ECMA2 schema and multi-valued attributes

Hello all,

I've been working with ECMA2s recently and I've just started to need a multi-valued attribute as part of the object schema.

Working with this, I had a problem trying to populate this attribute during an Import run.

Typically dealing with multi-valued attributes strategies in the past involves iterating through each value using a For Each... loop or something similar.  The issue I was running into was how to designate the index on the multi-valued attribute.  I couldn't find much on the web either.

For ECMA2 schemas I figured out an easy to populate the attribute. Place the value(s) in a List (of Object) type then you can populate the multi-valued attribute with the List.

Here's a little code showing what I mean:

Dim groups As List(Of Object) = New List(Of Object)

'populate groups with values as needed

newCsentry.AttributeChanges.Add(AttributeChange.CreateAttributeAdd("groupName", groups))

Hope this helps.
-Peter

Redmond IDM Summit

Thanks to Oxford Computer Group and Microsoft for another great IDM Summit held in Redmond last week. 
Lots of great presentations, classes and a final panel discussion including IDM world's very own Jackson Shaw.  Great speakers were there like: Stuart Kwan & Mark Wahl.  Jeremy Palenchar discussed his SSO project with the state of Kentucky.  OCG's North American President, Marvin Tansley, discussed pieces of IDM and how they fit together. Other OCG'er discussed ADFS and Cloud technology to name a few. 
I was lucky enough to join Microsoft's Rob de Jong to present/demo BHold's attestation feature, we showed how easy it could be to run attestation campaigns.  Further we showed how you can use the reporting feature to review attestation progress.  Imagine you had an application you wanted to attest to that was not connected to any identity management solution - you could use BHold's reporting feature to hand off a report to the application owner showing those owners that should have permissions revoked. It was great to see the amount of questions and powerful engagement from the audience.  This leads me to believe the US public is coming to the conclusion that audit and compliance are becoming more important.

There were some great after hours events too. We did a tour of three micro-distilleries which was really fantastic!

Here's more information of the summit in case you missed it.  http://www.oxfordcomputergroup.com/redmond-summit-agenda/  . If you're interested they mentioned they are doing it again next year around the same time.

BHold's New Connector in SP1

As I mentioned in my last post, Microsoft announced the release of FIM R2 SP1 and with that BHold's new bits too.  Something that was sorely lacking with the BHold solution was a dedicated connector between BHold Core and FIM Sync.  This latest release offers the first look at this new connector.

If you go to Microsoft's TechNet Site here to can try it yourself.  I did this last week and found a few issues with the instructions.

The biggest problem deals with the provisioning of OU containers in BHold. When you finish the lab all the OU containers stay under the root.  This is due to not having the reference of the parent containers correct.  The lab uses a SQL database as a source of the OU containers.  But the premise of using a string value of the parent attribute is incorrect, instead is should be a reference value.   I'm don't give out all the details, but most of you can figure it out from here.

Once you fix that AND make sure you also bring over the root container so that the references work all the way up, then it should be smooth sailing.   If you need any help just email me.

Lotus Notes Provisioning Experience

So I was at a client and had to remember how to provision to Lotus Notes.  Unfortunately I didn't have a lot of my notes and there's always something new from client to client so some learning was needed.

Let's start with the address book:  this is the target database where users will ultimately be created.  Also in Notes terms user objects are called Person documents.  So keep that in mind.  The default address book is called names.nsf -

I was given an address book that happened to be down a few levels from the top level.  What does this mean?  When you log in to the Lotus Notes client, you open the database be first entering the Server value (sometimes called Hierarchical server name) of ServerName/Location/sub-location.  This should be given to you by your Notes admin.  Then you browse around at this level until you find the name.nsf database, typically.  In my case the database was several folders deep, but was called names.nsf.  Unfortunately I would keep getting an error when trying to provision the user object to the Notes CS.  The error was:

NoCompatiblePartitionFoundException: The partition filter criteria...

The error went away after I was given access to use a top-level database.  But the name of that database was not the default names.nsf, which lead me to my next error.  When I tried to export this new user I would get:

Could not create objects in the address book. Primary address book not configured on the Lotus Notes server.
Google didn't help much to figure out this error, so I interpreted this to mean that FIM needs to write to the default database(names.nsf) first, then a secondary address book could be configured.  When I was finally given rights to export to the names.nsf address book (at the top level) the error went away, and was able to create the user object.  Maybe someone else can explain this.

Also while configuring the MA remember you need to configure the certifiers.  What's a certifier you ask?  A Notes admin explained it to me like this:  the certifier represents the  single OU structure like OU=abc,O=local (similar to AD), but it also includes an ID file that goes with it.  When I asked why they needed this, I was told it had something to do with security.  Oh yea and the ID file has a password too.  It's Notes' way of certifying the user created by someone authorized.

Here's a link to find standard provisioning code:  http://msdn.microsoft.com/en-us/library/windows/desktop/aa965243(v=vs.85).aspx

Provisioning code lesson
csentry("_MMS_IDStoreType").IntegerValue = 1  ' ID File as an attachment  - this means it places the ID file in the database (I think)

if you need to put the id file somewhere then use the following 2 lines.
csentry("_MMS_IDStoreType").IntegerValue = 2 'ID File will be generated then you have to tell it where you want it to go see next line
csentry("_MMS_IDPath").Value = \<filename>.id

Rebuild SQL indexes for dummies

Found this site, it's great.

http://www.ehow.com/how_6375896_rebuild-indexes.html

Reference membership of a set in FIM Portal

Sometimes you may want to have a group or set in the FIM portal be calculated from another group or set.

Unfortunately, the source can’t be a group, so stop there.  But if it’s a set then you’re OK.  The great thing about sets is that you can have both criteria based and manual users in it. Once you have it in a group export it to AD.  Now you have a solution a group with criteria based and manual users that can be administered from the FIM Portal.

 

  At this point create your target group (or set), go to members tab and do the following:

By choosing ResourceID ‘in’ <source set> it’ll do the trick.

Of course you could always go back the XPath filter, something like this:  /Person[ObjectID = /Group[DisplayName = 'sourceSet']/ComputedMember, but why when you can use the GUI.

FIM RCDC Tool

I'm sure most of you by now have had the chance to see how great the FIM Portal is. I remember when I first saw it; I couldn't believe how slick the interface looked. I thought, what a great place for a User Directory! How many times have clients asked for an interface that offered the ability to view employees, and even a place where employees can update some of their own information.

To this day, I still feel this is one of the best selling points for the FIM Portal. However, clients are always looking to customize those pages and offer up possible attributes that aren't out of the box. FIM doeslet you extend the schema and then you can add those attributes to pages, or RCDCs, so those new attributes come through. Good stuff until you actually see what it looks like to edit the RCDC. As the song goes, 'Could make a grown man cry...'

The way the RCDC looks and behaves is all done through XML and hence an xml file; an ugly, unforgiving and complicated file. After you play around with it for a while, you might finally figure out how it works. Unfortunately all it takes is a single typo and FIM barfs by not rendering the page and offers no explanation as to why it doesn't like what you did. Then it's a matter of going back over and over and over just to figure out what you did wrong. I've spent hours working on these just making small changes each time to make sure it works. Unfortunately, it consumes a lot of time, especially if you're a consultant and it starts burning too many hours on the project. You wonder what was Microsoft thinking when they put FIM together and fell short on some easy way to manipulate these pages! Microsoft, always the king of wizards configurations and WYSIWYG GUI.

Recently I discovered a tool, that does just that! It's a WYSIWYG tool that lets you manipulate RCDCs by dragging attributes around the page, and to other tabs. In addition, it offers easy to use wizards to add new attributes or tabs, or change the properties of existing attributes. After exporting the full FIM configuration, you load it into the tool, called RCDC Editor, and it loads the RCDC configuration and renders the page just like it was the FIM Portal.

Now you can move things around anyway you wish. Once you're finished, you save the project and it creates the needed xml file to be imported back to FIM. Run IISreset and that's it, you're done! Imagine sitting there with your client and decided together exactly what they'd like to see in the FIM Portal.

All the controls that are available in FIM are available through the RCDC Editor like: TextBox, Label, Check Box, Radio Button, etc. When adding new controls, the creators have tried to guide you in the right direction by pre-populating certain properties that you will probably want, this in turn makes using the tool that much easier and reduces the risk that the RCDC won't work. For example, let's say you created a new user attribute in the FIM database called 'User Laptop #', using the RCDC editor you click on Add New Control and you are offered a list of attributes that aren't currently used in the RCDC. You find 'User Laptop #' and click it, then decide what sort of control you want. Whether it's TextBox or MultiValue Control, etc, it immediately populates the control with what you might typically want, like Caption to be User Laptop #, and the Control Value to come from the FIM Database and from that actual attribute.

Now that being said, it does have an advanced option that will allow you to change any attribute property you want. Of course at this point you're on your own whether it'll work on not. The tool will let you enter any sort of information or gibberish, at that point.

Check it out, you can find it on www.tools4fim.com. You can download and play around with it, but until you buy a license, you can't save any of your work.

One final trick up this tool's sleeve is the Resultant Rights Evaluator. This is a nifty way of querying FIM and lets you see who will, and will not have rights to certain RCDC attributes. You want to know who can see or modify attributes in the RCDC. You define the requestor and the target and it'll return whether that requestor can Create, Delete, Modify or Read, it's very granular. I'll talk more about this piece of the tool next time.

troubleshooting EREs and provisioning

Just a quick note. I was having some problem with codeless provisioning and couldn't figure it out. the ERE was pending, it was being imported, the user object was reference. searching through the internet, I found this little gem. http://setspn.blogspot.com/2010/11/fim-troubleshooting-codeless.html Finally I figured out my FIM MA was the culprit. The AIF for the ERE attribute was missing from the user object . Added it back in and viola, all is well.

Security Questions

So now that I'm doing FIM, I must do all the new things FIM offers. Before it was just attribute synchronization. Now its web design, workflow, self service password reset to name a few. OK its fun learning new stuff.

Right now I'm dealing with password reset and I've run across a new challenge: what else do you ask besides 'What's your mother's maiden name?' ugg.. so I check my own bank website, it had some good questions. Checking the googlesphere doesn't reveal much. Then one of my colleagues, Tom, mentioned to go to www.goodsecurityquestions.com . This is a great place to get started and understand good from bad questions, it also a some great examples too.
Enjoy!