This is the 2nd blog continuing on from this post which is an introduction to using Azure Functions with the Lithnet FIM/MIM Powershell Modules. If you haven’t read that one please do so to get up to speed before this one as it has more detail around the setup.
Overview
This post details similar functionality to the first post but with integration to the FIM/MIM Synchronisation Server and the FIM/MIM Metaverse rather than the FIM/MIM Service.
https://dl.dropboxusercontent.com/u/76015/BlogImages/MIMMVFunction/Solution%20Arch%20Azure%20Metaverse%20Search.png
The solution is based around an Azure Function that;
- takes a HTTP WebRequest that contains a payload with the ObjectType, AttributeName and AttributeValue to search for in the Metaverse
- The Azure Function uses Remote Powershell to call the Lithnet MIIS Automation Powershell Module installed on the FIM/MIM Sync Server
- The Lithnet Powershell Module takes the query from the Azure Function, executes the query and returns the result to the Azure Function and the requesting client
- Note: My MIM Infrastructure is all located in Azure so there are configuration steps in this solution to allow access into my Azure environment. If your FIM/MIM infrastructure is elsewhere you’ll need to transpose the appropriate firewall rules for your architecture
Let’s get started.
Prerequisites
The prerequisites for this solution are;
- An Azure Tenant
- FIM/MIM Sync Server (as per the diagram above) with data in your Metaverse from a connected directory service (such as Active Directory)
- I’ll also be using the awesome Lithnet MIIS Powershell Module from here for Microsoft FIM/MIM from Ryan Newington. A fantastic contribution to the FIM/MIM community
- You’ll need to download and install it on your FIM/MIM Synchronisation Server. This differs from the Lithnet Module from the first post in this series as this one is specific to the Metaverse not the FIM/MIM Service.
Enable Powershell Remoting on the FIM/MIM Sync Server
On the FIM/MIM Sync Server where we will be sending requests from the Function App we need to enable Powershell Remoting. This is so we can leverage the Lithnet MIIS Automation Powershell module (that is a prerequisite to be installed on your FIM/MIM Sync Server).
On the FIM/MIM Synchronisation Server open Powershell (as Administrator) and execute the command Enable-PSRemoting -Force
https://dl.dropboxusercontent.com/u/76015/BlogImages/MIMMVFunction/EnablePSRemoting.png
Test from another server in your network that you can access the MIM Sync Server. I did this from my MIM Service Server.
https://dl.dropboxusercontent.com/u/76015/BlogImages/MIMMVFunction/Test%20Remote1.png
PSRemote Inbound Security Rule (Azure NSG)
Using Powershell Remote means we need to have an incoming rule into the Azure Network where my MIM Sync Server is located to allow connections from Azure Functions to my MIM Sync Server. Create an Inbound Rule in your Azure Network Security Group for TCP Port 5986 as per the rule below.
https://dl.dropboxusercontent.com/u/76015/BlogImages/MIMMVFunction/PSRemote%20Inbound%20Security%20Rule2.png
Create a Self Signed Cert on the FIM/MIM Sync Server
To secure the connection using Remote Powershell we will secure the HTTPS connection with a certificate. This is because the Azure Function is not a member of the domain where your FIM/MIM Sync Server is located. In this example I’m using a self-signed certificate.
In Powershell (as Administrator) on your FIM/MIM Sync Server run the following command where the DNSName is the DNS name of your FIM/MIM Sync that will resolve from Azure Functions to your FIM/MIM Sync server.
New-SelfSignedCertificate -DnsName mymimsyncserver.westus.cloudapp.azure.com -CertStoreLocation Cert:\LocalMachine\My
https://dl.dropboxusercontent.com/u/76015/BlogImages/MIMMVFunction/NewSelfSignedCert2.png
Create a Remote Powershell HTTPS Listener
Copy the thumbprint from the self-signed certificate above and use it along with the DNS name of your FIM/MIM Sync Server to run the following command in an Administrator command prompt on your FIM/MIM Sync Server.
winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname=”mymimsyncserver.westus.cloudapp.azure.com”;CertificateThumbp
rint=”536E41D6089F35ABCDEFD8C52BE754EFF0B279B”}
https://dl.dropboxusercontent.com/u/76015/BlogImages/MIMMVFunction/Certificate.png
Allow Powershell Remote (HTTPS) through your firewall on your FIM/MIM Sync Server
In an Administrator command prompt run the following command to create a new inbound firewall rule for the Remote Powershell session from your Azure Function.
netsh advfirewall firewall add rule name="WinRM-HTTPS" dir=in localport=5986 protocol=TCP action=allow
https://dl.dropboxusercontent.com/u/76015/BlogImages/MIMMVFunction/FWRuleOnSyncServer.png
Check that the new firewall rule was created successfully.
https://dl.dropboxusercontent.com/u/76015/BlogImages/MIMMVFunction/FWRuleVerified.png
Create your HTTP Request Function
Create a new HTTP Trigger Function choosing Powershell as the language. More detailed steps to do this is in the first post in this series here.
https://dl.dropboxusercontent.com/u/76015/BlogImages/MIMMVFunction/CreateFunction.png
Search FIM/MIM Metaverse Function App Script
Here is the base script to get you started. This differs a little from the first blog post example in that I’ve secured the username and password for connection to my MIM Sync Server. Details on how to do that are also linked to in the first blog post.
Also in this example I’m running Remote Powershell to execute the command on the FIM/MIM Sync Server as that is where the Lithnet MIIS Automation Powershell Module is installed and needs to run.
The following script;
- Takes an HTTP request with Object Type, AttributeName, AttributeValue
- It uses a Script Block to take the input variables from the HTTP request and perform a a Powershell Remote command (in this example Get-MVObject)
- Returns the object to the output
Save the function once you’ve added the script (and updated it for your credentials, target FIM/MIM Sync Server etc).
Bring up the Test dialog and give the script some input values in the Request Body that will result in a successful query result from your Metaverse. Select Run. If you’ve done everything correctly you’ll see an object returned from the Metaverse.
Test the Function App
https://dl.dropboxusercontent.com/u/76015/BlogImages/MIMMVFunction/Test%20Working.png
Execute the Azure Function from an HTTP Trigger
Now lets try it remotely. Here is a quick Powershell query to the Azure Function using the Powershell Invoke Rest Method using the same input to the Azure Function. And huzzah a returned object.
https://dl.dropboxusercontent.com/u/76015/BlogImages/MIMMVFunction/Query%20and%20Result.png
Summary
This concept provides a framework to allow a plethora of possibilities all possible through a combination of Azure Functions and the Lithnet MIIS Automation PS Module. The Lithnet MIIS PS Module provides all the functionality you get from being on the MIM Sync Server, but now you can retrieve information remotely or trigger functions remotely.
Follow Darren on Twitter @darrenjrobinson