TEC 2012 call for papers open for 2 more days

The Experts Conference Call for Papers still open until Nov 18th

http://www.theexpertsconference.com/us/2012/submit-a-paper/ 

For general info: http://www.theexpertsconference.com/us/2012/

I have attended at spoke at this conference since 2007. I love it. It is a great experience and loads of great in-depth technical training by top experts on Directory & Identity, as well as SharePoint, Exchange, Virtualization & Cloud and PowerShell Deep Dive. Also come and learn about the inside joke dealing with the rubber chicken.

SQL Extensible Management Agents That Scale (Rebecca Croft)

Rebecca, a fellow Ensynchian, presented at TEC 2011 on the limitations of the standard out of the box SQL Management and how she overcame them by writing a very fast eXtensible Management Agent (XMA).

First attempt use ado.net sql reader to read data (really fast) and write one row at a time to the AVP file (but that gets slow when dealing with large data sets).

Second attempt use the T-SQL “FOR XML” clause to transform the data to XML and then use an XSLT to transform to LDIF.

So the XMA executes a T-SQL statement to export the data to XML and then XSLT to transform to LDIF and then returns the LDIF file to the FIM Synchronization Service.

She even showed off a wizard to create the XMA for us. When it completed successfully she received a spontaneous round of applause.

Using FIM to manage BPOS/Office 365

Carol presented a solution to a very thorny problem – how to overcome the lack of delegation in BPOS. In BPOS a user is either an admin or a user. So she used FIM to provide the delegation. Very detailed, very complete solution. She illustrated some of the scripts she has posted on her blog such as http://www.wapshere.com/missmiis/a-script-to-create-sets-and-mprs-from-templates 

Well done Carol!

FIM 2010 reporting using SQL Server Reporting Services (Jeremy and Craig)

Jeremy and Craig had an interesting shoot out showing off their differing versions of reporting from FIM. Jeremy has an “agent” that he uses to pull the data out of FIM and store it in SQL, after which doing SSRS reports is not terribly difficult. Craig’s approach was to start off by creating a generic SSRS Data Processing extension for PowerShell, and then adjusted to pull data from FIM. Both approaches look very slick. Afterwards they explained how their efforts actually turned out to be quite complimentary. Two thumbs up gentlemen!

Cloud computing single sign-on. Making ADFS work with Google and Salesforce (Nikita Ryumin)

This TEC session on the Directory Services track was short but sweet illustrating how to connect ADFS to Google and SalesForce.

Desktop Virtualization and Identity Management

I did a lunch time presentation in partnership with Jonathan Sander. We presented how we can use Quest VWorkspace and Quest One Identity Manager to build a corporate store (we code named it VIPER) to provide a dynamic desktop experience.

Creating Authentication Activities in FIM (Ikrima Elhassan)

This session at TEC was quite interesting. Ikrima presented quite a lot of material about how to extend FIM with your own authentication activities, demonstrating a OTP password reset approach.

Code is available at https://github.com/ikrima/Public-Development

Designing and Implementing RBAC Solutions with FIM 2010 Group Management

After I introduced Brad Turner and turned the time over to him, he showed off some really cool FIM extensions to enable RBAC. He even showed how it fits the NIST RBAC definitions even through level 3.

The key design decision was to extend the Set and Group objects. The Set then functions as a role. This allows for both explicit and criteria based membership. A new object type for a Role Membership allows for the user’s membership in a role to expire at an individual time.

FIM Best Practices: Sizing Your FIM Installation

I had a lot of fun presenting this session. Largely based on chapter 5 in volume 1 I showed how to decide on your High availability approach, how that impacts your topology choice, and then how to estimate your scale, load, and complexity points. Then based on those factors figure out how big to make your SQL Server that hosts the FIM service database.

In the middle I did enjoy putting in a plug for our Ensynch sponsored green, dishwasher safe water bottles, as I took a drink of my fruit punch Gatorade mix.

I received lots of great questions and got to see lots of familiar faces.

Can PXEs Fly? FIM and SCCM Integration (Rob Allen)

I was looking forward to this one, but got called away. I hope to look at the slides soon.

Creating Management Agents with the new EZMA (Andreas Kjellman)

At TEC 2011, Andreas Kjellman of Microsoft, who “owns” the FIM synchronization engine, showed off the upcoming EZMA framework.

The problem:

The existing eXtensible Management Agent (XMA) does not have a call based import method, we are limited to using GUIDs as the initial anchors, and we don’t have partitions in an XMA.

Solution

EZMA – which, IMO, will actually be a little harder to do than an XMA but will allow the developer to do much more that will make the FIM admin’s life easier.

Some of the new features:

Call based import, that you can batch! So just like with an AD MA run profile step (see the figure) we can configure batch size and it will actually have an impact, and you can also choose a partition to process.

The call based export is modified to be able to batch it  too. So instead of calling ExportEntry for each csentry object you will get the ExportEntries method which will have a collection of csentry objects that have pending exports.

The schema, partitions and hierarchy can be discovered programmatically.

Custom anchors – that aren’t GUIDs.

Even better support for custom parameters (of different data types)

Finally the ability to do a full export! Which is great when you have a target that doesn’t store state.  However, you must decide at design time which type of exports your MA will be executing.  You can choose either delta or full, but not both.

Comments

The XMA will still be supported.

The EZMA is more of a developer activity than the XMA was. Your dev will need to learn new interfaces, but should need to know a little less about the internal workings of the sync engine.

Bottom Line

Good move because now we can write EZMA’s that are as fully functional as anything the product group does.

Files, FIM, and PowerShell (James Booth)

James Booth former Microsoft Group Program Manager for MIIS (precursor to FIM) presented on using PowerShell to process files in preparation for consumption by FIM.

James points out that “In the beginning, it was all files.” These call based MA’s are the new kids on the block, also said that at Microsoft in 2000 the philosophy was “XML is the answer, now what is your question?”

James has posted his new commandlets to GitHub https://github.com/jhbooth/LDIF-PowerShell 

Commandlet	Description
Import-DirectoryCredential	Imports directory credentials from a file, and returns a custom PowerShell object. Imports directory credentials from a file created using Export-DirectoryCredential
Export-DirectoryCredential	see above
Import-LDIF	Imports directory information from an LDIF file, and writes custom PowerShell objects to the pipeline.
Export-LDIF	Exports directory information from the pipeline to an LDIF file
Convert-EscapeDnComponent	Escape DN components – escaping

James also talked about “munging” the data by piping the data through other functions to transform the data.

He also cautioned against thinking that PowerShell is the only way to do something.

TEC 2011–FIM Workflows Deep dive

I am already in Las Vegas, prepping to assist my fellow Ensynch coworkers, Joe Zamora, and Rebecca Croft as they lead an awesome value packed pre-conference workshop tomorrow (Sunday) morning at 8 AM to 12 PM (noon). Jerry Camel and Brad Turner will also be around to assist.

There are so many good sessions to attend this time here are some of the ones I am looking forward to:

Monday morning gets the FIMsters off to a great start with a choice of two great sessions:

1) Andreas Kjellman of Microsoft presenting on Msft PM 2Creating Management Agents with the new EZMA. Apparently “in the next few months a new” and to me very exciting “development framework for creating management agents will be released.” This is a great one to send a developer so they can prep for using the EZMA which sounds as though it will make the XMA obsolete.

2) James Booth, formerly of Microsoft, now of Boothbilt, makes his return to speaking at TEC as he presents on Files, FIM, and Powershell. I am looking forward to learning how James has made use of PowerShell to automate certain chores in maintaining FIM. Man, I love collaborating with that guy!

Then in the post lunch sleepiness we have two exciting speakers to keep us awake, Craig Martin, FIM MVP, speaking on FIM Powershell Deep Dive Must stack up for PS deep dive and Rob Allen with his cleverly named Can PXEs Fly? FIM and SCCM Integration. Which one to choose?

Immediately following Craig’s session I am delivering: FIM Best Practices: Sizing Your FIM Installation. Hopefully it will be a beaut!

At the same time following another FIM MVP, Carol Wapshere (of Miss MIIS fame), will be speaking on Head in the clouds – navigating the identity pitfalls of a complex cloud migration. At that altitude it sounds like someone got a bloody nose. Nonetheless, I am sure that Carol’s clear and direct style of speech will help others avoid the nose bleed.

Another “bloody nose” session will also be going on at the same time as mine, AD FS Troubleshooting in the Wild – Cookies and Tokens and Fiddler, Oh My! by Laura Hunter and Brian Puhl. Those MS IT masters of disaster err I mean ADFS are at it again.

Winding up the day and setting the stage for the Quest sponsored TEC party, is Brad Turner, showing off some really slick FIM add-ons from one of our latest projects. I will be there to lead things off for Designing and Implementing RBAC Solutions with FIM 2010 Group Management. Also at the same hour Brian Komar, shows off some work from a recent project (thanks for leading that one Brian!) illustrating the Simplifying certificate enrollment to non-Windows computers

To Gil Kirkpatrick, Christine McDermott, and Stella De Jean Lowe and all of the other folks at Quest involved in TEC, I say you have put together what looks to be an amazing set of pre-cons and first day sessions! Look for my reviews on Monday as the day goes, I am going to try and blog it as we go. I suppose that’s really a twitter kind of thing, but then again has anyone ever known me to limit myself to 120 characters?

TEC 2010 Europe – Sweet German Chocolate!

Overall TEC 2010 Europe  in Dusseldorf Germany was pretty cool. I enjoyed the speakers reception on Sunday night and got to meet some folks from the SharePoint side some of whom are even interested in FIM and one of them bought my book!

For the first time I was able to bring my wife along to TEC! We enjoyed some good time in Dusseldorf including seeing Schloss (Palace) Benrather.

Monday we started off with a keynote from  Uday Hegde and Mark Wahl on the future of Directory and Identity Technologies. It was mostly an overview and demo of the various MSFT Identity technologies, FIM, RMS, ADFS etc. I did enjoy Mark’s well prepared video demo. He clearly had practiced the timing quite well, explaining as the mouse moved across the screen carrying out his demo.

I spent some time in the solution lab taking a look at Quest’s newest acquisition, Active Entry (part of the Voelcker acquisition). It is quite an exciting product, with Role Mining, and RBAC capabilities. More on that at another time.

I loved Brian Komar’s presentation on how to screw up your PKI. I know he has titled the other way but if you take your notes the wrong way then he is teaching you how to screw up. But if you study it the right way it is quite an insightful look into how to avoid huge mistakes!

For the next session to attend it was a close call between “Claims Provisioning and the Cloud” by Mark Wahl and Andreas Kjellman and attending Joe Kaplan’s “Add LDAP and Two-Factor Auth to ADFS v2”. I chose to attend Joe Kaplan’s session. it really was quite interesting to see the tact he took to add in LDAP auth and two-factor. Even funnier was how Joe revealed his grand deception that his two factor authentication component was accepting any password.

After lunch I skipped Jeremy Palenchar’s awesome session on Logging and Auditing with FIM (I saw it in LA back in April) in order to relax for my care and feeding of identity databases. As always presenting at TEC is great fun. I gave away a few copies of FIM Best Practices Volume 1 in the session. Then Brad Turner spoke in FIM and ILM High availability.

Monday nights reception was great fun. I had quite a thrill talking to so many readers of blog and book.

Tuesday morning I enjoyed Mark Wahl’s presentation on Integrating FIM into IT Service Management. While it was geared towards using Service Center Service Manager as a data warehouse, the thought of integrating automated Identity Management with help desk and asset management is quite intriguing. Then Brad spoke about Applying FIM Policy retroactively with ROPU “Run on policy update” which we refer to as Rope You.

I attended part of Jackson Shaw’s Evolution of the Identity Market. He had a fascinating story of how the destruction of one company’s directory led to the meta directory concept.

After lunch I delivered my session on FIM Performance Tuning. It was a bit surreal but I was asked to personalize several copies of FIM Best Practices Volume 1.

I enjoyed being able to attend Andreas Kjellman’s how to avoid a FIM support call. I thought the feedback about the common support items was invaluable.

Wednesday we skipped out to some sight seeing.

TEC Europe – Come hear me speak!

I will be presenting at TEC Europe in Dusseldorf Germany Oct 4-6. During my sessions I will give away a copy or two of my book FIM Best Practices Volume 1 .

FIM 2010 Performance Tuning (SQL and more)
Speaker: David Lundell

Learn how to tune FIM 2010 to make it scream. Take a look at the various architectures and what they buy you. Learn how crucial SQL is to FIM performance and what to do about it. You’ll also learn tips for workflows and the FIM web service and receive a crash course in the SQL Server Optimization.

Proper Care and Feeding of Your Databases: FIM, ILM, CLM, RMS, SharePoint and OCS
Speaker: David Lundell

Without proper care and feeding of your databases (FIM Meta Directory Services, FIM Certificate Services, FIM Web Service, RMS, SharePoint and OCS logging), chaos will result. Learn to conquer the chaos as David Lundell, SQL expert and ILM/FIM MVP, teaches you appropriate backup strategies, database and index maintenance tactics, and performance optimization tricks including guidance on fillfactor settings for SharePoint. You will also receive a crash course in the SQL Transaction Log, SQL Recovery Models, Database Maintenance Plans, Index Optimization, SQL Backups, and SQL Agent Jobs.

 

TEC Decks Posted!

If you attended TEC you can now get the Slide Decks by registering on TheExpertsCommunity.com

and accessing the following item: TEC 2010 Conference Materials Have Been Posted!

You can find my sessions here:

 http://theexpertscommunity.com/item/list/type/session/meta_expert_tag/speaker%3Adavidlundell

Proper Care and Feeding of Your Databases: FIM, ILM, CLM, RMS, SharePoint and OCS

Without proper care and feeding of your databases (FIM Meta Directory Services, FIM Certificate Services, FIM Web Service, RM... continue reading "Proper Care and Feeding of Your Databases: FIM, ILM, CLM, RMS, SharePoint and OCS"

FIM 2010 Performance Tuning (SQL and more)

Learn how to tune FIM 2010 to make it scream. Take a look at the various architectures and what they buy you. Learn how cruci... continue reading "FIM 2010 Performance Tuning (SQL and more)"

Brad Sessions are here:

http://theexpertscommunity.com/item/view/type/expert/id/1760

Applying Policy Retroactively with FIM 2010
Abstract not available. ...

Using DFS and GPO in ILM High Availability Scenarios
This presentation will demonstrate how ILM Architects, Engineers, and Administrators can leverage Active Directory Distributed File System (DFS) to replicate solution content between the primary ILM server and the warm-standby server as well as...

 

Joe Zamora:

Custom Workflow Development in FIM 2010
Get an in-depth look at the extensibility of Forefront Identity Manager 2010 through the use of custom workflow development. Although FIM 2010 includes a new “codeless provisioning” feature set, you’ll find that you can’...

Other Ensynch Presentations:

Federated SSO Solutions Using SharePoint 2010
In the world of on premise and hosted “cloud based” solutions, how can you best simplify your coexistence strategy? Attend this session presented by Ensynch’s Identity Management and SharePoint teams to see how the combined kn...

 

Building Exchange 2010, Managing and Integrating with Exchange Online via Microsoft Business Productivity Online Services (BPOS)
Microsoft Exchange 2010 is available both as on-premise software and as a hosted service, and you can now choose the right deployment option for your organization, whether you deploy Exchange Server on-premises, host your mailboxes with Exchange Onli...

Technorati Tags: session:fim2010performancetuning,session:databases

TEC 2010 -- Results

TEC 2010 was a blast. In the Kickoff Gil Kirkpatrick issued several challenges including one to Brad Turner to simulate the workings of the FIM Sync Engine. Eventually we expect to see a video of the final presentation posted to YouTube. In the interim Brad has some nice pictures posted: TEC 2010 – Annual Wook Lee Memorial Challenge for Identity Results

 

I attended Craig Martin’s session “Automate FIM deployment with Powershell” and learned a few things about the FIM Powershell commandlets.

Next I split my time between Joe Zamora’s session on Custom Workflow in FIM 2010 and Gil and Jeremy’s session on Reporting in FIM 2010. (I had swapped my session time on Monday with Joe’s Wednesday time as I was worried that the Icelandic Volcanic Ash cloud was going to keep me from getting there on Monday – but it didn’t). I enjoyed both. I am afraid my late arrival in Gil and Jeremy’s session caused a bit of a stir as they were discussing some of their SQLXML tricks and Jeremy told everyone that wanted to know more about it to ask me (as I am looking at their stuff for the first time).  I think Gil and Jeremy had a great presentation with a fascinating proof of concept. I heartily endorse their statements regarding this not being a production ready setup but I love what they showed.

Other concerns caused me to miss the rest of the afternoon. The Quest Hospitality Suite was nice.

Tuesday morning I put the finishing touches on my presentations and then attended Jack Kabat’s session on Deploying FIM, he provided some good advice on how to handle the initial load scenario.

After lunch I presented on Care and Feeding of Databases. I had quite a wide range of attendees. Some were interested in the SharePoint databases others in OCS and of course the majority for FIM Service and Sync. There were also a few who needed to know about FIM CM. I did also show a few photos from my recent trip to Prague including my evidence of elven habitation (they had their own check in kiosk at the Prague Airport).

That night we (Ensynch) had a great party at the ESPN Zone watching the Lakers eliminate the Oklahoma City Thunder. We rented out the Championship Lounge which is above the rest of the facility and feels like a skybox, including big windows out which you can see the big screen at the Bar. We were 100 yards away from the Staples center so after the game we had to fend off some game attendees intent on crashing our party.

Wednesday morning I presented on FIM Performance tuning and talked about the performance improvements that are possible. Then Brad spoke about using ROPU (Run On Policy Update, which we pronounce Rope You, because it ropes you into doing more things) and its power.

If you want access to the slides and videos etc you need to register on www.theexpertscommunity.com

Escape from Prague – Good to go for TEC

I went to Prague for a project intending to stay one week, but unfortunately I was delayed an additional week (volcanic ash cloud from Iceland – reread the news if you missed it). While Prague is a beautiful city and I met many wonderful people, the uncertainty of when I would be able to get home weighed heavily on me. I was worried about being separated from my family for weeks? months? More importantly ;) I was worried about getting back for The Experts Conference!

Well I have made good my escape! I am back home and will be heading to TEC! Hope to see you there!

BTW, Joe Zamora and I traded speaking slots (I was afraid I wasn’t going to arrive at TEC before Tuesday). No worries now, but we are keeping the schedule change. Joe will speak Monday after lunch and I will speak both Tue after lunch and then Wed at 8 AM.

Register for TEC 2010 – hope to see you there

 

Register using this code to get a discount: ATESENSYNC

TEC 2010 – Speaking and Sponsoring

I am super excited about speaking at The Experts Conference 2010 (I also spoke at Directory Experts in ‘07, and ‘08 as well as last year’s The Experts Conference).

Register using this code to get a discount: ATESENSYNC

Once more Ensynch is sponsoring TEC but this year we are a gold sponsor for TEC 2010.

Here is the lineup of Ensynch Speakers at The Experts Conference (also see Brad Turner’s take on our new speakers)

Track	Speaker	Picture	Topic	Date
Exchange – Pre conference workshop	Justin Hiedeman		Exchange 2010 Migration to Microsoft Exchange Online: Hands-on Workshop	Sunday April 25th 1pm-5pm
Directory & Identity	David Lundell		FIM 2010 Performance Tuning (SQL and more)	Monday April 26th 1:00 pm
Directory & Identity	Brad Turner		Using DFS and GPO in ILM High Availability Scenarios	Monday April 26th 2:15 pm
Directory & Identity and SharePoint	Chris Calderon   and Jeff Holliday	Jeff	Federated SSO Solutions Using SharePoint 2010	Tuesday April 27th 9:45 am
Directory & Identity	David Lundell		Proper Care and Feeding of Your Databases: FIM, ILM, CLM, RMS, SharePoint and OCS	Tuesday April 27th 1:30 pm
Directory & Identity	Joe Zamora		Custom Workflow Development in FIM 2010	Wednesday April 28th 8:00 am
Directory & Identity	Brad Turner		Practical Converged Physical and Logical Access Control	Wednesday April 28th 9:45 am