Alex Tcherniakhovski - Security : MIIS

Accessing ILM WMI Inteface from non-windows host

alextch — Fri, 09 Nov 2007 20:24:00 GMT

This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm

This screencast explores a scenario of calling WMI interface of ILM 2007 (MIIS component) from a non-Windows host, by utilizing Java.

Specifically middle-ware provided by Jintegra is utilized to access WMI from a Linux server.

This approach could be utilized when there is a requirement to remotely from a non-Windows host trigger functionality of ILM server exposed via WMI. In this screencast we will examine a scenario of calling setPassword method of MIIS_CsObject class in order to reset Active Directory Password from Linux via ILM.

Please, follow this link to see the screencast.

References:

Accessing Windows Management Instrumentation (WMI) from Java

Configuring DCOM for Remote Access

Mapping VB Code to Java Code

Shutting Down a Managed Windows Machine Using WMI in Java

J-Integra® Product Installation Instructions

Connecting ILM 2007 with SharePoint Services Lists

alextch — Sun, 02 Sep 2007 16:19:00 GMT

This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm

In this blog I explore the possibilities of using information stored in SharePoint Services V3.0 lists to drive provisioning processes (specifically integration with Active Directory). The idea behind this approach is to merge provisioning and synchronization capabilities of ILM with collaboration and workflow components of SharePoint Services 3.0.

Please, follow this link for a complete walkthrough.

This is my second posting on this subject. In my first post “Adding workflow components into your MIIS solutions” I examined the scenario of integration of ILM with SharePoint InfoPath Libraries. Both solutions have similar goals: to utilize workflow capabilities of WSS 3.0 and to propagate information stored in SharePoint throughout the enterprise. At the same time the underlying extensible management agents utilize different technologies to accomplish the integration with WSS 3.0. The connector for InfoPath libraries utilizes Microsoft.SharePoint.dll and the connector for SharePoint Lists leverages SharePoint Web Services. Since Microsoft.SharePoint.dll can only be utilized on the same server where WSS is running, the first solution is ideal for scenarios where Workflow needs to be added to ILM provisioning processes (in other words MIIS and WSS need to be running on the same box), also InfoPath forms provide richer capabilities to workflow (ex. Digital signatures, Role based views, data validation, etc). The List Connector, on the other hand, uses SharePoint Web Services; therefore MIIS and WSS could be running on different servers, this connector is ideal for scenarios where extracting employee information from WSS is required. I am hoping one day to combine those two connectors into one, so that we don’t have be concerned whether the data resides in a list or a InfoPath library. For now depending on what you are trying to accomplish you will have to choose the appropriate solution.

Additional Links

Walkthrough: How to build an extensible management agent for MIIS

Adding workflow components into your MIIS solutions

alextch — Tue, 19 Dec 2006 19:54:00 GMT

This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm

In this blog I explore the possibilities of integrating SharePoint Services V3.0 workflow capabilities into MIIS based provisioning solutions. The idea behind this approach is to merge provisioning and synchronization capabilities of MIIS with collaboration and workflow components of SharePoint Services 3.0.

Please, follow this link for a complete walkthrough.

Additional Links

Populating InfoPath 2007 Forms with data from Active Directory

Walkthrough: How to build an extensible management agent for MIIS

A PRACTICAL SCENARIO OF USING EXPORT_PASSWORD ATTRIBUTE

alextch — Wed, 04 Oct 2006 06:24:00 GMT

This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm

If you have been working with MIIS for some time then you probably noticed that each connector space receives an attribute called export_password. Intuitively I knew that this attribute must have something to do with the password synchronization capabilities of MIIS, but unfortunately I could not find any good documentation to help me better understand the role this attribute plays or scenarios in which we could be leveraging this attribute. Luckily while working on my extMA for Oracle principals, I found myself in a situation where I needed to resolve an issue with setting initial Oracle user passwords, which prompted me start asking questions about this attribute. Many thanks to Tomasz Onyszko who helped me understand the role of export_password attribute and how to utilize it in my extMA. In this blog I will show how I used the export_password attribute to solve what I believe to be a very common scenario of setting-up initial password via extensible Management Agent (extMA).

THE PROBLEM

Undoubtedly, most of the systems for which you will be writing an extMA will require a password attribute to be set for each identity that you create on that system. Furthermore, the password value that you submit during the creation of the user identity will be most likely hashed by the system. For example Oracle maintains PASSWORD attribute field in the DBA_USERS system view, but the value of the PASSWORD attribute is the result of proprietary hashing function performed by Oracle on the password value that extMA provides during user creation (see sample entry below).

USERNAME PASSWORD

------------------------------ ------------------------------

ALEXTC 9220D38B94449548

So for example, while provisioning ALEXTC to Oracle I may execute something like this in the provisioning code:

ManagementAgent = mventry.ConnectedMAs(“oraPrincipals”)

Connectors = ManagementAgent.Connectors.Count

Anchor = mventry("uid").Value

If 0 = Connectors Then

csentry = ManagementAgent.Connectors.StartNewConnector("user")

csentry("USERNAME").Value = "" & Anchor.ToUpper & ""

csentry("DEFAULT_TABLESPACE").Value = "SYSTEM"

csentry("TEMPORARY_TABLESPACE").Value = "TEMP"

csentry("PROFILE").Value = "DEFAULT"

csentry("PASSWORD").Value = mventry["initialPassword"].Value

csentry.CommitNewConnector()

Once execution of the provisioning logic completes the value of PASSWORD attribute in the Connector Space (CS) will be set to the value stored in mventry under the initial password attribute (for example “password”), but after exporting this entry to Oracle the value of the PASSWORD attribute on ORACLE will be 9220D38B94449548, the hashed value of “password” (at least in my test environment). Since MIIS needs to re-import all the exported changes in order to confirm successful export you will get the infamous warning “export-entry-not-reimported” for each newly exported user. Mind you that this warning does prevent us from provisioning a user to Oracle but, clearly we can’t have warnings like this in production environment. Additionally storing hashes of passwords in the CS is not considered to be a good security practice (violates the principal of reduction of surface of attack). Therefore we must find a better approach of setting-up that initial password.

THE NEED FOR EXPORT-ONLY ATTRIBUTE IN CS

So if we analyzed the problem described above then a simple solution would be to tell MIIS that the PASSWORD attribute is export-only and don’t bother re-importing it. Unfortunately or fortunately, MIIS does not have a facility to designate a specific attribute as export-only, but as you may have guessed, this is where the export_password attribute comes to the rescue. This attribute is generated by MIIS for each entry in the CS and by design is export-only; therefore it is a perfect candidate for storing those initial passwords. So let us recode the provisioning logic as such:

ManagementAgent = mventry.ConnectedMAs(“oraPrincipals”)

Connectors = ManagementAgent.Connectors.Count

Anchor = mventry("uid").Value

If 0 = Connectors Then

csentry = ManagementAgent.Connectors.StartNewConnector("user")

csentry("USERNAME").Value = "" & Anchor.ToUpper & ""

csentry("DEFAULT_TABLESPACE").Value = "SYSTEM"

csentry("TEMPORARY_TABLESPACE").Value = "TEMP"

csentry("PROFILE").Value = "DEFAULT"

csentry("export_password").Value = mventry["initialPassword"].Value

‘ you may also consider writing a function that generates the initial ‘password based on the business logic appropriate to your scenario

csentry.CommitNewConnector()

I also removed the Oracle PASSWORD attribute from flowing into CS, we simply don’t need it anymore. Now for each provisioned Oracle account I have the value of its initial password stored in export_password attribute. Next we will look at how to get this value into remote system (Oracle in my case)

RELATIONSHIP BETWEEN EXPORT_PASSWORD AND CUSTOM PASSWORD EXTENSION

My initial thought of using the export_password attribute was to simply access it during the exportEntry routine in my extMA and passing its value to the method that creates an Oracle account. But I realized that export_password attribute is not accessible in the exportEntry sub. This is where I started to ask questions, and was explained that the export_password attribute is special in some other way then being just export-only.

Specifically, by setting the export_password attribute in provisioning code, we trigger the execution of SetPassword routine of our custom password extension after the entry is exported to the connected system. So in my custom password extension for the Oracle Principals I have the following implementation of SetPassword function:

Public Sub SetPassword(ByVal csentry As CSEntry, ByVal NewPassword As String) Implements Microsoft.MetadirectoryServices.IMAPasswordManagement.SetPassword

Dim cmd As New OracleCommand

Dim UserName As String = csentry("USERNAME").Value

Dim Password As String = NewPassword

Dim SQLString As String = "alter user " & UserName & " identified by " & Password

Try

cmd.CommandText = SQLString

cmd.Connection = OracleConnection

cmd.ExecuteNonQuery()

cmd.Dispose()

Catch ex As Exception

EventLogger.WriteToEventLog(ex.Message, EventLogEntryType.Error)

cmd.Dispose()

Throw New Exception(ex.Message)

End Try

End Sub

Note that one of the arguments that the SetPassword takes is NewPassword, which comes from the export_password attribute.

SEQUENCE OF EVENTS

Just to tie this all together let’s walk through the process of provisioning a new user to Oracle.

1. Provisioning code executes and sets the value of export_password to some value

csentry("export_password").Value = "password"

2. The entry is exported to Oracle.

We need to make an important note here. Since the SetPassword routine can only execute after the account is created on Oracle (you can’t set a password on account that does not exist yet) we need to provide some logic within our extMA to set the initial password to some complex and random value so that Oracle would allow us to create that account. The reason for making password copmlex and random is to protect the account just in case step 3 fails.

Public Shared Function createUser(ByVal userName As String, _

ByVal defaultTableSpace As String, _

ByVal tempTableSpace As String, _

ByVal profile As String, _

ByVal expired As Boolean, _

ByVal locked As Boolean, _

ByVal quota() As String, _

ByVal dbConnection As OracleConnection)

Dim password As String = randomOraPassword.Generate

Dim identifiedClause As String = "identified by “ & password

Dim sql As String

sql = "CREATE USER " & userName.ToUpper & " " & identifiedClause & _

" DEFAULT TABLESPACE " & defaultTableSpace & _

" TEMPORARY TABLESPACE " & tempTableSpace & _

" PROFILE " & profile

Notice that in my createUser call I generate some random password which allows me to create that initial account. Nobody should know what this random password is, since it will be overwritten shortly.

3. After the entry is exported the SetPassword sub is called and sets the user password to the value stored in export_password

CONCLUSION

If the system that you are working with requires passwords and also hashes them, you need to ensure that your extMA has also has a custom password extension attached to it, with the appropriate logic for SetPassword function. Then leverage the export_password attribute to propagate the initial value of the password to the SetPassword routine.

RESOURCES:

Tomasz’s blog on this topic

MIIS Developer Reference – Using password extensions

Walkthrough: How to build an extensible management agent for MIIS

Synchronizing Active Directory and Oracle security principals using Microsoft Identity Integration Server (MIIS)

Improving Import Performance of MIIS Extensible Management Agent (extMA)

alextch — Wed, 27 Sep 2006 20:45:00 GMT

This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm

I am assuming that the reader is familiar with the process and concepts behind creation of an extMA. If not, please, take a look at my blog Walkthrough: How to build an extensible management agent for MIIS This blog should provide you with the necessary background on the concepts involved in building your own connector for MIIS.

During the early stages of developing a new extMA performance is not probably the first thing on your mind, you are mainly concerned with getting the basic functionality of an extMA working properly, and there is nothing wrong with this approach. But as you move your extMA out of your development environment and start testing it against some real production scenarios, the issues of performance become more important. Things that worked just fine in you lab environment with a dozen or a hundred test accounts suddenly don’t go as smoothly anymore when your extMA needs to handle for example 30,000 accounts. Of course, performance tuning is more of an art then a science and highly dependant on the system that you are connecting to. But there are some universal performance improving principals, one of which is minimizing number of round trips to database/directory in order to reduce the impact of network latencies incurred by each trip. While working on performance tuning of my extMA for Oracle Security Principals I was reminded of the importance of this principal and would like to share some of that experience in this blog.

Before you even start tuning, it is important to establish a reference point with respect to acceptable performance of your extMA.

In the case of extMA for Oracle Principals we are extracting information from several Oracle system views, for example DBA_USERS, DBA_ROLES, etc. So in order to establish a benchmark I simply created a SQL query that extracts similar information that would be consumed by MIIS and timed its execution while starting the query from Oracle SQL PLUS Worksheet. Of course prior to doing this you need to setup a test environment with a significantly large number of test accounts (in my case I have 10,000 user objects in Oracle and the query would complete in under 1 minutes). Based on this test I set my goal to have the extMA to perform full import stage only operation within 2-3 minutes. Obviously, it would not be realistic to expect our extMA to perform better then the native tools, but we should strive to be in the same range at least.

So when I ran the Oracle extMA against the same test data and the import took over 30 minutes, I knew that this extMA had some room for improvement.

Note: extMA always use file based import process, meaning that data from the remote system is first dumped into a text file (comma delimited, AVP, etc) and then MIIS uses that file to bring the data into the connector space. As a developer of an extMA you only have control over how quickly the data from the remote system ends up in the dump file, after that MIIS does its magic and you have little control over it. So when I said that my extMA took 30 minutes to process 10000 records most of those 30 minutes (about 25) were spent getting data into the dump file.

Good Practice: Always create a benchmark for your extMA performance by using the native tools of the system in question to extract the data to be consumed by MIIS.

So let’s take a look at the original (poorly performing) logic used to extract user information from Oracle and we will try to find some potential performance issues with this approach.

Public Shared Function enumerateUsers(ByVal dbConnection As OracleConnection, _

ByVal exportFile As StreamWriter)

Dim sqlDBA_USERS As String

sqlDBA_USERS = "select * from dba_users"

Dim cmdDBA_USERS As New OracleCommand(sqlDBA_USERS, dbConnection)

cmdDBA_USERS.CommandType = CommandType.Text

Dim rdDBA_USERS As OracleDataReader = cmdDBA_USERS.ExecuteReader

While rdDBA_USERS.Read

exportFile.WriteLine("ObjType: User")

exportFile.WriteLine("ID: " & rdDBA_USERS.Item("USERNAME"))

exportFile.WriteLine("USER_ID: " & rdDBA_USERS.Item("USER_ID"))

. . . . . .

Getting remaining user attributes, Removed here to conserve space

. . . .

Dim sqlProxy_User As String

sqlProxy_User = "select proxy from proxy_users where client = " & "'" & rdDBA_USERS("USERNAME") & "'"

Dim cmdProxy_User As New OracleCommand(sqlProxy_User, dbConnection)

cmdProxy_User.CommandType = CommandType.Text

Dim rdProxy_User As OracleDataReader = cmdProxy_User.ExecuteReader

While rdProxy_User.Read

exportFile.WriteLine("PROXY: " & rdProxy_User("PROXY"))

End While

rdProxy_User.Close()

. . . .

Getting quota information, very similar in concept to getting proxy info,

Removed to concerve space

. . . . .

exportFile.WriteLine()

End While

rdDBA_USERS.Close()

End Function

Let me explain the main points of this function:

Dim sqlDBA_USERS As String

sqlDBA_USERS = "select * from dba_users"

Dim cmdDBA_USERS As New OracleCommand(sqlDBA_USERS, dbConnection)

cmdDBA_USERS.CommandType = CommandType.Text

Dim rdDBA_USERS As OracleDataReader = cmdDBA_USERS.ExecuteReader

These 5 lines of code use the previously established connection to an Oracle server in order to retrieve a cursor which would contain entries from the DBA_USERS system view. So after completion of this portion of the function we get rdDBA_USERS cursor which contains information on Oracle users.

After we setup a loop to enumerate through the rdDBA_USERS cursor and dump information on Oracle Users into an AVP file later to be consumed by MIIS

While rdDBA_USERS.Read

exportFile.WriteLine("ObjType: User")

exportFile.WriteLine("ID: " & rdDBA_USERS.Item("USERNAME"))

exportFile.WriteLine("USER_ID: " & rdDBA_USERS.Item("USER_ID"))

. . . . . .

End While

Unfortunately, not all information pertaining to Oracle users is stored in DBA_USERS. For example information on Quota and Proxy is stored in other system views. Since we need to get this information as well, inside the loop we create another query to get the remaining information for the user currently being processed as part of the loop. Here is the portion of the function that extracts Oracle Proxy authentication information. Similar work needs to be done for Quota information and potentially other aspects of Oracle user security settings.

Dim sqlProxy_User As String

sqlProxy_User = "select proxy from proxy_users where client = " & "'" & rdDBA_USERS("USERNAME") & "'"

Dim cmdProxy_User As New OracleCommand(sqlProxy_User, dbConnection)

cmdProxy_User.CommandType = CommandType.Text

Dim rdProxy_User As OracleDataReader = cmdProxy_User.ExecuteReader

While rdProxy_User.Read

exportFile.WriteLine("PROXY: " & rdProxy_User("PROXY"))

End While

rdProxy_User.Close()

At first this function seems to be quite logical and at least on the surface there does not appear anything substantially wrong with it, but yet this peace of code produces results that were completely off the benchmark expectations that we established using native Oracle tools. So certainly there must be something we can do to improve this function.

After doing some reading on the behavior of Oracle cursors in ODP.NET, I realized that by default OracleDataReader brings only one record at a time from the database. See section on “Controlling the Number of Rows Fetched in One Database Round Trip” in Oracle Data Provider for .NET Developers Guide for more details. In other words, in the case of the 10,000 users the extMA will make 10,000 trips to the database, plus at least additional 10,000 for each query executed inside the loop. So it is no wonder that the import process would take such a long time. But luckily there is an easy way to change this behavior by manipulating the FetchSize property of the OracleDataReader object. So based on this my initial thought was be to modify my code like this:

Dim sqlDBA_USERS As String

sqlDBA_USERS = "select * from dba_users"

Dim cmdDBA_USERS As New OracleCommand(sqlDBA_USERS, dbConnection)

cmdDBA_USERS.CommandType = CommandType.Text

Dim rdDBA_USERS As OracleDataReader = cmdDBA_USERS.ExecuteReader

rdDBA_USERS.FetchSize = cmdDBA_USERS.RowSize() * 1000

By setting the FetchSize to cmdDBA_USERS.RowSize() * 1000 I was hoping to achieve some major performance gains, since I reduced the number of trips to the database for the DBA_USER data by 1000. Unfortunately, after running this modified code the results were almost the same, still about 30 min for full import. At this point I started to realize that the issue is probably related to the fact that I am performing queries from inside the loop, which still would cause at least 10000 trips to the database for each additional attribute not stored in DBA_USERS (for example Proxy and Quota data). Just as a test after commenting out the queries from the inside the loop the full import completed in just a few minutes, of course this was at a price of loosing some important information about Oracle user. I could not apply the same logic of using larger FetchSize when querying proxy_users, since such query would typically return only a few rows because we were limiting it to entries for a specific user.

sqlProxy_User = "select proxy from proxy_users where client = " & "'" & rdDBA_USERS("USERNAME") & "'"

Good Practice

At this point I realized that I needed to change my approach. Instead of querying multiple system views once per each user I created a join statement which would pull all of the information from Oracle in one of several trips.

Here is the modified portion of the function that brings all of the data in one cursor and does this in just a few trips:

Dim sqlDBA_USERS As String

sqlDBA_USERS = "select T1.*, T2.proxy, T3.tablespace_name, T3.MAX_BYTES

from dba_users T1, proxy_users T2, dba_ts_quotas T3

where T1.USERNAME = T2.client(+) and T1.USERNAME = T3.USERNAME(+) order by T1.USERNAME"

Dim cmdDBA_USERS As New OracleCommand(sqlDBA_USERS, dbConnection)

cmdDBA_USERS.CommandType = CommandType.Text

Dim rdDBA_USERS As OracleDataReader = cmdDBA_USERS.ExecuteReader

rdDBA_USERS.FetchSize = cmdDBA_USERS.RowSize() * 1000

So the resulting cursor will hold information in the following format (I omitted some attributes for clarity):

USERNAME PROXY TABLESPACE_NAME MAX_BYTES

------------------------------ ------------------------------ ------------------------------ ----------

AALFORT AARMITAGE SYSTEM 125829120

AALFORT AARMITAGE USERS 314572800

AALFORT AAPPLEBY SYSTEM 125829120

AALFORT AAPPLEBY USERS 314572800

AALFORT AALSOP SYSTEM 125829120

AALFORT AALSOP USERS 314572800

AALFORT AANGUS SYSTEM 125829120

AALFORT AANGUS USERS 314572800

AALFORT AALLENDORF SYSTEM 125829120

AALFORT AALLENDORF USERS 314572800

AALFORT AANNAN SYSTEM 125829120

AALFORT AANNAN USERS 314572800

Now that I had all the data in once cursor all I need is a way to properly enumerate through this cursor and dump the data into the export file.

Here is the code that accomplishes this:

Dim parentRecordID As String = String.Empty

While rdDBA_USERS.Read

Dim oraUser As oraUser

Dim oraUserID As String = rdDBA_USERS.Item("USERNAME").ToUpper

If Not oraUserID.Equals(parentRecordID.ToUpper) Then

parentRecordID = rdDBA_USERS.Item("USERNAME")

oraUser = New oraUser(rdDBA_USERS.Item("USERNAME"), exportFile)

oraUser.USER_ID = rdDBA_USERS.Item("USER_ID")

… some attributes removed to conserve space …

If Not IsDBNull(rdDBA_USERS("PROXY")) Then

oraUser.addProxy(rdDBA_USERS("PROXY"))

End If

If Not IsDBNull(rdDBA_USERS("MAX_BYTES")) Then

oraUser.addQuota(rdDBA_USERS("TABLESPACE_NAME"), rdDBA_USERS("MAX_BYTES"))

End If

If Not IsDBNull(rdDBA_USERS("PROXY")) Then

oraUser.addProxy(rdDBA_USERS("PROXY"))

End If

Else

If Not IsDBNull(rdDBA_USERS("MAX_BYTES")) Then

oraUser.addQuota(rdDBA_USERS("TABLESPACE_NAME"), rdDBA_USERS("MAX_BYTES"))

End If

If Not IsDBNull(rdDBA_USERS("PROXY")) Then

oraUser.addProxy(rdDBA_USERS("PROXY"))

End If

End While

Let me explain the main logic points of this peace of code.

Dim parentRecordID As String = String.Empty

While rdDBA_USERS.Read

Dim oraUser As oraUser

Dim oraUserID As String = rdDBA_USERS.Item("USERNAME").ToUpper

If Not oraUserID.Equals(parentRecordID.ToUpper) Then

parentRecordID = rdDBA_USERS.Item("USERNAME")

oraUser = New oraUser(rdDBA_USERS.Item("USERNAME"), exportFile)

oraUser.USER_ID = rdDBA_USERS.Item("USER_ID")

As before we will go through each record stored in the cursor, but this time multiple records in the cursor may belong to the same user (see sample data shown earlier), hence the introduction of concept of a parent record. For example

AALFORT SYSTEM 125829120

AALFORT USERS 314572800

User AALFORT may have 2 quota entries; therefore this user will have 2 rows in the resulting cursor. Once we start processing the first record for AALFORT we would set parentRecord = AALFORT, so that when we get to the second entry for this user we will know to append the second quota entry to the same Oracle User object. Once we are done processing AALFORT and move to the next user the parentRecordID will now point to the Username of this new user. By the way the oraUser object is an abstraction of Oracle User record that I created in the extMA to simplify storage of the information while processing a record.

Else

If Not IsDBNull(rdDBA_USERS("MAX_BYTES")) Then

oraUser.addQuota(rdDBA_USERS("TABLESPACE_NAME"), rdDBA_USERS("MAX_BYTES"))

End If

If Not IsDBNull(rdDBA_USERS("PROXY")) Then

oraUser.addProxy(rdDBA_USERS("PROXY"))

End If

In the case of the Else, we know that we are still processing the same record. During our first pass we already gathered everything from DBA_USERS view, so now we only need to deal with multi-value attributes such as Quota and Proxy.

Note: since the data in the cursor is stored in this format:

USERNAME PROXY TABLESPACE_NAME MAX_BYTES

------------------------------ ------------------------------ ------------------------------ ----------

AALFORT AARMITAGE SYSTEM 125829120

AALFORT AARMITAGE USERS 314572800

AALFORT AAPPLEBY SYSTEM 125829120

AALFORT AAPPLEBY USERS 314572800

We need to take measures in order not to add duplicate entries into the Proxy or Quota attributes. Therefore the ora.addProxy and ora.addQuota are implemented in such a way as not to allow duplicates. Here is a how addProxy is implemented

Private _PROXIES As New ArrayList

Sub addProxy(ByVal proxy As String)

If Not _PROXIES.Contains(proxy) Then

_PROXIES.Add(proxy)

_exportFile.WriteLine("PROXY: " & proxy)

End If

End Sub

With the above described modifications the extMA now performs full import stage only operation in under 3 minutes, most of which are spent by MIIS actually bringing the data into the CS. The input file is being produced in a matter of seconds. As you can see, by applying this fundamental performance guidance of reducing the number of round-trips to database we were able to achieve dramatic improvement in our extMA.

You can find the complete source code for this extMA at http://workspaces.gotdotnet.com/oraSecPrincMA

Simply ask to join the workspace and I will be happy to provide you with access to source code.

Dealing with “System.InvalidOperationException: Collection was modified; enumeration operation may not execute” error message in provisioning code.

alextch — Mon, 14 Aug 2006 19:24:00 GMT

This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm

This error message always gets me by surprise, so finally I decided to document this potential pitfall.

I typically get this error message in the provisioning code when I am trying to disconnect multiple connectors from different connector spaces. So here a sample code that will cause this error

If mventry(“oracleEnabled”).value = false

For Each MA As ManagementAgent In mventry.ConnectedMAs

If MA.Name.StartsWith("oracle") Then

Mventry.ConnectedMAs(MA.Name).Connectors.DeprovisionAll()

End If

Endif

So in this peace of code I am checking if the oracleEnabled Boolean attribute is set to false, and if yes (according to my business logic), I need to go through all of the connectors for Oracle and disconnect them. At first, this peace of code looks quite logical, we go through every connector space attached to the mventry and if it is an Oracle connector space, we deprovision all connectors. But if this code gets executed you will get an exception: System.InvalidOperationException: Collection was modified; enumeration operation may not execute.

So what is the problem with this code? Well, the issue is really not related to MIIS, but rather how .NET handles enumeration of collections. Basically, the issue here is that inside the FOR EACH loop we are changing the collection that is used to control the loop. So in our case, we are using mventry.ConnectedMAs collection to control the loop, but inside the loop we are disconnecting some of the connector spaces which changes the mventry.ConnectedMAs collection, which in turn impacts the enumeration of the loop, and .NET throws an exception and rightly so.

So how do we get around this? Here is one way, simply save the MA names to a string array and then use that array for controlling the FOR EACH loop.

Dim ConnectedOraMAs() As String

Dim i As Integer = 0

For Each MA As ManagementAgent In mventry.ConnectedMAs

If MA.Name.StartsWith("oracle") Then

ReDim Preserve ConnectedOraMAs(i)

ConnectedOraMAs(i) = MA.Name

i = i + 1

End If

If Not ConnectedOraMAs Is Nothing Then

If mventry(“oracleEnabled”).value = false Then

For Each MA As String In ConnectedOraMAs

mventry.ConnectedMAs(MA).Connectors.DeprovisionAll()

End If

Very practical example of using MapAttributesForJoin Method

alextch — Fri, 14 Jul 2006 19:53:00 GMT

This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm

I finally found a very good practical example of demonstrating the use of MapAttributeForJoin method in the MA extension project, which I would like to share with you.

One of my clients had a situation where employeeID was stored as a string in HR but as an int in other systems. Since MIIS can only conduct direct join operations on similar data types some data conversion was required. This is where MapAttributeForJoin came to a rescue. Please, follow this link for complete walk-through on this scenario.

Synchronizing Active Directory and Oracle security principals using Microsoft Identity Integration Server (MIIS)

alextch — Mon, 05 Jun 2006 16:56:00 GMT

This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm

This walkthrough explores the possibility of using MIIS for the purposes of synchronizing Active Directory Users with Oracle Security Principals (Users and Roles stored in Oracle database). Password synchronization mechanism is also discussed.

Since MIIS out of the box does not currently handle synchronization/provisioning with Oracle security principals, an extensible management agent was developed for this purpose (see link to source code). The purpose of this walkthrough is to provide instructions on how to get up and running using this extMA for the purposes of evaluating the solution and providing feedback on the approach taken by the author. At present time the extMA is still in the early stages of development and is lacking proper error logging and has not been subjected to performance testing, but does provide base functionality required to provision/synchronize AD with Oracle principals including users, roles and password changes originating from AD.

Please, follow this link to see the recorded walkthrough: http://alextch.members.winisp.net/ADtoOra/ADtoOracle.html

Source code for the extMA included below as part of this blog.

Note: Originally the souce code has been published on gotdotnet space, which has now been phased out. I made some references regarding getting the source code from gotdotnet in the walkthrough, please disregard those and get the source here in this blog entry.

About a month after posting this blog I got an e-mail from Quest’s London office. The had a great idea of using this extensible Management agent as part of a custom solution based on Quest Active Role Server for one his clients.

I was very excited about working with Quest Active Role Server since I new that the combination of MIIS, Active Role Server and my extMA, would rectify some of the shortcomings that were present in the original approach.

Specifically, Active Role Server adds the following advantages to my original solution:

Ability to create virtual attributes and therefore avoid schema extensions
Ability to define dynamic groups in Active Directory, therefore avoiding the need to use another tool for group management.
Ability to define dynamic groups based on multi-value attributes.
Ability to specify input rules for our custom attributes, and therefore avoid potential human input errors
Ability to rapidly create custom user interfaces to incorporate new functionality available trough Active Directory

I put together a demo of the solution that outlines main advantages that Quest Active Role Server may bring to a scenario of synchronizing AD and Oracle.

Please, follow this link to see the recorded demo:

http://alextch.members.winisp.net/QARStoORA/QARS2ORA.html

Special thanks for to stuart.harrison@quest.com and Noel.Sidebotham@quest.com Quest

Another reader has raised a good question regarding adding network encryption capabilities to this extMA. This is especially important issue if you are synchronizing passwords from AD to Oracle. In this case we definitely need to ensure that the network channel is encrypted and we are not sending passwords in clear text.

My suggestion to solving this issue is to utilize Oracle Advanced Security component (licensed separately from Oracle), which among other things allows for encryption of network traffic between Oracle Client (in our case MIIS) and Oracle server. Instructions on configuring this component could be found on Oracle site here.

By using this approach we achieve the desired level of security without having to implement encryption ourselves.

We could go even one step further and modify the custom password synchronization code to only allow password propagation if the Oracle client is configured and required to use network encryption. Here is conceptually how we could accomplish this.

Oracle Client with Advanced Security option installed and enabled stores its advanced security configuration settings in the sqlnet.ora file. Here is how sqlnet.ora looks when the client is required to use encryption.

SQLNET.ENCRYPTION_CLIENT = required

SQLNET.ENCRYPTION_TYPES_CLIENT = 3DES168

So by parsing this file and checking if SQLNET.ENCRYPTION_CLIENT is set to “required” we could be reasonably sure that the communication with the Oracle server will be encrypted or not be established at all (see Oracle documentation for more details).

Next in MIIS custom password synchronization extension we have a function that determines the security level of the connection

Public Function GetConnectionSecurityLevel() As Microsoft.MetadirectoryServices.ConnectionSecurityLevel Implements Microsoft.MetadirectoryServices.IMAPasswordManagement.GetConnectionSecurityLevel

Return ConnectionSecurityLevel.NotSecure

End Function

By default this function returns ConnectionSecurityLevel.NotSecure. We should modify this function to check the value of SQLNET.ENCRYPTION_CLIENT in sqlnet.ora and based on the value of this attribute return ConnectionSecurityLevel.NotSecure or Return ConnectionSecurityLevel.Secure.

Finally in the extMA configuration GUI (last page of the MA configuration wizard) we could specify whether or not to allow password propagation over unsecured connection. In this way we are de-coupling configuration of Oracle from configuration of MIIS.

Another approach to take is to utilize built-in IPSec capabilities of Windows and establish an IPSec channel between MIIS and Oracle server. Of course, if Oracle is not running on Windows you may need to do some additional research around configuring IPSec between Windows and UNIX servers. See my blog on creating IPSec channel between Windows Server and Solaris

http://blogs.msdn.com/alextch/archive/2005/05/12/windows_to_solaris_ipsec.aspx

The big advantage of IPSec approach is cost, sine IPSec is typically built-in into the operating system, but Oracle Advance Security option is a separately licensed option.

Extensible MA and Data Source Systems that auto-generate anchor attributes

alextch — Wed, 17 May 2006 19:35:00 GMT

This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm

While developing an extMA for SharePoint Form library I ran into an interesting issue that I think will be worth sharing. The issue that I will describe would apply to any system that auto-generates an anchor attribute and if you are writing and extMA for it.

First a little bit of background

One of the functionalities of the extMA that I am developing was to create an InfoPath form in a SharePoint Form library for a person object in Metaverse (in MIIS talk, provision into SharePoint Form library). This would allow for integration of InfoPath and SharePoint with MIIS for purposes of workflow and data manipulation. Since each form within the SharePoint library is auto-assigned a unique ID by the SharePoint I decided to use this ID as an anchor attribute for the form object. This implies that when provisioning to this connector space we need to use the following template (see MIIS developer guide for more details):

ManagementAgent = mventry.ConnectedMAs("sharepointlibV1.1")

Connectors = ManagementAgent.Connectors.Count

' Construct a temporary escaped distinguished name.

DN = ManagementAgent.EscapeDNComponent(System.Guid.NewGuid().ToString)

If 0 = Connectors Then

csentry = ManagementAgent.Connectors.StartNewConnector("person")

' Assign the temporary escaped distinguished name to the DN property.

csentry.DN = DN

csentry.CommitNewConnector()

End If

The idea behind this code is to create a connector with temporary DN, since we really don’t know the real anchor value until the connector is exported.

So what I could not quite figure out at the beginning is how to change this temporary DN for the real formID. The issue was that I assumed that within the ExportEntry function of an extensibleMA I would only have read-only access to the csentry object, but after experimenting a bit it proved not to be true. Here is sample code that I used to export an entry:

Public Sub ExportEntry(ByVal modificationType As ModificationType, ByVal changedAttributes As String(), ByVal csentry As CSEntry) Implements IMAExtensibleCallExport.ExportEntry

Select Case modificationType

Case modificationType.Add

generateFormFromTemplate(csentry, _

diskFormFullPath, _

templateForm, _

sectionName)

csentry("id").Value = UploadForm(docFolder, formName, diskFormFullPath)

In this code sample the heavy lifting is done by the generateFormFromTemplate function, which actually creates the xml document based on the values in the csentry and the template xml file that is provided as part of configuration. Next the form is uploaded to the SharePoint Form library via the function UploadForm, which in case of successful execution returns ID of the newly uploaded form.

The main point here is this line csentry("id").Value = UploadForm(docFolder, formName, diskFormFullPath). Csentry(“id”).value is the anchor attribute of the connector, and as you can see I am able to set it during the ExportEntry call, which ultimately replaces the temporarily generated DN for this connector.

So in conclusion, when developing an extMA for a system that auto-generates anchor attributes ensure to include code for replacing the temporary DN with the value assigned by the data system. This could be accomplished in the ExportEntry function.

Building extensible management agent for MIIS

alextch — Wed, 10 May 2006 00:37:00 GMT

Walkthrough: How to build an extensible management agent for MIIS

This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm

This walkthrough provides exposure to the process of building from scratch an extensible management agent for Microsoft Identity Integration server. Specifically we will take a look at creating a management agent for SharePoint document library, which contains InfoPath forms. The idea behind this connector is to provide a framework for merging workflow capabilities built-in into InfoPath with provisioning powers of MIIS. More importantly, this walkthrough is aimed at providing developers and or administrators with the knowledge around creation of additional connectors for MIIS.

Please, follow this link to view the walkthrough.

Automating Fail-over of MIIS Service deployed in a Hot-Standby configuration via Microsoft Cluster Service.

alextch — Sun, 18 Dec 2005 01:34:00 GMT

Automating Fail-over of MIIS Service deployed in a Hot-Standby configuration via Microsoft Cluster Service.

This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm

As customers start to rely more heavily on MIIS especially for password synchronization capabilities, the issue of automated fail-over of this service becomes very important.

This presentation explores the scenario of using Microsoft Cluster Service to automate the fail-over of MIIS when deployed in Hot-Standby configuration. The impact on PCNS is also discussed.

View presentation

Generic Script Resource for MIIS

MSDN Documentation on Cluster Generic Script Resource

Step-by-step guide on installing MIIS in a hot-standby configuration

alextch — Sat, 10 Dec 2005 17:35:00 GMT

Step-by-step guide on installing MIIS in a hot-standby configuration

This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm

As companies start to explore password synchronization capabilities of MIIS, they realize that MIIS is starting to become a mission critical application and look for ways to reduce potential for downtime of MIIS.

This step-by-step guide walks you through the process of installing MIIS in a hot-standby configuration. High-availability aspects of Password Synchronization Service (PCNS) are also considered in this guide.

Please, follow this link to view the guide.

How to establish password synchronization between Active Directory and SunOne Diretory using MIIS

alextch — Sat, 03 Sep 2005 01:47:00 GMT

How to establish password synchronization between Active Directory and SunOne Directory using MIIS

This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm

This blog guides you through the process of establishing password synchronization between Active Directory and SunOne Directory via MIIS.

Please, follow this link for detailed discussion and demo of this solution

How to integrate MIIS and SQL 2005 SSIS

alextch — Tue, 09 Aug 2005 18:01:00 GMT

How to integrate MIIS and SQL 2005 SSIS

This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm

This blog explores the possibility of integrating MIIS and SQL Server 2005 Integration Services. Specifically it looks at a scenario of linking records across disparate directories by utilizing Fuzzy Lookup functionality of SQL 2005 SSIS.

Please, follow this link for detailed discussion and demo of this solution.

How to utilize Fuzzy Matching Capabilities of SQL 2005 to match records from various enterprise directories, when no mutually unique identifiers exist among the directories

alextch — Sat, 16 Jul 2005 02:52:00 GMT

How to utilize Fuzzy Matching Capabilities of SQL 2005 to match records from various enterprise directories, when no mutually unique identifiers exist among the directories.

This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm

Quite often I find myself in a situation where I need to establish a link between records in disparate directories and no mutually unique identifier exists within the directories. A common example of such situation is synchronization of HR and Active Directory. Within HR system employee records are identified by employeeID and in Active Directory accounts are uniquely identified by objectSID attribute, but employeeID field in Active Directory is not populated with the corresponding employeeID.

In the absence of a unique identifier we typically resort to matching records by a combination of fields (Last Name, First Name, Initial etc), but in a large enterprise with tens of thousands of records this approach does not work well due to a variety of reasons:

Spelling errors
Duplicate records
Large number of identities with the same combination of Last and First names

Luckily with the release of SQL 2005 we nwt have another tool in our arsenal that would allow us to streamline the process of matching records in disparate directories by utilizing Fuzzy Lookup capabilities of BI engine that comes with this product.

Please, follow this link for a step-by-step walkthrough.