Nordström Kent - Microsoft Forefront Identity Manager 2010 R2 Handbook

Microsoft Forefront Identity Manager 2010 R2 Handbook

---

Microsoft Forefront Identity Manager 2010 R2 Handbook

Copyright 2012 Packt PublishingAll rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book.Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.First published: August 2012Production Reference: 1170812Published by Packt Publishing Ltd.Livery Place35 Livery StreetBirmingham B3 2PB, UK.ISBN 978-1-849685-36-8www.packtpub.comCover Image by Priyal Bhiwandkar ( < > )

Credits

Author Kent Nordstrm Reviewers Peter GeelenHenrik Nilsson Acquisition Editor Dhwani Devater Lead Technical Editor Pramila Balan Technical Editors Veronica FernandesMerin JoseNaheed Shaikh Copy Editors Brandt D'MelloInsiya Morbiwala Project Coordinator Sai Gamare Proofreader Aaron Nash Indexer Tejal Daruwale Graphics Manu JosephValentina D'Silva Production Coordinator Arvindkumar Gupta Cover Work Arvindkumar Gupta

About the Author

Kent Nordstrm wrote his first lines of code in the late 70s, so he's been working with IT for quite some time now. When Microsoft released its Windows 2000 operating system, he started a close relationship with them, which has continued ever since.For many years now, Kent has been working part-time as a Sub-contractor to Microsoft Consulting Services, and has been doing many of the implementations of FIM and its predecessors for multinational companies and large organizations in Sweden. Apart from FIM, Kent is also well known within the community for his knowledge about Forefront TMG, Forefront UAG, and PKI. Find out more by visiting his blog at http://konab.com.I would like to thank my family for their patience during the many evenings and weekends I have spent writing this book.I would also like to thank Peter Geelen and Henrik Nilsson for taking the time to review my writing. Your feedback has been invaluable!

About the Reviewers

Peter Geelen is CISSP, CISA, MCT (Microsoft Certified Trainer), MCSE:Security, and MCSA:Security, ITIL & PRINCE2 foundation certified.Peter has been working with ICT since 1997, with a solid base on the Microsoft Windows server platform, running IT and network projects with MS server management and network support, advanced troubleshooting, presales, and enterprise architecture.Since 2005, he has also been working as a consultant in Security, Identity, and Access Management, delivering Microsoft product support for server and enterprise platforms, such as Windows server, SQL Server, Directory Services, MS Identity Integration Server, MS Identity Lifecycle Manager, Forefront Identity Manager 2010, Omada Identity Manager, PKI, TMG, IAG/UAG, ADFS, and other IDM systems; and single sign-on and security solutions, including Sentillion expreSSO and Vergence product suite, Identity Forge solutions, and BHOLD.Peter is co-founder of Winsec.be, the Belgian Microsoft Security User Group (http://www.winsec.be). He has been awarded the MVP award for Identity Lifecycle Manager (now MVP Forefront Identity Manager) four times, since 2008.He is currently working as a Premier Field Engineer, FIM and Security, at Microsoft. Peter blogs at http://blog.identityunderground.be. You may also catch him on LinkedIn, at http://be.linkedin.com/in/pgeelen.Peter has also reviewed FIM Best Practices Volume 1: Introduction, Architecture And Installation Of Forefront Identity Manager 2010 , by David Lundell (http://www.lulu.com/shop/david-lundell/fim-best-practices-volume-1-introduction-architecture-and-installation-of-forefront-identity-manager-2010/ebook/product-18334749.html). Henrik Nilsson has been working with Forefront Identity Manager and its predecessors since 2006. Before that he had been working in the IT industry since 1997, mainly as a developer of Microsoft products. In 2010, Henrik was awarded the Microsoft Most Valuable Award for spreading his knowledge about FIM in the community.Henrik works at Cortego as a consultant within the IDA area using Microsoft products. Cortego is a Swedish consulting company working explicitly with Identity and Access Management.I wish to thank my girlfriend Amanda, who coped with me not only while I was reviewing this book, but also during the times that I spent on the Identity and Access Management topic, which not only is my job but also my main interest.

www.PacktPub.com

Support files, eBooks, discount offers and more

You might want to visit www.PacktPub.com for support files and downloads related to your book.Did you know that Packt offers eBook versions of every book published, with PDF and ePub files available? You can upgrade to the eBook version at > for more details.At www.PacktPub.com, you can also read a collection of free technical articles, sign up for a range of free newsletters and receive exclusive discounts and offers on Packt books and eBooks.

http://PacktLib.PacktPub.comDo you need instant solutions to your IT questions? PacktLib is Packt's online digital book library. Here, you can access, read and search across Packt's entire library of books.

Why Subscribe?

• Fully searchable across every book published by Packt
• Copy and paste, print and bookmark content
• On demand and accessible via web browser

Free Access for Packt account holders

If you have an account with Packt at www.PacktPub.com, you can use this to access PacktLib today and view nine entirely free books. Simply use your login credentials for immediate access.

Instant Updates on New Packt Books

Get notified! Find out when new books are published by following @PacktEnterprise on Twitter, or the Packt Enterprise Facebook page.

Preface

Microsoft's Forefront Identity Manager simplifies enterprise Identity Management for end users by automating admin tasks and integrating the infrastructure of an enterprise with strong authentication systems.The Microsoft Forefront Identity Manager 2010 R2 Handbook is an in-depth guide to Identity Management. You will learn how to manage users and groups, and implement self-service parts. This book also covers basic Certificate Management and troubleshooting.Throughout the book we will follow a fictional case study. You will see how to implement IM and also set up Smart Card logon for strong administrative accounts within Active Directory. You will learn to implement all the features of FIM 2010 R2. You will see how to install a complete FIM 2010 R2 infrastructure, including both test and production environments. You will be introduced to Self-Service management of both users and groups. FIM Reports to audit the identity management lifecycle are also discussed in detail.With the Microsoft Forefront Identity Manager 2010 R2 Handbook you will be able to implement and manage FIM 2010 R2 almost effortlessly.

What this book covers

, The Story in this Book : In this chapter, the author gives a short description of a fictive company, which he uses throughout the book as an example.He also discusses some of the Identity Management-related challenges faced by the fictive company, solutions to these challenges, and the company's IT system infrastructure., Overview of FIM 2010 R2 : In this chapter, the author gives an overview of the history of FIM 2010 R2, FIM Synchronization Service, FIM Service, FIM Portal, FIM Reporting, FIM Certificate Management, and licensing., Installation : In this chapter, we discuss the prerequisites for installing different components of FIM 2010 R2, see how to actually install the components, and look at a few post-installation steps to get it working., Basic Configuration : In this chapter, we discuss some of the basic configurations we need to look at, no matter how our environment looks or how we plan to use FIM 2010 R2. We focus on the initial configuration of FIM Synchronization Service and FIM Service, specifically topics such as creating Management Agents, schema management, FIM Service Management Agents, initial load versus scheduled runs, and moving configurations from the development to the production environment.If you have an environment already set up, this chapter can act as a guide for you to verify that you have not missed any important steps that will cause your FIM environment to not work properly., User Management : User management is the primary goal for most FIM deployments. Synchronizing user information between different Management Agents, and managing user provisioning/deprovisioning is often the first thing we focus on in our FIM deployment.In this chapter, we discuss how user management is set up in FIM Service and FIM Synchronization Service. We also discuss how to manage users in Active Directory, Microsoft Exchange, a fictive phone system, and how to enable users to do some self-service., Group Management : Once you have User Management in place, it is usually time to start looking at Group Management. In this chapter, we will look at the different group scopes and types in AD and FIM, how to manage groups using the Outlook add-in, and synchronizing groups between HR, AD, and FIM., Self-service Password Reset : In this chapter, we look at the Self-service Password Reset (SSPR) feature, which allows users to reset their own passwords if they have forgotten them.We discuss how to enable password management in AD, allow FIM Service to set a password, and configure FIM Service. We also discuss the user experience of the Self-service Password Reset feature., Using FIM to Manage Office 365 and Other Cloud Identities : In this chapter, we see how FIM 2010 R2 might fit into the puzzle of managing Office 365 identities and also how FIM might play a role in Identity Federation scenarios., Reporting : One of the new features in FIM 2010 R2 is built-in Reporting support. In this chapter, we discuss how to verify the System Center Service Manager 2010 (SCSM) setup, the default reports that are automatically installed, and the SCSM ETL process. We look at the methods to check/verify and modify reports., FIM Portal Customization : In this chapter, we take a quick look at the components of the FIM Portal UI. We discuss how to modify the basic FIM Portal UI, and how to customize search scopes and forms., Customizing Data Transformations : In this chapter, we will discuss the overall need and options for data transformation and selective deprovisioning. We also look at an example of managing Microsoft Lync, and a case with strange roles., Issuing Smart Cards : In this chapter, we will take a look at how we can use FIM CM to issue Smart Cards. You will see how FIM CM adds a lot of functionality and security to the process of managing the complete lifecycle of your Smart Cards., Troubleshooting : In this chapter, we discuss how to go about troubleshooting issues, depending on where we see the failure and the type of failure. We also see how to perform backup and restore the various parts of FIM.Next page