Bobby and Nima's Forefront Identity Manager Blog : MIIS

Farewell!

bobbygill — Tue, 28 Jul 2009 00:56:00 GMT

As a lot of you may already know, after 4 years of working on MIIS / ILM / FIM I've decided to leave Microsoft. No, I'm not being fired, nor am I jumping ship to a competitor :) Rather I am leaving Microsoft to pursue a MBA at Columbia starting this fall.

If I have one hope is it that you have found this blog, along with the talks, webcasts and reports I have done to be useful in helping to digest the seemingly endless new concepts coming out with FIM 2010. It can be a lot to take in one shot for sure, as sometimes I even find myself scratching my head as to how something works and even more so when I attempt to describe it,

To all of my colleagues and friends I have made in my time on the MIIS/ILM/FIM teams, I wish you all the best going forward. As for me, its back to the student life for the time being.

Going forward, I'll still be available to help people with FIM (as much as my new student life permits of course!) if you want to reach me, you can email me at bobby.gill (at) gmail.com and you can always find me on facebook at www.facebook.com/jasjeet

Ill be at TechReady tomorrow morning and I should be at the FOX Sports Grill event in the evening, so come grab me if you see me.

In the meantime, I leave this blog in the more than capable hands of my colleague Nima.

Thanks

Bobby

ILM "2" also comes as a hybrid...

bobbygill — Tue, 18 Nov 2008 21:26:00 GMT

For those of you who are MIIS / ILM 2007 pros, when seeing the Codeless Provisioning functionality one of the first questions that comes to mind is "can I use my existing rules extension in ILM "2"?".

Of course.

At a basic level, with ILM "2" RC, you can take an existing ILM 2007 deployment and migrate it's synchronization engine component straight into ILM "2" RC. You can do this by copying the IdentityIntegrationServer DB to a ILM "2" server, and upon installing ILM "2" point to this database instance during the setup of the synchronization component. The installer will then migrate that data forward such that all existing MA and MV configurations are ready to use right away, including rules extensions.

But if you want to go beyond this, its important to note how Codeless Provisioning works side-by-side with existing ILM synchronizaiton concepts. That is, while Codeless Provisioning bubbles up a business process driven approach to synchronization it is inherently underpinned by the same basic mechanics which power the ILM synchronization engine. As such, the adding of this functionality should not in any way change the behaviour of how MA's work, how rules extensions are called or how traditional metaverse provisioning is done.

This side-by-side coexistence is collectively referred to as a hybrid deployment.

Metaverse Provisioning

In fact, it is supported to run Codeless Provisioning based provisioning logic side by side with traditional metaverse extensions. Codeless Provisioning is driven through the processing of Expected Rule Entry (ERE) objects, these determine which MV objects are provisioned a connector and how flows are applied on top. For a MV object being sync'ed, this processing is done prior to the calling of the Metaverse rules extension. Hence if for any reason the ERE's attached to a MV object do not achieve a desired outcome in a CS, you can use a Metaverse extension to provision additional connectors, apply initial flows and deprovision existing connectors just you would have done with ILM 2007.

Custom Functions = Rules Extensions

Metaverse extensions are just one aspect of a hybrid scenario. A more common use case is for scripted flow. ILM "2" RC contains around 20 built in functions, which for the most part should satisfy most basic needs. However if this is not true, then you can always use an traditional Rules Extension to apply a transformation on a outbound flow. Using an MA, you can defined an advanced flow like before. This flow will be applied after any Sync Rule flows have been pushed onto an object, thus allowing you to append or overwrite attribute flow data that was provided by a Sync Rule.

Join / Projection Rules

On the inbound side, the traditional Join/Projection concepts live on as you remember them in ILM 2007. Just like the extension points, you can use traditional declared/advanced join projection rules along side Synchronization Rule concepts. In this case, if you have defined a Inbound Synchronization Rule on an MA that also has traditional join/projection rules defined the Synchronization Rule will be evaluated first. So if a disconnector exists within this MA such that it matches a Synchronization Rule's connected scoping filter, than this disconnector will be attempted to be joined/projected to the MV based on that Synchronization Rule definition. If the evaluation of that disconnector against the Synchronization Rule results in the CS object remaining a disconnector, then the existing declared join/projection rules will be executed against it.

How to make ILM "2" scream.

bobbygill — Mon, 03 Nov 2008 18:24:00 GMT

One of the big features of ILM "2" RC are the changes we have made to the portal and server to enable ILM to scale higher. In the portal and in the ILM service we've tuned, and jiggered with the way we interact with SQL and on the wire to make the ILM experience faster and snappier. Out of this, we've both gotten a better idea of what it takes to deploy ILM in such a way to maximize performance as well as key pieces of knowledge to help administrators keep their deployment running zipper quick. I will be writing a series of posts outlining much of this knowledge over the coming days.

Hardware

If you are asking yourself which hardware to buy to deploy ILM, recognize that ILM is extensively CPU bound. Having a fast disk is essential, however the key gating factor is the CPU horsepower on your box. This is because of ILM's policy and rights calculations require SQL to execute multiple-statement operations when performing what are seemingly simple operations from the portal. Typically we use 4xQuad-Core boxes in our performance deployments.
In an organization of 50,000 users, 20,000 groups, you should expect your base database size to be about 7 GB or so. The growth of this database will be dependent on the frequency of changes executed on the ILM system. Any rig set up for ILM should have enough RAM to load this database entirely into memory.

SQL

SQL is where performance starts and ends in the ILM Service. It is critical to having ILM perform at enterprise scales that SQL is setup such that it can best serve the ILM application. You may wonder why we took the hard dependency on SQL Server 2008 in RC, and the answer is more than it's snappy new logo. SQL Server 2008 introduces a new feature called Filtered Indices which specifically aims to limit index pollution as well improve queries across sparse columns by selectively including values within specified indices. ILM weakly-typed, single-table based storage mechanism begs for the usage of this new capability and we did it. If you only have 1000 objects in your ILM store, well then this isnt much of a deal, but when you start scaling into the 50k+ arena, filtered indices come into their own.

Beyond this, deploying ILM requires a steady eye towards maintaining and monitoring ILM performance. Here are couple of tips off hand which should help you keep ILM screaming:

Turn off Automatic Statistics Updating. SQL uses a sampling technique by default to generate the statistics it uses for creating query plans. We've found that sometimes SQL grabs a bad sample and as such you will see queries all of a sudden fall off of a cliff. To prevent this turn off the automatic statistics update and manually run a fullscan statistics update on the ObjectsInternal table. Frequency of executing this will depend on the frequency of updates to the ILM database.
Pre-grow your ILM DB, TempDB and Transaction logs. Ensure that you max out these files from the get-go so you do not take the cost of incrementally increasing the files during normal operation.
Ensure you have seperated out the ILM DB, TempDB, and Transaction logs onto seperate drives.
Ensure that SQL has been set to have a fixed upper limit on the memory it can consume during operation. If left uncheck you will see SQL gobble away memory until it starts to adversely affecting the performance of both the OS and as a result ILM.

ILM Service:

The ILM Service itself is actually quite lightweight and very much dependent on the performance of SQL. To help streamline the service further you can try:

Ensure tracing is set to error level or is off completely. Running at an excessive tracing level is guaranteed to bring ILM to it's knees.
If you find certain queries are taking so long that the underlying SQL connections are timing out, you can use the dataReadTimeout and dataWriteTimeout attributes within the resource management service node in the resource management service configuration file to set the number of seconds for the underlying SQL timeouts.

That's all for now. Look for some further posts talking about other ways to monitor and manage ILM performance.

In the meantime, we are currently at Tech Ed Europe in Barcelona. You can come find me, or Nima, at the ILM booth located in the main exhibition area for the next couple of days. I will be running an Instructor Led Lab on ILM on Thursday at 1pm.

If you get a chance, I definitely recommend attending one of the many ILM sessions being done over the next couple of days:

Thursday: Identity Lifecycle Manager 2 (Part 3): Extensibility and provisioning with ILM 2 (Nima GanjeH)

2:40-3:55pm

Wednesday: Identity Lifecycle Manager 2 (Part 2): Expressing and enforcing business policy (Alex Weinert)

1:30-2:45pm

Announcing Identity Lifecycle Manager “2” Release Candidate

bobbygill — Mon, 03 Nov 2008 16:07:00 GMT

We're back! Today we have a guest blogger to announce the Release Candidate for ILM "2":

I’m Lori Craw, group product manager covering identity and security at Microsoft. Today I am pleased to announce the exciting news that the Identity Lifecycle Manager “2” Release Candidate (RC) is now available.

ILM “2” builds on our Identity Lifecycle Manager 2007 investments, and includes solutions that will help IT more efficiently and effectively automate identity policies for users and their associated credentials and entitlements. An important set of features in this release focus on self-service for end users, enabling them to manage some of their own information like their passwords and groups, using self-service tools built into Office. The IT pro tools, combined with end-user self-service in Office and developer experiences using .NET and Visual Studio add up to a very powerful combination.

We’ve received great feedback on these features from our beta and TAP customers so far. We also have seen some great momentum with core partners, including Quest, Omada, and Unisys.

So what’s new in the RC, you ask? Some of the top new additions to the RC include:

- Support for scale out of the ILM "2" middle tier database and portal on separate servers, and support for multiple portal servers
- Added support for managing groups across multiple Active Directory forests
- Improvements in the request and notification emails, including customizable notification emails and request details baked into the out-of-box request emails
- Support for third-party certificate authorities (CAs)
- Performance and stability improvements
- Localization support for German and Japanese

I’d like to invite you to learn more about ILM “2” and to try out the RC for yourself by visiting www.microsoft.com/ilm2.

Regards,
Lori Craw
Group Product Manager
Microsoft Identity and Security

Extending ILM "2" to manage and provision computer objects

bobbygill — Wed, 25 Jun 2008 18:39:00 GMT

One topic for ILM “2” that came up repeatedly at TechEd IT Pro North America this year was extensibility. Specifically, many customers asked how the system can be configured to manage an arbitrary resource, enabling them to apply policies to and provision any resource they care about. To demonstrate this, I included a demo in Fred Delombaerde’s extensibility breakout session where we demonstrated how ILM can be configured to manage computers. Part of this demo involved managing computer security group memberships and provisioning new computers to Active Directory.

A few people asked if we had the steps to perform that scenario documented anywhere. Since we didn’t publish a hands on lab for this, I’ve included a step by step to accomplish the scenario below.

What is the objective?

Our goal is to manage computers assets.

Steps to accomplish our goal:

1. Create a Computer object type.

2. Create objects of type Computer.

3. Add the computer objects to a security group called “All Computers”.

4. Have computers provisioned automatically to AD.

How to do it?

1. The first thing we need to do is extend the schema to support computer object types. Create a computer object type.

a. Go to http://localhost/identitymanagement/aspx/schema/Schema.aspx

b. Click on “New” and fill in the details for the new object type as below.

c. Click “Finish” and “Submit”.

d. A computer object type is created now, and we can actually now begin creating and managing computers. If additional attributes beyond those on the base Resource type are desired for computers, you can create them and bind them to the computer object type.

2. Create a new search scope “All Computers”. The search scope will enable selecting computers to add to a group later on.

a. Go to Administrative Settings > Search Scope Configuration: http://localhost/identitymanagement/aspx/customized/CustomizedObjects.aspx?type=SearchScopeConfiguration&display=Search+Scope+Configuration

b. Click on “New” and fill in the fields as below.

Click “Finish” and “Submit”

c. Go to Run->Cmd and run “iisreset”.

Syncing Computers to the Metaverse:

To provision computers to downstream systems, we must first represent them in the metaverse. Computer objects can be sync’ed to the metaverse through a combination of configuration in the portal and in the ILM MA screens within the Identity Manager. The overall steps for replicating Computer objects in the portal are:

1.) Add the Computer object type to the Synchronization Filter (such that the ILM MA can see it).

2.) Configuring the App Store <-> Metaverse object type mapping within the ILM MA that will replicate computers into the metaverse.

1. Go to the “All Resources” page.

2. Click on Page 2, and click on Synchronization Filter.

3. There will be a single Synchronization Filter object defined.

4. Add Computer to the Synchronize ObjectType Description reference attribute.

At this point, Computer objects should now be visible from the ILM MA. Return to Identity Manager and follow these steps:

1.) Click on the ILM MA, and select “Refresh Schema”

2.) You should see a new schema update being pulled back as a result of the previous action.

3.) Go to the MA properties, go to Object Types, click “Show All” and you will see the computer object type.

The next thing you need to do is configure the mapping between the object type in the app store and that in the metaverse. This is new in Beta 3, in that by creating this mapping you will automatically replicate objects from the App store into the Metaverse and vice versa.

Before we can add a mapping for the Computer object, we must first define an object type to represent it in the metaverse.

1. Go to the Metaverse Designer page in Identity Manager and select "Create Object Type" from the list of actions.

2. Specify a name for the new object type and select any attributes you want in the metaverse for this object.

3. Now go back to the ILM MA properties, go to Object Types, click “Show All” and you will see the computer object type. Select it. Note: You will need to repeat this step for the AD MA as well, so that you can define attribute flows for Computers in AD.

4. Go to "Configure Object Type Mappings" in the ILM MA properties and "Add Mapping” between the Computer object and an object type in the metaverse. (Note in beta 3, your metaverse object type has to be prefixed with ‘managed:’ in order to be visible here.)

5. Go to Attribute Flow, you will see the mapping you selected on the previous page visible here. Set up all necessary attribute flows to replicate a Computer object into the managed:Computer object type. Note if you want data to flow both ways you will need to setup flows in both directions.

In order to being provisioning computers to AD using processes in ILM, you need to first define a synchronization rule for computers, along with the provisioning process and Management Policy that triggers it.

1. Create a new synchronization rule for computers.

a. Go to http://localhost/IdentityManagement/aspx/syncrule/AllSyncRules.aspx

b. Click on “New”

c. Specify general information for the synchronization rule and indicate this is an outbound synchronization rule. If we were importing data from AD into ILM this would be an inbound synchronization rule.

d. Proceed to the Scope page, selecting the managed object type representing computers in the metaverse, your AD MA, and the computer object type on the MA as below.

e. Proceed to the Relationship page and specify the relationship criteria used to identify related computers. The example below uses DisplayName as the criteria. Select the object creation option and if desired, the relationship termination options as below.

f. Proceed to the Outbound Attribute Flow page to define the flows for this synchronization rule. For this example, we will provide the minimum flows required to provision the computer to AD: We’ll define a flow for our relationship criteria (DisplayName), and for the dn of the computer.

g. Define the flow for the DisplayName. Click on the “Click to define flow” link and specify the flow as below. Click OK when finished.

h. Define the flow for the dn attribute. Click “New Attribute Flow” and click on the “Click to define flow” link to bring up the flow definition page again.

i. Select “dn” as the “Destination” for the flow.

ii. For the flow’s “Source”, specify the value that should be used.

i. Make sure you’ve selected “Initial Flow Only” for both the flows defined above.

2. Create a new action process to add the synchronization rule to computers that should be provisioned.

a. Go to the processes page in the portal: http://localhost/IdentityManagement/aspx/process/AllProcesses.aspx

b. Click on “New”.

c. Specify some general info about the process as below. Select “Action” as the process type. Click Next to proceed to define the activity.

d. From the list of available activities, select the Synchronization Rule Activity and click “Select”.

e. Select the computer synchronization rule created previously as below, and click save.

f. Now we’re finished defining the provisioning workflow, so click Finish and submit the new process.

3. Create a new set that will contain the computer objects you want to provision.

a. Go to the sets page in the portal: http://localhost/IdentityManagement/aspx/sets/AllSets.aspx

b. Click on “New”.

c. Specify some general info about the process as below and proceed to define the Dynamic Membership of the set.

d. Select the “Enable dynamic membership in current set” option and define the set’s membership criteria. In the example below we’re creating a set of all computers, so we simply select “All computers” from the first line of the filter statement, and do not add any statements or sub conditions to further filter the membership.

e. Click Finish and submit the request to create the new set.

4. Create a new Management Policy Rule to kick off the provisioning process when a new computer is created in ILM.

a. Go to the Management Policies page in the portal: http://localhost/IdentityManagement/aspx/policy/AllPolicies.aspx

b. Click on “New”.

c. Specify some general info about the Management Policy as below and proceed to define the Operation and Users.

d. Specify the operation and users that should trigger the computer provisioning process. In the image below we’ve indicated that the operation we care about is the creation of new objects (computers), and the requestor of the operation can be anyone. Proceed to the Condition After page when finished with this page.

e. Now you must specify the set of resources whose creation should trigger our provisioning process. Here we select the set of “All computers” we defined earlier.

f. Finally we select the provisioning action process we want to run in the Policy Workflows page. Click Finish and we’re done!

Now let’s create a new computer and a security group containing it as its member and see them provisioned to AD.

1. Create instance of Computer object type “Comp0001”

a. Go to http://localhost/identitymanagement/aspx/customized/AllCustomizedObjectTypes.aspx - All Resources

Click on “Computer”

b. Click on “New”

c. Fill in as below

Click “Finish” and “Submit”

d. New object of type computer “Comp0001” is created

2. Create a Group named “All Computers”

a. Go to the Security Groups page in the portal: http://localhost/identitymanagement/aspx/Groups/CreateSecurityGroup.aspx?Previous=..%2fGroups%2fAllGroups.aspx

b. Fill in as below

Click “Next”.

Deselect “Adminstrator”

From the drop down select “All Computers”

Select “Comp0001” and click “Finish” , “Submit”.

3. Go to the created group “All Computers” @ http://localhost/identitymanagement/aspx/Groups/AllGroups.aspx

a. Click on the group “All Computers”

b. Go to members section

c. So the computer object “Comp0001” is part of “All Computers” group.

Make sure the sync script that came installed on the beta 3 vpc is running. After waiting a short while for the data to be sync’d out to AD, open the AD Users and Computers console and verify the computer was provisioned successfully.

- Nima