Ing. Ondřej Ševeček | GOPAS a.s. | MCM: Directory Services | MVP: Enterprise Security | | |

Forefront Identity Manager 2010

Forefront Identity Manager  Identity Management  syncing AD/LDS/SQL/etc. database contents  indentity centered  Automatic group management  attribute values  manager  user self service  Web portal user/group management  SharePoint based  Self service password reset  web based and GUI extension

Identity?  User  Group  table, cabinet, pc, car,...

History  Identity Integration Server 2003 (MIIS 2003)  Identity Lifecycle Manager 2007 (ILM 2007)  MIIS CLM 2007  Forefront Identity Manager 2010 (FIM 2010)  Forefront Idnetity Manager 2010 R2

Price?  5000 USD per CPU socket  80 USD per managed identity

Forefront Identity Manager  FIM Synchronization service  syncing AD/LDS/SQL/etc. database contents  indentity centered  FIM Service  attribute values  manager  user self service  FIM Portal  SharePoint based  Self service password registration and reset  web based and GUI extension

Forefront Identity Manager 2010

FIM Synchronization FIM Sync AD AD MA AD AD MA AD LDS SQL DB ADLDS MA SQL MADB MA Metaverse

FIM Service and Portal Idea FIM Sync AD AD MA AD LDS SQL ADLDS MA SQL MA Metaverse FIM Service SharePoint Portal

FIM Service Management FIM Sync FIM SVC DB FIM MA AD AD MA AD LDS SQL ADLDS MA SQL MA Metaverse FIM Service

FIM Portal FIM Sync FIM SVC DB FIM MA AD AD MA AD LDS SQL ADLDS MA SQL MA Metaverse FIM Service SharePoint Portal

Forefront Identity Manager 2010

AD Object Management  Manual group membership  scripting  Permission based delegation  OU hierarchy  using “static” groups  no attribute validation

AD Object Management Example  Prague managers can reset passwords for OU=Prague  Sales manager can change department to all users in OU=Sales and OU=Marketing  Sales manager can change group membership of Sales IS group  Users cannot reset their own passwords anonymously

FIM Management  Dynamic group membership  attribute query based  manager based  Policy based delegation  group membership  attribute value based  attribute validation

FIM Management Examples  Sales manager can change department to all users in OU=Sales and OU=Marketing  but only from Marketing to Sales  Users can reset their own passwords anonymously  after providing answers to several questions

FIM Management Examples  CZ Users can change their own telephone  but the format must be  CZ Users can change their own city  but the result must still be CZ User  School director can change department of his students  but the students must remain in the same school  Sales manager can change group members of Sales IS group  but can add only his own users

FIM Management Examples  We have Sales Management group which contains several sales managers  Every sales user is assigned one of the sales managers  We can create a group that would contain all Sales people  group whos members are those people, whos manager is member of the Sales Management group

Ing. Ondřej Ševeček | GOPAS a.s. | MCM: Directory Services | MVP: Enterprise Security | | |