ILM Best Practices (Identity Life Cycle Manager)

4th of July -- Independence Day

2009-07-05T22:00:00.001-07:00

233 years ago, 56 men signed a document and began a labor to give birth to a nation. I am very grateful for their service and for their sacrifices and for each and every soldier, and dutiful civil servant since then. They have afforded me and my family a great many blessings. As well some of my family members have been privileged to serve. One of my grandfathers taught ground school during World War II and the other served in the Army and was stationed in Greenland. I honor their service.

As part of my Independence Day celebration I read some of the writings of Abraham Lincoln. I found this moving passage from his first public speech in March 9, 1832 to the people of Sangamon County, he spoke on the topic of education :

"That every man may receive at least a moderate education, and thereby be enabled to read the histories of his own and other countries, by which he may duly appreciate the value of our free institutions, appears to be an object of vital importance, even on this account alone, to say nothing of the advantages and satisfaction to be derived from all being to read the Scriptures and other works, both of a religious and moral nature themselves."

I believe that this "moderate education" unto "every man" is a key basis for our continuing freedom.

I also wonder whether Identity Management would have a much different meaning without the Declaration of Independence.

The attributes behind Message Delivery Restrictions

2009-06-29T00:40:00.000-07:00

Do you know what attributes are used to control who can and can't send to a Distribution List in Exchange 2003 and Exchange 2007? or Does it use a DACL?

Knowing such things is key if you are going to automate distribution list management through .NET programs, or MIIS/ILM/FIM, Quest ARS or any other tool that is talking to LDAP attributes. For Powershell you need a separate list since the names are different.

Seeing as how a picture is worth a thousand words I'll include some after a brief explanation:

At first I was afraid that it used the SendTo permission on DACLs but fortunately that is not what the Exchange GUI tools change. This is fortunate since ILM does not have an out of the box MA that modifies DACLs on AD objects, it is also fortunate since programming against DACLs is somewhat complicated. I must give thanks to my friend Joe Kaplan and his co-author Ryan Dunn for the helps in their book (see page 302 listing 8.2 listing the DACL) and their forum http://directoryprogramming.net/default.aspx

The .NET Developer's Guide to Directory Services Programming

With the help from their book I was able to eliminate DACLs since the darn things never changed. FC never lies.

Open the Exchange Console, navigate to the Distribution lists open their properties and go to Mail Flow Settings click on Message Delivery Restrictions and then click on the Blue check mark next to Properties:

So what I found was five attributes that control the fate of who can and who can't send to a particular recipient (in this case a distribution list)

authOrig, unauthOrig, and msExchRequireAuthToSendTo,

Attribute Name	Name in GUI	Explanation	Powershell (Set-DistributionGroup) Just as an FYI
authOrig	Accept messages from Only senders in the following list:	If this attribute and dLMemSubmitPerms are both empty then that is the equivalent of All Senders. If populated only those recipients and the members of Distribution Lists enumerated in dLMemSubmitPerms can sends listed can send items to this distribution list minus anyone listed in unauthOrig and anyone that is a member of distribution lists enumerated in dLMemRejectPerms	-AcceptMessagesOnlyFrom
dLMemSubmitPerms	same as above	see above	-AcceptMessagesOnlyFromDLMembers
unauthOrig	Reject messages from Senders in the following list:	Prevents recipients listed here from sending to this Distribution list	-RejectMessagesFrom
dLMemRejectPerms	same as above	Prevents recipients who are members of the Distribution lists mentioned from sending email to this Distribution list	-RejectMessagesFromDLMembers
msExchRequireAuthToSendTo	Require that all senders are authenticated	When set to True only authenticated users (no external users) can send mail to this Distribution list	-RequireAllSendersAreAuthenticated

For more info on attribute to Powershell attribute name conversions see

http://blogs.technet.com/evand/archive/2007/02/19/filterable-properties-in-exchange-2007-rtm.aspx

For more on the Powershell commands with some examples see

http://technet.microsoft.com/en-us/library/bb397214.aspx

What would be really nice would be if FIM 2010 already had the schema and OVC extended for this. Since this is the very next thing people at a big company ask for after finding out they can automate distribution list maintenance.

As promised some pretty pictures to help explain (on the left you see the screenshot from ADSI edit and on the right the snapshot of the Exchange Console

On this one I reverse the order

By now you get the idea, that if you select a distribution listt in the Senders in the following list they get put here:

So we see that the Exchange Console clever sorts the DLs from the individuals and puts them into their separate attributes.

H30, Geneva Cola, Sitrus and Orange Fizz

2009-06-24T22:23:00.001-07:00

Back in business school I was a connoisseur of fine commercials. Recently I watched a commercial for Lipton Ice Tea (note I am a teetotaler who doesn't drink tea) and I have to admire their cleverness in coming up with names for competitor products (see the title) in their "Lipton Tea, I think I love you" commercial. (Lyrics here)

Really the names are clever although the best is the H30 -- I just love it, a chemical compound that as far as I can tell can't exist, but we all know they are making fun of flavored water. Of course I also love ordering water by requesting Di-Hydrogen-Oxide.

OK they didn't actually have Geneva Cola it was really Milan Cola, but since I really wanted to blog about Geneva and how "I think I love [it]" well I couldn't resist the name substitution.

Now before I pester you with anymore puns let me tell you why I love Geneva, Microsoft's next evolutionary leap with Federation and SSO.

Of late there has been a lot of buzz about Cloud computing. But there are obstacles, when you host applications in the cloud or use SaS type applications you wind up creating new identity stores.

With Geneva your identities will be almost ubiquitous, in that you can use it anywhere and your applications built using the Geneva framework will be able to accept and use identities from anywhere that you decide to trust. It won't matter anymore where your applications, are in Microsoft's cloud, your cloud, or your partner's cloud.

In short if Cloud Computing will transform the industry then Geneva is the way to get there. It certainly lowers some of the barriers

Additionally, we can use Geneva to provide SSO for apps within an organization.

Now to tie in the commercial, since Geneva also supports the SAML 2.0 protocol it even inter-operates with Hot Ball of GAS SSO, and "Fiction Books Access Manager"

Best Practices ILM 2007 Coding Conventions and Habits

2009-06-22T15:31:00.001-07:00

In response to question in the MMSUG yahoo group I thought I would post the following:

Naming conventions for MV objects and attributes.

Most CS objects and attributes come to us with names -- the exception being when we are writing our own views in SQL or Oracle

There are many object types and attributes pre-defined in the metaverse if you use those no need to rename most of them seem to come from the required and suggested attributes for either an X.500 Directory or LDAP Directory.

For new objects it depends on how you want to process things. If you need to take some code based actions that are identical for similar but different object types then using a prefix or suffix can help. I have seen some very complex GALSync scenarios implemented that way, div-Person, div2-Person, div3-Person, div-DL, Div2-DL, Div3-DL, div-Contact, div2-Contact, div3-Contact. Then in provisioning code you can match on patterns to make decisions.

For Attributes some like to create them with a prefix with the client name. I generally like to match my attributes to the names from LDAP.

Naming conventions for coded attribute flows (AF).

In the 2731 class the instructions have you replacing the generated name User.samAccountName -> Person.sAMAccountName with something more like SamAccountName.

The benefit of the generated names is that they are pretty much unique and human readable although they are long. These days I tend to leave the default names.

Ways to make extensions for AF more adjustable without re-coding.

I have seen one developer use the flow rule names as a language to processor module to handle 90% of his string manipulation. That certainly cut down on the need for re-coding.

That may have been an extreme example but it shows you what is possible.

Another tactic is to preprocess Attribute flow by performing the transformations in a SQL view -- it is much faster, but you can only use information available from that database. If you need to change it you won't need to change the MA Extension code. This is my preferred approach.

Ways to make provisioning code more adjustable without re-coding.

Make use of XML config files to store things like Exchange Mailbox stores to use, and then read them in during the initialize method (called once when the dll is loaded, since the dll's stay in cache for 5 min after use this won't necessarily be every run) of the Provisioning dll, and then make use of them during the provision method (called once per connected cs object being synchronized). Don't load an xml config file in the provisioning method unless you are looking for a way to slow down performance.

Favorite ways to make the status for any particular object easy to understand for people who don't know ILM/AD, etc.

We like to use reports and give the reports and their columns good descriptive names like ILM Disconnectors. Uh I mean AD Objects (Users, Groups OUs etc) that don't have matches in the other systems (like HR).

In the reports on connected objects using the binary functions in SQL to translate

For info on reports see Brad Turner's blog on the community reporting pack that he created (I helped but only on one report).

Desert Code Camp -- SQL, XPath and FIM

2009-06-19T14:57:00.001-07:00

I just presented 3 sessions at the 2009 Desert Code Camp on Saturday June 13, 2009 at Devry University

Thanks to Devry for hosting it and thanks to Lorin Thwaits of KB Alertz for being the Code Camp Director and to all other volunteers.

Title (and link to Desert Code Camp site)	Abstract	Presentation Link	Comments
I dream in SQL (writing queries)	Learn how to write SQL queries: SELECT statements, JOIN clauses, group by with Practical examples from the realm of Identity Management	I_Dream_in_SQL	Audience: 36 The room was packed. Despite the odd hum in the background due to feedback from the projectors, things went fairly well. I had created the session, slides and examples for a group that was brand new to SQL or pretty shaky but most that showed up had plenty of experience writing queries but wanted to formalize their knowledge learn some of the terms, best practices and gain understanding of why they write queries that way. I tweaked the slides to include some of the topics I added on the fly in response to questions and the audience's deeper than novice experience. I received lots of great questions.
Query Performance Tuning	Learn how to optimize your SQL 2008 queries, learn how to use Query Plans and Statistics to measure performance -- find the weak points and then what can be done to speed your queries, learn when to avoid cursors (usually) and how to replace them.	Optimizing SQL Queries	Audience: 37 About half the class from the 1st hour followed me to this one. It was a another packed session SRO! I wish I had more time to delve in. Showed people the different ways to analyze queries and some basics about query tuning with a focus on dumping cursors. I have also revamped these slides somewhat.
XPath Queries (tastes just like SQL)	On more and more fronts XPath queries are available to us, learn how to take your existing SQL query skills and translate them to XPath. See practical examples of XPath queries against a WCF based Web service (Forefront Identity Manager).	XPath Queries (tasted just like SQL)	Audience: 17 Joe Zamora co-presented this one with me so that we could show off his FIM query tool as an example to others that write against XML SOAP WCF web services. After the crowd did agree XPATH does taste like SQL!

To PKI or not to PKI?

2009-06-02T11:12:00.001-07:00

When should one implement a Public Key Infrastructure and when should one not? Obviously we implement a PKI to solve a problem, usually around security, enabling secure communications with a web server, multi-factor authentication, encryption. A PKI solution can be very versatile, but it comes at a price in setup and maintenance. But what alternatives do we have? Let's examine each problem in turn

Problem	PKI difficulties	Alternatives	Benefits for Alternatives
Enable Secure web transactions (SSL)	certs expire without warning anyone	none
Secure network communications (IPSEC)	Need to issue certificates to all client computers (can use AutoEnroll GPO)	none
Multi-factor authentication for Wireless networks using 802.1X	Need to issue certificates to all client computers or smart cards to all users	Radius -- One Time Password Tokens	With Quest Defender issuing and maintaining of OTP is very easy. Defender is much easier than standing up a PKI and issuing smart cards to everyone
Multi-factor authentication (certificates, smart cards)	Need to issue smart cards to all users (can be time consuming) Need special hardware	One Time Password Tokens	With Quest Defender issuing and maintaining of OTP is very easy. Defender is much easier than standing up a PKI and issuing smart cards to everyone. Can work even on computers without the smart card reader.
Encryption of files (EFS)	Need to issue smart cards to all users (can be time consuming)	AD Rights Management Services	Enrollment of users is transparent -- new users can be given permissions by adding them to groups without having to re-encrypt the files. No need to renew certificates. Restrictions are enforced after file is opened. It allows you to assign rights and permissions to other people to documents (open, saving, edit, print, cut and paste) and emails (forward, cut and paste)
Enabling users (internal and/or external) to use your code without getting scary warning (Signing Code Modules, Macros, ActiveX controls etc)	Need to issue/buy certificates for developers	none
Signing emails	Need to issue certificates (whether on smart cards or not) to all users	PGP (web of trust)
Encrypting emails	Need to issue certificates (whether on smart cards or not) to all users	AD Rights Management Services or PGP (web of trust)	AD RMS Enrollment of users is transparent. Restrictions are enforced after file is opened. It allows you to assign rights and permissions to other people to documents (open, saving, edit, print, cut and paste) and emails (forward, cut and paste)

In short you need certificates for SSL, IPSEC, code signing and signing emails. Whether you build your own PKI or get certificates for them is another question. For SSL and code signing you can get away with buying your certs and should if your web site and/or code is for the public (although if you have enough you may want to look at setting up a subordinate CA with a Public CA that way you control the certs but they are issued through a trusted root CA and your customer don't get those confidence inspiring messages asking them whether to trust you or not) . For IPSEC and signing emails you should implement your own PKI in order to save the cost of buying so many certs.

If you need to implement signing of emails along with multi-factor authentication then it makes sense to take advantage of the versatility of certificates on smart cards. Then it makes sense to implement the Certificate Management component (CLM) of ILM 2007 to ease many of the challenges with issuing and managing smart cards.

However, if multi-factor authentication and encryption are your main goals you may want to take a look at one time password tokens with Defender and Microsoft's AD Rights Management Services (AD RMS) respectively. Both present easier and perhaps cheaper alternatives, that also add capabilities. Defender adds the capability to use multi-factor authentication on machines without smart card readers, and AD RMS adds the capability to restrict what users can do with content even after they decrypt it.

The Business Impact of Identity and Access Management with Forefront Identity Manager 2010

2009-05-15T11:31:00.001-07:00

Brad and I are going to cover the value of the whole Identity Management Stack from Microsoft and a few additional pieces from partners.

When:
Thursday, May 28th

Where:
Webinar/Online
(Live Meeting links will be
sent to all registrants) (Click Here to RSVP)

Presenters:
David Lundell – Microsoft MVP for ILM, Ensynch Practice Director
Brad Turner – Microsoft MVP for ILM, Ensynch Sr. Technical Architect
Time:
9am-10am Pacific/Arizona
10am-11am Mountain
11am-12pm Central
12pm-1pm Eastern

*Convert time zone

Webinar: The Business Impact of Identity
and Access Management with Forefront Identity Manager 2010 (formerly ILM "2")

You’re invited to attend an informational webinar showcasing the business benefits associated of Identity and Access Management with the newly named Microsoft Forefront Identity Manager 2010 (Formerly ILM "2").

This webinar is designed for Business and Technology Decision-makers interested in reducing operational costs while increasing security, compliance and overall operational efficiency. If you're interested in how Identity and Access Management solutions can impact business results, this webinar is for you.
Ensynch is proud of our world-class Identity and Access Management practice, boasting 3 Microsoft MVPs (out of only a handful world-wide). This team’s efforts have earned Ensynch back-to-back Microsoft Worldwide Partner Awards for Identity Management in 2007 and 2006. Take advantage of this opportunity to learn from their vast enterprise and mid-market experience in incorporating Best Practices to deliver heightened business results.

Agenda:
The Business Value of Microsoft’s Identity Management Stack

Evaluate the business challenges, the cost and the opportunities for savings with Identity Management

IDA with Forefront Identity Manager 2010 (ILM 2)
Maintaining existing ILM 2007 deployments

Strong Authentication

Certificate Services
Quest Defender

Sharing with Partners and Customers
Active Directory Federation Services /Geneva

Reducing the need to provision Accounts for Partners
Speedier disabling of access for Partner/Customer’s Accounts
Implications with cloud based applications

Information Protection (now that you’re sharing your documents, how do you protect them)
Active Directory Rights Management Services

Add-ons

Dealing with the ILM 2 RC 0 Cert in Windows server 2003 domain

2009-04-29T14:54:00.001-07:00

The Password Reset instructions ask us to use Group Policy to distribute the cert to the clients. This only works in Windows Server 2008 functional level domains. In Windows Server 2003 domains you can automate this using cerutil.exe
The following command will export the cert generated by ILM 2 install to the ilm2cert.cer file in the working directory

certutil -store trustedpeople IdentityLifeCycleManager2 ilm2cert.cer

This command can be used to import the cert from the command line
certutil -f -addstore trustedpeople ilm2cert.cer

-- I guess we could put the cert in a public share and then add this to the login script
certutil -f -addstore trustedpeople \\someserver\publicshare\ilm2cert.cer

Or add this to a batch file that also calls the password client install

Problems with Sync Rules in ILM 2 RC0 (err FIM RC0)?

2009-04-20T18:08:00.001-07:00

Well I had a problem with a recent install -- the Metaverse Object Type Dropdown list was empty!

Turns out the source of this drop down list is the mv-data object type. However my install didn't have this object. Obviously something was wrong. How does one create this object in the first place? Not directly in the portal. I am not certain when this object is supposed to be created. Install time? First export through the ILM MA? None of these seem to match up based on time stamps. It wasn't created during install. It was created before the first import of the ILM MA, and the first Export of the ILM MA. It does match the time of the creation of the ILM MA in the Identity Manager tool in the synchronization engine. The object is created by a request generated by the Built In Synchronization Account (BISA) this is the account used by the ILM MA.

My solution was to modify my ILM sync engine Metaverse schema and then viola the drop down list was populated (the mv-data object was created). This means that after the MA is created some process in the sync engine is either sending a request to the ILM 2 Web Service through the ILM MA or the ILM 2 web service is monitoring the Sync Engine. I am guessing the former.

Earth Hour -- Mandatory?

2009-04-20T16:45:00.001-07:00

Just because we didn't participate in Earth Hour, didn't mean that our Power company, Salt River Project (SRP) needed to turn off power to the whole neighborhood last night and again this morning ;)

I am all for using our resources wisely. But sometimes I rebel against the symbolic gestures.

I mean if the power company needs an hour off can't they just schedule downtime like we do with computer systems?

ILM FIM Webinar Custom Workflow -- Joe Zamora

2009-04-20T11:54:00.001-07:00

Joe Zamora the maintainer of the Ensynch ILM 2 Custom Workflow Walkthrough is our main presenter at our next Webinar this Thursday at 9 AM Pacific. To register click on the image below. The code from our Pre-con workshop is posted on CodePlex Ensynch Custom WF Activities

Install ILM 2 in a SharePoint Farm

2009-04-16T17:40:00.001-07:00

As I endeavored to install the ILM 2 Portal into a SharePoint farm (WSS 3.0 SP 1) with a remote database I encountered the following problem:

The dreaded Premature Failure during installation.

When I turned on logging for the install and examined the file, I found:

Action 14:55:25: ConfigPortalAnonymousAccess.

CAQuietExec:

CAQuietExec: This operation can be performed only on a computer that is joined to a server farm by users who have permissions in SQL Server to read from the configuration database. To connect this server to the server farm, use the SharePoint Products and Technologies Configuration Wizard, located on the Start menu in Administrative Tools.

CAQuietExec:

CAQuietExec: Error 0xffffffff: Command line returned an error.

CAQuietExec: Error 0xffffffff: CAQuietExec Failed

Action ended 14:55:30: InstallFinalize. Return value 3.

Action 14:55:30: Rollback. Rolling back action:

So I turned on SQL Profiler and I noticed:

So I decided to go ahead and give anonymous access (temporarily of course)

Then I mapped the login to each of the three SharePoint databases and made it db_owner.

Then my install worked perfectly. I hope to research and find out exactly which limited permissions are needed.

What's in name? Forefront Identity Manager 2010

2009-04-16T17:26:00.001-07:00

In case you haven't heard Zoomit VIA or rather Microsoft MetaDirectory Services has been renamed yet again, from Microsoft Identity Integration Server 2003 to Identity Lifecycle Manager 2007 to Forefront Identity Manager 2010 or FIM for short. For obvious reasons the L was dropped when the F was added (Forefront + ILM = FILM).

So ILM 2 => FIM 2010

(stole this graphic from Brad Turner's blog -- his Smart Art creations are beautiful -- recently I have been studying smart art under his tutelage I hope to soon approach his level of skill)

Doug Leland, general manager of Microsoft’s Identity and Security Business Group, explained, "For example, our Identity Lifecycle Manager product is now officially named Forefront Identity Manager. We see the Forefront brand as synonymous with Business Ready Security."

http://www.microsoft.com/presspass/features/2009/Apr09/04-16BusinessReadySecurity.mspx

From Microsoft MetaDirectory Services (MMS) to MIIS was a complete rewrite dumping Zscript for .NET and putting the metadirectory in the SQL Server back end. ILM 2007 added the Certificate Lifecycle Management piece while leaving the core functionality of MIIS alone. FIM 2010 of course adds lots of new functionality (everything you have read about ILM 2, the portal for self-service, password reset, the web service) but good old MIIS is still there as the FIM Synchronization Engine, but there have been substantial improvements under the hood to enable synchronization rules to be configured in the portal and flow into the Sync Engine.

So what's in a name some new features that according to Doug Leland spell Business Ready Security.

The Target date is still Q1 of calendar year 2010.

Ensynch The Place to Be

2009-04-15T07:46:00.001-07:00

In the last four months two very talented people have joined Ensynch, Chris Calderon, ILM MVP, and Mark Struck.

Chris Calderon of IdentityJunkie.com fame is extremely talented with ILM, AD Federated Services (AD FS) and many other tools.

Mark Struck, is a very talented developer, and experienced implementer of ILM. Even before Mark joined the team he and I collaborated to figure out how to use the ILM 2 web services.

A few excellent Live@edu (Outlook Live) Blogs

2009-04-14T12:35:00.001-07:00

I have been involved with the Microsoft Live@edu (formerly Windows Live@edu) and the Outlook Live (formerly Exchange Labs) programs for quite sometime.

What a wonderful opportunity for schools to alleviate the cost of hosting email for students and then to be able to offer it to alumni helping provide them with lifelong connection to the university and way to keep their email address from their student days. Maintaining stronger ties leads to more evangelism on the school's behalf and will lead to more Alumni donations. I would have love have kept my dpl@bigdog.engr.arizona.edu, lundelld@gas.uug.arizona.edu or dlundell@u.arizona.edu accounts. Instead of rediscovering friends on facebook I might never have lost touch with them in the first place.

A few weeks ago Robert Hughes of Bridgepoint introduced me to Jonny Chambers blog as another excellent resource to information about Outlook Live. So I thought I would collect some resources here:

Jonny Chambers blog

Jonny has a great list of official links to Live@edu

http://cid-c76eae4d4a509fbd.profile.live.com/Lists/cns!C76EAE4D4A509FBD!495/

Almero Steyn (pronounced Al mare Roo Stain) another ILM MVP has also put together some fantastic blog posts on Outlook Live.

ILM 2 addons

2009-03-25T14:31:00.001-07:00

Marvin Tansley of Gemalto demonstrated their add-on to ILM 2 for provisioning One Time Password (OTP) devices using ILM 2, with the goal of minimizing the # of portals that users visit in order to perform self service management. It looks really good, it even accounts for lost device management.

Gil Kirkpatrick of Quest interviewed me on camera to discuss my experiences at the conference. That was fun.

At lunch Gil handed out prizes (we provided a red colored XBox -- I guess the red had something to do with Resident Evil). But you had to present to win, and I do mean present -- you had to respond within 10 seconds to get your prize.

<PrizeOffering TTL="10 Seconds">Resident Evil Xbox</PrizeOffering>

New Certificate and Identity Blogger on the Loose

2009-03-25T11:34:00.001-07:00

Marc Mac Donnell has just launched his blog on http://assurancesinidentity.blogspot.com/ and called it Assurances in Identity, and has posted the links to the CLM API documentation and case study about some work he did with MCS UK and CapGemini.

I look forward to many more posts from Mark about some of the wizardry and trick in managing certificates and identities.

MSIT's implementation of ILM 2

2009-03-25T11:30:00.001-07:00

TEC 2009 continues onto the last day.

Joel Silver spoke on his efforts and plans to implement ILM 2 for Microsoft. He presented a very interesting workflow to show how he addressed the challenge of creating unique email aliases.

Then I listened to Felix as he discussed some of the interesting aspects of LDAP enhancements from around the vendorscape (I think I just made that word up).

TEC 2009

2009-03-24T15:50:00.001-07:00

Now that our pre-conference workshop on Taming the Chaos – Building a Practical Lifecycle Mgt. Application in the ILM “2” Portal is done

and our (Brad, Chris and me) sessions done: Proper Care & Feeding of ILM, CLM and RMS , Designing an Object Expiration & Reconciliation process in ILM 2 , Rescue Your Identity Metasystem from Chaos (reporting against ILM 2), and ADFS Extensibility, we are all able to relax a little and enjoy everyone else's sessions.

I spent a fair amount of time looking at Quest's One Identity Management Solutions (thanks to Jonathan Sanders), and I also got to attend Felix Gaehtgens's (Kuppinger Cole) session on You've Authenticated the User, so Now What? wherein he discussed RBAC vs Attribute Based Access Control (ABAC) and a standard that is new to me called XACML (Zack uh mel). I really enjoyed it despite it being a forward looking theoretical discussion.

Brad was telling me how much he enjoyed the ILM “2” Chalktalk by Andreas Kjellman and Mark Wahl

TEC 2009 -- Ensynch Identity Bus

2009-03-24T15:32:00.001-07:00

Last night Fellow ILM MVP's Brad Turner, Chris Calderon, Carol Wapshere (pronounced Wap shear and well known as Miss MIIS) and I along with a number of other TEC 2009 attendees rode on the Ensynch Identity Bus to take us from the Green Valley Ranch Resort to the Las Vegas Strip. After a great steak dinner at Smith and Wollansky's (across from New York New York) a few us of walked the strip hoping to see the fountains at the Bellagio, but alas they shut off at midnight.

Our first run of the night was with a completely full bus!

The bus will also be running tonight

Departing Green Valley Ranch Resort 8:30pm, 9pm, 9:30pm, 10pm, 11pm, 11:30pm, 12am, 12:30am.
Drop-off / Pick-up at Mandalay Bay, 9pm, 9:30pm, 10pm, 10:30pm, 11pm, 11:30pm, 12am, 12:30am, 1:00am (last pick-up)
Drop-off / Pick-up at New York, New York, 9:10pm, 9:40pm, 10:10pm, 10:40pm, 11:10pm, 11:40pm, 12:10am, 12:40am, 1:10am (last pick-up)

Posted: ILM 2 Business Value webinar recording

2009-03-16T11:00:00.001-07:00

ILM 2 Business Value Webinar Recording

It has actually been posted for some time now, I have just been a bit busy (apology to my readers).

Other items will also get posted here in the column on the right hand side:

http://ensynch.com/pa_ci_identity_and_access_management.aspx

ILM/MIIS Sync Engine Clustering Windows 2008

2009-03-16T10:31:00.001-07:00

First, let me say thank you to Alex Tcherniakhovski for pioneering the way in clustering the MIIS Service or as it is now known the ILM Sync Engine. That blog, presentation and script was an excellent set of work. http://blogs.msdn.com/alextch/archive/2005/12/17/clusteredmiis.aspx

On Windows Server 2008, a few things have changed that break the script that Alex T. provides.

In Windows Server 2003 the cluster services runs as a domain account and as long as the user has access to all nodes, to stop and start services, and as an MIIS Administrator then it should be able to do the trick.

Well with Windows Server 2008 the security model for the cluster service has changed:

http://support.microsoft.com/kb/947049

http://technet.microsoft.com/en-us/magazine/2008.07.failover.aspx

There is no service account, instead there is a Cluster Name Object created in AD as a computer object.

So the cluster service, which runs the generic resource scripts, now runs under local system in a special context with limited privileges.

So this means you can’t impersonate during WMI calls because it doesn’t have enough rights.

I tried making the CNO a member of the local administrators group, but that wasn’t enough. I may still get this to work.

For the mean time I am switching the remote wmi calls to use embedded credentials, but the local WMI calls can't have credentials like so:

if Node = activeNode Then

Set objWMIService = objSWbemLocator.ConnectServer(Node, _

"root\CIMV2")

Else

Set objWMIService = objSWbemLocator.ConnectServer(Node, _

"root\CIMV2", _

strUser, _

strPassword, _

"MS_409", _

"ntlmdomain:" + strDomain)

End If

After changing this several places in the code -- fixing how the command to sleep worked, I can now failover without a problem!

At TEC get on the Ensynch Identity Bus

2009-03-12T00:27:00.001-07:00

If you are coming to TEC 2009 at the Green Valley Ranch Resort outside of Las Vegas, and want to take a trip to the strip Monday or Tuesday night then you are in luck -- Ensynch is sponsoring the Identity Bus -- we'll have some buses that will be running from the Resort to one of the Monorail stops on the strip. Details will be provided at the conference in your handouts. I will riding on the Identity Bus some of the time and hope to see you there!

Thanks to Stuart Kwan for coining the term Identity Bus, and thanks to Christine McDermott for helping suggest a practical way to make it happen, and thanks to Tyeson Cluff our marketing consultant for making it happen!

Netpro DEC -> Quest TEC -- Ensynch's Sessions

2009-03-11T12:09:00.001-07:00

Back in business school we always studied name changes and rebranding, and this one has been interesting

Last summer NetPro deciding to expand the Directory Experts Conference (DEC) to include an exchange conference and so they re-branded the conference NetPro's The Experts Conference. Then Quest acquired NetPro, so it became a completely re-branded conference as Quest's The Expert Conference.

So NetPro DEC became Quest TEC.

Sunday Mar 22nd - Wed Mar 25th in Vegas www.tec2009.com

Day	Time	Topic	Speakers
Sunday	1PM - 5 PM	Pre conference Workshop 2 Taming the Chaos – Building a Practical Lifecycle Mgt. Application in the ILM “2” Portal	David Lundell and Brad Turner
Monday	1 PM - 2:15 PM	Designing an Object Expiration & Reconciliation process in ILM 2	Brad Turner
	1 PM - 2:15 PM	Proper Care & Feeding of ILM, CLM and RMS Databases	David Lundell
	Mon 4 PM - 5:15 PM	Rescue Your Identity Metasystem from Chaos Through Reporting against ILM 2 with SSRS	David Lundell Brad Turner
Tue	2:45 PM - 4 PM	ADFS Extensibility	Chris Calderon will probably co-present with Randy Weimar

(yes the current schedule has Brad and I speaking on Monday at 1 PM in different rooms)

Another talented Ensynchian joins the blogosphere

2009-02-12T13:21:00.001-07:00

My colleague Joe Zamora, a talented developer, who has been instrumental in helping us advance our knowledge of custom workflows, has just launched his own blog: CShark.

His first post is on how to "Generate AccountName in ILM2 custom workflow activity" and it came in response to a question in the ILM 2 connect forum entitled: Custom Workflow Activity to Generate samAccountName.

Go Joe Go!