Identity Journey https://docs.microsoft.com/archive/blogs/identityjourney/feed.xml Tue, 16 Apr 2019 06:09:28 GMT en-US hourly 1 MIM Hybrid Reporting with PowerBI https://docs.microsoft.com/archive/blogs/identityjourney/mim-hybrid-reporting-with-powerbi Tue, 10 Apr 2018 09:22:47 GMT https://blogs.technet.microsoft.com/identityjourney/?p=845 hybrid reporting which collects identity management activities across different MIM Service systems and provides a unified report in Azure portal. Currently there are only three reports available in Azure Active Directory (Self-Service Password registration/reset and self-service groups activity). In additional, you can also export the data to your security information and event management(SIEM) system for your own custom views. In this blog, I will leverage Microsoft PowerBI platform to analyse those requests and generate some essential report. Firstly, we need download and install Microsoft Identity Manager Hybrid Reporting Agent  in all MIM Service Servers. Then, the activity data of Identity Manager in JSON structure is sent to the Windows Event Log, in a well-defined path: Application and Services Logs, Identity Manager Request Log. Afterwards, we can start exporting those data to your SIEM. To simply the data collection, I run following PowerShell command to export those data to a CSV file and import the data into PowerBI desktop by selecting "Get Data"-->"text/CSV" Get-WinEvent -LogName "Identity Manager Request Log" | foreach {"$($_.id)|$($_.message)"|Out-File MIMRequestNew.csv -Append During the import of CSV file, PowerBI allows us to customize the delimiter and load them into separate columns, click "Load" to confirm . Next, we are going to leverage the "The Query Editor" to transform these MIM requests to a table for further reporting. As it is known that the MIM requests are written in JSON format, we shall choose the message column and right click "Transform"-->"JSON". Once completion, these MIM requests are parsed into the "records" which allows us to navigate the request details. Then we click the button at the right corner to expand these properties/attributes of the records. please note the attributes of the records vary from different types (CRUD) of MIM request which you shall compose the query editor accordingly. Finally, all weneed is to publish the dataset into the PowerBI and build the report from there. Below is some basic reports via "Quick insights", enjoy :)  ]]> How to Create a Web Service Connector for SAP in FIM/MIM(Part 2) https://docs.microsoft.com/archive/blogs/identityjourney/how-to-create-a-web-service-connector-for-sap-in-fimmimpart-2 Mon, 04 Jul 2016 23:39:30 GMT https://blogs.technet.microsoft.com/identityjourney/?p=836 part1, we will move on to leverage the built-in “Web Service Configuration Tool” to configure the import and export logic. 1. Launch the tool and click “Add” under discovery 2. Supply the web service URL which is created in part1 and click “Next” image   3. Choose “Basic” and input the username and password. click “Next” image 4.  It listed the functions exposed by the interface. click “Finish”. (Note: Make sure the web service only exposes one HTTP endpoint) image 5. Add new object Types and its associated attributes including the anchor, which defines the schema of the connector space. image 6. Expand the objectType node in the left panel, then it allows you to control the behavior of each run profile by constructing the workflow. While all the available workflows are listed in the right panel. The workflow varies between the different projects, a sample config file for SAP is published in the TechNet download center. Once you finish the project, don’t forget to save it under the “Extension” folder in the FIM installation path. Now we finally come to the step to create a management agent in the synchronization manager. It is actually quite straight forward as all other management agent does, just make sure you specify the correct wsconfig file and credential. image]]> How to Create a Web Service Connector for SAP in FIM/MIM(Part 1) https://docs.microsoft.com/archive/blogs/identityjourney/how-to-create-a-web-service-ma-for-sap-part-1 Mon, 04 Jul 2016 09:33:40 GMT https://blogs.technet.microsoft.com/identityjourney/?p=445 SE80" which brings up the object navigator. 2.  Browser to the and type the package name image 3. Enter and select "yes" to choose the creation. image 4. Fill in the information as below and click OK. It will prompt for a transport request. Save it a transport request. image 5. After successful creation of the package, right click on the package name and choose Create—>enterprise service image         6. Choose “Service Provider” image 7. Choose “Existing ABAP Objects(Inside Out)” image 8. Name the service and choose “Function Group” image 9. Type “SU_USER” in the endpoint image 10. Select Functions you want exposure (for demo purpose, only BAPI_USER_GETLIST is required here)       image 11. Choose the default SOAP Application as below. image 12. Specify the package name and its transport request and click “continue” image 13. Click complete.Once the web service is created successfully under the package. Select “configuration” tab and modify the profiler to “Stateful”       image 14. Finally choose the web service and right click “Activate” image Then we need add an endpoint binding for the web service. 1. Open the Transaction SOAMANAGER. Select “Single Service administration” under Application and Scenario Communication tab. image   2. Provider the WebService created in above step and “apply selection” image 3.  Make sure you have below configuration selected. image 4. Click “Create Endpoint” under configuration tab, make sure “userID/Password” is selected as authentication method.     image So far we’ve completed the configuration of sap web service which allows the web service connector to consume. The highlight URL is web service address which we need for the web service config. image]]> Configure Privileged Access Management(PAM) in an Existing Domain https://docs.microsoft.com/archive/blogs/identityjourney/configure-privileged-access-managementpam-in-an-existing-domain Sun, 01 May 2016 22:01:32 GMT https://blogs.technet.microsoft.com/identityjourney/2016/05/01/configure-privileged-access-managementpam-in-an-existing-domain/ Microsoft Identity Manager (MIM) 2016, a new feature PAM is added to help organizations restrict privileged access to some certain security groups. However, if you read through the TechNet guide, it is recommended to create a new trusted domain. Then is it a mandatory to have another new domain to leverage the PAM feature? The answer is NO, we can actually just leverage the JIT evaluation which is called “Priv Only” Mode. Note: As PAM is part of the lateral movement protection controls for securing privileged access, "Priv only" mode is ONLY supported in lab environment not in Production. In the lab environment, I deployed the PAM component and MIM Service in the existing CONTOSO domain. Then I run below PowerShell Cmdlets (PAM module) to prepare PAM environments. Please pay attention to the parameter switch PrivOnly allows you to indicate the group already exists in the contoso domain. New-PAMGroup -SourceDomain contoso -SourceGroupName ITAdmins -PrivOnly After the successful execution of the cmdlet, you shall be able to query the PAM groups as below screen shows. It is a manually managed security group with msidmPamEnabled set to True and some other pam related attributes set image Then it’s time to setup the PAM roles by specifying some parameters including the PAM groups , candidates and other advanced features like Approval and MFA. Here I just keep the default configuration: once any one of the candidates submit the PAM request, he/she will be added to the two security groups:  ITAdmins and HRAdmin together for the next following hour. image Finally it’s time to test the privilege access either via Powershell cmdlet or the sample PAM portal. Once I submit the request via the portal, the access will be activated and the below events will be logged under Applications and Services Logs/Privileged Access Management image Then PAM monitor Service will remove them automatically when the access expires and log an event as below under the same event catalog. image In a nutshell, following above steps you shall still be able to setup the PAM solution without adding a new privileged domain.]]> Another approach to delete all users from FIM portal https://docs.microsoft.com/archive/blogs/identityjourney/another-approach-to-delete-all-users-from-fim-portal Mon, 18 Apr 2016 21:42:48 GMT https://blogs.technet.microsoft.com/identityjourney/2016/04/18/another-approach-to-delete-all-users-from-fim-portal/ existing delete script in the internet for the purpose, however its performance may not be ideal considering the below two factors. 1. The script composes a single request for each user. 2. Every single request will be evaluated with the existing request-MPRs. As i mentioned in my previous blog, FIMMA introduces the async and bulk mode during export. So the approach here is to leverage the built-in FIMMA account (note: FIMMA account type is a resource not a user in FIM Service) to delete the users in batch mode. 1. Choose the MA which contributes the metaverse most (we take ADMA as an example here), and modify the object deletion run as below. image 2.  Configure the deprovisioning rule of FIMMA as below image 3. Delete the connector space of the ADMA 4.  Run Full import on the ADMA, inside this step it will trigger the metaverse deletion rule and then FIMMA deprovisioning rule. Note: No sync profile is needed here. 5. Run Export on FIMMA, it will then delete all the users in FIM Service . 6. Revert the changes done in step1,2]]> How to enable FIM Powershell MA logging in the eventlog https://docs.microsoft.com/archive/blogs/identityjourney/how-to-enable-fim-powershell-ma-logging-in-the-eventlog Mon, 18 Apr 2016 21:08:57 GMT https://blogs.technet.microsoft.com/identityjourney/2016/04/18/how-to-enable-fim-powershell-ma-logging-in-the-eventlog/  

With the links (Technet and TechNet blog), they only demo how to log the Powershell verbose trace to a file.  What if we would like to enable them in the default windows eventlog for further monitor?

here’s the section you shall put in the %ProgramFiles%\Microsoft Forefront Identity Manager\2010\Synchronization Service\bin\miiserver.exe.config, and do not forget to restart the FIMSynchronziationService. After that, we shall be able to have these events with source “ConnectorsLog” under application.

<source name="ConnectorsLog" switchValue="Warning">
      <listeners>
             <add initializeData="ConnectorsLog"
                  type="System.Diagnostics.EventLogTraceListener, System, Version=2.0.0.0, Culture=neutral,  PublicKeyToken=b77a5c561934e089"
                   name="ConnectorsLog" traceOutputOptions="LogicalOperationStack, DateTime, Timestamp, Callstack">
                   <filter type="" />
             </add>
      </listeners>
</source>

]]> Why FIM/MIM MA is slow? Part 2 https://docs.microsoft.com/archive/blogs/identityjourney/why-fimmim-ma-is-slow-part-2 Wed, 13 Apr 2016 22:49:00 GMT https://blogs.technet.microsoft.com/identityjourney/2016/04/13/why-fimmim-ma-is-slow-part-2/  

Continue with the “Why FIM/MIM MA is slow?Part 1”, we will discuss the most often case “the slowness on FIMMA export”. Based on my field experience, the average performance for export on FIMMA is around 10 objects/sec.  You probably need some investigation if yours is far beyond the average or it can not meet the high-level business requirement.

You may or may not aware since FIM 2010 R2, it introduces the Composite Request to allow to export a batch changes to the FIM Service. The FIM MA export is configured by default to use an asynchronous, batch-request evaluation mode for requests created by the FIM Synchronization engine account. And we do allow you to control the behavior in the miiserver.exe.config under %FIMInstallDirectory%\2010\Synchronization Service\Bin

Property Default Value Notes
asynchronous True FIMMA export run under  async or sync mode
aggregate True FIMMA export run under batch mode or single mode
aggregationThreshold 1000 The number of attributes (not resources) that are included in a batch.

However the perquisite of this mode is all changes in the composite request must succeed in order for the changes to be applied.  Let’s say under the default config, all the 1000 attribute changes (aggregationThreshold) must succeed otherwise it falls back to the single mode for the batch. Below are the screenshots for the success and failed scenarios separately.

image

So there are below two best practices based on this mechanism which may help you improve the FIMMA export performance.

1. Try to fix these errors/bad data happened during export.

2. Tune the batch size (aggregationThreshold) to reduce the chance of failed batches.

]]> Why FIM/MIM MA is slow? Part 1 https://docs.microsoft.com/archive/blogs/identityjourney/why-fimmim-ma-is-slow-part-1 Wed, 13 Apr 2016 21:43:00 GMT https://blogs.technet.microsoft.com/identityjourney/2016/04/13/why-fimmim-ma-is-slow-part-1/  

“Why FIM/MIM MA is slow” is one of the most frequent questions we’ve got from our customers. It’s actually a board topics which has various causes. Before we dig into to the details, it is quite necessary for us to clarify below two checkpoints.

1. Which particular run profile is slow?

     As we all know, there are three type run profiles for every Management Agent and so does FIMMA. Every run profile type involves different components. And pay attention to the different interfaces leveraged by import and export profile.

Run Profile Type Action
Full/Delta Import Import objects from FIM Service to FIMMA connector space via SQL interface
Full/Delta Sync Apply the sync rules between FIMMA connector space and metaverse
Export Export objects from FIMMA connector space to FIM Service via web service
(https://%fimservicehost%:5725)

 

2. How we define slow?

    When we mention “slow”, it could be general or slower. So it’s important to have a baseline of the FIMMA’s performance by collecting the perf counters under FIM 2010 Namespace.

image

Then you probably ask what kind of performance is expected? The answer is it depends on several elements like the typology, the scale, server config and sql instance config. That’s why you need setup your own baseline , the more frequent you inspect on this, the more accurate is your FIM solution’s baseline. And Microsoft Product team do publish a testing result on small profile and medium profile separately as a reference.

So next time, instead of saying “FIMMA is slow”, you shall more specific about “Which run profile of FIMMA is slow to what extend”.

]]> How to talk to FIM/MIM Service Pogrammatically https://docs.microsoft.com/archive/blogs/identityjourney/how-to-talk-to-fimmim-service-pogrammatically Sun, 10 Apr 2016 23:00:00 GMT https://blogs.technet.microsoft.com/identityjourney/2016/04/10/how-to-talk-to-fimmim-service-pogrammatically/  
You've probably told more than once that FIM/MIM Service is a WCF Service which exposures several endpoints . Then how can we connect to the WCF service programmatically? In this blog, i will take the Resource Endpoint as a starting point and demo how to invoke Get method.

Firstly, we create a Visual C# console Application and add a service reference to the create a proxy for the running FIMService. After clicking "OK", there are five default endpoints added to the configuration file App.config.

Note: you shall modify the URI according to your fim service host name.

 

 

Next, we need compose a request message by specifying the parameter. As described in the Developer reference page , a Get Request is to retrieve the object by supplying the objectID . Below is the copy of the code snippet.

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.ServiceModel;
using System.ServiceModel.Channels;
using GetResourceDemo.FIMServiceReference;
using Microsoft.ResourceManagement;
using Microsoft.ResourceManagement.WebServices;
using System.Xml;

namespace GetResourceDemo
{
    class Program
    {
        static void Main(string[] args)
        {

           //GetAction
            const string GetRCAction = "https://schemas.xmlsoap.org/ws/2004/09/transfer/Get";
            const string RMNameSpace = "https://schemas.microsoft.com/2006/11/ResourceManagement";
           //create a WCF resourceClient by referring the config file
           ResourceClient rc = new ResourceClient("ServiceMultipleTokenBinding_Resource"); 

           //compose the request message
           Message request;
           request = Message.CreateMessage(MessageVersion.Default,GetRCAction );
            // the built-in FIM administrator's account, shared across all the systems
           UniqueIdentifier id = new UniqueIdentifier("7fb2b853-24f0-4498-9534-4e10589723c4");
           request.Headers.Add(MessageHeader.CreateHeader("ResourceReferenceProperty",RMNameSpace, id.ToString(), false)); 

           //invoke the get method
           using (Message responseMessage = rc.Get(request))
           {
               //Parse the reponse messgae
               XmlDictionaryReader fullObject = responseMessage.GetReaderAtBodyContents();
               XmlDocument Xdoc = new XmlDocument();
               Xdoc.Load(fullObject);

               XmlNamespaceManager xmlNamespace = new XmlNamespaceManager(Xdoc.NameTable);
               xmlNamespace.AddNamespace("rm", RMNameSpace);
               XmlNodeList nodes = Xdoc.SelectSingleNode("//rm:Person", xmlNamespace).ChildNodes;
               foreach (XmlNode node in nodes)
               {
                   Console.WriteLine("{0} : {1}", node.Name.ToString().Replace("rm:", ""), node.InnerText.ToString());
               }
           }

           Console.ReadKey();
        }
    }
}

Finally, build the project and run it, you’ll have all the information for the default FIM administrator. :)

Further if you don't want to build the FIM client library from scratch, I would recommend the lithnet FIM client which simplifies the interactive with FIM Service.

Capture

]]> The Ultimate Tools to work with RCDC in FIM https://docs.microsoft.com/archive/blogs/identityjourney/the-ultimate-tools-to-work-with-rcdc-in-fim Sun, 15 Mar 2015 03:57:00 GMT https://blogs.technet.microsoft.com/identityjourney/2015/03/15/the-ultimate-tools-to-work-with-rcdc-in-fim/  

Resource Control Display Configuration (RCDC) is the concept you can't get rid of when you start to do some UI customization in the FIM portal.  However, we don’t provide a friendly UI to view and edit these XML configuration files  and when something goes wrong we don’t have any hints besides a red line on the page “There is an error in the person displaying configuration, please contact your system administrator ”.

In this blog I would like to share two favorite tools I normally use, they can solve up to 99% RCDC issues according to the field experiences. Then how about the remaining 1%, you may need to build from the scratch :)

It is known that each RCDC resource contains an XML configuration file which follows a specific set of predefined schemas. Then an XML editor is quite necessary to avoid some typo or syntax errors. Here I would like to take the visual studio as an example, you may leverage other similar tools as well.

1. Copy the default XSD Schema from the Appendix A and save it to the a file such as RCDC.xsd

2. Copy the file to the visual studio default schema folders C:\Program Files (x86)\Microsoft Visual Studio 12.0\Xml\Schemas (note: it may vary from different visual studio versions)

3. Open the RCDC with visual studio and click XML--> schemas, making sure the RCDC.xsd is selected.

image

4. Then for anything which doesn’t comply with the schema , you will have a wave line beneath with detail explanation.

image

However in some scenarios like migrating RCDC configuration files from one environment to another, the UI complains the wrong configuration even it passes the schema validation. Then we have to rely on the FIM portal verbose trace (please note the trace is client trace instead of FIMService) to provide us with more hints. 

1.  Follow the instructions below to enable the verbose trace and make sure you run an IISRESET after to make it take effect.

https://social.technet.microsoft.com/wiki/contents/articles/2260.how-to-configure-fim-portal-tracing.aspx

2.  Repro the issue as shortly as you could otherwise you will have a large trace generated.

3.  Open the log file with the SDK tool Service Trace Viewer Tool , normally the failures in red will guide you the root cause. (In my case, there’s undefined attribute name in my FIM Service Schema.)

image

Hope this blog can help your FIM RCDC deployment :)

]]>