Manager 2010 R2 Handbook

Microsoft Forefront

_Identity

Manager

2010

R2

Handbook

A

_complete

handbook

on

FIM 2010

R2

_covering

both

Identity

and Certificate

_Management

Kent Nordstrom

rise^

PUBLISHING BIRMINGHAM-MUMBAI n, .,

enterp

' "N '

Table

of

_Contents

Preface

₁

Chapter

1: The

Story

in this Book

7

The

_Company

₇

The

_challenges

₈

Provisioning

of

users 8

Identity lifecycle

procedures

8

Highly Privileged

Accounts

_(HPA)

₈

Password

_management

₉

Traceability

9

The

solutions

9

Implement

FIM 2010 R2 9

Start

_using

smart cards

₁₀

Implement

federation

10

The environment

₁₁

Moving

forward

12

Summary

13

Chapter

2: Overview

of FIM 2010 R2

15

The

_history

of FIM

2010 R2

16

FIM

_{Synchronization}

Service

_{(FIM Sync)}

17

Management Agents

19

Non-declarative

vs. declarative

_{synchronization}

₂₀

Password

_{synchronization}

₂₀

FIM Service

_Management

_Agent

₂₁

FIM Service

₂₁

Request pipeline

22

FIM Service

_{Management Agent}

₂₃

Table

_of

Contents

FIM Portal

24

Self Service Password Reset

_(SSPR)

24

FIM

_Reporting

25

FIM Certificate

Management (FIM CM)

25

Certificate

_{Management portal}

26

Licensing

27

Summary

28

Chapter

3: Installation

29

Development

versus

production

29

Capacity

planning

30

Separating

roles 31 Databases 31 FIM

features

31

Hardware

32

Installation order

32

Prerequisites

34 Databases 34

Collation and

_languages

35

SQL aliases 36 FIM-Dev 38 SQL 38 SCSM 39

Web

servers

41

FIM Portal 41

FIM Password Reset 42 FIM Certificate

_Management

44

Service accounts 45

Kerberos

_{configuration}

48

SETSPN 50

Delegation

52

System

Center Service

_Manager

Console 52

Installation

53

FIM

_{Synchronization}

Service

53

FIM Service and FIM Portal

58

FIM Password

Reset

_portal

67

FIM Certificate

_Management

70

SCSM

_management

71

SCSM Data Warehouse

76

Post-installation

_{configuration}

80

Granting

FIM Service

access to FIM

Sync

80

Securing

the FIM Service mailbox

80

of

Redirecting

to

_{IdentityManagement}

₈₁

Enforcing

Kerberos

81

Editing binding

in IIS

for

FIM Password

sites 82

Registering

SCSM

_Manager

in

Data Warehouse 82

FIM

_{post-install scripts}

for

Data Warehouse 87

Summary

87

Chapter

4: Basic

_{Configuration}

89

Creating Management Agents

90

Active

_Directory

90 Least

_privileged

91

Directory

replication 93 Passwordreset 93

Creating

AD MA 93 HR

_(SQL

_Server)

105

Creating

SQL MA 107 Run

_profiles

116

Single

orMulti_step 116

Schema

_management

116

FIM

_Sync

versus FIM Service schema

116

Object

deletion

in MV

117

Modifying

FIM Service

schema

118

FIM Service MA 120

Creating

the FIM

Service

MA 120

Creating

run

_profiles

127

First

_import

128

Filtering

accounts

128

Initial

load

versus

scheduled

runs 130

Moving configuration

from

_development

to

_production

131 Maintenance mode for

_production

132 Disablingmaintenance mode 133

Exporting

FIM

_{Synchronization}

Service

_settings

134

Exporting

FIM Service

_settings

134

Exporting

the FIM Service schema 135

Exporting

the FIM Service

_policy

135

Generating

the difference files 136

Generating

the schema difference 136

Generating

thepolicydifference 136

Importing

to

_production

137

Importing

custom code 137

Importing

theService schemadifference 137

Importing

the

_{Synchronization}

Service

_settings

137

Table

_of

Contents

PowerShell

_scripts

141

Summary

141

Chapter

5: User

Management

143

Modifying

MPRs

foruser

_management

143

Configuring

sets

foruser

management

148

Inbound

_{synchronization}

rules

150

Outbound

_{synchronization}

rules

158

Outbound

_{synchronization}

policy

159

Outbound

_{system scoping}

filter 159

Detected rule

_entry

160

Provisioning

161

Non-declarative

_provisioning

162

Managing

usersin a

phone system

163

Managing

usersin Active

_Directory

170

userAccountControl

170

Provision users to Active

Directory

173

Synchronization

rule 174

Set 177

Workflow 178

MPR 181

Inbound

_{synchronization}

from AD 183

Temporal

Sets

185

Self-service

_using

the

FIM

_portal

186

Managers

can see

direct

reports

188

Userscan _{manage their}own attributes 190

Managing Exchange

194

Exchange

2007

194

Exchange

2010

195

Synchronization

rule for

_Exchange

195

Mailboxusers 196

Mail-enabledusers 197

Summary

198

Chapter

6:

_{Group Management}

199

Group

scope and

types

199

Active

_Directory

199

FIM 201

Type

201

Scope

202

Member Selection 202

Installing

client add-ins

206

Add-ins

and extensions 206

Creating

and

_managing

_{distribution groups}

212

Importing

groups from HR

219

F1M

Service

and Metaverse 222

Managing

groups in AD

224

Security

groups

225

Distribution

_groups

229

Synchronization

rule 229 Set 233 Workflow 234 MPR 236

Summary

237

Chapter

7: Self-service Password Reset

239

Anonymous

request

239

QA

versus

OTP

240

Enabling password management

in AD 240

Allowing

FIM Service to set

_passwords

242

Configuring

FIM

Service

246

Security

context

247

Password

Reset

Users Set

247

Password Reset AuthN workflow 248

Configuring

the QA

_gate

249

The OTPgate 251

Require re-registration

254

SSPR MPRs

255

The user

_experience

255

Summary

262

Chapter

8:

_Using

FIM to

_Manage

Office

365 and

Other Cloud

Identities

263

Overview of

Office

365

263

DirSync

267

Federation 273

PowerShell

orCustom MA 277

Using

UAG and FIM

to

_get

OTP for Office

365 279

Summary

280

Chapter

9:

Reporting

281

Verifying

the

SCSM

_setup

281

Synchronizing

data from FIM to SCSM

283

Default

_reports

285

The SCSM ETL process 286

Looking

at

_reports

289

Table

_of

Contents

Modifying

the

_reports

294

Summary

296

Chapter

10: FIM Portal Customization

297

Components

of the

Ul

298

Portal

_{Configuration}

301

Navigation

Bar Resource

302

Search scopes 311

Usage Keyword

311

Search Definition

313

Results

314

Creating

yourown _{search scope}

315

Filter Permissions 318

RCDC 319

Summary

323

Chapter

11:

_Customizing

Data Transformations

325

Our

_options

325

PowerShell 326

Classic rules

extensions 326

SSIS

327

Workflow activities

328

Extensible

_{Connectivity Management Agent}

328

Managing Lync

329

Provision

_Lync

Users

329

Managing

multivalued attributes

331

Selective

_{deprovisioning}

339

The case with the

strange

roles

340

Summary

345

Chapter

12:

_Issuing

Smart Cards

347

Our scenario

347

Assurance level 348

Extending

the schema

349

The

_{configuration}

wizard

351

Create

service accounts 351

Create certificate

_templates

for FIM CM

service accounts 352

FIMCM UserAgentcertificatetemplate 353 FIM CM Enrollment

Agent

certificate

template

356 FIM CM

_{Key Recovery Agent}

certificate

_template

356 Enable the

_templates

356

Require

SSL

on

the

CM

portal

357

Kerberos

_again!

357

Run the wizard

359

Backup

certificates 364

Rerunning

the

wizard

365

Theaccounts 365

The database 365

Configuring

the FIM CM

_Update

Service 366

Database

_permissions

366

Configuring

the

CA 367

Installing

FIM CM CAfiles

367

Configuring

Policy

Module

368

Installing

the FIM CM client 371

FIM

CM

_permissions

372

Service Connection Point

372

Users and

_groups

374

Certificate

_Template

375

Profile

_{Template object}

377

Profile

Template

settings

378

Allowing

managers

to

issue certificates for

consultants 379

Creating

a Profile

_Template

for consultant

Smart

Cards

379

Configuring

permissions

for consultant Smart Cards

382

John enrollsa Smart Card 382

RDP

_using

Smart Cards

386

CM

_{Management Agent}

386

Summary

387

Chapter

13:

Troubleshooting

389

Reminder 389

Troubleshooting

390 Kerberos

390

Connected Data Sources

392

FIM

_Sync

393 FIM Service 398

Request

errors 398

Sync

errors 401

Reporting

404 FIM CM

405

Agent

certificates 406 CA 407

FIM clients

407

Backup

and restore

408

FIM

_Sync

408

FIM

Service

and Portal 409

Table

_of

Contents Source code 410

Summary

411

Afterword

413

Index

₄₁₅

[

viii

_]