Adventures in Identity Management
Identity management is made a heck of a lot easier if you have a fool-proof way of identifying someone - no wonder governments are so keen on the idea of identity cards. I make no claim either way on the id cards, but I will say that unique identifiers make ILM/MIIS system so much easier to run that, more than a best practise, they are an absolute essential.
I recently downloaded the ILM “2″ beta 3. I’ve had a bit of a play with it, but this post is not going to be in-depth at all - just some random thoughts.
ILM works on a single object at a time, so it can be a little tricky if you want to make a decision based on other objects in your metaverse. It is, however, perfectly possible (though, I believe, officially discouraged) to run SQL queries against the metaverse table from your extension code.
I’ve just installed the SAP MA (also called the ERP MA) for the first time. As usual it took four times as long as seemed strictly necessary so, in this post, I shall summarise the steps I took to create a basic MA, able to import Users and Employees from SAP into ILM.
A truly effective IdM system should be able to tidy up user data as part of the user-decommissioning process. This might include zipping up home folders and, in the case of email, archiving mailboxes to something like a PST file.
My old method of archiving mailboxes with Exmerge when disabling Exchange users won’t work with Exchange 2007 so it’s time for an update.
Another non-ILM post today - but this is just something I’ve done recently, and I found I had to trawl around a fair bit for the information I needed, and I may as well jot it down. This post shows the steps I took to get the configuration working, after encountering various errors along the way. There may well be other ways.
The project was to install two replica instances of ADAM SP1 using NLB for failover, and to add some custom fields to the user Class.
In the early stage of your ILM project, or whenever taking over some new aspect, It’s worth putting some effort in to drawing a clear picture for whoever has the job of approving your change. What I try to do is produce a spreadsheet that shows, very clearly, the adds and deletes; and in the case of updates, the old attribute value next to the new attribute value.
Permalink Comments off
This is a repost of an article which was originally about multivalue attributes in general, but with a focus on group members. I realised I had made some generalisations about multivalue attributes which actually specifically apply only to attributes like member, which contain reference DN values. So I am now re-releasing the post, with a focus just on member.
Group population is not the simplest thing to automate, however it is often a time-consuming manual task, and something high up on the priority list for an ILM project. Here are a few points which may help you on your way.
Thought I’d already covered joins sufficiently in this post? Heck no, I got plenty more to say!
You can have multiple join rules, which you may (or may not) combine into Mapping Groups.
Extension code cannot run standalone, but only within ILM. To debug the code you must first attach Visual Studio to the miiserver process.
