Returners (KR). None of these positions are mandatory. Each Pro or CP will have a mandatory multi-valued attribute that identifies them as one or more of those positions. A WR could also be a KR, for example, hence the reason for the multi-valued attribute.

-->We will move toward near-real-time scoring, however since most of the statistics services are expensive, we will use a text format to input scoring initially. An ILM Management Agent will be created for the CP statistics and a Management Agent will be created for Pros Statistics.

-->Statistical fields will be represented as attributes.

-->The engine will be built so scoring will be determined by the FLO and will be flexible to allow weights for Pro and CP statistics, if needed as well as weight toward player positions. The weights will be applied in attribute flow.

-->Since College schedules are not as consistent as professional schedules, this adds a complexity to the league that can be desired or undesired. Because of this, and the Professional bye week, there will be functionality for automatic bye week adjustment where an unused player will be used in the place of a bye week player. More difficult leagues will not utilize this capability.

This is all I can come up with right now. Keep the e-mails coming and we'll start building this thing out later this week or into next.

Have a good day!

--Shawn

This posting is provided "AS IS" with no warranties, and confers no rights.

MIIS/ILM Tricks: ILM Fantasy Football

2008-08-12T22:00:00Z

Hello Everyone!

In the light of the upcoming football season, I am going to start a new series of blog posts where we will utilize Identity Lifecycle Manager to create our own Fantasy Football engine. The posts will split time between this TechNet blog and my MSDN blog, http://blogs.msdn.com/therabournidentity. The goal is to think outside of the box, have fun and hopefully associate our findings with real-world issues.

Rules of Engagement:

1. We will utilize Identity Lifecycle Manager 2007 with Feature Pack 1 as the main engine and since I use Virtual Machines on the road, I will use one single virtual machine for the entire solution. When relevant scenarios arise, I will let everyone know what the good practices are.

2. We are only allowed to use Active Directory, ADAM, SQL and File-based Management Agents.

3. The Fantasy Football league will be a Hybrid College/Professional league. Players will be able to select College and Professional players and rules will be adjusted accordingly.

4. Once the next ILM version is released, we will upgrade the entire system.

5. Rules Extensions will be written in both C# and Visual Basic and posts will be made on my MSDN blog.

6. Reader submissions and ideas will be accepted and fully credited.

7. Each post will have the appropriate technical level in the title (100-200-300-400)

Later this week, we will create specification of the environment on the TechNet blog.

Thanks!

--Shawn

This posting is provided "AS IS" with no warranties, and confers no rights.

MIIS/ILM Tricks: Where did the post go?

2007-12-11T22:45:00Z

Hello!

To stay consistent with the overall theme of MSDN (Developers) and Technet (IT Professionals), the MIIS/ILM Related Posts with source code in them have been placed in my newly created MSDN blog: http://blogs.msdn.com/therabournidentity

Have a good day!

--Shawn

This posting is provided "AS IS" with no warranties, and confers no rights.

MIIS/ILM Tricks - Breakdown of Exchange Provisioning and Other Changes in ILM 2007 FP1

2007-12-07T21:01:00Z

I use a lot of acronyms for this post, so I wanted to build a “key” so I wouldn’t get confused

o Microsoft Identity Integration Server 2003 Service Pack 2 (later abbreviated as MIIS 2003 SP2, MIIS SP2 or MIIS) + Certificate Lifecycle Manager (CLM) = Identity Lifecycle Manager (abbreviated as ILM 2007 or ILM)

o Identity Lifecycle Manager 2007 Feature Pack 1 (abbreviated as ILM 2007 FP1 or ILM FP1) = ILM 2007 + Vista client support for CLM and other CLM enhancements + Exchange 2007 support in the identity engine + Cumulative updates since ILM 2007/MIIS SP2

o MIIS and ILM (no FP) refer to binary versions 3.2.559-3.2.10xx

o ILM FP1 refers to binary versions 3.3.118 and later

One of the more frequently asked questions regarding ILM 2007 FP1 is, “What does ILM 2007 FP1 offer me above and beyond ILM 2007 or MIIS 2003 SP2 with regard to the metadirectory engine?”

There are many improvements to CLM. But for the metadirectory engine, or the beast formerly known as MIIS, there are a few fixes beyond ILM 2007/MIIS 2003 SP2 described in the ILM FP1 release notes:

· Run profiles listed in the Run Profile dialog box are automatically sorted alphabetically.

· The versioning for the CLMUtils class has been corrected. The CLMUtils class can now be used with Visual Basic .NET. (side note: fixed in 3.2.1005, see http://support.microsoft.com/?id=937561 )

· Any management agent for Lotus Notes created with ILM 2007 FP1 will be configured to run out of process by default. This is to allow for memory issues with the IBM Notes 7 client. (side note: fixed in 3.2.1001)

· When the ILM 2007/MIIS 2003 server was busy and the Run History information was refreshed, a false out-of-memory status could be generated. This feature pack corrects this condition. (side note: fixed in 3.2.1001)

Again, I am talking specifically about the metadirectory engine. Looking at the release notes I see this information:

· The management agent for Active Directory Global Address List (GAL) now supports Microsoft® Exchange Server 2007.

· The management agent for Active Directory now supports Microsoft Exchange Server 2007 Mailboxes, Mail Users, Mail Contacts and Distribution Lists.

With regard to Exchange 2007 Provisioning, I decided to dig deeper

In the Active Directory Management Agent (AD MA) and in the Active Directory Global Address List Management Agent (GalSync MA) there is a new checkbox in the “Configure Extensions” dialog:

“Enable Exchange 2007 Provisioning”

I thought to myself – what does this checkbox provide to us that MIIS SP2 or ILM does not provide?

In checking the box we activate functionality in a new DLL, Exch2007Extension.dll, that is added to the Extensions directory that runs the Powershell cmdlet Update-Recipient (http://technet.microsoft.com/en-us/library/bb738148.aspx)

Where specific to ILM FP1, the parameters passed to the cmdlet are as follows:

· Identity is the DN of the object

· Confirm is false

· Credential is the account running the MA (creating the new objects)

· DomainController is either the DC name acquired by using standard DC discovery (dsgetdc) or hardcoded into the MA, depending on MA settings

· Server is not set

· Whatif is not set

The Update-Recipient cmdlet was added in Exchange 2007 SP1 specifically for use with MIIS or ILM. Since the Recipient Update Service (RUS) was discontinued in Exchange 2007, a process is still needed to “stamp” the object to become mail-enabled. According to the details for Update-Recipient,

“The version of the GAL synchronization management agent that was included in Microsoft Identity Integration Server (MIIS) 2003 was designed to work with Exchange Server 2003 and relied on the Recipient Update Service (RUS). Because RUS is a deprecated feature and is no longer required for Exchange 2007, the new GAL synchronization management agent that is included in ILM 2007 is designed to function without RUS.”

For the MIIS SP2 or ILM admin who is looking for a workaround, consider that ILM FP1 performs the Update-Recipient operation per-object after an export using the credentials of the principal that the MA is running under. If you wanted to work around having MIIS SP2 or ILM 2007 you would have to identify the newly-created objects and run a process out-of-band from MIIS/ILM with proper credentials to replace the functionality that is enabled with the “Enable Exchange 2007 Provisioning” checkbox. For GalSync, the procedure to work around not having ILM FP1 is similar to the MIIS procedure outlined in How to Deploy Exchange 2007 in a Cross-Forest Topology (http://technet.microsoft.com/en-us/library/aa998597.aspx )

Of course this document states:

“Synchronizing Exchange 2007 GALs by using MIIS 2003 is supported only as a custom solution. The recommended solution for synchronizing Exchange 2007 GALs is to use Exchange 2007 Service Pack 1 (SP1) and Identity Lifecycle Manager (ILM) 2007 Feature Pack 1”

To me, using ILM FP1 is an easy choice. A checkbox is much easier than writing a custom out-of-band script.

--Shawn

This posting is provided "AS IS" with no warranties, and confers no rights.

MIIS/ILM Tricks - Joining using name tables for abbreviated and similar names

2007-11-08T07:35:00Z

This content is now posted in the MSDN blogs:

http://blogs.msdn.com/therabournidentity/archive/2007/12/11/miis-ilm-code-experiment-joining-using-name-tables-for-abbreviated-and-similar-names.aspx

--Shawn

This posting is provided "AS IS" with no warranties, and confers no rights.

MIIS/ILM Tricks - XML-based MIIS/ILM Metaverse Router (part 1)

2007-06-28T14:26:00Z

This content is now posted in the MSDN blogs:

http://blogs.msdn.com/therabournidentity/archive/2007/12/11/miis-ilm-code-experiment-xml-based-miis-ilm-metaverse-router-part-1.aspx

--Shawn

This posting is provided "AS IS" with no warranties, and confers no rights.

RWPT - What not to do when you're coming home from an onsite visit

2007-02-14T01:12:00Z

I have a great story about my travels I would like to share with you. So I travel for Microsoft, I spend an average of 3 business weeks a month on the road. When you travel a lot one thing I have found that is important is to have a good routine. Here is an example from a few weeks ago where I started a new routine of never using the trunk of a rental car.

So I am walking toward the parking lot of my hotel and I am getting ready to go to my rental car so I can make my flight in 2 hours to go home and see my family. I start using the keyless entry on the keychain to honk the horn of the car so I can find it. I start to hear honking so I pop my trunk open and I walk to my car and put my bags in the trunk and I walk to the door and try to use the key to open the car. The car wouldn't open. I try to push the button on the keys to open the car and it still doesn't open. I finally use the button on the keys to honk the horn and the car next to the one I had locked my bags in the trunk in started honking. Of course neither the hotel or the rental car company could/would/should help me break in to someone else's car. Luckily, I noticed that inside the car of the person who forgot to close the trunk of the identically colored Pontiac G6 that got my bags that the directions to the hotel were in German. I let my friends at the hotel know and they told me that there were frequently German people visiting the hotel as Siemens was across the street. They called Siemens and I guess a pretty loud e-mail was sent to the site. Two hours later a German man with an identical Pontiac G6 rental came out to help. Of course it was not the same Pontiac G6 that my bags were locked in. Luckily for me, he knew another German man who had rented said Pontiac G6. I missed my flight but I had my bags.

I am certainly glad I get to make these mistakes so you guys don't have to. Now, I argue that the whole ordeal is 96% my fault for locking my stuff in someone else's trunk and 4% the other man's fault for leaving his trunk open... Of course my wife was expecting me to be home at 2:00pm so I could be with the kids so she could be at a meeting at 7:00 and my flight didn't arrive until 8:00 so she'll argue that it was 100% my fault for not paying attention. She's probably right.

The best part was sending this in an e-mail to my colleagues and getting their stories back.

This posting is provided "AS IS" with no warranties, and confers no rights.

RWPT - My Day Ruining Maneuver

2006-12-14T06:15:00Z

So here is a nice little tip that is a direct result of sleep deprivation and bad habit.

I was working on some C# code that grabs some log files and wraps them up into a cab file and moves them off to a different location. After that it clears the directory so new logs can be written. In writing the code I figured I would take the liberty of trying to get everything in the folder deleted except for the tool itself.

So in thinking I did this:

---snip---

Directory.Delete(Directory.GetCurrentDirectory(), true);

---end---

Where Directory refers to System.IO.Directory

So I am trucking along, writing some other functionality and I finally compiled the code... I fixed the compilation errors (usually missing semi-colons or curly brackets) and I went to test. I had a test directory C:\testdir\testdata where the tool was to be run in testdir and the data to be put in the cab file was in testdata.

Of course at 2:30am I am not thinking about the code I wrote an hour or two before, nor do I think about running this under the debugger. No I dragged the tool from the debug directory straight into a default command prompt. I was puzzled as the code did not return. So I went and looked at the code, thinking I might have done something wrong. I spent about 10 minutes looking. I figured it was hung somewhere so I looked for any potential hanging points - maybe a for loop where I put a greater than sign where I needed a less than sign or something like that. I went to control + C the running code and I caught a glimpse of my desktop...

Zero icons. Of course I had no browsing history anymore either. No PST's. No documents in the My Documents folder.

My default command prompt centers at %userprofile%... the "true" in the Directory.Delete means "go into all of the sub directories and torch everything."

Luckily I had a fairly recent backup. For the rest I used a third party file recovery tool.

This posting is provided "AS IS" with no warranties, and confers no rights.