1. Forefront Identity Manager 2010
Technical Overview
Daniel Kaufmann (Microsoft Schweiz)
Dominik Zemp (Microsoft Schweiz)

2. Agenda Identity and Access Management FIM Overview and Architecture
Business Needs and IT Challenges
Business Ready Security
Microsoft Identity and Access Management Solution
FIM Overview and Architecture
FIM Features
User Management
Group Management
Password Reset
Policy Management incl workflow
Extensibility
CLM
Benefits of FIM

3. Identity and Access Business Needs and IT Challenges
Provide secure access to applications from anywhere
Simplify user experience for collaboration
Provide seamless movement between applications
Reduce cost of account management
Multiple locations and devices
Difficulty in extending business resources
Disparate systems to manage
Complex account lifecycle management
BUSINESS Needs
IT Needs
Agility and Flexibility
Control

4. Business Ready Security Solutions
Secure Messaging
Secure Collaboration
Secure Endpoint
Information Protection
Identity and Access Management

5. Simplify Identity Management
GOVERNED SELF-SERVICE AND AUTOMATION
Empower Business
Self-service profile, credential, and group management
Password and PIN reset from Windows login
Group management from within Microsoft Office
Single identity across heterogeneous applications
Empower IT
End-to-end, workflow-driven user provisioning
Policy-controlled self-service capabilities
Automatic, attribute-based group membership for simplified resource access
GROUP MANAGEMENT
IDENTITY MANAGEMENT
CREDENTIAL
MANAGeMENT “
If you wanted to access a file share in your network, previously you might have had to call your service desk and get approval. Now it is all workflow based. You go to a portal. There is no manual labor.
- Brian Desmond, Microsoft MVP

6. Identity Management tasks
Provisioning
Deprovisioning
Synchronization
Self-Service Profile Management
Self-Service Group Management
Self-Service Password Management
Certificate and Smart Card Management

7. Identity Management User provisioning
Policy-based identity lifecycle management system
Built-in workflow for identity management
Automatically synchronize all user information to different directories across the enterprise
Automates the process of on-boarding users
Active Directory
Lotus Domino
HR System
Workflow
User Enrollment
LDAP
FIM
SQL Server
Approval
Manager
Oracle DB
FIM CM
User provisioned on all allowed systems

8. Identity Management User de-provisioning
Automated user de-provisioning
Built-in workflow for identity management
Real-time de-provisioning from all systems to prevent unauthorized access and information leakage
Active Directory
Lotus Domino
HR System
Workflow
User de-provisioned
LDAP
FIM
SQL Server
Oracle DB
User de-provisioned or disabled on all systems
FIM CM

9. Identity Synchronization and Consistency Identity synchronization across multiple directories
Attribute Ownership
FirstName
LastName
EmployeeID
Title
Telephone HR
System
FIM
givenName
Samantha
Samantha sn
Dearing
Dearing
title
mail
employeeID
007
007
telephone
givenName sn
title
mail
employeeID
telephone
GivenName sn
title
mail
employeeID
telephone
Samantha
Dearing
007
Coordinator
SQL Server DB
givenName
Samara sn
Darling
title
Coordinator
Coordinator
mail
employeeID
007
telephone
Identity
Data
Aggregation
Active
Directory/
Exchange
givenName
Sam sn
Dearing
title
Intern
mail
employeeID
007
telephone
LDAP
givenName
Sammy sn
Dearling
title
mail
employeeID
008
telephone

10. Identity Synchronization and Consistency Identity consistency across multiple directories
Attribute Ownership
FirstName
LastName
EmployeeID
Title
Telephone HR
System
FIM
givenName
Samantha sn
Dearing
title
mail
employeeID
007
telephone
givenName
Samantha
Samantha
Bob
Samantha sn
Dearing
Dearing
Dearing
SQL Server DB
title
Coordinator
Coordinator
Coordinator
Coordinator
givenName
Samara
mail sn
Darling
employeeID
007
title
Coordinator
telephone
mail
Incorrect or Missing
Information
employeeID
007
telephone
Identity
Data
Brokering
(Convergence)
Active
Directory /
Exchange
givenName
Sam sn
Dearing
title
Intern
mail
employeeID
007
telephone
LDAP
givenName
Sammy sn
Dearling
title
mail
employeeID
007
telephone

11. Evolution of Identity Manager
User
Management
Group
Management
Common Platform
Workflow
Connectors
Logging
Web Service API
Synchronization
Credential
Management
Policy
Management
Identity Synchronization
User Provisioning
Certificate and Smartcard Management
Office Integration for Self-Service
Support for 3rd Party CAs
Declarative Provisioning
Group & DL Management
Workflow and Policy 11

12. Key Pillars of Forefront Identity Manager
Policy Management
SharePoint-based console for policy authoring, enforcement & auditing
Extensible WS– * APIs and Windows Workflow Foundation workflows
Heterogeneous identity synchronization and consistency
Credential Management
Heterogeneous certificate management with 3rd party CAs
Management of multiple credential types
Self-service password reset integrated with Windows logon
User Management
Integrated provisioning of identities, credentials, and resources
Automated, codeless user provisioning and de-provisioning
Self-service profile management
Group Management
Rich Office-based self-service group management tools
Offline approvals through Office
Automated group and distribution list updates

13. FIM 2010 Architecture

14. User Demo

15. SharePoint-Based Management Console
Group Management
Self-service group and distribution list management with the FIM Web portal
Office integration allows users to manage group membership from within Microsoft Office Outlook® for maximum productivity
Automatically add users to either group based on their employee type at the time they are provisioned to Active Directory
Group and distribution list management, including dynamic membership calculation in these groups and distribution lists based on user’s attributes
FIM Add-in for Outlook
SharePoint-Based Management Console

16. Group Management Purpose: Membership: Scope: Distribution Security
Manual (Owners adding/removing members or users requesting membership subject to Approval Policy)
Manager
Criteria-Based
Scope:
Universal
Global
Domain Local

17. Group Management Demo

18. Identity Stores and Management Agents
Type of System
Management Agents
Network operating systems and directory services
Active Directory Domain Services 2000, 2003, 2003 R2, 2008, 2008 R2
Active Directory Lightweight Directory Services (ADLDS) – 2000, 2003, 2003 R2, 2008, 2008 R2 
Active Directory Global Address List (GAL) – Exchange 2000, 2003, 2007, 2010
IBM Tivoli Directory Server up to version 6.2 Novell eDirectory - v8.7.3, v8.8
Sun ONE and Netscape Directory Servers - v5.1, v5.2
IBM Directory Server - v6.0, v6.2
Certificate and Smart Card Management
FIM Certificate Management
and messaging
Exchange Server 2007 and 2010 (use AD Management Agent) Lotus Notes - v6.5, v7.0 (32 bit Lotus Notes Client)
Databases
Microsoft SQL Server 2000, 2005, IBM DB2 Universal Database 9.1 and 9.5 (64-bit client v9.5 FP5 or v9.7 FP1 required) Oracle Database - 10g (64-bit client)
File-based
Attribute value Pairs CSV Delimited Fixed Width Directory Services Markup Language (DSML) 2.0 LDAP Interchange Format (LDIF)
1 These file formats allow for integration with a variety of applications, databases, telephone switches, X.500 systems, Mainframe and metadirectory products or underlying systems that can produce a file for importa and export..
Other
SAP - R/3 Enterprise (4.7), mySAP 2004 (ECC 5.0) (32bit client)
XML-based systems
Extensible Management Agent for custom connectivity other systems

19. Certificate and Smart card management
Increase access security beyond username and password solutions
Streamline deployment by enrolling user and computer certificates without user intervention
Simplify certificate and SmartCard management using Forefront Identity Manager (FIM)
Enhance remote access security through certificates with Network Access Protection
Stronger authentication through certificates for administrative access and management
End User
SmartCard
User is validated using multi- factor authentication
FIM policy triggers request for FIM CM to issue certificate or SmartCard
Certificate is issued to user and written to either machine or smart card
User ID and Password
Multi-Factor Authentication
SmartCard
End User
HR System
FIM
FIM CM
FIM Certificate Management (CM) requests certificate creation from AD CS
User Enrollment and Authentication request sent by HR System
Active Directory Certificate Services (AD CS)

20. Its all about trust Authentication Digital Signature Encryption
“I am the employee you know as Mary”
Digital Signature
“This content hasn’t changed since I signed it”
Encryption
“No one but Mary can see this content”

21. FIM 2010 CM Functionality
Single administration point for smart cards & digital certificates
User self-service capabilities to help reduce helpdesk burden
Configurable policy-based workflows for common tasks
Enroll / renew / update
Personalize smart card
Recover / smart card replacement
Issue temporary / duplicate smart card
Revoke / retire / disable smart card
Detailed auditing and reporting capabilities
Support for centralized, decentralized and self-service scenarios
Extensibility to support additional authentication technologies including one time password (OTP) devices, physical access cards & biometrics
Tightly integrated with Active Directory and Certificate Services

22. FIM 2010 + FIM 2010 CM Approval workflows Card created & printed
AuthN & AuthZ
Workflows
Delegation & Permissions
Action
Workflow
Service DB
Sync DB
Management Agents
New user added in HR app
Does user have permission to add user to FIM ?
FIM manages manager and dept head approvals
Once approved, changes committed to ILM app store
FIM sends welcome and confirmation s
Identity Stores
FIM syncs to external identity stores
Sync receives
request
Approval workflows
Card created & printed
Certificates requested
Self-service notification and One Time Password sent to end user
End user downloads certificates onto smart card
FIM CM

23. Microsoft Solution Components
Workflows, Profiles for Smart Card Deployment and Management
Certificate Authority
Issue, Renew, Revoke Certs
Active Directory
Certificate Templates
Policy
Revocation info:
Certificate Revocation List
Online Responder
Certs Revoked?
Auto-publish and
Auto- Enroll
Revocation Check
Smartcard Personalization
Client PC
Enrollment
Renewal
Legend
FIM CM client / web kiosk
Self-service smart card management
Forefront Identity Manager
Windows Server
AD Certificate Services
AD Domain Services

24. FIM 2010 CM Architecture FIM - CM Server Physical Architecture
Microsoft CA’s
End User
Physical Architecture
SQL AD
FIM-CM Policy Module
FIM-CM Exit Module
Internet Explorer
FIM-CM Browser Control
FIM-CM AD Integration
FIM-CM Web App
Internet Information Server
Component Architecture
Microsoft Certificate Authority
Smart Card Middleware

25. CLM Demo

26. Technical Deployment Opportunities
FIM is very extensible
Infrastructure footprint can start small and scale up
FIM Sync is Agentless
Amount of custom development required minimized and is well encapsulated to empower administrators
No need to learn a new programming language use C# or VB.NET

27. Additional Technical information
More information
TechCenter on TechNet
Product Page
TechNet Forum
Additional Technical information