One of the things I was tasked with was to set the initial Dynamics AX password for a new user.  I used information derived from our HR source to create the first password.  This information needed to be encrypted in Dynamics AX on export, so the password encryption piece was added into the AX management agent.  We'll actually call an internal Dynamics X++ method to perform the encryption.

I mentioned a global variable in the previous post

Axapta ax = new Axapta();

This is an Axapta class object from the Microsoft.Dynamics.BusinessConnectorNet namespace.

In the ExportEntry() method, we loop through the different tables in Dynamics and populate attributes, but first we need to create an AxaptaRecord class object against a table in Dynamics AX.  In this example, "table" is a string "RBOSTAFFTABLE."

AxaptaRecord axRec;

axRec.CreateAxaptaRecord(table); 

Since we're solely creating new users, we loop through the attributes and use the set_Field property to populate the AX table with the Connector Space entry attributes.  I am not going to bore you with those details.  However, Dynamics AX requires that the password attribute be encrypted.  Since we don't have access to the encryption method for export attribute flow or to use within the management agent, we have to handle this attribute differently.   We set the value initially in clear text, however we actually handle changing the password after we insert the initial AxaptaRecord in a new table transaction session, looking up the new entry by the unique StaffID value we just populated.

axRec.Insert();//inserting initial attribute values

ax.TTSBegin();

axRec.ExecuteStmt("select forupdate * from %1 where %1.StaffID == '" + csentry["RBOSTAFFTABLE.StaffID"].Value + "'") 

Once we have our object selected, we can grab the cleartext password we inserted previously, encrypt the cleartext password using the Axapta method CallStaticClassMethod for the Dynamics X++ class "RBOUtils" and method "Encrypt" and set it on the object, all in one line.  And updating the object and committing the transaction is merely a formality.   

axRec.set_Field("Password", ax.CallStaticClassMethod("RBOUtils", "Encrypt", axRec.get_Field("Password").ToString()));


axRec.Update();

ax.TTSCommit()

 CallStaticClassMethod is a powerful method, as you can see.  You can utilize Dynamics X++ methods from your MA.  Very cool stuff. 

--Shawn

 This posting is provided "AS IS" with no warranties, and confers no rights.

Today I'm going to talk about the Dynamics AX Management agent, specifically, the connection made in the functions for Import and Export. 

The Dynamics AX Management Agent I created utilizes the Extensible Connectivity Management Agent available in MIIS, ILM and FIM.  You can use the extensible connectivity management agent to connect to virtually anything as long as you have a way to connect.  In this example, we will hook the Microsoft.Dynamics.BusinessConnectorNet Namespace, which is available with an installation of the Dynamics AX client. In order to connect to the Dynamics AX instance, you need to set up the client and establish a connection configuration.  You set up the connection configuration using the AX configuration utility.  The string name of the configuration you set up is going to be utilized in the setup of the MA.  I use the variable name "Configuration" as a configuration parameter in the MA. 

The import method, GenerateImportFile() and the export connection method, BeginExport() will use the Configuration information to connect to Dynamics AX. 

Both methods take advantage of a global variable I set up

Axapta ax = new Axapta();

The import method looks like this:

public void GenerateImportFile(string filename, string connectTo, string user, string password, ConfigParameterCollection configParameters, bool fullImport, TypeDescriptionCollection types, ref string customData)

{    

            String domain = user.Remove(user.IndexOf(@"\"));

            String username = user.Remove(0, user.IndexOf(@"\") + 1)

\\ The string "user" comes in from the management agent as DOMAIN\username

            System.Net.NetworkCredential creds = new System.Net.NetworkCredential(username, password, domain);

            ax.LogonAs(username, domain, creds, "", "", "", configParameters["Configuration"].Value);

\\ Seems redundant to pass the NetworkCredential in as well as username and domain in LogonAs

\\ The three nulls in LogonAs are company, language and objectServer; 

\\ all of which are defined in the AX configuration, 

\\ which is pulled from the management agent as one of the configParameters.  

 ... insert code here...

}

Creating the connection for BeginExport is identical

public void BeginExport(string connectTo, string user, string password, ConfigParameterCollection configParameters, TypeDescriptionCollection types)

{         

            String domain = user.Remove(user.IndexOf(@"\"));

            String username = user.Remove(0, user.IndexOf(@"\") + 1);

            System.Net.NetworkCredential creds = new System.Net.NetworkCredential(username, password, domain);

            ax.LogonAs(username, domain, creds, "", "", "", configParameters["Configuration"].Value);

...insert code here...

}

Seems pretty straightforward, right?   Until next time...

--Shawn

 This posting is provided "AS IS" with no warranties, and confers no rights.

Hello Everyone! 

OK, I admit.  I am lame for not posting here in 16 months.  I've been very busy and I want to be able to provide valuable and helpful information but I need to table the previous topic.  In my last post, I was building a Fantasy Football Engine with ILM 2007  and I still want to do that... eventually.  More appropriately, however, one of my last projects was the Microsoft Retail Stores and one of the outcomes of the project was a Extensible Connectivity Management Agent for Dynamics AX. 

In MIIS 2003 SP1 and later (and ILM 2007/FIM 2010) the Extensible Connectivity Management Agent is the answer to the question "Does MIIS have a management agent for X?" if X is not compatible with a management agent built into the product or available as an add-on or download.  Utilizing the IMAExtensibleCallExport, IMAExtensibleFileExport and/or the IMAExtensibleFileImport interfaces of the Microsoft.MetadirectoryServices namespace you can hook into just about anything that is .Net to connect to a data source.  For Dynamics AX, I utilized the Microsoft.Dynamics.BusinessConnectorNet namespace to write entries to Dynamics AX within IMAExtensibleCallExport and to import and confirm building a file with IMAExtensibleFileImport.  I felt I needed to create this management agent using an Extensible MA rather than using a database MA, as Dynamics AX can utilize a couple of different versions of SQL, as well as other third party database products and I wanted to build the Management Agent to be reusable for future customers beyond the Microsoft Retail Stores.

Building the AX MA was not a trivial exercise.  I came into the project knowing absolutely nothing about Dynamics AX.  I must say, Dynamics AX is the singlemost elegant product I have ever worked with!!  I received a list of attributes and tables that I needed to interface with to provision users and a preferred order to write them in from the Retail Store AX team and started cranking the management agent out.  In the next few posts, I will address how I tackled building the management agent and some of the issues that were encountered and how they were resolved. 

--Shawn

 This posting is provided "AS IS" with no warranties, and confers no rights.

I am creating a series of posts crossing this MSDN blog and my TechNet blog http://blogs.technet.com/shawnrab where we will be build our own Fantasy Football engine utilizing Identity Lifecycle Manager with Feature Pack 1 and writing Visual Basic and Visual C# Rules Extensions

The initial rules of engagement are posted here:  http://blogs.technet.com/shawnrab/archive/2008/08/12/miis-ilm-tricks-ilm-fantasy-football.aspx

Have a good day!

--Shawn

 This posting is provided "AS IS" with no warranties, and confers no rights.

Why is the manager field important?  In Active Directory Users and Computers, it helps with the Organization tab on the user properties.  In populating a user's manager field, you also indirectly populate the manager's Direct Reports field.  This also helps enhance the Exchange GAL. 

This sample relies on having an employeeID that is unique for the enterprise and a managerID coming from somewhere.  I've also seen an attribute named similar to reportsTo used instead of managerID.   Two metaverse attributes need to be created managerID and adDN.  The managerID attribute would be flowed in from the ERP source and the adDN attribute would be a 1-1 mapping of the DN attribute in Active Directory.  We would set this in the MapAttributesForExport() function.  It relies on the manager having a correct, unique employee ID and looks back at the metaverse to see if the manager has an adDN attribute.  If the manager doesn't exist yet, the logic below will quietly fail.  The following attribute flows are:

ERP<----->MV<----->AD

ERP.person:managerID---(1-1 mapping)-->MV.person:managerID

MV.person:adDN<---(1-1 mapping)---AD.user:<dn>

MV.person:adDN(of the manager),managerID--->(rules extension mapping)--->AD.user:manager

Here is the rules extension of the Export Flow rule for populating AD.user:manager

                case "cd.user:manager<-mv.person:adDN,managerID":

                    if (mventry["managerID"].IsPresent)

                    {

                        MVEntry[] mveManager;

                        mveManager = Utils.FindMVEntries("employeeID", mventry["managerID"].Value); //performs a search

                        //on the managerID or reportsTo field coming in from ERP for entries with that corresponding employeeID

                         if (mveManager.Length == 1)//if we get only one return (which we should)

                        {

                            if (mveManager[0]["adDN"].IsPresent)//if there is the DN on that return

                            {

                                csentry["manager"].Value = mveManager[0]["adDN"].Value; //set the DN as the manager

                                break;

                            }

                            else

                            {

                                break;//dn may not be populated yet - it will occur on the next run

                            }

                        }

                        else

                        {

                            break;//should never happen (employeeID is unique)- we'll fall through if it does

                        }

                     }

                    else

                    {

                        break;

                    }

This method also works with a Secretary attribute.  You just need a secretaryID or similar and we reuse the adDN attribute.  WARNING!! FindMVEntries() does a search of the metaverse.  Make sure the attribute you are searching for is indexed in the metaverse.  In this case employeeID would need to be indexed. 

What if there is not a unique ID like employee ID?  You'll have to replace the trivial FindMVEntries backward lookup with logic similar to join rules for a manager.   Hopefully your ERP data provides enough to show who a person's manager is. 

Have a good day!

--Shawn

This posting is provided "AS IS" with no warranties, and confers no rights.

And Just in case...

This Sample Code is provided for the purpose of illustration only and is not intended to be used in a production environment. THIS SAMPLE CODE AND ANY RELATED INFORMATION ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE. We grant You a nonexclusive, royalty-free right to use and modify the Sample Code and to reproduce and distribute the object code form of the Sample Code, provided that You agree: (i) to not use Our name, logo, or trademarks to market Your software product in which the Sample Code is embedded; (ii) to include a valid copyright notice on Your software product in which the Sample Code is embedded; and (iii) to indemnify, hold harmless, and defend Us and Our suppliers from and against any claims or lawsuits, including attorneys’ fees, that arise or result from the use or distribution of the Sample Code.

This function is making the assumption that your design will determine the RDN, the LDAP container/OU that the object will sit and the string name of the management agent you are provisioning to. 

/*

private void ProvisionLDAPUser(MVEntry mventry, string MAName, string rdn, string container)

        if (ldapMA.Connectors.Count == 0)//make sure we don't have any pre-existing connectors

                CSEntry cseLDAP = ldapMA.Connectors.StartNewConnector("user");//generically start a new user

 If you wanted to, you could bring the predetermination of the user object type out of the function, in case you wanted to bring the logic for the determination of object (ex: user vs. contact)

private void ProvisionLDAP(MVEntry mventry, string MAName, string rdn, string container, string objectType)

        if (ldapMA.Connectors.Count == 0)//make sure we don't have any pre-existing connectors

                CSEntry cseLDAP = ldapMA.Connectors.StartNewConnector(objectType);//generically start a new object

 There isn't any error handling on CommitNewConnector, for handling duplicates or incorrect/missing container (OU).  I like to handle outside of this function as I predetermine the rdn variable and container and if there is a caught error, I can handle it accordingly

try

{

        ProvisionLDAPUser(mventry, "Test Active Directory", String.Concat("CN=", mventry["displayName"].Value), "OU=Exchange Users,DC=test,DC=fabrikam,DC=com" );

 }

catch (ObjectAlreadyExistsException)

...

}

This is helpful if there is a conflict on naming.  Notice in my case, the RDN is the string literal "CN=" and the displayName attribute.  I can ensure some uniqueness in the creation of that displayName attribute and not have to worry about ObjectAlreadyExistsException.  If I don't, I can append an integer value or maybe use another attribute to append to the constructed RDN to ensure uniqueness. 

 More to come on this concept.

--Shawn

This posting is provided "AS IS" with no warranties, and confers no rights.

And Just in case...

This Sample Code is provided for the purpose of illustration only and is not intended to be used in a production environment. THIS SAMPLE CODE AND ANY RELATED INFORMATION ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE. We grant You a nonexclusive, royalty-free right to use and modify the Sample Code and to reproduce and distribute the object code form of the Sample Code, provided that You agree: (i) to not use Our name, logo, or trademarks to market Your software product in which the Sample Code is embedded; (ii) to include a valid copyright notice on Your software product in which the Sample Code is embedded; and (iii) to indemnify, hold harmless, and defend Us and Our suppliers from and against any claims or lawsuits, including attorneys’ fees, that arise or result from the use or distribution of the Sample Code.

(formerly posted at http://blogs.technet.com/shawnrab/archive/2007/06/28/xml-based-miis-ilm-metaverse-router-part-1.aspx ) 

So one of the complaints of people who use MIIS/IIFP/ILM for GALSync is that there is only one field for a metaverse rules extension.  If you wanted to add provisioning in addition and seperate from the logic in the provision() block in the GALSync DLL, you would have to extend the GALSync.vb code which is subject to change (and be replaced in cumulative updates and service packs). There is decent solution out there called the MVRouter which looks in the MIIS extensions directory and looks for any DLL that starts with "mv" or "MVExtension" in the Extensions directory underneath the MIIS installation folder(technically it has a global called PREFIX that you can set).  It will call MV_Galsync.Provision() or MV_Extension.Provision() within MVRouter.Provision() if your PREFIX is "MV_".  The sample is located at the MIIS developer reference  (http://msdn2.microsoft.com/en-us/library/ms698364.aspx) and more targeted at http://msdn2.microsoft.com/en-us/library/ms696018.aspx

In sporadic posts, including this one we will build upon the sample at http://msdn2.microsoft.com/en-us/library/ms696018.aspx to create an XML-based MVRouter and we will use that to try some fairly cool things with MIIS.

I warn all of you.  This is just a sample.  We're going to grow this sample as time passes.  Also, suggestions are always appreciated.  There will always be a better way to write code. 

----snip----

            return numParticipatingDLLs;

        }// end popInitializeArr

    }//end class

}//end namespace

----end snip----

So our requirements need to be that the file name has to correspond exactly with the XML tag and must exist in the extensions directory.  We should probably fix that later.  We also have some other homework to do and I have ideas to show the potential of this thing. 

Right now the XML tagging would look like this:

---snip----

<rules-extension-properties>

    <dllfiles>

        <examplemvdllname.dll></examplemvdllname.dll>

        <samplemvdllname2.dll></samplemvdllname2.dll>

        ...

    </dllfiles>

</rules-extension-properties>

----end snip----

Think about the potential here - we could use the tags and innertext to our advantage.  In the future, I will show some optimization I think we need and if anyone adds insight, I can add that.  Also I have an advancement that I want to put in place that may (or may not) work. 

--Shawn

This posting is provided "AS IS" with no warranties, and confers no rights.

And Just in case...

This Sample Code is provided for the purpose of illustration only and is not intended to be used in a production environment. THIS SAMPLE CODE AND ANY RELATED INFORMATION ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE. We grant You a nonexclusive, royalty-free right to use and modify the Sample Code and to reproduce and distribute the object code form of the Sample Code, provided that You agree: (i) to not use Our name, logo, or trademarks to market Your software product in which the Sample Code is embedded; (ii) to include a valid copyright notice on Your software product in which the Sample Code is embedded; and (iii) to indemnify, hold harmless, and defend Us and Our suppliers from and against any claims or lawsuits, including attorneys’ fees, that arise or result from the use or distribution of the Sample Code.

(formerly posted at http://blogs.technet.com/shawnrab/archive/2007/11/07/miis-ilm-rocket-science-joining-using-name-tables-for-abbreviated-and-similar-names.aspx ) 

I am tasked this week with performing joins.  We have an Active Directory environment and a Lotus Notes environment and we're simply trying to get the similar accounts joined.  Biggest problem is that we don't have anything consistent between the two.  No Employee ID and the Notes ShortName is not consistently the same as samAccountName in Active Directory.  Most of the identities have a first name, middle initial and a last name.  Some of them do not have a middle initial.

 We have around 10000 total identities and we were able to get all but 1700 joined with these three mappings:

1.) Lotus Notes (FirstName and MiddleInitial and LastName) ---direct mapping---> MV via Active Directory (givenName and initials and sn)

2.) LN(FirstName and LastName) ---direct mapping---> MV via AD (givenName and sn) with LN(ShortName) ---rules extension mapping--->MV via AD(samAccountName)

3.) LN(FirstName and LastName) ---direct mapping---> MV via AD (givenName and sn) with LN(ShortName) ---rules extension mapping--->MV via AD(first eight letters of the samAccountName)

 Where one of the entries of ShortName was "close" to samAccountName, however ShortName is multivalued

of the 1700 left, a large chunk is test accounts, service accounts and other fun items, but we found around 450 "potential" joins where we had LastName and one of the ShortName-samAccountName mappings correct however the first name was not correct.  I found a pattern where we would have a successful join if we could correlate similar or abbreviated names.  Example (names have been faked to protect the innocent):

 Similar/Misspelled Name-->Phillip D. Jones (pdjones) vs. Philip D. Jones (pdjones)

Abbreviated Name-->Richard J. Smith (rjsmith) vs. Rich J. Smith (rjsmith)

I created a file with entries comma seperated where these associations were made. Here are some example lines:

 Andrew,Andy,Drew

Edward,Eduard,Eddy,Eddie,Ed,Edwin

Jennifer,Jenifer,Jen,Jenny,Jeni,Jennie

Katherine,Kathleen,Kathrine,Catherine,Cathleen,Cathy,Kathy,Kate,Cate,Cathrine

Timothy,Tim,Timmy

...etc...

We were able to come up with over 100 names that could be abbreviated, spelled differently or easily misspelled.  I then created a multi-valued Metaverse Attribute called AltFirstName and flowed in these names.  To do so, I saved my flat file to the Extensions Directory (typically C:\Program Files\Microsoft Identity Integration Server\Extensions) and added the following logic to my Management Agent rules extensions (NOTE: the Notes Extension is below, the Active Directory Extension is similar, yet the attribute name givenName is used where in LN, FirstName is used.)

Public Class MAExtensionObject

Implements IMASynchronization

    Dim AltNameArr As String() ' global array to populate similar names

    Public Sub Initialize() Implements IMASynchronization.Initialize

        AltNameArr = File.ReadAllLines(Utils.ExtensionsDirectory + "\names.txt") ' single call to push the lines of the file to

        ' a String Array - each string represents the possible alternate names

    End Sub

...

...

I then created these join mappings 

1.) LN(FirstName and LastName) ---direct mapping---> MV via AD (AltFirstName and sn) with LN(ShortName) ---rules extension mapping--->MV via AD(samAccountName)

2.) LN(FirstName and LastName) ---direct mapping---> MV via AD (AltFirstName and sn) with LN(ShortName) ---rules extension mapping--->MV via AD(first eight letters of the samAccountName)

Now, I am sure there is a more efficient way to do this, using SQL or XML rather than a flat file to import the name associations, or using a two-dimensional array instead of looping the file into one array and splitting to get a second array, but as a first test, we were rather successful with zero false positives.  We were able to recover 425 of the 450 "potential" joins this way. 

I'd like to mention that I received a lot of help from the customer on creating the large list of names (over 400 names) - Christine M. and my shadow this week, Raffe who also came up with a few as well.  Both were also very good voices of reason ensuring me that I wasn't unreasonable trying to get "Brian" to map to "Brien" when the last name was Smiswartszkoether (completely made-up last name intended to sound unique) on both sides. 

I am sure I am not the first person to do this, but if I can help someone out there out with their joins by posting this, I've done exactly what I've set out to do. 

Have fun, and good luck

--Shawn

UPDATE:  11/28 - For those people running SQL 2005, it appears that Alex Tcherniakhovski found a way to do this using functionality built in to SQL 2005 SSIS - see http://blogs.gotdotnet.com/alextch/archive/2005/07/15/init-record-linking-via-ssis.aspx

or

http://blogs.msdn.com/alextch/archive/2005/08/09/miis-and-ssis.aspx

to find out more. 

This posting is provided "AS IS" with no warranties, and confers no rights.

And Just in case...

This Sample Code is provided for the purpose of illustration only and is not intended to be used in a production environment. THIS SAMPLE CODE AND ANY RELATED INFORMATION ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE. We grant You a nonexclusive, royalty-free right to use and modify the Sample Code and to reproduce and distribute the object code form of the Sample Code, provided that You agree: (i) to not use Our name, logo, or trademarks to market Your software product in which the Sample Code is embedded; (ii) to include a valid copyright notice on Your software product in which the Sample Code is embedded; and (iii) to indemnify, hold harmless, and defend Us and Our suppliers from and against any claims or lawsuits, including attorneys’ fees, that arise or result from the use or distribution of the Sample Code.

Hello! 

Welcome to my MIIS/ILM Code Experiment!  My name is Shawn Rabourn and I am in my seventh year at Microsoft and I currently work for Application Consulting and Engineering (ACE) Services as a Security Consultant.  This Blog is in response to a lot of the feedback I was receiving from my Technet Blog, http://blogs.technet.com/shawnrab - I have been experimenting with a lot of different coding concepts in Microsoft Identity Integration Server and Identity Lifecycle Manager and much of it belongs outside of the TechNet space and more in the MSDN space.  So, today I will be posting a few posts from my Technet Blog, making sure it is in the correct area.  I also have a lot of scripts and samples that I have stored away for a rainy day that I will post here in the future. 

 --Shawn

This posting is provided "AS IS" with no warranties, and confers no rights.

And Just in case...

This Sample Code is provided for the purpose of illustration only and is not intended to be used in a production environment. THIS SAMPLE CODE AND ANY RELATED INFORMATION ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE. We grant You a nonexclusive, royalty-free right to use and modify the Sample Code and to reproduce and distribute the object code form of the Sample Code, provided that You agree: (i) to not use Our name, logo, or trademarks to market Your software product in which the Sample Code is embedded; (ii) to include a valid copyright notice on Your software product in which the Sample Code is embedded; and (iii) to indemnify, hold harmless, and defend Us and Our suppliers from and against any claims or lawsuits, including attorneys’ fees, that arise or result from the use or distribution of the Sample Code.