Adventures in identity management
I’m working on a great project at the moment – basically ILM is the provisioning engine sitting behind a self-registration system written in Sharepoint and built on SQL. This has finally given me the opportunity to re-write my simple ILM scheduler as a windows service!
I use a lot of SQL MAs. While ILM/MIIS is great at syncing data between directories, it really isn’t that great at calculating and comparing. As much as possible I like to do the data manipulation in SQL, and then keep ILM to what it’s best at – joins and syncs. After exporting data to…
Thanks to Joe Stepongzi for pointing this one out to me: you can flow a metaverse string attribute direct to a connector space relational DN attribute, as long as the metaverse string holds a valid DN.
Function RunProfile – run a MA run profile Sub ArchiveLog – copy import and export logs to a timestamped version, while modifying them to work with a XML stylesheet Function ExportsPending – check if the MA has pending exports Function DeltaImportsPending – check if a Delta table has any lines to import Function RunSSIS – call a SQL 2005…
Identity management is made a heck of a lot easier if you have a fool-proof way of identifying someone – no wonder governments are so keen on the idea of identity cards. I make no claim either way on the id cards, but I will say that unique identifiers make ILM/MIIS system so much easier…
I recently downloaded the ILM “2” beta 3. I’ve had a bit of a play with it, but this post is not going to be in-depth at all – just some random thoughts.
ILM works on a single object at a time, so it can be a little tricky if you want to make a decision based on other objects in your metaverse. It is, however, perfectly possible (though, I believe, officially discouraged) to run SQL queries against the metaverse table from your extension code.
I’ve just installed the SAP MA (also called the ERP MA) for the first time. As usual it took four times as long as seemed strictly necessary so, in this post, I shall summarise the steps I took to create a basic MA, able to import Users and Employees from SAP into ILM.
A truly effective IdM system should be able to tidy up user data as part of the user-decommissioning process. This might include zipping up home folders and, in the case of email, archiving mailboxes to something like a PST file. My old method of archiving mailboxes with Exmerge when disabling Exchange users won’t work with…
Another non-ILM post today – but this is just something I’ve done recently, and I found I had to trawl around a fair bit for the information I needed, and I may as well jot it down. This post shows the steps I took to get the configuration working, after encountering various errors along the…