UNIFYBroker/Microsoft Identity Manager Configuration

Upon installation, UNIFYBroker/Microsoft Identity Manager adds the ability to generated packaged MAs via the UNIFYBroker interface. These map the selected adapter's schema for use in Microsoft Identity Manager 2016, Forefront Identity Manager 2010 R2, Forefront Identity Manager 2010, and Identity Lifecycle Manager 2007.

Exporting the Management Agent

Click on the Functions menu of the adapter to generate a management agent for, and select Generate FIM xMA.

Configure the management agent settings as appropriate, enter a file name, and select a save location. The following options are available for the save location:

Pressing the Generate xMA button will cause the MA to be created and use the save location option selected.

Once the management agent has been exported, the FIM Synchronization Service Manager needs to be restarted to reload the available xMAs. The new management agent will then be selectable from the Create Management Agent screen.

There are some advanced options available when configuring the management agent:

Following successful installation and configuration of the adapter, communication should be tested in Microsoft Identity Manager by attempting to create and use the exported management agent. The process of creating and configuring a management agent is outlined in Microsoft's documentation on the use of Microsoft Identity Manager.

Configuration Settings

The created management agent will contain some settings which pertain to connection with UNIFYBroker:

Management Agent Schema

A generated xMA will contain adapter schema fields current as of the time of its creation, with each field now mapped to its appropriate value type in FIM. This represents the scope of attributes that will be controlled and altered by the management agent. Missing attributes will be ignored and not managed.

The unique entity identifier is added to all entries that are imported from UNIFYBroker, added to the management agent schema as the IdBID field. This provides the identity management solution with a handle to UNIFYBroker's unique identifier. In some systems that have a non-required key and no other unique fields, the IdBID can be used for DN generation and join criteria. It is also configurable when provisioning to UNIFYBroker - assigning a Guid value to the field ensures that provisioning remains seamless where the field is used in such a manner. Note that clearing the original connector entity will result in this field is used, so caution is recommended in scenarios where its use is required.

The object class defined in the adapter defines the object class that will be presented to the connector space. As configured, Composite Adapters represent multiple object classes, allowing different object types to exist and reference each other within the same connector space. The object class of connector space entries needs to be taken into account when configuring join rules, attribute flows, and provisioning rules and logic. An additional object class known as a "container" is generated by UNIFYBroker from the distinguished names of entities for the purpose of DN resolution.

As the xMA is currently an Extensible Connectivity 1 management agent, any alterations to the adapter schema will need to be managed manually in FIM. Any added, updated or removed fields in the adapter schema should be suitably created or altered in the MA in order to reflect the data currently being presented by the adapter. 

Since UNIFYBroker adapters utilize LDIF as their communication mechanism, the management agent contains an additional dn field. The value of this field is controlled by the Distinguished Name Generator of the adapter, and is the unique identifier of an entity for the purposes of the FIM connector space (mapping to the DN property of connector space entries). As a result, the default anchor of the created management agent is the dn field. This accommodates most scenarios, but may need to be modified under more advanced business requirements and scenarios where join options are more limited. New users provisioned to UNIFYBroker systems should have their connector space entry DN property match the format expected by UNIFYBroker. As this may result in transient objects and other inconsistencies being introduced, UNIFYBroker will block any distinguished names that do not match what the configured DN generator produces.

Please note that the DN property in the connector space is case insensitive (see http://msdn.microsoft.com/en-us/library/microsoft.metadirectoryservices.csentry.dn.aspx), and as such, generated distinguished names must have case insensitive uniqueness across the entire adapter (including Composite Adapters), or transient objects and duplicates will occur.

Run Profiles

The packaged management agent comes with several run profiles pre-packaged, allowing for quick use of the management agent once created. Any failures in operation are typically reported back to FIM, but it is also advised that the UNIFYBroker logs are consulted for further assistance in troubleshooting.

Note that import and export operations will not succeed if the target adapter is disabled in UNIFYBroker.

LDIF Format

The xMA utilizes the LDIF format for all interactions with UNIFYBroker. During a full or delta import, LDIF files are created by UNIFYBroker in the MAData directory for reading by FIM. These are named UNIFYFull.txt and UNIFYDelta.txtrespectively. These files can be inspected following import operation to examine what information is being generated and presented by the adapter.

Exports to UNIFYBroker are also sent using the LDIF format in accordance with the operations FIM is attempting. As such, it is important to ensure a solution is baselined correctly from the offset to ensure add, update and delete requests are kept consistent. 

Configuring WCF for v4

            <system.servicemodel>
                <bindings>
                  <basichttpbinding>
                    <binding name="MetadataExchangeHttpBinding_ILDIFAdapter" closetimeout="10:00:00" opentimeout="10:00:00" receivetimeout="10:00:00" sendtimeout="10:00:00" maxbuffersize="65536" maxreceivedmessagesize="204003200" transfermode="Streamed">
                      <!-- Uncomment the following lines if you wish to use SSL. The service config must also be set to use SSL! -->
                      <!--
            <security mode="Transport">
            <transport clientCredentialType="None"
            proxyCredentialType="None" realm="">
            <extendedProtectionPolicy policyEnforcement="Never" ></extendedProtectionPolicy>
            </transport>
            </security>
            -->
                    </binding>
                  </basichttpbinding>
                </bindings>
                <client>
                <endpoint address="" binding="basicHttpBinding" bindingconfiguration="MetadataExchangeHttpBinding_ILDIFAdapter" contract="IdentityBrokerLDIFAdapter.ILDIFAdapter" name="ILDIFAdapter"></endpoint>
                </client>
            </system.servicemodel>