The Identitry Blog About and around Microsoft products Forefront Identity Manager 2010 and ADFS

Fellow FIM MVP David Lundell has written a great article about the problem of using wildcards (% and _) in FIM XPath queries (Sets, Groups, Search Scopes etc.). The problem lies in that Microsoft has made the choice to treat these wildcard characters as literals instead of wildcards meaning that installing FIM Hotfix Rollup Package 4.0.3594.0 could break your FIM implementation.

Go ahead and read Davids article:

What the %_ is the deal with wildcards in FIM Queries in the latest hotfix?

It was announced today that Microsoft acquires “certain Assets”of BHold company but the roadmap isn’t clear yet.
Unaware of all products from BHold I guess it’s BHold’s Role Management pieces Microsoft lays their hands on or at least I hope it is…

Read more here:
Microsoft’s “Pathway”
Kuppinger Cole’ announcement

I wonder what this means for Omada? Or as Ian Glazer(Gartner) says:
If you get acquired by Microsoft (or Quest), you win! If you don’t get acquired, you lose and the risk to your market increases.  BHOLD wins the Microsoft IAG lottery

Hurry up if you wish to take it, it’s been made available today and the beta period will end the 4:th of August.
You can read more on how to sign up at Born To Learn.

Unless you’ll be able to take the beta exam the real exam will according to what I’ve heard be available sometime between September and November.

I’m proud to announce I’m now a Microsoft Certified Trainer and this spring I’ll hold the 4 day Implementing Forefront Identity Manager 2010course at Cornerstonein Stockholm, Gothenburg and Malmö (in Swedish). If you’re interested to attend the course go ahead and visit Cornerstone and don’t be confused Cornerstone calls the course T207.

 

These are the preliminary course dates:

• 22-25 February in Malmö
• 15-18 March in Stockholm
• 5-8 April in Gothenburg
• 3-6 May in Stockholm

A little bird whispered in my ear that SQL Server 2008 R2 is now supported for FIM 2010 from yesterday, still no update of the Hardware and Software Requirements and nothing about an update for making the installer work but hopefully we’ll hear about it soon.

I know, I haven’t been blogging as much as I should but a lot of work and a whole bunch of interesting development projects have been taking up my time but I’m very pleased I can finally report that one of these projects have reached it’s first release to CodePlex.

FIM is of course the ultimate place for attributes to issue as claims using ADFS 2.0 since you typically store attributes from all different kinds of connected directories there. Not only will you be able to issue standard attributes - you can do lookups for groups, sets or roles and publish these as claims as well, perfect for authorization scenarios.

The footprint on ADFS 2.0 is minimal and it doesn't require more than the usual attribute store configuration. The attribute store also comes with a command-line test client that allows you to get the communication with FIM correct and also enables you to run custom queries against FIM. The test client is pretty much a command-line version of the FIM Query Tool once published by Joe Zamora from Ensynch except it uses the attribute store under the hood that also can be attached directly to ADFS 2.0.

It's currently in Beta so please try it out and report issues to the project page on CodePlex so that I can make it better!

http://fimattributestore.codeplex.com/

The ADFS 2.0 configuration of the attribute store.

Example output from the Test client.

Carol(MissMiis) has created a really nice activity for executing PowerShell scripts, both local and remote and it opens up for all kinds of possibilities! Check it out!

http://www.wapshere.com/missmiis/powershell-activity

I’m currently working with Markus Vilcinskas on a couple of FIM Experts articles on how to detect non-authoritative accounts. Today we published the first two parts were the second part also contains an in depth description on how object state detection works. Enjoy!

Detecting Non-Authoritative Accounts – Part 1: Envisioning

Detecting Non-Authoritative Accounts – Part 2: Design