Introduction to Identity Management with MIIS 2003 Steve Plank Architectural Engineer Session code

Agenda MIIS Scenarios How MIIS works MIIS Futures

Hire Scenario HRSystem MIIS Notes ContractorSystem AD App Mode SQLServer iPlanetDirectory ActiveDirectory LotusNotes File LDAP SQL LDAP

Fire Scenario HRSystem MIIS Notes ContractorSystem AD App Mode SQLServer iPlanetDirectory ActiveDirectory LotusNotes File LDAP SQL LDAP

Identity Joining Scenario HRSystem MIIS iPlanetDirectory ActiveDirectory LotusNotes givenName sn title mail employeeID telephone Klarek Cenntt 008 givenName sn title mail employeeID telephone givenName sn title mail employeeID telephone Clark Kennttt 007 givenName sn title mail employeeID telephone Klarke Kent Superhero Clark Kent 007 Reporter Clark Kent Reporter 007 Project to Metaverse givenName sn title mail employeeID telephone Clark Kent 007 Join on employeeID JOINED PROJECTED 007 Join on employeeID JOINED Join on employeeID JOINED Manual Join

Attribute Flow Scenario HRSystem MIIS iPlanetDirectory ActiveDirectory LotusNotes FirstName LastName EmployeeID Title Telephone givenName sn title mail employeeID telephone Klarek Cenntt 008 givenName sn title mail employeeID telephone givenName sn title mail employeeID telephone Clark Kennttt 007 givenName sn title mail employeeID telephone Klarke Kent Superhero 007 givenName sn title mail employeeID telephone Clark Kent 007 Reporter Clark Kent Reporter 007 Identity Data Aggregation givenName sn title mail employeeID telephone 007 Clark Kent 007 Reporter

Attribute Flow Scenario HRSystem MIIS iPlanetDirectory ActiveDirectory LotusNotes FirstName LastName EmployeeID Title Telephone givenName sn title mail employeeID telephone Klarek Cenntt 007 givenName sn title mail employeeID telephone givenName sn title mail employeeID telephone Clark Kennttt 007 givenName sn title mail employeeID telephone Klarke Kent Superhero 007 givenName sn title mail employeeID telephone Clark Kent 007 Reporter Clark Kent Reporter 007 Clark Kent Reporter Reporter Clark Kent Clark Reporter Identity Data Brokering (Convergence)

Attribute Flow Scenario HRSystem MIIS iPlanetDirectory ActiveDirectory LotusNotes FirstName LastName EmployeeID Title Telephone givenName sn title mail employeeID telephone 007 givenName sn title mail employeeID telephone givenName sn title mail employeeID telephone Clark 007 givenName sn title mail employeeID telephone Kent 007 givenName sn title mail employeeID telephone Clark Kent Clark Kent Reporter 007 Kent Reporter Reporter Clark Kent Clark Reporter Identity Data Integrity Enforcement 007 Superhero ReporterSuperhero

Identity Data Integrity Enforcement HRSystem MIIS iPlanetDirectory LotusNotes ActiveDirectory FirstName LastName EmployeeID Title Telephone givenName sn title mail employeeID telephone 007 givenName sn title mail employeeID telephone givenName sn title mail employeeID telephone Clark 007 givenName sn title mail employeeID telephone Kent 007 givenName sn title mail employeeID telephone Clark Kent Clark Kent Reporter 007 Kent Publisher Publisher Clark Kent Clark Reporter Identity Data Integrity Enforcement 007 Reporter SuperheroReporter

MIIS in action… Demo

Agenda MIIS Scenarios How MIIS works MIIS Futures

ConnectorSpace Management Agent (MA) ConnectedDirectories Terminology Metaverse i/f“filters”schemafiltersrules i/f“filters”schemafiltersrules i/f“filters”schemafiltersrules StagingProjectionProvisioningExportJoin Import/Export Run ProfileSync Run Profile

ConnectorSpace Management Agent (MA) ConnectedDirectories Terminology Metaverse i/f“filters”schema i/f“filters”schemafiltersrules i/f“filters”schema Rules Extension Import Attribute FlowExport Attribute Flow filtersrules filtersrules

MIIS – Metadirectory Functionality and Connectivity Identity Data LDAPSQL Wide range of connectivity Active Directory & ADAM Sun/iPlanet Directory IBM DS Novell eDirectory Microsoft SQL 2000 & SQL 7 Oracle 9i/8i IBM DB2 Lotus Notes 5.x/6.x Microsoft Exchange 5.5, 2K, 2K3 Microsoft NT 4.x RACF DSML, LDIF, CSV, fixed width …others to follow MA SDK allows ISVs and corporate developers to build custom MAs NOS LOB Apps

Synchronizing Identity Stores - The Management Agent SDK Easy to use SDK to build Management Agents.Net hosted set of interfaces Address IT Pro and ISV audiences IT Pro Fast MA development using template Simple to configure by reusing “Extensible MA UI” ISVs Allow customizing MA configuration UI and provide customized look and feel Enable packaging and redistribution of management agents Enable Identity Manager-integrated development of MA configuration UI Supports password synchronization

Password Synchronization: Password Change Notification Password Filter The password filter is extremely lightweight to minimize any impact on the DC Filter receives the change notifications and securely communicates passwords to the service Password Notification Service Service encrypts and queues the password notification to be delivered to the registered targets (MIIS or HIS) Notifications are transmitted via secure RPC to target Queuing and retry mechanism guards against lost passwords due to connectivity issues PCNS and MIIS mutually authenticate to prevent spoofing Active Directory Domain Controller LSA Process Password Filter Password Notification Service Identity Integration Server

Password Synchronization: Identity Integration Server MIIS receives notifications from PCNS and locates matching object for user’s Active Directory account MIIS leverages metadirectory “join” relationship to locate correct accounts in the target systems MIIS maintains queue for each target system to optimize delivery and handle systems that are less reliable Passwords can be synchronized to any system managed by MIIS management agents. Password Extensions allow synchronizing passwords to custom applications and directories Identity Integration Server PCNS Connected Directories Connector Space Queue Metaverse

Visualization Different hierarchies suit different needs Multiple hierarchical representations can be discovered from data Polyarchy eliminates the requirement for fixed hierarchy Polyarchy provides multiple hierarchical views and richer visualization of infrastructure information

MIIS Scenarios How MIIS works MIIS Futures Agenda

MIIS Roadmap Lowering the cost and risks of Identity Management Extending MA Reach and password capabilities MIIS - Gemini MIIS 2003 SP1 Q4/CY04 Codeless provisioning Entitlement reporting Self-service platform Password reset additional MAs Additional MAs MA SDK Password Extensions Password synchronization from Windows desktop Providing tools for provisioning MIIS 2003 SP1 ResKit - Q4/CY04 Code generator Workflow

1. Codeless provisioning 2. Richer logging/auditing 3. Self-service platform 4. Workflow for provisioning and self-service 5. Password self-service reset 6. Cluster support 7. Computed attributes (dynamic groups) 8. Cross-forest group management 9. Entitlement reporting 10. Capacity planning documentation 11. Scalability improvements 12. UNIX / OpenLDAP / Generic LDAP MA

Review MIIS Scenarios How MIIS works MIIS Futures