Forefront Identity Manager - Understand How it Works

I’m getting nervous to write this, as this software is outside my experience as a .NET Developer and specifically as a SharePoint Developer. But I done one project with this so far, so worth to share to you guys, as this software really challenging and actually really easy to do if you got at least little or medium level knowledge in Windows Active Directory.

Alright, I’ll go with the short brief. Forefront Identity Manager is a software / system which could handles and combine an attributes of entity from a different other sources, and then put it on any other destination sources. What I’m talking about the sources is such as Active Directory, SQL Server Database, SAP, Oracle, or any other data sources.

See that diagram above to make it easier to understand, I took it from TechNet Microsoft. What we got now in the example above is there are 5 data sources, Active Directory, Lotus Notes, HR SQL Database, Vendor Database, and Telephone Text File. In Active Directory, there’s a bunch of attributes such as Logon data (computer user name, any other data related to the system). In Lotus Notes (if the company intend to use Lotus Notes rather than Exchange), we got E-mail, Department, Manager, Location, and so on. Different configuration might affect the diagram also, such as if you use Exchange Server rather than Lotus Notes, then we don’t need to use another connector / data sources to Exchange, as it’s already integrated with Active Directory. There’s a bunch of attributes also inside HR SQL Database and Vendor Database, and any other data sources. It pulls the attributes from data sources with some conditional or just barely pull it, put it on some temporary space named as connector space, then will do some attributes combining based on rules. Then it’ll become a full complete identity data, and then push it to another data sources we want to put. Just as simple as that, as long as there’s a such primary key, or Microsoft called it Anchor, which shared across multiple data sources. No Anchor, no combining / joining. With Anchor, everyone happy, all data sync’d.

From this concept, we knew that this software is all about data synchronization, especially identity synchronization between those data sources. I’ll try to write on my understanding, so it’ll be easier to read (or might harder?).

Metaverse

Metaverse is specifically a storage or space that holds an aggregated information from multiple data sources. This is the main internal storage for FIM to work. Those attributes pulled from multiple data sources, will be saved in here.

Management Agents

Management Agents is a such configuration for specific data source. One Management Agent represent one data source, and it holds a lot of settings related to the data source, especially on how we want to push and pull the data into the Metaverse. The best part of this, if we can’t find the Management Agent (MA) which fit to our scenarios, we can create one.

Processes

Process should be simple, as in my mind, there’s a 3 big processes, Import, Sync, Export. But from those we can get more little specific like Full Import, Delta Import, etc. Import, is importing the data from data source to connector space.  Sync, is a process to committing the imported data from connector space to metaverse, and then do a join and vice versa between data sources. Export, is a process when we push the sync’d data to the data sources.

Diagrams

Of course, diagrams is suddenly very important here, when we are planning to deploy solutions with this kind of software. Before you go through, always write diagram on how we want to push and pull the data. Based on the knowledge above, actually we can draw a sync line between those data sources.

Introduction: Microsoft Forefront Identity Manager (FIM) 2010

Guys, there’s something that I want to share to all of you. I wrote this with my style, and hope you enjoy the entire article. I’ll write on next couple posts about Microsoft Forefront Identity Manager (FIM) 2010 from developers perspective. I’m a .NET developer, remember? Of course I will write this from my point of view.

Microsoft Forefront Identity Manager is a new name for Identity Lifecycle Manager which was officially named as Identity Lifecycle Manager (ILM) 2007. It’s a software specialized for exporting / importing a data from one to another data source. More specific, an attribute to another attribute. If you imagine on a big company that has a couple data source for employees identity, such as Active Directory and Exchange for email and logins, HR systems as employee data, maybe a site portal with such kind of different user data, or plus with telephony system which holds all the extension number of all employees. And they want to put and combine all data from data sources, and deploy to another data source such as Active Directory, they may need this software and you may use this (and sell services) for them. I don’t know exactly the cost for this software, but at next articles, again, I just want to share from .NET developers perspective, not another.

In 2010 version, there’s a big change since Identity Lifecycle Manager in 2007 version. Now, we can export import to a new Management Agent (MA) named FIM Portal. This portal also works as the UI for FIM. We can specify attribute imports and exports, defining rules, creating attributes, change some security so users can also create an identity by accessing this portal. But for FIM Portal, I won’t discuss further, as I still need some exploration on this. Actually it’s pretty “friendly” compared to the console application which is not good for inexperience user like me. But if you missed a configuration, your FIM Portal sync won’t work even you’re already make a good configuration. And there’s a performance consideration using FIM Portal, when you try to sync users more than 5000. It’ll sync an additional object called Detected Rule Entry (DRE) and Expected Rule Entry (ERE) which always will consist more than one per user! But if you use only the console, you won’t get a GUI, not much as friendly as the portal, no expanded functionality, but it’s really easy to configure and to code.

Here’s the list of next article, and it’ll changed to link if I’ve published an article for that title:

• Forefront Identity Manager - Understand How it Works

• Forefront Identity Manager - Sync Methods

• Forefront Identity Manager - Management Agent Configurations

• Forefront Identity Manager - Creating Custom Management Agent

• Forefront Identity Manager - Creating Custom Rule Extension

• Forefront Identity Manager - Creating Custom Password Sync Rule

Guys, at last I’m pretty confident to write this article, and really appreciate your comments. Again, I’m not a system engineer, nor a FIM expert, just a .NET app developer. So sorry if any mistakes on next couple articles, and please do comments for this, so I can make a quick changes if necessary. I also intend to get some quote from some sites including Microsoft.com, and I’ll give it to you at the end of articles.