1. Introduction to Identity Management with MIIS 2003 Steve Plank Architectural Engineer Session code

2. Agenda MIIS Scenarios How MIIS works MIIS Futures

3. Hire Scenario HRSystem MIIS Notes ContractorSystem AD App Mode SQLServer iPlanetDirectory ActiveDirectory LotusNotes File LDAP SQL LDAP

4. Fire Scenario HRSystem MIIS Notes ContractorSystem AD App Mode SQLServer iPlanetDirectory ActiveDirectory LotusNotes File LDAP SQL LDAP

5. Identity Joining Scenario HRSystem MIIS iPlanetDirectory ActiveDirectory LotusNotes givenName sn title mail employeeID telephone Klarek Cenntt 008 givenName sn title mail employeeID telephone givenName sn title mail employeeID telephone Clark Kennttt 007 givenName sn title mail employeeID telephone Klarke Kent Superhero 007 867-5309 Clark Kent 007 Reporter Clark@contoso.com 867-5309 Clark Kent Reporter Clark@contoso.com 007 Project to Metaverse givenName sn title mail employeeID telephone Clark Kent 007 Join on employeeID JOINED PROJECTED 007 Join on employeeID JOINED Join on employeeID JOINED Manual Join

6. Attribute Flow Scenario HRSystem MIIS iPlanetDirectory ActiveDirectory LotusNotes FirstName LastName EmployeeID Title E-Mail Telephone givenName sn title mail employeeID telephone Klarek Cenntt 008 givenName sn title mail employeeID telephone givenName sn title mail employeeID telephone Clark Kennttt 007 givenName sn title mail employeeID telephone Klarke Kent Superhero 007 givenName sn title mail employeeID telephone 867-5309 Clark Kent 007 Reporter Clark@contoso.com 867-5309 Clark Kent Reporter Clark@contoso.com 007 Identity Data Aggregation givenName sn title mail employeeID telephone 007 Clark Kent 007 Reporter 867-5309

7. Attribute Flow Scenario HRSystem MIIS iPlanetDirectory ActiveDirectory LotusNotes FirstName LastName EmployeeID Title E-Mail Telephone givenName sn title mail employeeID telephone Klarek Cenntt 007 givenName sn title mail employeeID telephone givenName sn title mail employeeID telephone Clark Kennttt 007 givenName sn title mail employeeID telephone Klarke Kent Superhero 007 givenName sn title mail employeeID telephone867-5309 Clark Kent 007 Reporter 867-5309 Clark Kent Reporter Clark@contoso.com 007 Clark@contoso.com Clark Kent Reporter Clark@contoso.com 867-5309 Reporter Clark@contoso.com 867-5309 Clark Kent Clark@contoso.com Clark Reporter 867-5309 Identity Data Brokering (Convergence)

8. Attribute Flow Scenario HRSystem MIIS iPlanetDirectory ActiveDirectory LotusNotes FirstName LastName EmployeeID Title E-Mail Telephone givenName sn title mail employeeID telephone 007 givenName sn title mail employeeID telephone givenName sn title mail employeeID telephone Clark 007 givenName sn title mail employeeID telephone Kent 007 givenName sn title mail employeeID telephone867-5309 Clark Kent 007 867-5309 Clark Kent Reporter Clark@contoso.com 007 Clark@contoso.com Kent Reporter 867-5309 Reporter Clark@contoso.com 867-5309 Clark Kent Clark@contoso.com Clark Reporter 867-5309 Identity Data Integrity Enforcement 007 Superhero ReporterSuperhero

9. Identity Data Integrity Enforcement HRSystem MIIS iPlanetDirectory LotusNotes ActiveDirectory FirstName LastName EmployeeID Title E-Mail Telephone givenName sn title mail employeeID telephone 007 givenName sn title mail employeeID telephone givenName sn title mail employeeID telephone Clark 007 givenName sn title mail employeeID telephone Kent 007 givenName sn title mail employeeID telephone867-5309 Clark Kent 007 867-5309 Clark Kent Reporter Clark@contoso.com 007 Clark@contoso.com Kent Publisher 867-5309 Publisher Clark@contoso.com 867-5309 Clark Kent Clark@contoso.com Clark Reporter 867-5309 Identity Data Integrity Enforcement 007 Reporter SuperheroReporter

10. MIIS in action… Demo

11. Agenda MIIS Scenarios How MIIS works MIIS Futures

12. ConnectorSpace Management Agent (MA) ConnectedDirectories Terminology Metaverse i/f“filters”schemafiltersrules i/f“filters”schemafiltersrules i/f“filters”schemafiltersrules StagingProjectionProvisioningExportJoin Import/Export Run ProfileSync Run Profile

13. ConnectorSpace Management Agent (MA) ConnectedDirectories Terminology Metaverse i/f“filters”schema i/f“filters”schemafiltersrules i/f“filters”schema Rules Extension Import Attribute FlowExport Attribute Flow filtersrules filtersrules

14. MIIS – Metadirectory Functionality and Connectivity Identity Data LDAPSQL Wide range of connectivity Active Directory & ADAM Sun/iPlanet Directory IBM DS Novell eDirectory Microsoft SQL 2000 & SQL 7 Oracle 9i/8i IBM DB2 Lotus Notes 5.x/6.x Microsoft Exchange 5.5, 2K, 2K3 Microsoft NT 4.x RACF DSML, LDIF, CSV, fixed width …others to follow MA SDK allows ISVs and corporate developers to build custom MAs NOS LOB Apps

15. Synchronizing Identity Stores - The Management Agent SDK Easy to use SDK to build Management Agents.Net hosted set of interfaces Address IT Pro and ISV audiences IT Pro Fast MA development using template Simple to configure by reusing “Extensible MA UI” ISVs Allow customizing MA configuration UI and provide customized look and feel Enable packaging and redistribution of management agents Enable Identity Manager-integrated development of MA configuration UI Supports password synchronization

16. Password Synchronization: Password Change Notification Password Filter The password filter is extremely lightweight to minimize any impact on the DC Filter receives the change notifications and securely communicates passwords to the service Password Notification Service Service encrypts and queues the password notification to be delivered to the registered targets (MIIS or HIS) Notifications are transmitted via secure RPC to target Queuing and retry mechanism guards against lost passwords due to connectivity issues PCNS and MIIS mutually authenticate to prevent spoofing Active Directory Domain Controller LSA Process Password Filter Password Notification Service Identity Integration Server

17. Password Synchronization: Identity Integration Server MIIS receives notifications from PCNS and locates matching object for user’s Active Directory account MIIS leverages metadirectory “join” relationship to locate correct accounts in the target systems MIIS maintains queue for each target system to optimize delivery and handle systems that are less reliable Passwords can be synchronized to any system managed by MIIS management agents. Password Extensions allow synchronizing passwords to custom applications and directories Identity Integration Server PCNS Connected Directories Connector Space Queue Metaverse

18. Visualization Different hierarchies suit different needs Multiple hierarchical representations can be discovered from data Polyarchy eliminates the requirement for fixed hierarchy Polyarchy provides multiple hierarchical views and richer visualization of infrastructure information

19. MIIS Scenarios How MIIS works MIIS Futures Agenda

20. MIIS Roadmap Lowering the cost and risks of Identity Management Extending MA Reach and password capabilities MIIS - Gemini MIIS 2003 SP1 Q4/CY04 Codeless provisioning Entitlement reporting Self-service platform Password reset additional MAs Additional MAs MA SDK Password Extensions Password synchronization from Windows desktop Providing tools for provisioning MIIS 2003 SP1 ResKit - Q4/CY04 Code generator Workflow

21. 1. Codeless provisioning 2. Richer logging/auditing 3. Self-service platform 4. Workflow for provisioning and self-service 5. Password self-service reset 6. Cluster support 7. Computed attributes (dynamic groups) 8. Cross-forest group management 9. Entitlement reporting 10. Capacity planning documentation 11. Scalability improvements 12. UNIX / OpenLDAP / Generic LDAP MA

22. Review MIIS Scenarios How MIIS works MIIS Futures