Introduction to Identity Management and Forefront Identity Manager 2010 R2 SP1

Introduction to Identity Management and Forefront Identity Manager 2010 R2 SP1 (Part 2)

by Sajid Khan [Published on 27 December 2015 / Last Updated on 27 December 2015]

In this part of this series, I will introduce to you Microsoft’s answer to identity management.

If you would like to be notified when Scott Lowe releases the next part of this article series please sign up to the WindowsNetworking.com Real time article update newsletter.

If you would like to read the first part in this article series please go to Introduction to Identity Management and Forefront Identity Manager 2010 R2 SP1 (Part 1).

Introduction

When we last met, we had just wrapped up a 1,300 word discussion regarding the importance of identity management in the enterprise and outlined some of its benefits. We also discussed some foundational items you need to consider before embarking on an identity management journey in your organization. In this part of this series, I will introduce to you Microsoft’s answer to identity management. Entitled Forefront Identity Manager 2010 R2, Microsoft’s product provides organizations with a comprehensive set of identity management features.

Buying FIM 2010 R2

Before we jump into the product feature set, let’s take a look at how it’s licensed. As is usually the case with Microsoft products, licensing for FIM 2010 R2 is messy and complex.

Servers

First of all, for each server to which you deploy a FIM component, you must buy a server license to run the software.

Database

FIM requires a SQL Server database to operate. Frankly, I’m stunned that Microsoft doesn’t grant a runtime instance of SQL for FIM, but according to the full licensing document, FIM implementers must also buy a SQL Server license.

Users

For each user that you manage through FIM, you need a Windows Server Client Access License (CAL). If you’re a Microsoft shop, you probably already have these licenses.

Additionally, for each user that you manage through FIM, you need a FIM CAL is required. Administrators that manage users through FIM also require a CAL.

If you have external users that you need to include in your FIM environment, you also need an external connectorlicense as well as a CAL for each external user.

Reporting

FIM 2010 R2 leverages the reporting functionality from System Center Service Manager. With the purchase of FIM, you are granted an SCSM license designed strictly to enable reporting.

FIM 2010 R2 components

In small environments, you might deploy most of the FIM environment to a single server, but as the environment grows, you will probably find it easier to deploy FIM to multiple servers. This allows you to more easily grow those aspects of the environment that experience the most usage. The table below describes FIM’s major components.

Component	Description
FIM Synchronization Service	The synchronization service is one of FIM’s core services. It handles “metaverse”-wide synchronization of identities between data sources. This service creates and maintains identities in other systems.
FIM Service	The FIM service is a web service component that provides connecting functionality behind the scenes in FIM.
FIM Portal	The FIM portal is a user and administrator-facing component that exposes much of FIM’s functionality to users, including password reset capability, group management tasks, and administrative options. The portal runs on SharePoint.
FIM Certificate Management	The certificate management component is generally used in conjunction with smart cards and isn’t deeply integrated into the rest of the suite. Many FIM deployments don’t even include this component.
FIM Reporting	FIM leverages System Center Service Manager’s reporting engine. Reporting in FIM is handled through this special SCSM service. Users of FIM are granted a runtime license for SCSM’s reporting component to enable this functionality.
FIM Password Registration Portal	One of FIM’s best features is the ability to provide users with the ability to establish security questions and answers that they can use to reset their passwords on their own in the event that they’re forgotten.
FIM Password Reset Portal	Once a user establishes security questions, if he forgets his password, he can visit the password reset portal and reset it without having to contact the IT help desk. In R2, the password reset portal is fully web based, so it can be used across any platform. There are no longer any ActiveX controls. The password reset tool can also integrate with the Windows login screen so that users can reset their passwords even if they’re unable to log in to their PCs.
SQL (FIM service database database)	The FIM database stores all of the information for the environment and is used for certain transformations that take place.
BHOLD	BHOLD is a relatively new addition to FIM that enables organizations to delegate role management to users. This can further streamline the identity management experience in the organization.
FIM Outlook Client	A number of FIM actions require authorization through built-in workflows. Through the FIM Outlook client add-in, users and administrators can approve or deny actions right from Outlook without having to open a separate application.

Table 1

In this article series, you will learn about the identity management and password reset parts of FIM, but I will not be discussing certificate management.

Some additional terminology

As you may have guessed, FIM is a relatively complex software platform and there is a lot of supporting knowledge that goes into deploying the product. As such, there is quite a bit of terminology that’s important to understand.

·         Metaverse. According to Microsoft, the metaverse is “…a set of tables in the SQL Server database that contains the combined identity information for a person or resource. Management agents update and modify the metaverse from multiple connected data sources, and in turn, management agents use the data in the metaverse to update and modify the connected data sources. The metaverse contains its own schema, which defines which object types and attributes the metaverse can contain.” In other words, the metaverse is the universe in which the various FIM objects reside.

·         Connector space. This is an area where objects are written before being synchronized with the metaverse or a connected data source.

·         Connector. In FIM, a connector is an object is the connector space that is connected to an object in the metaverse.

·         Explicit Connector. A specialized type of connector that can only be created manually and that remains connected even when filters are in place.

·         Management agent. In FIM, a management agent is responsible for connectivity to a specific data source.

Data source options

FIM can connect to a variety of data source data. The list below described which data sources Microsoft Forefront Identity Manager (FIM) 2010 R2 supports:

·         Active Directory Domain Services 2000, 2003, 2003 R2, 2008


·         Active Directory Lightweight Directory Services (ADLDS)


·         Active Directory global address list (GAL) 


·         Attribute-value pair text files 


·         FIM Certificate Management


·         Delimited text files 


·         Directory Services Markup Language (DSML) 2.0 


·         Microsoft Exchange Server 2007 and 2010 (use the management agent for Active Directory)


·         Microsoft SQL Server 2000, SQL Server 2005, SQL Server 2008


·         Fixed-width text files 


·         IBM DB2 Universal Database 9.1 or 9.5


·         IBM Directory Server 6.0 or 6.2


·         LDAP Data Interchange Format (LDIF) 


·         Lotus Notes release 6.5 or 7.0


·         Novell eDirectory 8.7.3 or 8.8


·         Oracle10g Database 


·         AP R/3 Enterprise (4.7), mySAP 2004 (ECC 5.0)


·         Sun ONE and Netscape Directory Server 5.1 and 5.2


·         SAP HCM

·         Oracle eBusiness Suite

·         Oracle PeopleSoft

There are also some additional management agents available for certain online services, such as Office 365. Using these data sources, you can manage identities across just about any system.

High level deployment overview

Bearing in mind that I won’t be covering the certificate management parts of FIM in this series, it’s possible to deploy FIM in a number of different scenarios. Here are some things to keep in mind:

·         Most roles can coexist on a single server. This is generally suitable only in very small or lab environments.

·         The SCSM data warehouse service must run separately from the other services.

·         For scalability, administrators often place each role on a separate server. In the world of virtualization, this is a pretty easy feat to accomplish and provides the opportunity to granularly scale components as needed.

·         A best practice is to install the FIM portal and the FIM service together.

On the issue of scale, not all FIM services can load balance or use multiple servers. Only a single server of the role type is supported.

Summary

With more foundational elements in place, in the next part of this series, we’ll walk through the beginnings of a FIM deployment.

If you would like to be notified when Scott Lowe releases the next part of this article series please sign up to the WindowsNetworking.com Real time article update newsletter.

If you would like to read the first part in this article series please go to Introduction to Identity Management and Forefront Identity Manager 2010 R2 SP1 (Part 1).