Introduction
As the title suggests this is Part 3, and the final part in a three-part post on configuring FIM/MIM to synchronise users passwords from AD to the Domino ID Vault via PCNS and FIM/MIM.
Part 1 here detailed the creation of a PowerShell Management Agent to join users from Domino to the MIM Sync Metaverse.
Part 2 here detailed the creation and configuration of the Domino Agents to receive password changes via the PS MA into the ID Vault.
This post will wrap it all up with the details on calling the Domino Agents on password sync events (from PCNS via MIM)
Prerequisites
You will need the IBM Notes client installed and configured on your MIM Sync Server in order to put a document in the database we created in Part 2 and start the agent to process the document(s).
Overview
Essentially this is the process;
- Password changed for a user (either by an admin, or by the user via their domain joined workstation, password reset or any other password change mechanism)
- Password change is captured by the AD PCNS Filter installed and configured on each (writeable) Domain Controller
- The DC using the PCNS Config in the domain locates the MIM Sync Server to send the password change too
- The MIM Sync Server has the associated AD Domain configured as a Password Sync Source
- Our new PowerShell ID Vault Notes MA is configured as a Password Target
- MIM Sync passes off the password change event for MIM joined users to the ID Vault Password Change MA which initiates the Password.ps1 script (below)
- The password.ps1 script creates a document (that contains the details for the password change) in our ID Vault Password Sync Database we created in Part 2 of this series and then tells the MIMPwdTrigger Agent to start
- The MIMPwdTrigger Agent picks up the document, passes it to the MIMPasswordSync Agent which sends the password change to the ID Vault
Domino PowerShell Management Agent Password.ps1 Script
Put this Password.ps1 script in the same location you put the Schema, Import and Export scripts earlier.
Testing Password Sync End to End (Active Directory to the ID Vault)
The following screen shots show me tracing through the logs for a password change as it makes it way from the AD Domain Controller to MIM Sync to the MA to the MA Password script to the Notes DB as a document triggered to be process by the Notes Agent and the user updated in the ID Vault.
First the password change event is initiated to the MIM Sync Service by the Domain Controller that captured the password change.
PCNS provides all the details for the password change.
The MIM Sync Server determines where to send the change which includes our PS Notes MA.
Our PS Notes MA logged the process.
Notes MA LOG
=============================================================
Display Name: Jane XXX/xxx/xxxxx-Aus
Action: Set
Old pwd:
New pwd: Password123456
Unlock: False
Force change: False
Validate: False
Database: System.__ComObject
As did the Notes Agent as it process the change.
Notes Agent Log
MIMPasswordSync|mimpasswordsync: 08/03/2017 02:56:22 PM: Reseting password …
MIMPasswordSync|mimpasswordsync: 08/03/2017 02:56:22 PM: Server: xxxNotes1/xxxxx-Aus User:Jane xxx/xxx/xxxxx-Aus
MIMPasswordSync|mimpasswordsync: 08/03/2017 02:56:23 PM: Return value: true
MIMPasswordSync|mimpasswordsync: 08/03/2017 02:56:23 PM: Removed User ID Vault change document from ‘xxxNotes1/xxxxx-Aus’
And finally we see the change reflected in the ID Vault. Looking at the time-stamps along the way we see that it all happened in approximately 2 seconds.
Summary
This three-part blog post has shown how to get passwords from Active Directory to the MIM Sync connected source across to IBM Domino and into the ID Vault using the Granfeldt PowerShell Management Agent and some configuration with a Database in Domino with two Domino Agents.
What have you synchronised passwords too using FIM/MIM ?