Identity Management Extensibility

Forefront Identity Manager 2010 Management Pack is on Connect

Joe Schulman — Fri, 02 Jul 2010 03:21:41 GMT

This post is to help people discover the FIM MP via search engines. The Forefront Identity Manager 2010 Management Pack is posted on Microsoft Connect while we gather customer feedback.

Enroll in the FIM connect site and look for the Management Pack (MP) in downloads.

https://connect.microsoft.com/site433

CodePlex project for community client

Joe Schulman — Fri, 09 Apr 2010 22:20:00 GMT

Paolo started a codeplex project to continue development of the unsupported client. Paolo fixed a bunch of bugs, added more strongly-typed classes, and enabled approvals. Check it out now:

http://fim2010client.codeplex.com/

Forefront Identity Manager 2010 has Shipped!

Joe Schulman — Tue, 02 Mar 2010 18:05:00 GMT

It's been a long and fruitful road, but now we're pleased to announce that FIM is available for customers! Read the full Forefront blog post here:

http://blogs.technet.com/forefront/archive/2010/03/02/rsa-conference-2010-identity-at-the-forefront.aspx

Excellent description of RCDCs

Joe Schulman — Wed, 09 Dec 2009 20:00:00 GMT

Please see David's excellent guide to using RCDCs:

http://www.ilmbestpractices.com/blog/2009/11/fim-rcdc-explained-in-brief.html

Using PowerShell to automate tasks in FIM

Joe Schulman — Wed, 11 Nov 2009 20:00:00 GMT

Markus has put together a great set of example PowerShell scripts which automate many tasks in FIM. Check them out today in the Scriptbox:

http://social.technet.microsoft.com/Forums/en-US/ilm2/thread/807617bc-b560-4cbe-a137-b9f338bfbd8e

Another great tweak from Paolo

Joe Schulman — Tue, 10 Nov 2009 20:00:00 GMT

Check out another useful tweak from Paolo with the unsupported web service client. Paolo adds another strongly-typed class to the client:

https://espace.cern.ch/idm/Lists/Posts/Post.aspx?ID=14

Shout out to Paolo for tweaking the unsupported client

Joe Schulman — Tue, 20 Oct 2009 19:00:00 GMT

Paolo at Cern has been using the unsupported client and contributing back to the community with bug fixes. It's always exciting to see developer adoption of our platform!

http://social.technet.microsoft.com/Forums/en-US/ilm2/thread/ffc16720-0dfb-4131-b676-9225f15b4f72?prof=required

The IDA Guys and RC1 unsupported client

Joe Schulman — Mon, 05 Oct 2009 20:00:00 GMT

Many thanks to The IDA Guys for getting together an unsupported client for RC1. We in the product group are deeply grateful for the great work the field do in extending the value of FIM for our customers.

http://blogs.technet.com/idaguys/archive/2009/10/04/fim-2010-rc1-resource-management-client-sample-announcement.aspx

A new face in the Identity Management blog community

Joe Schulman — Fri, 02 Oct 2009 22:00:00 GMT

A colleague on the product team recently joined the ranks of bloggers in the Identity Management community. Please welcome Darryl, and I look forward to his insights on FIM!

http://blogs.msdn.com/darrylru/default.aspx

Forefront Identity Manager 2010 RC1 is released!

Joe Schulman — Thu, 01 Oct 2009 00:30:00 GMT

Check out the exciting announcement:

MSFT Identity and Access news- Forefront Identity Manager RC1 and ADFS 2.0 SAML interoperability

Discovered a new blog in the community: Identity Management Crisis

Joe Schulman — Thu, 24 Sep 2009 22:00:00 GMT

Interesting topics from a new entry in the identity management blogging community:

http://www.idmcrisis.com/

Reminder: The IDA Guys Blog

Joe Schulman — Thu, 17 Sep 2009 22:00:00 GMT

This is a friendly reminder that The IDA Guys have some great content to check out. For example,

http://blogs.technet.com/idaguys/archive/2009/07/29/manageability-for-identity-and-access-management-solutions.aspx

Reminder: “Forum Greatest Hits”

Joe Schulman — Wed, 02 Sep 2009 22:00:00 GMT

A recent conversation with a customer reminded me about Markus and Ahmad’s “Greatest Hits” on the TechNet forums:

http://social.technet.microsoft.com/Forums/en-US/identitylifecyclemanager/thread/284da8d2-201c-42ca-bc63-00651c0b80b8

No change in status to report

Joe Schulman — Fri, 28 Aug 2009 02:53:00 GMT

This post is a reminder that we have no change in status to report with respect to dates, etc. The previous post is still accurate:

http://blogs.technet.com/stbnewsbytes/archive/2009/03/24/identity-lifecycle-manager-2-schedule-update.aspx

FIM Query Tool

Joe Schulman — Mon, 24 Aug 2009 22:10:00 GMT

I was catching up with my blog roll and saw that Joe Zamora at Ensynch put together a nifty little app to query the FIM Service. I recommend checking it out!

http://c--shark.blogspot.com/2009/07/auditing-with-fim-query-tool.html

Office Protocol Docs Published

Joe Schulman — Wed, 15 Jul 2009 22:00:00 GMT

As a small part of the the announcement about Office 2010 Technical Preview, Microsoft published the Office 2010 protocol documents. A small and dedicated group of us worked hard and long for these past months to release documents related to FIM’s protocols on time. Of particular interest to this audience may be the FIM web service protocol document.

The protocol documents are part of Microsoft’s earnest commitment to interoperability. More information about this program can be found here.

FIM 2010 Wallpapers

Joe Schulman — Fri, 10 Jul 2009 22:00:00 GMT

I’ve been meaning to post some of Richard’s excellent desktop wallpapers for Forefront Identity Manager 2010.

Direct Link: http://code.msdn.microsoft.com/Project/Download/FileDownload.aspx?ProjectName=imexsamples&DownloadId=6543

IDA Guys Blog

Joe Schulman — Wed, 10 Jun 2009 22:00:00 GMT

I am catching up on my blog roll, and I would like to shout out to a relatively new blog in the IDA space: The IDA Guys.

+1 on "Never say it will only take Five Minutes" -- the only task that takes 5 minutes is the one you don't do ...

Creating a Named Group and adding Persons as members

Joe Schulman — Mon, 11 May 2009 22:00:00 GMT

Leading announcement: I appreciate the feedback I’ve gotten from some of you about the API of the new client. One piece of key feedback I want very much to incorporate is how we can unify accessing single-valued and multi-valued attributes. Please send any additional comments my way.

For this week’s post we see the benefits of promoted properties and transactions. The full source code is available on MSDN code gallery.

Example 1: Create a Named Group

In this example we create a new object and pass it to the client to be created on the server.

public Guid CreateGroup()

{

RmGroup newGroup = new RmGroup();

newGroup.DisplayName = "My New Group";

// Demonstrate accessing a non-promoted attribute

newGroup[RmGroup.AttributeNames.MembershipAddWorkflow].Value = "OwnerApproval";

// Any user object's ObjectId

newGroup.Owner = this.OwnerObjectId;

return this.client.Create(newGroup);

}

Now let’s add some users to the group.

Example 2: Add members to Group

In this example we demonstrate using a transaction to track our changes to the group object. To add a member to a group simply add another reference to the ExplicitMember attribute. The public client exposes the ExplicitMember as List<Guid>, and in this example we add another Guid. Once all of the changes are complete, we accept the changes and send the transaction to the client. The client transforms the changes into da:ModifyRequest/da:Change elements and sends them over the wire.

public void AddUsers(Guid groupId)

{

RmGroup group = this.client.Get(groupId) as RmGroup;

RmResourceTransaction transaction = new RmResourceTransaction(group);

transaction.BeginChanges();

int numberAdded = 0;

foreach(RmResource resource in this.client.Enumerate("/Person[Department='Sales']"))

{

RmPerson person = resource as RmPerson;

if(person != null)

{

numberAdded++;

group.ExplicitMember.Add(person.ObjectID);

}

Assert.IsTrue(numberAdded >0);

transaction.AcceptChanges();

Assert.IsTrue(this.client.Put(transaction));

}

We successfully created a group and added users to it programmatically.

This morning’s post delayed until Monday

Joe Schulman — Thu, 07 May 2009 22:00:00 GMT

Preparing for TechEd has eaten up cycles to proof today’s post. I should have the cycles on the plane this weekend.

What can I do with the web service interface?

Joe Schulman — Wed, 06 May 2009 22:00:00 GMT

I got a very good question today from a TAP customer last week which I hope is generally applicable. The customer asked “What can I do with the web service interface?” Fantastic question! With the web service interface, you can….

Do everything the portal does. (The portal uses the web service interface for all requests.)
1. Create and delete groups.
2. Add and remove members from groups.
3. Create and delete users.
4. Configure synchronization rules to provision users and groups to connected systems like AD.
5. Configure management agents and the metaverse using ma-data and mv-data objects.
6. Create calculated groups and read their resulting calculated membership.
7. Create workflow definitions and configure policy to fire these workflows upon changes in the system.
8. Search for objects with complex queries.
9. Save searches for objects by using Sets and configure the system to take action when values in the set change.

If you are considering batch creation of groups or objects or are looking for a good integration story with another product, I invite you to consider using the web service interface. For more information, I recommend reading my previous post on this topic.

Product Team Attendance at TechEd 2009

Joe Schulman — Tue, 05 May 2009 22:00:00 GMT

Members from the product team will attend the TechEd 2009 conference next week in Los Angeles. Fred, Alym, Joel, and myself will attend the conference to speak about FIM and staff the booth. I invite you to attend our sessions:

Alym and Joel will present using FIM to reduce the cost of the help desk for MSIT (SIA-307).
Fred and I will speak about using FIM to reduce the cost of provisioning and credential management (SIA-308).
Brian Komar will talk about integrating FIM workflows with certificate management (SIA-310).

If you are in the area, please stop by our booth on the expo floor or check out one of our sessions.

How to Search for Existing Groups

Joe Schulman — Thu, 30 Apr 2009 22:00:00 GMT

In this week’s post we look at the three most common queries to search for existing groups: getting all groups, “my groups”, and groups that match a particular filter. While these examples show off the current prototype client, the filters and principles may be used on any client. The test case source code may be downloaded from MSDN code gallery.

Example 1: All Groups

To search for all groups, we pass a simple filter “/group” to the Enumerate method. The Enumerate method returns a .NET enumerator, which C# can use in its foreach construct. Note that the enumerator returns the parent class RmResource and that we down-cast the returned object to an RmGroup. Some queries might return a mixed bag of object types so it is necessary to check the status of the cast in production.

Behind the scenes the enumerator is making the enumerate and pull requests. This iterator does not expose the count of the enumeration since we would prefer to move away from clients relying upon it. Therefore, if you only want a fixed number of objects, either include a break in the foreach or make the pull request with MaxElements set to the value you desire.

[TestMethod]

public void Example1AllGroups()

{

// In this example we enumerate all groups in the system

// and show how to get some common attributes

foreach (RmResource resource in client.Enumerate("/Group"))

{

RmGroup group = resource as RmGroup;

Assert.IsNotNull(group);

Console.WriteLine(String.Format(consoleFormat,

group.DisplayName,

group.ObjectID,

group.DisplayedOwner,

group.ExplicitMember.Count,

(group.Type == RmGroupType.Distribution)

)

);

}

Example 2: My Groups

To search for “my groups”, we search for groups whose owner are equal to the user’s ObjectID. In this example we already know the user’s ObjectID (perhaps from a previous query for all users whose ObjectSid equals some value). We also limit results to distribution lists by including the group type. Note that this client contains an enum for group type for easy checks and searches.

[TestMethod()]

public void Example2GetMyDls()

{

// In this example we enumerate all of "my" dls

String filter = String.Format("/Group[{0}={1} and {2}='{3}']",

RmGroup.AttributeNames.Owner.Name,

"6FB8413E-49DA-48d9-A204-FFB8F0EEE133",

RmGroup.AttributeNames.Type.Name,

RmGroupType.Distribution

);

foreach (RmResource resource in client.Enumerate(filter))

{

RmGroup group = resource as RmGroup;

Assert.IsNotNull(group);

Assert.IsTrue(group.Type == RmGroupType.Distribution);

Console.WriteLine(String.Format(consoleFormat,

group.DisplayName,

group.ObjectID,

group.DisplayedOwner,

group.ExplicitMember.Count,

(group.Type == RmGroupType.Distribution)

)

);

}

Example 3: Match DisplayName

To search for a group which has a DisplayName or MailNickname like a predicate, we need to use the contains and starts-with functions in FIM’s XPath dialect. Nima posted great examples on his blog with a more complete description of FIM’s dialect features. Last, note the static structures we’re using to refer to attribute names. The static definitions of attributes specific to groups, like Owner and MailNickname, are stored in the RmGroup class. The static definitions of attributes common to all objects types like DisplayName are stored in the RmResource class. The values of these attributes at runtime, however, are present on the RmGroup object.

[TestMethod()]

public void Example3SearchGroups()

{

// In this example we search for a group with displayname or alias that contain the search

String filter = String.Format("/Group[contains({0}, '{1}') or starts-with({2}, '{1}')]",

RmResource.AttributeNames.DisplayName.Name,

"Sales",

RmGroup.AttributeNames.MailNickname.Name

);

foreach (RmResource resource in client.Enumerate(filter))

{

RmGroup group = resource as RmGroup;

Assert.IsNotNull(group);

Console.WriteLine(String.Format(consoleFormat,

group.DisplayName,

group.ObjectID,

group.DisplayedOwner,

group.ExplicitMember.Count,

(group.Type == RmGroupType.Distribution)

)

);

}

Prototype V2: Overview of the new API

Joe Schulman — Fri, 24 Apr 2009 00:00:00 GMT

In this post we’ll discuss the new Prototype Public Resource Management client. I uploaded the MSDN-style documentation to MSDN Code Gallery. The purpose of this post is to walk you through the direction I’m thinking about for a supported API. These ideas are a snapshot of my thinking today and will change in the future. I welcome feedback about both the high-level approach and specific granular details. There may be scenarios or features overlooked which should be incorporated into an eventual supported client.

Changes from previous prototype

Changes since the last version of the public prototype:

This client is called “rmclient” to clearly differentiate it from the previous one.
The source code is not yet available.

Since the previous source code was meant only as documentation and never would become production code, there were few restrictions on publishing it.
Elements of this prototype may become production code. As a result, we are not yet sure what pieces we may release at this time.
We expect to have either a compiled binary, source code, or supported alternative ready for the RC1 release.

The client and object model are decoupled.
The client is layered on top of WCF.
The client uses MEX for metadata.

The original client was never intended to be copied into complex environments. As a result, many of you discovered the silent requirement to have the xsd file present for the previous public client to work.
We have a factory method that instantiates strongly-typed objects. It is now possible to use casting to check whether an object is a Person or Group.

There is a “DefaultClient” which provides basic functionality that I’ve seen in POCs. This DefaultClient isn’t the only client, however, unlike the previous prototype.
There is a pattern of “Promoted Properties” which enable developers to use Intellisense for discovering FIM object schema.

Architecture

The basic architecture of the client has 3 layers: Default Client, WS-* clients, and WCF ClientBase. All three layers are publically accessible with the intention that your code can call the layer which is most appropriate. For most customers, the DefaultClient will be sufficient since it enables basic CRUD and Enumeration operations at a high level. The diagram below summarizes these three layers, with DefaultClient depending on the WS-* clients underneath it, and those clients depending on WCF ClientBase.

All of these classes are in the Microsoft.ResourceManagement.Client namespace. The DefaultClient is expected to be the client you use for 80% of scenarios. We intend it to be a low barrier to entry and sufficiently abstracted from the actual SOAP messages. Customers who need to modify the specific SOAP messages will need to use one of the WS-* clients. Customers who need to modify the WCF channel will have to use their own WCF ClientBase. Those three options should encompass 99% of all scenarios our customers want:

DefaultClient for easy, straight-forward use
WS-* clients for power users needing advanced control
WCF ClientBase for extreme special cases

ObjectModel

The object model is completely decoupled from the client into the Microsoft.ResourceManagement.ObjectModel namespace. There are two key points I would like to make.

First, there is a base class called RmResource which is a Dictionary. You can always use a key to index any attribute out of RmResource using the Dictionary interface. RmResource also exposes public properties for some well-known attributes like ObjectId and ObjectType so that developers can use Intellisense and pass those properties as arguments to methods.

We created derived classes RmPerson and RmGroup. These classes get the common public properties like ObjectId from the parent class, but they also expose additional attributes specific for their types. For example, RmPerson exposes FirstName and EmployeeId. RmGroup exposes ComputedMember and ExplicitMember. We intend to have a class for each object type in FIM and that each object type has all of the necessary promoted properties.

Since all of these objects are public, customers can create their own derived classes for custom object types in FIM. For example, Contoso may create a Contact object with an Email address. Contoso simply needs to create a new class that derives from RmResource and create a public property for Email. The class diagram below summarizes the relationships and intended inheritance:

Second, RmResource just stores data. To commit changes back to the web service, we’re musing with the idea of requiring transactions. The reason is our web service is designed to accept “differences” to objects rather than entire representations. We are considering calculating these differences with a transaction object rather than inside the RmResource object itself. At first glance it feels more clean to separate data and operations about the data. We’ll show how these transactions work in the upcoming examples, and we hope that you agree they are a natural way to program against the FIM web service.

I hope this was a useful introduction for our direction of the new prototype. Please contact me with feedback about this direction.

Agenda for Remainder of Q2 CY2009

Joe Schulman — Thu, 23 Apr 2009 22:00:00 GMT

As promised, this week I introduce the new prototype of the Public Resource Management Client and the remaining schedule. The theme of this quarter is “Yet Another FIM Portal”. The FIM Portal is a great experience for both Administrators and Information Workers, but I often hear how customers want pieces of FIM functionality integrated into their existing portals. We will explore how to accomplish some key scenarios using this new client in the context of creating a simple portal. The intention is that when RC1 is released there will be sufficient examples to demonstrate meaningful POCs to customers.

April 23: Prototype V2: Overview of the new API
April 30: Search for Existing Groups
May 7: Create a Named Group and add Person objects as members
May 14: Batch create 100 Person objects and then batch create 1 set per unique department
May 21: Retrieve pending approvals and approve or reject them
May 28: Sync config: Fundamentals of ma-data and mv-data
June 4: Sync config: Updating the SQL MA
June 11: Wrapping rmclient with SQL Reporting Services?

Note that custom workflows are omitted from this agenda because the content is very well covered by Joe Zamora’s blog CShark. Also note that June 11 will be the last blog post of the quarter.