Share via


Connected Data Sources and Management Agents

Information is brought into the metadirectory from connected data sources by the management agents.

Connected data sources

The primary purpose of a metadirectory is to gather identity information from multiple sources and combine it in a single location so that the data can be easily administered from one location. Each data source that contributes to or receives data from the metadirectory is known as a connected data source. A connected data source can be an enterprise directory, a mail directory, a human resources database, or data in flat files, such as LDIF or delimited text files.

Microsoft® Forefront Identity Manager (FIM) 2010 R2 supports the following connected data sources:

  • Active Directory Domain Services 2000, 2003, 2003 R2, 2008

  • Active Directory Lightweight Directory Services (ADLDS)

  • Active Directory global address list (GAL)

  • Attribute-value pair text files

  • FIM Certificate Management

  • Delimited text files

  • Directory Services Markup Language (DSML) 2.0

  • Microsoft Exchange Server 2007 and 2010 (use the management agent for Active Directory)

  • Microsoft SQL Server 2000, SQL Server 2005, SQL Server 2008

  • Fixed-width text files

  • IBM DB2 Universal Database 9.1 or 9.5

  • IBM Directory Server 6.0 or 6.2

  • LDAP Data Interchange Format (LDIF)

  • Lotus Notes release 6.5 or 7.0

  • Novell eDirectory 8.7.3 or 8.8

  • Oracle10g Database

  • AP R/3 Enterprise (4.7), mySAP 2004 (ECC 5.0)

  • Sun ONE and Netscape Directory Server 5.1 and 5.2

Management agents

Management agents control the data flow between a connected data source and the metaverse. There is a management agent for each supported connected data source. To configure a management agent, you use a set of user-defined properties to determine how objects from the connected data source are synchronized with the metaverse. The property set of a management agent differs slightly depending on the management agent type, but all management agents perform the following common tasks:

  • Schema discovery. The management agent generates a schema based on the objects and attributes in the connected data source.

  • Configure the Connector Filter. The connector filter controls which objects from the connector space are processed by the management agent. You use connector filters to prevent selected connector space objects from synchronizing with objects in the metaverse.

  • Configure Join and Projection. Join and projection rules determine how an object from the connector space is synchronized with an object in the metaverse. If a similar object already exists in the metaverse and meets specific criteria, the connector space object can be joined, or linked, to that metaverse object. If a similar object is not found in the metaverse, the connector space object can be projected to the metaverse; that is, a corresponding new metaverse object is created.

  • Configure Attribute Flow. When you configure attribute flow, you map the attributes of the connected data source object to the attributes of the metaverse object type.

  • Configure Deprovisioning. Deprovisioning determines how connector space objects are processed after they have been deleted from the metaverse object, or disconnected due to provisioning.

  • Configure Rules Extensions. You can further control how the management agent processes data by writing a rules extension for the management agent. You can use rules extensions to perform customized actions, such as searching for a specific attribute value or catching synchronization errors. For more information about rules extensions, see the FIM Developer Reference.

For more information about how management agents process data, see Understanding Management Agent Rules.

Management agent types

Management agents can be one of two types: call-based or file-based. Call-based management agents use a real-time connection to import data from and export data to the connected data source, whereas file-based management agents use a text file to import data from and export data to the connected data source.

Call-based management agents File-based management agents

Active Directory

Active Directory Lightweight Directory Services (ADLDS)

Active Directory global address list (GAL)

FIM Certificate Management

IBM DB2 Universal Database

IBM Directory Server

Lotus Notes

Microsoft SQL Server

Novell eDirectory

Oracle Database

Sun and Netscape directory servers

Attribute-value pair text files

Delimited text files

Directory Services Markup Language (DSML)

Extensible connectivity

Fixed-width text files

LDAP Data Interchange Format (LDIF)

The management agent for extensible connectivity

The management agent for extensible connectivity is a special management agent provided with FIM that you can use to develop a management agent that can synchronize with any connected data source. It is part of the FIM management agent software development kit (SDK). The management agent SDK is set of tools, interfaces, documentation, and sample code needed to develop a custom management agent. You can use the management agent SDK and the management agent for extensible connectivity to develop management agents that integrate with the Synchronization Service Manager configuration without creating your own user interface. Some of the tasks you can perform with the management agent SDK are:

  • Authenticating and connecting to connected data sources

  • Creating and importing files from a connected data source to FIM

  • Performing delta exports to a connected data source or file

When you create an extensible management agent, you specify a previously configured extension DLL file that contains the configuration information necessary to create the management agent and connect to the data source. When the management agent is run, the extension DLL will query the connected data source and create an import file for the management agent. The management agent then uses this import file and runs in the same manner as any other file-based management agent. The extension DLL can also create an export file to export connector space data out to the connected data source.

For more information, see Using the Management Agent for Extensible Connectivity, or see the FIM Developer Reference.

Add-in management agents

FIM provides you with flexibility for connecting to a wide range of connected data sources using management agents. In addition to the management agents included when you install FIM, Microsoft makes available new management agents online. For the latest information about management agents available for FIM, see the FIM Technical Library (https://go.microsoft.com/fwlink/?LinkID=101307).

Management agent run profiles

Management agents use a run profile to specify how to run a management agent. A run profile is a series of steps that determine such things as whether the management agent performs an import or export, how many objects to process, or which partition to use. A management agent can have multiple run profiles. The run profiles are stored along with the management agent data. For more information about run profiles, see Configuring Management Agents.

Management agent schemas

Each management agent contains a schema that is created from the structure of the data in the connected data source. The schema is created in different ways, depending on the management agent type. The following table lists and describes the management agent types.

Management agent for Schema model

Active Directory

Active Directory Lightweight Directory Services (ADLDS)

Active Directory global address list (GAL)

IBM Directory Server

Sun and Netscape directory servers

Schema is generated based on the dynamic discovery of the source directory by the management agent.

Attribute-value pair text files

Delimited text files

Directory Services Markup Language (DSML)

Extensible connectivity

Fixed-width text files

LDAP Data Interchange Format (LDIF)

Schema is generated based on the discovery of the data in the template input file.

Note

You cannot edit the schemas for delimited text files and fixed-width text files.

IBM DB2 Universal Database

Microsoft SQL Server

Oracle Database

Schema is generated based on the source database table definition.

FIM Certificate Manager

Lotus Notes

Schema is generated based on the fixed schema that models the database structure.

Note

After you create a management agent, the schema for that management agent persists with the configuration for that management agent The schema is updated only when the user explicitly requests it by using the Refresh Schema command in Management Agents. For information about refreshing the schema, see Configuring Management Agents.

Encryption and security

Each management agent configured in FIM contains data that needs to be secured, for example the credentials required to connect to the target data source, and any SetPassword calls made by that management agent. All credential data is encrypted using a Windows Crypto API key, which is stored securely in the FIM SQL database. The following table lists the encryption technologies supported by FIM to bind and connect to the target data source, and to secure SetPassword calls.

Management agent for Bind Connection SetPassword

Active Directory

Negotiate

Kerberos Sign & Seal, plaintext

Kerberos

Active Directory Lightweight Directory Services (ADLDS)

Negotiate

SSL, Kerberos Sign & Seal, plaintext

SSL, Kerberos Sign & Seal, plaintext

IBM Directory Server

Simple Authentication and Security Layer (SASL)

SSL

SSL

Lotus Notes

Lotus Notes client proprietary

Lotus Notes client proprietary

Lotus Notes client encryption

Novell eDirectory

Digest, simple

SSL, plaintext

SSL, plaintext

Sun and Netscape directory servers

Digest, simple

SSL, plaintext

SSL, plaintext