Validate Your Authoritative Sources – Creating a Fuse for FIM/MIM Import and Sync run cycles

18th of October, 2017 / / No Comments

 

Introduction

The Microsoft Identity Manager Synchronisation Engine has been around for close to 20 years and is highly functional and very reliable.
The Achilles heal though for any IDAM Sync Engine will always be an authoritative source and the information it provides to the Sync Engine.
I’m seeing more and more SaaS services being used as the Authoritative Source for identity management systems. Think Success Factors and Workday. Connecting across the internet to these and the rate of change within organisations means the amount of change data I’m seeing as well as the common human factor of changes en-mass means it is even more important to validate your import feeds before processing through your Sync Engines business logic.… [Keep reading] “Validate Your Authoritative Sources – Creating a Fuse for FIM/MIM Import and Sync run cycles”

Continuous Credential Prompt when accessing MIM Password Registration Portal

20th of September, 2017 / / 4 Comments

First published at https://nivleshc.wordpress.com
Recently I was at a customer site, setting up a Microsoft Identity Manager (MIM) 2016 environment, which included the deployment of the Self Service Password Registration and Self Service Password Reset portals. For additional security, I was using Kerberos instead of the default NTLM.
I finished installing the MIM Portal, Service, Password Registration and Password Reset Portals without any issues.
I then proceeded to securing all http endpoints by enabling them for SSL and after that removing the http bindings, so that you could access the MIM Portal, Password Registration and Password Reset Portals only via https.… [Keep reading] “Continuous Credential Prompt when accessing MIM Password Registration Portal”

Automatically Provision Azure AD B2B Guest Accounts

19th of September, 2017 / / 4 Comments

Azure ‘Business to Business’ (or the catchy acronym ‘B2B’) has been an area of significant development in the last 12 months when it comes to providing access to Azure based applications and services to identities outside an organisation’s tenancy.
Recently, Ryan Murphy (who has contributed to this blog) and I have been tasked to provide an identity based architecture to share Dynamics 365 services within a large organisation, but across two ‘internal’ Azure AD tenancies.
Dynamics 365 takes its identity store from Azure AD; if you’re assigned a license for Dynamics 365 in the Azure Portal, including in a ‘B2B’ scenario, you’re granted access to the Dynamics 365 application (as outlined here).  … [Keep reading] “Automatically Provision Azure AD B2B Guest Accounts”

Enabling and using Managed Service Identity to access an Azure Key Vault with Azure PowerShell Functions

19th of September, 2017 / / 4 Comments

Introduction

At the end of last week (14 Sept 2017) Microsoft announced a new Azure Active Directory feature – Managed Service Identity. Managed Service Identity helps solve the chicken and egg bootstrap problem of needing credentials to connect to the Azure Key Vault to retrieve credentials. When used in conjunction with Virtual Machines, Web Apps and Azure Functions that meant having to implement methods to obfuscate credentials that were stored within them. I touched on one method that I’ve used a lot in this post here whereby I encrypt the credential and store it in the Application Settings, but it still required a keyfile to allow reversing of the encryption as part of the automation process.… [Keep reading] “Enabling and using Managed Service Identity to access an Azure Key Vault with Azure PowerShell Functions”

ADFS Service Communication Certificate Renewal Steps

17th of September, 2017 / / 3 Comments

Hi Guys, adfs service comprises of certificates which serve different purpose for federation service. In this blog post I will share a brief description of these certificates, their purpose and will discuss renewal process of service communication certificate.
 
Type of ADFS Certificates and their purpose
 

Certificate Type Description Purpose
Service Communication certificate
 		 Standard Secure Sockets Layer (SSL) certificate that is used for securing communications between federation servers, clients, Web Application Proxy, and federation server proxy computers.
… [Keep reading] “ADFS Service Communication Certificate Renewal Steps”

Easier portability of the FIMAutomation powershell snap-in

15th of September, 2017 / / No Comments

I am a fan of Ryan Newington’s MIM PowerShell modules, I think they are like the missing tools that Microsoft should have provided in the box from day one. Sometimes though, for various reasons, we may not have approval or access to use 3rd party or open source code, or other tools may expect exports to be in a specific format.
Using the FIMAutomation PSSnapin is easy … on servers with the MIM Service installed. … [Keep reading] “Easier portability of the FIMAutomation powershell snap-in”

Display Microsoft Identity Manager Sync Engine Statistics in the MIM Portal

15th of September, 2017 / / No Comments

Introduction

In the Microsoft / Forefront Identity Manager Synchronization Service Manager under Tools we have a Statistics Report. This gives a break down of each of the Management Agents and the Connectors on each MA.
I had a recent requirement to expose this information for a customer but I didn’t want them to have to connect to the Synchronization Server (and be given the permissions to allow them to). So I looked into another way of providing a subset of this information in the MIM Portal itself.  … [Keep reading] “Display Microsoft Identity Manager Sync Engine Statistics in the MIM Portal”

Configuring Remote PowerShell to a Remote Active Directory Forest for FIM/MIM GalSync

7th of September, 2017 / / No Comments

Introduction

Windows Remote Management (aka Remote PowerShell) is a wonderful thing; when it works straight out of the box when you’re in the same domain. Getting it working across Forests though can feel like jumping through hoop after hoop, and sometimes like the hoops are on fire.  When configuring GALSync ([Exchange] Global Address List Synchronisation) with FIM/MIM this always means across AD Forests. The graphic below shows the simplest relationship. If there is a firewall(s) in between then you’ll have additional hoops to jump through.… [Keep reading] “Configuring Remote PowerShell to a Remote Active Directory Forest for FIM/MIM GalSync”

MIM2016 Upgrade Hanging on Custom Action – SetPermissionEval

5th of September, 2017 / / No Comments

I was upgrading a client’s environment from FIM2010 R2 to MIM2016, during the upgrade of the Synchronization service, the installer appeared stuck, I waited for over an hour, there was no activity and no progress update. I checked the msi installation log, and found the last activity was CustomAction = SetPermissionEval, ActionType=3073. Other than this, there was no errors or any indication of failures.
msilog
According to this TechNet article, SetPermissionEval sets access permission (ACLs) for file folders, registry, DCOM launch/access permission and WMI.… [Keep reading] “MIM2016 Upgrade Hanging on Custom Action – SetPermissionEval”

Receive Push Notifications from Microsoft Identity Manager on your Mobile/Tablet/Computer

5th of September, 2017 / / No Comments

Background

Recently in a FIM/MIM environment a daily automated process was executing but the task it was performing was dependent on an upstream process that generates a feed, and the schedule for that feed had changed (without notice to me). Needless to say FIM/MIM wasn’t getting the information it needed to process. This got me thinking about notifications.
If you’re anything like me you probably have numerous email accounts and your subconscious has all but programmed itself to ignore “new email” notifications.… [Keep reading] “Receive Push Notifications from Microsoft Identity Manager on your Mobile/Tablet/Computer”