Best practices in the Identity Management world come hard-won, and are often discovered only after going down paths that seemed perfectly reasonable at the time, only to find they don’t scale or adapt to new business requirements.
Projects fail for many non-technical reasons – politics, resistance to change, poor data quality and unrealistic expectations. In this session get the inside track from someone who’s been architecting and delivering Identity solutions with FIM (and its predecessors) for 7 years, and in many different environments.
The session offers practical advice on preparing the non-technical landscape for your IdM project, and on architecting your solution to really benefit from the strengths of Forefront Identity Manager 2010 R2.
Presented by Carol Wapshere
Disclaimer: These are conference session notes I compiled during various sessions at Microsoft Tech Ed 2012, September 11-14, 2012. The majority of the content comprises notes taken from the presentation slides accompanied, occasionally, by my own narration. Some of the content may be free hand style. Enjoy… Rob
Introduction
Identity Architecture with Forefront Identity Manager. Don’t build your Identity management solution like Charles Sturt chose to conduct explorations (poorly planned). Pivot to: Don’t rely on bad information!
When do you need to address fundamental design changes? Rapidly changing needs?
Agenda
- What does FIM do?
- Project planning
What is FIM 2010 R2?
Summary by component.
Synchronization Service – Core service, connects matched objects in directories and applications for provisioning.
Password Synchronization – Driven from Active Directory, can synch with any connected accounts
Portal and Service – Portal based on SharePoint, user administration and workflow
Self-Service Password Reset – Secret questions (portal view), access from GINA or Portal, one time password capability
Reporting – System Center Data Warehouse based, auditing information
Role Management – New! Role modelling, assignment, compliance and maps to permissions
Certificate Manager – Request and renew certificates (can be hooked to Synch service)
Planning
What drives an Identity Management project? Stakeholders? Deadlines? Other project dependencies?
Who is driving it? Needs to be properly sponsored (IT driven rarely succeeds).
Early involvement of Identity stakeholders. Understand your environment. Get policy in writing, talk to the people who know. Do data analysis.
Requirements
- Determine essential vs. desirable
- Focus on outcomes
- Get specifics (define specific tasks, etc)
- Don’t try the big bang (don’t do everything at once)
Scale/Effort/Testing
- Greater scale, greater effort
- Greater scope equals greater risk
- Keep project phases small
Task Automation
Automation requires neat, predictable shapes. Requires a degree of consistency. Don’t focus on trying to automate everything. There will always be manual processes.
FIM is state based.
- Current state of objects
- Future state of objects
- Don’t care about the how or why an object has changed state
Extensibility
- Synch Service
- Custom Workflow
- Web Services
Do try to use out of the box, and use supported functionality. Avoid undocumented API/functionality.
Synch Data
- Runs best on clean data
- Unique identifiers
- Validated source data
- Consistent formatting
- Avoid free text (use drop lists, checkboxes etc)
- Minimise double entry (prefer single entry)
- Multiple data sources (e.g. AD is not necessarily the best place to get phone numbers)
- Locate data sources which are most up to date (sources of truth)
Find the Source (per object type of sub-category)
- One object source
- One attribute source per attribute
- Make sure everyone understands the sources of truth!
Avoids duplication, merge conflicts.
Overhead
- Identity accounts
- Clean up old accounts
- Move unmanaged accounts out of scope (don’t manage with FIM) – maybe move to alternate OU
Dev and Test
- Have full production data sets (i.e. be realistic)
- Run all rules through real data
- Rules must cope with real data
- Analyse joins/cleans
- Identify exceptions
- Understand scale
- Test hardware/environment should be fully spec’d (as much as possible)
Expect Teething Pain
- Production data may provide surprises
- Just in time requirements
- Confusion about what is changed and where (source data concept)
Administration
- Doesn’t work in isolation without management/monitoring
- Data errors/merge issues will occur, require manual intervention
- Rules will change (change FIM, don’t work around it)
Return on Investment?
Scenario [Demo]
Integrating a Cloud Application with FIM
Created additional tab in the portal for roles for the Cloud application. Synch service synchs roles to AD. Once authenticated, the Cloud App can read the properties based on the claim token (e.g. group membership). Changes in the portal are automatically synched to AD.
Henry Parkes used to say ‘Federation is great!’ and he wasn’t wrong.
Benefits Realised?
- Automatically provide user data
- Manage licensing
- Ensure tokens are up to date
- Self service and/or approval
- Minimised IT overhead
Summary
- Understand the environment
- Develop for automation
- Be realistic (what can FIM do, how much scope to undertake)
