What's cooking

April 23, 2009 at 7:06 PMHenrik Nilsson

I've just attended a great webinar performed by Joe Zamora at Ensynch and the last question he got was what they were planning to release next but he was a little bit secret about it.

I thought I could tell you that I'm currently working on a big secret thing (it will be released to the public) but except for that I will add support for finding unique names against the ILM DB, and I miss functionality for handling multi-value attributes among the functions so there is going to be a split multi-value activity in order to get a single value from a multi value and there will be a update multi-value function, I'm not sure if the last one will be a stand alone activity yet it could as well be a part of the update value activity.

Edit: ...obviously everything will be released to public when ready for it!

Posted in: Workflow | Forefront Identity Manager

Tags: , , ,

Cortego ILM 2 Workflow Activity Library

April 8, 2009 at 4:19 PMHenrik Nilsson

After a lot of work I’m confident these workflow activities work pretty satisfying therefore I’ve decided to release them to the public but without any guarantees. I wish to send my thanks to Brad Turner and the others at Ensynch that made the great walkthrough in making custom ILM2 activities - http://www.codeplex.com/ILM2WFActivity and to Mark Gabarra that made a video on the subject before he left Microsoft (sad!) - display-name-generation-activity-a-custom-ilm2-action-activity.

The Expression and Destination fields are common for almost all activities except the password generator activity that only have a destination and the Unique name activity that takes more than one expression that are evaluated one at a time. The expression field can take more than one input value and even string values so for example “[//Target/LastName], [//Target/FirstName]” is ok. The destination field only takes a single output of either the “[//WorkflowData/…]” or “[//Target/…]” types.

Update Value Activity

This is the simplest activity in the library, it takes any input and writes it to either the WorkflowDictionary - [//WorkflowData/…] or to a target attribute – [//Target/…]. The main usage for this activity is to write a value created by the Function activity that in RC0 only have the workflow dictionary as working destination.


Activity information configuration

Display Name Cortego Update Value Activity
Description Updates a Target value from an Expression
Activity Name Cortego.ILM.Workflow.Activities.UpdateValueActivity
Assembly Name Cortego.ILM.Workflow.Activities, Version=, Culture=neutral, PublicKeyToken=b88d7150cfc8f36b
Authentication, Action, Authorization Your choice.
Type Name Cortego.ILM.Workflow.Activities.UpdateValueActivitySettingsPart

Normalize Diacritic Characters Activity

This activity is almost the same as the Update Value Activity except it normalizes diacritic characters, for example ÄÖÅÜčȭ becomes AOAUco and this very useful for writing email addresses that can’t contain diacritics. Read more about diacritic characters at http://en.wikipedia.org/wiki/Diacritic.


Activity information configuration

Display Name Cortego Normalize Diacritic Characters Activity
Description Normalizes Diacritic Characters like ÅÄÖ to AAO.
Activity Name Cortego.ILM.Workflow.Activities.NormalizeDiacriticCharactersActivity
Assembly Name Cortego.ILM.Workflow.Activities, Version=, Culture=neutral, PublicKeyToken=b88d7150cfc8f36b
Authentication, Action, Authorization Your choice.
Type Name Cortego.ILM.Workflow.Activities.NormalizeDiacriticCharactersActivitySettingsPart

Regex Replace Activity

This is almost the same as the Update Value Activity as well except it takes a Regular Expression Pattern and an optional replacement value that could be used for removing or replacing invalid characters from attribute values. A good example of this is the Active Directory sAMAccountName attribute that doesn’t support /\[]:;|=,+*?<>@ the regular expression for this would be… “[/:;\|=,\+\*\?<>@\[\]\\]”. If you’re not familiar with Regular Expressions, have a look at http://msdn.microsoft.com/en-us/library/hs600312(VS.71).aspx. The replacement value is used if you wish to replace characters with something else but just leave it empty for removing characters.


Activity information configuration

Display Name Cortego Regex Replace Activity
Description Uses a Regular Expression to do string replacements.
Activity Name Cortego.ILM.Workflow.Activities.RegexReplaceActivity
Assembly Name Cortego.ILM.Workflow.Activities, Version=, Culture=neutral, PublicKeyToken=b88d7150cfc8f36b
Authentication, Action, Authorization Your choice.
Type Name Cortego.ILM.Workflow.Activities.RegexReplaceActivitySettingsPart

Generate Password Activity

This activity generates a strong password with at least one character from each category, upper case characters (A-Z), lower case characters (a-z), numeric characters (0-9) and special characters (!#%&/()=?-:;><@$,._*). It’s recommended that password values are written to a custom target attribute (hidden from UI) instead of directly with an outbound sync rule since the password in that case will end up fully readable in the Expected Rules Entry. Remember that passwords generated with this activity is hard to remember and only suitable as temporary passwords before the users can set it’s own, we don’t want to end up with passwords on paper notes under the keyboard.


Activity information configuration

Display Name Cortego Password Generator Activity
Description Generates strong passwords.
Activity Name Cortego.ILM.Workflow.Activities.PasswordGeneratorActivity
Assembly Name Cortego.ILM.Workflow.Activities, Version=, Culture=neutral, PublicKeyToken=b88d7150cfc8f36b
Authentication, Action, Authorization Your choice.
Type Name Cortego.ILM.Workflow.Activities.PasswordGeneratorActivitySettingsPart

Unique Name Activity

This is the most advanced activity in the library, it works almost the same as the Update Value Activity but there are two main differences, it takes any number of input expressions and the expressions are evaluated against an LDAP catalog from top to bottom and as soon as a unique value is found it’s written to the destination. It currently doesn’t support LDAPS and it has only been tested against Active Directory.


Activity information configuration

Display Name Cortego Unique Name Activity
Description Generates or takes value before it’s checked for uniqueness against LDAP catalog.
Activity Name Cortego.ILM.Workflow.Activities.UniqueNameActivity
Assembly Name Cortego.ILM.Workflow.Activities, Version=, Culture=neutral, PublicKeyToken=b88d7150cfc8f36b
Authentication, Action, Authorization Your choice.
Type Name Cortego.ILM.Workflow.Activities.UniqueNameActivitySettingsPart

As you can see from my previous blog post I’ve removed the normalize diacritics and regex remove functionality and put those functions as separate activities and it’s easy to chain activities, just write your output value (destination) from any activity including the Function activity that comes with ILM2 to the workflow dictionary and use that value as input (expression) value in the next activity.

LDAP Search Activity

This activity doesn’t have any user interface so it can’t be used directly within ILM2 but it’s included in the Unique Name activity. The reason I’ve chosen not to add a UI for it is because it returns a nested dictionary (Dictionary<string, Dictionary<string, object>>) that could be hard to use from other activities but you could of course use it in your own custom activities or workflows.

Summing up

You may freely use the activities and the code in any way but if you use the code without major changes I want you to keep the comment in top of each code file that references my blog and my company. It would also be nice if you could give me some feedback, report any problems and tell me about other cool features that could be useful within the library. Please drop a message if you wish be noticed when changes or additions are made to the library and I already have an interesting activity that will show up within the library soon.

In order to use the code you’ll have to strong name the assembly using your own key before putting it into the GAC and if you aren’t sure how to do that and how to deploy, have a look at the very good document Brad Turner and the other guys at Ensynch published, see link in the beginning of this post.

Download Cortego ILM2 Workflow Activity Library Here

Posted in: Forefront Identity Manager | Workflow

Tags: , , , , ,

ILM2 Unique Name Workflow Activity

March 31, 2009 at 2:29 PMHenrik Nilsson

I’m currently working with ILM2 for a customer and realized there was no way to ensure usernames are unique except by writing a custom workflow activity, my first except for the LDAP search activity that resides in the same library and is used by the unique name activity. It has been a struggle to complete this because of enormous problems with the Workflow Designer in VS2008 so I decided to go ahead write a code only activity. It turns out the problem with an evil MessageBox within the designer that showed up until I killed the VS2008 task was because I had set the DesignerSerializationVisibility attribute to DesignerSerializationVisibility.Content instead of DesignerSerializationVisibility.Visible.

Writing an activity for ILM2 isn’t rocket science, you first decide what information it needs and create Dependency properties and bind these to usual properties, you create a web UI with whatever logic it needs and finally you write the activity that does the work.

This is how it looks…


So what is is good for then…
Looking at the picture you see that it first take an ILM Target attribute, this is for example “AccountName” and this is where the first found unique value will be written.

The Expression Evaluator makes it possible to a number of different values to be evaluated from top to bottom, if the first attribute value shows up to already be existing in the target LDAP catalog the next one is tested for. After a little peeking inside the ILM2 assemblies I managed to find out how to add the lookup button that when pressed shows up this familiar dialog…


The control is named ProcessParameterPicker and could easily be added to your activity UI by calling base.DesignerHostProvider.CreateParameterPickerControl() and then give it a TextBox object to write to.

The Remove Characters checkbox and the Remove Characters Regex Textbox allows you to remove special characters that might sneak into the source values, for example the sAMAccountName attribute doesn’t allow characters like /\@+*? and so on. Just check the checkbox and add a regular expression for finding the invalid characters and they are trimmed away before the evaluation is made.
The sAMAccountName attribute is also a little bit picky about the length that can’t exceed 20 characters but how to sort that out is up to you.

The Normalize Diacritics checkbox is especially useful in countries like Sweden where I live and where non ASCII characters like ÅÄÖ needs to be normalized before used in for example email addresses.

Then there are a bunch of LDAP attributes that are used to make up the search for the attribute value within a catalog…

  • LDAP Search Root – Where in the catalog you wish to begin you search.
  • LDAP Object Class – If you wish to filter your search to a special object type (currently only supports a single object class).
  • LDAP Target Attribute – The attribute you wish to check for uniqueness.
  • LDAP Server – Self explaining.
  • LDAP Server Port – Self explaining, 389 by default and currently there is no support for LDAPS.
  • LDAP User Name – Self explaining.
  • LDAP Password – Self explaining.
  • Last but not least a button that enables you to try LDAP connectivity.

I’ll publish the library with source code as soon as I been able to test it more but if you would like to help me test it out send me a mail from the contact page and I’ll send it to you.

Posted in: Forefront Identity Manager | Identity Management | Workflow

Tags: , , ,