Table Of ContentMicrosoft Forefront Identity
Manager 2010 R2 Handbook
A complete handbook on FIM 2010 R2 covering both
Identity and Certificate Management
Kent Nordström
professional expertise distilled
P U B L I S H I N G
BIRMINGHAM - MUMBAI
Microsoft Forefront Identity Manager 2010 R2
Handbook
Copyright © 2012 Packt Publishing
All rights reserved. No part of this book may be reproduced, stored in a retrieval
system, or transmitted in any form or by any means, without the prior written
permission of the publisher, except in the case of brief quotations embedded in
critical articles or reviews.
Every effort has been made in the preparation of this book to ensure the accuracy
of the information presented. However, the information contained in this book is
sold without warranty, either express or implied. Neither the author, nor Packt
Publishing, and its dealers and distributors will be held liable for any damages
caused or alleged to be caused directly or indirectly by this book.
Packt Publishing has endeavored to provide trademark information about all of the
companies and products mentioned in this book by the appropriate use of capitals.
However, Packt Publishing cannot guarantee the accuracy of this information.
First published: August 2012
Production Reference: 1170812
Published by Packt Publishing Ltd.
Livery Place
35 Livery Street
Birmingham B3 2PB, UK.
ISBN 978-1-849685-36-8
www.packtpub.com
Cover Image by Priyal Bhiwandkar ([email protected])
Credits
Author Project Coordinator
Kent Nordström Sai Gamare
Reviewers Proofreader
Peter Geelen Aaron Nash
Henrik Nilsson
Indexer
Tejal Daruwale
Acquisition Editor
Dhwani Devater
Graphics
Manu Joseph
Lead Technical Editor
Pramila Balan Valentina D'Silva
Technical Editors Production Coordinator
Veronica Fernandes Arvindkumar Gupta
Merin Jose
Naheed Shaikh Cover Work
Arvindkumar Gupta
Copy Editors
Brandt D'Mello
Insiya Morbiwala
About the Author
Kent Nordström wrote his first lines of code in the late 70s, so he's been working
with IT for quite some time now. When Microsoft released its Windows 2000 operating
system, he started a close relationship with them, which has continued ever since.
For many years now, Kent has been working part-time as a Sub-contractor to
Microsoft Consulting Services, and has been doing many of the implementations
of FIM and its predecessors for multinational companies and large organizations
in Sweden. Apart from FIM, Kent is also well known within the community for
his knowledge about Forefront TMG, Forefront UAG, and PKI. Find out more by
visiting his blog at http://konab.com.
I would like to thank my family for their patience during the many
evenings and weekends I have spent writing this book.
I would also like to thank Peter Geelen and Henrik Nilsson for
taking the time to review my writing. Your feedback has been
invaluable!
About the Reviewers
Peter Geelen is CISSP, CISA, MCT (Microsoft Certified Trainer), MCSE:Security,
and MCSA:Security, ITIL & PRINCE2 foundation certified.
Peter has been working with ICT since 1997, with a solid base on the Microsoft
Windows server platform, running IT and network projects with MS server
management and network support, advanced troubleshooting, presales, and
enterprise architecture.
Since 2005, he has also been working as a consultant in Security, Identity, and
Access Management, delivering Microsoft product support for server and enterprise
platforms, such as Windows server, SQL Server, Directory Services, MS Identity
Integration Server, MS Identity Lifecycle Manager, Forefront Identity Manager 2010,
Omada Identity Manager, PKI, TMG, IAG/UAG, ADFS, and other IDM systems; and
single sign-on and security solutions, including Sentillion expreSSO and Vergence
product suite, Identity Forge solutions, and BHOLD.
Peter is co-founder of Winsec.be, the Belgian Microsoft Security User Group
(http://www.winsec.be). He has been awarded the MVP award for Identity
Lifecycle Manager (now MVP Forefront Identity Manager) four times, since 2008.
He is currently working as a Premier Field Engineer, FIM and Security, at Microsoft.
Peter blogs at http://blog.identityunderground.be. You may also catch him on
LinkedIn, at http://be.linkedin.com/in/pgeelen.
Peter has also reviewed FIM Best Practices Volume 1: Introduction, Architecture And
Installation Of Forefront Identity Manager 2010, by David Lundell
(http://www.lulu.com/shop/david-lundell/fim-best-practices-volume-
1-introduction-architecture-and-installation-of-forefront-identity-
manager-2010/ebook/product-18334749.html).
Henrik Nilsson has been working with Forefront Identity Manager and its
predecessors since 2006. Before that he had been working in the IT industry since
1997, mainly as a developer of Microsoft products. In 2010, Henrik was awarded
the Microsoft Most Valuable Award for spreading his knowledge about FIM in
the community.
Henrik works at Cortego as a consultant within the IDA area using Microsoft
products. Cortego is a Swedish consulting company working explicitly with Identity
and Access Management.
I wish to thank my girlfriend Amanda, who coped with me not only
while I was reviewing this book, but also during the times that I
spent on the Identity and Access Management topic, which not only
is my job but also my main interest.
www.PacktPub.com
Support files, eBooks, discount offers and more
You might want to visit www.PacktPub.com for support files and downloads related to
your book.
Did you know that Packt offers eBook versions of every book published, with PDF and ePub
files available? You can upgrade to the eBook version at www.PacktPub.com and as a print
book customer, you are entitled to a discount on the eBook copy. Get in touch with us at
[email protected] for more details.
At www.PacktPub.com, you can also read a collection of free technical articles, sign up for a
range of free newsletters and receive exclusive discounts and offers on Packt books and eBooks.
http://PacktLib.PacktPub.com
Do you need instant solutions to your IT questions? PacktLib is Packt's online digital book
library. Here, you can access, read and search across Packt's entire library of books.
Why Subscribe?
• Fully searchable across every book published by Packt
• Copy and paste, print and bookmark content
• On demand and accessible via web browser
Free Access for Packt account holders
If you have an account with Packt at www.PacktPub.com, you can use this to access
PacktLib today and view nine entirely free books. Simply use your login credentials for
immediate access.
Instant Updates on New Packt Books
Get notified! Find out when new books are published by following @PacktEnterprise on
Twitter, or the Packt Enterprise Facebook page.
Table of Contents
Preface 1
Chapter 1: The Story in this Book 7
The Company 7
The challenges 8
Provisioning of users 8
Identity lifecycle procedures 8
Highly Privileged Accounts (HPA) 8
Password management 9
Traceability 9
The solutions 9
Implement FIM 2010 R2 9
Start using smart cards 10
Implement federation 10
The environment 11
Moving forward 12
Summary 13
Chapter 2: Overview of FIM 2010 R2 15
The history of FIM 2010 R2 16
FIM Synchronization Service (FIM Sync) 17
Management Agents 19
Non-declarative vs. declarative synchronization 20
Password synchronization 20
FIM Service Management Agent 21
FIM Service 21
Request pipeline 22
FIM Service Management Agent 23
Management Policy Rules (MPRs) 23
