GOPAS
TECHED 2012
Ing. Ondřej Ševeček | GOPAS a.s. |
MCM: Directory Services | MVP: Enterprise Security |
ondrej@sevecek.com | www.sevecek.com |
FOREFRONT IDENTITY MANAGER
2010
Forefront Identity Manager 2010
OVERVIEW
Forefront Identity Manager
 Identity Management
 syncing AD/LDS/SQL/etc. database contents
 indentity centered
 Automatic group management
 attribute values
 manager
 user self service
 Web portal user/group management
 SharePoint based
 Self service password reset
 web based and GUI extension
Identity?
 User
 Group
 table, cabinet, pc, car, ...
History
 Identity Integration Server 2003 (MIIS 2003)
 Identity Lifecycle Manager 2007 (ILM 2007)
 MIIS 2003 + CLM 2007
 Forefront Identity Manager 2010 (FIM 2010)
 Forefront Idnetity Manager 2010 R2
Price?
 5000 USD per CPU socket
 80 USD per managed identity
Forefront Identity Manager
 FIM Synchronization service
 syncing AD/LDS/SQL/etc. database contents
 indentity centered
 FIM Service
 attribute values
 manager
 user self service
 FIM Portal
 SharePoint based
 Self service password registration and reset
 web based and GUI extension
Forefront Identity Manager 2010
COMPONENT DETAILS
FIM Synchronization
AD
AD
AD MA
AD
LDS
ADLDS MA
SQL MA
SQL
DB
AD MA
FIM Sync
DB MA
Metaverse
FIM Service and Portal Idea
AD
AD
LDS
AD MA
FIM Sync
ADLDS MA
Metaverse
SQL MA
SQL
FIM
Service
SharePoint
Portal
FIM Service Management
FIM
Service
AD
FIM SVC DB
AD
LDS
AD MA
FIM Sync
FIM MA
ADLDS MA
Metaverse
SQL MA
SQL
FIM Portal
FIM
Service
AD
FIM SVC DB
AD
LDS
AD MA
FIM Sync
FIM MA
ADLDS MA
Metaverse
SQL MA
SQL
SharePoint
Portal
Forefront Identity Manager 2010
FIM SERVICE AND PORTAL
MANAGEMENT SCENARIOS
AD Object Management
 Manual group membership
 scripting
 Permission based delegation
 OU hierarchy
 using “static” groups
 no attribute validation
AD Object Management Example
 Prague managers can reset passwords for
OU=Prague
 Sales manager can change department to all
users in OU=Sales and OU=Marketing
 Sales manager can change group
membership of Sales IS group
 Users cannot reset their own passwords
anonymously
FIM Management
 Dynamic group membership
 attribute query based
 manager based
 Policy based delegation
 group membership
 attribute value based
 attribute validation
FIM Management Examples
 Sales manager can change department to all
users in OU=Sales and OU=Marketing
 but only from Marketing to Sales
 Users can reset their own passwords
anonymously
 after providing answers to several questions
FIM Management Examples
 CZ Users can change their own telephone
 but the format must be +420...
 CZ Users can change their own city
 but the result must still be CZ User
 School director can change department of his
students
 but the students must remain in the same school
 Sales manager can change group members of
Sales IS group
 but can add only his own users
FIM Management Examples
 We have Sales Management group which
contains several sales managers
 Every sales user is assigned one of the sales
managers
 We can create a group that would contain all
Sales people
 group whos members are those people, whos
manager is member of the Sales Management
group
GOPAS
TECHED 2012
Ing. Ondřej Ševeček | GOPAS a.s. |
MCM: Directory Services | MVP: Enterprise Security |
ondrej@sevecek.com | www.sevecek.com |
THANK YOU!