Shawn's MIIS/ILM Tricks, PKI Hints, and Résumé Writing Prevention Tips : MIIS/ILM

ILM Tricks: ILM FFL Specification (part 1)

shawnrab — Thu, 14 Aug 2008 20:07:00 GMT

Hello Everyone!

On my last post I proposed we use Identity Lifecycle Manager 2007 with Feature Pack 1 as a Fantasy Football engine. This post will serve as part 1 for the initial specification for the engine. Thoughts are not in any particular order. The direct ILM implications are bolded.

-->Typical outside Fantasy Football Leagues (FFLs) have of anywhere from 8-16 Individual Teams (ITs) where a team is set up by the Fantasy Team Owner (FTO). Since the initial rules specified in the first TechNet post that we would have a Hybrid College/Pro League and our depth of players is greater, we're going to design the league to enable leagues of up to 64 ITs. We'll set the minimum at 2 to leave the possibility of a head-to-head league open.

-->Units: Pro Football Player (Pro), College Football Player (CP), Fantasy League Owner (FLO), Fantasy Team Owner (FTO), Individual Team (IT), Individual Leagues (IL). Each will have a unique identifier.

-->A FLO must always be a FTO. A FTO can own many ITs, but only one IT per IL. Pros and CPs are available for each IL and can only be used once per IL on an IT.

-->Metaverse object types will be created for Pros, CPs, FTOs, ITs and ILs.

-->FTOs that are FLOs will have a reference attribute for the IL that that they are the FLO for.

-->ILs will have a reference attribute listing the ITs

-->Pros and CPs positions that will be considered for league use are Quarterback (QB), Fullback/Tailback/Runningback (RB), Wide Receiver (WR), Tight End (TE), Team offensive line (OL), Kicker (K), Team Defense + Special Teams (D/ST), Interception Specialists (IS), Tackling Specialists (TS), Sack Specialists (SS), Kick Returners (KR). None of these positions are mandatory. Each Pro or CP will have a mandatory multi-valued attribute that identifies them as one or more of those positions. A WR could also be a KR, for example, hence the reason for the multi-valued attribute.

-->We will move toward near-real-time scoring, however since most of the statistics services are expensive, we will use a text format to input scoring initially. An ILM Management Agent will be created for the CP statistics and a Management Agent will be created for Pros Statistics.

-->Statistical fields will be represented as attributes.

-->The engine will be built so scoring will be determined by the FLO and will be flexible to allow weights for Pro and CP statistics, if needed as well as weight toward player positions. The weights will be applied in attribute flow.

-->Since College schedules are not as consistent as professional schedules, this adds a complexity to the league that can be desired or undesired. Because of this, and the Professional bye week, there will be functionality for automatic bye week adjustment where an unused player will be used in the place of a bye week player. More difficult leagues will not utilize this capability.

This is all I can come up with right now. Keep the e-mails coming and we'll start building this thing out later this week or into next.

Have a good day!

--Shawn

This posting is provided "AS IS" with no warranties, and confers no rights.

MIIS/ILM Tricks: ILM Fantasy Football

shawnrab — Tue, 12 Aug 2008 22:00:00 GMT

Hello Everyone!

In the light of the upcoming football season, I am going to start a new series of blog posts where we will utilize Identity Lifecycle Manager to create our own Fantasy Football engine. The posts will split time between this TechNet blog and my MSDN blog, http://blogs.msdn.com/therabournidentity. The goal is to think outside of the box, have fun and hopefully associate our findings with real-world issues.

Rules of Engagement:

1. We will utilize Identity Lifecycle Manager 2007 with Feature Pack 1 as the main engine and since I use Virtual Machines on the road, I will use one single virtual machine for the entire solution. When relevant scenarios arise, I will let everyone know what the good practices are.

2. We are only allowed to use Active Directory, ADAM, SQL and File-based Management Agents.

3. The Fantasy Football league will be a Hybrid College/Professional league. Players will be able to select College and Professional players and rules will be adjusted accordingly.

4. Once the next ILM version is released, we will upgrade the entire system.

5. Rules Extensions will be written in both C# and Visual Basic and posts will be made on my MSDN blog.

6. Reader submissions and ideas will be accepted and fully credited.

7. Each post will have the appropriate technical level in the title (100-200-300-400)

Later this week, we will create specification of the environment on the TechNet blog.

Thanks!

--Shawn

This posting is provided "AS IS" with no warranties, and confers no rights.

MIIS/ILM Tricks: Where did the post go?

shawnrab — Tue, 11 Dec 2007 22:45:00 GMT

Hello!

To stay consistent with the overall theme of MSDN (Developers) and Technet (IT Professionals), the MIIS/ILM Related Posts with source code in them have been placed in my newly created MSDN blog: http://blogs.msdn.com/therabournidentity

Have a good day!

--Shawn

This posting is provided "AS IS" with no warranties, and confers no rights.

MIIS/ILM Tricks - Breakdown of Exchange Provisioning and Other Changes in ILM 2007 FP1

shawnrab — Fri, 07 Dec 2007 21:01:00 GMT

I use a lot of acronyms for this post, so I wanted to build a “key” so I wouldn’t get confused

o Microsoft Identity Integration Server 2003 Service Pack 2 (later abbreviated as MIIS 2003 SP2, MIIS SP2 or MIIS) + Certificate Lifecycle Manager (CLM) = Identity Lifecycle Manager (abbreviated as ILM 2007 or ILM)

o Identity Lifecycle Manager 2007 Feature Pack 1 (abbreviated as ILM 2007 FP1 or ILM FP1) = ILM 2007 + Vista client support for CLM and other CLM enhancements + Exchange 2007 support in the identity engine + Cumulative updates since ILM 2007/MIIS SP2

o MIIS and ILM (no FP) refer to binary versions 3.2.559-3.2.10xx

o ILM FP1 refers to binary versions 3.3.118 and later

One of the more frequently asked questions regarding ILM 2007 FP1 is, “What does ILM 2007 FP1 offer me above and beyond ILM 2007 or MIIS 2003 SP2 with regard to the metadirectory engine?”

There are many improvements to CLM. But for the metadirectory engine, or the beast formerly known as MIIS, there are a few fixes beyond ILM 2007/MIIS 2003 SP2 described in the ILM FP1 release notes:

· Run profiles listed in the Run Profile dialog box are automatically sorted alphabetically.

· The versioning for the CLMUtils class has been corrected. The CLMUtils class can now be used with Visual Basic .NET. (side note: fixed in 3.2.1005, see http://support.microsoft.com/?id=937561 )

· Any management agent for Lotus Notes created with ILM 2007 FP1 will be configured to run out of process by default. This is to allow for memory issues with the IBM Notes 7 client. (side note: fixed in 3.2.1001)

· When the ILM 2007/MIIS 2003 server was busy and the Run History information was refreshed, a false out-of-memory status could be generated. This feature pack corrects this condition. (side note: fixed in 3.2.1001)

Again, I am talking specifically about the metadirectory engine. Looking at the release notes I see this information:

· The management agent for Active Directory Global Address List (GAL) now supports Microsoft® Exchange Server 2007.

· The management agent for Active Directory now supports Microsoft Exchange Server 2007 Mailboxes, Mail Users, Mail Contacts and Distribution Lists.

With regard to Exchange 2007 Provisioning, I decided to dig deeper

In the Active Directory Management Agent (AD MA) and in the Active Directory Global Address List Management Agent (GalSync MA) there is a new checkbox in the “Configure Extensions” dialog:

“Enable Exchange 2007 Provisioning”

I thought to myself – what does this checkbox provide to us that MIIS SP2 or ILM does not provide?

In checking the box we activate functionality in a new DLL, Exch2007Extension.dll, that is added to the Extensions directory that runs the Powershell cmdlet Update-Recipient (http://technet.microsoft.com/en-us/library/bb738148.aspx)

Where specific to ILM FP1, the parameters passed to the cmdlet are as follows:

· Identity is the DN of the object

· Confirm is false

· Credential is the account running the MA (creating the new objects)

· DomainController is either the DC name acquired by using standard DC discovery (dsgetdc) or hardcoded into the MA, depending on MA settings

· Server is not set

· Whatif is not set

The Update-Recipient cmdlet was added in Exchange 2007 SP1 specifically for use with MIIS or ILM. Since the Recipient Update Service (RUS) was discontinued in Exchange 2007, a process is still needed to “stamp” the object to become mail-enabled. According to the details for Update-Recipient,

“The version of the GAL synchronization management agent that was included in Microsoft Identity Integration Server (MIIS) 2003 was designed to work with Exchange Server 2003 and relied on the Recipient Update Service (RUS). Because RUS is a deprecated feature and is no longer required for Exchange 2007, the new GAL synchronization management agent that is included in ILM 2007 is designed to function without RUS.”

For the MIIS SP2 or ILM admin who is looking for a workaround, consider that ILM FP1 performs the Update-Recipient operation per-object after an export using the credentials of the principal that the MA is running under. If you wanted to work around having MIIS SP2 or ILM 2007 you would have to identify the newly-created objects and run a process out-of-band from MIIS/ILM with proper credentials to replace the functionality that is enabled with the “Enable Exchange 2007 Provisioning” checkbox. For GalSync, the procedure to work around not having ILM FP1 is similar to the MIIS procedure outlined in How to Deploy Exchange 2007 in a Cross-Forest Topology (http://technet.microsoft.com/en-us/library/aa998597.aspx )

Of course this document states:

“Synchronizing Exchange 2007 GALs by using MIIS 2003 is supported only as a custom solution. The recommended solution for synchronizing Exchange 2007 GALs is to use Exchange 2007 Service Pack 1 (SP1) and Identity Lifecycle Manager (ILM) 2007 Feature Pack 1”

To me, using ILM FP1 is an easy choice. A checkbox is much easier than writing a custom out-of-band script.

--Shawn

This posting is provided "AS IS" with no warranties, and confers no rights.

MIIS/ILM Tricks - Joining using name tables for abbreviated and similar names

shawnrab — Thu, 08 Nov 2007 07:35:00 GMT

This content is now posted in the MSDN blogs:

http://blogs.msdn.com/therabournidentity/archive/2007/12/11/miis-ilm-code-experiment-joining-using-name-tables-for-abbreviated-and-similar-names.aspx

--Shawn

This posting is provided "AS IS" with no warranties, and confers no rights.

MIIS/ILM Tricks - XML-based MIIS/ILM Metaverse Router (part 1)

shawnrab — Thu, 28 Jun 2007 14:26:00 GMT

This content is now posted in the MSDN blogs:

http://blogs.msdn.com/therabournidentity/archive/2007/12/11/miis-ilm-code-experiment-xml-based-miis-ilm-metaverse-router-part-1.aspx

--Shawn

This posting is provided "AS IS" with no warranties, and confers no rights.