Regarding the recent SAP IDM Announcement

 “Life begins like a dream, becomes a little real, and ends like a dream.” ― Michael Bassey Johnson, The Oneironaut’s Diary

As many of you already know, SAP has made public its plans on how SAP IDM will be retired as a supported offering. I’ve been stewing on this for a bit as I try to figure out exactly how I feel about this and what needs to happen next.

To be fair, I haven’t worked with the product much for just over four years, and even then, I was working more with Version 7 than with Version 8. My opinions are completely my own and do not represent my current employer, any previous employer, or SAP.

While IDM is certainly showing its age, there are some very good things about it that I would love to see as an open-source offering. First is the Batch Processing capabilities of IDM, based on the old MaXware Data Synchronization Engine/MetaCenter solutions. It features some powerful functionality to synchronize and cleanse data. It sets up fairly easily and is quite easy to configure. I’m sure the open-source community could do well with maintaining the UI (It definitely should be JAVA-based rather than the old Windows MMC) that will fit better in today’s Enterprise setting. Also, easy integration with SaaS services is a needed upgrade.

The other thing that should be released into the wild is the Virtual Directory. It also provides powerful functionality for several use cases, from pass-through authentication to assisting in M&A use cases. It’s the perfect example of a “Black Box” offering that just works. It also makes it much easier to synchronize and cleanse data by representing many different back ends via the easy-to-consume LDAP standard.

It saddens me that SAP is choosing to move away from IDM, as one of the key selling points of SAP IDM is its ability to integrate seamlessly with the SAP ecosystem. I hope SAP will help all LCM/IGA vendors connect more easily with systems. SaaS integration should be easy or standards-based, but we still need to be concerned for organizations still using on-premises SAP tools.

SAP has indicated that Microsoft’s Entra ID will be the main partner in the future, but I hope they make this information open to all vendors and that there will be continuing support of standard protocols. This article gives me some hope, but actions speak louder than words. I do have some concerns that SAP, known as a vast software ecosystem that supports itself and tends to ignore the enterprise, is handing off to another large software provider whose management tools tend to support their software ecosystem first and consider the enterprise second. Let’s face it: most of Microsoft’s Identity and Access Management efforts have been about supporting the Office 365 family of products. Don’t get me wrong; it’s better than SAP in this regard, but it’s not that high of a level to meet. For what it’s worth, I am guardedly optimistic, but I always try to remain hopeful.

Finally, I think it’s important to thank the IDM team in Sofia for all their hard work over the years, which, of course, would not have been possible without the vision and effort of the original MaXware team based in Trondheim, Norway, and associated teams in the UK, Australia, and the US. The production from these small teams helped define what Identity Management is to this day.

Will this be my last blog entry on the topic of SAP IDM? I don’t know. Part of it will depend on if there are any moves towards the Open Source world. There have been at least three times in my life when I thought I was done with this tool, and deep down, I’m pretty sure there is a little more in my future. 

In the meantime, I hope to resume blogging more regarding the Identity and Access Management field in the near future. Time will tell.

You've read my ramblings, now listen to them!

You've been reading my ramblings for years here and on SCN. Now you have a chance to listen to some of my thoughts on SAP IDM and a bit on SAP IDM 8 I was recently interviewed by long time colleague and fellow IDM Expert,Scott Eastin for his IDM Masters Interview Series. 

Please take a moment to listen to the interview and support Scott's efforts!

BTW, please let me know if this is interesting and if we should consider a regular podcast / YouTube discussion of SAP IDM, along with topics that you would like to see covered!

Thanks!

Using VDS to Promote Efficiency

Hi there.  I know it's been a while since I posted here, but it's not because I'm not working on NetWeaver IDM or writing.  I've been doing a lot of the former and a bit of the latter.  In order to help promote the growth of a NW IDM technical knowledge base, I've been posting most of my IDM specific things on the SAP Community Network Blog.  I'll still be posting here from time to time, but it will more likely be architectural or opinion related pieces about IDM.

To that point I'd like to talk about the seldom discussed Virtual Directory Server.  I've always loved VDS and it's MaXware predecessor, MVD. There's just so much this product can do. While most of the SAP world is familiar with the Virtual Directory as a Web Services proxy for GRC or use with HCM, it is so powerful and flexible that it can do everything from provisioning to authorization and authentication management, to representing data sources in all kinds of different ways.

That's one of the things I'd like to talk about today.  Ask most Directory Services administrators about a recommended architecture and they will tell you straight out, "flat, as flat as possible."  However there are a number of reasons that this tends not to happen.

So how do we deal with this.  Simple, via the Virtual Directory Server.  Set up the flat structures that the administrators want, then use VDS to  represent the directory with different views, deep organized by geography  department, types of equipment, whatever.  Present the displayname and other attributes as the different divisions request.  Create separate customer facing views of your Identity Data.

Also don't be limited by only using Directory Services information for your Virtual View of data, use the Identity Store, UME and other sources separately or joined together to create your new interface.  Information on this can be found here. The advantage here is that you can create a virtually (if you'll pardon the pun) unlimited number of data representations. Now go forth and create Virtual Directories make your Identity Management group, the "Can do!" group that provides everyone the flexibility that your external customers need while providing the optimal efficiency that the back office wants to deliver.

TechEd 2012 Wrapup

Quicker than I thought possible, another TechEd has come and gone. It's been a fantastic TechEd this year.

From the SAP Identity Management perspective we saw some exciting new things this year:

• NW IDM Service Pack 6 is scheduled to be released in the next couple of weeks with some nice new features.
• Longer term enhancements will see the end of the dreaded MMC console! I don't think we'll see this in the next couple of enhancements, but I think we'll see it by the end of 2013!
• Virtual Directory received a renewed focus with sessions not only on standard SAP use cases but also in dealing with Identity Services.
• SAP SSO got some nice attention as well.  I'd expect that next year we'll have some hands-on sessions as well.

One thing that I did notice this year was a near complete lack of attention to GRC.  This has me wondering many things.  I don't think that GRC is going away, as the compliance space is very hot right now with all the big companies (IBM, EMC, Oracle, CA, etc.) involved and some other small players (SailPoint, Aveksa) are growing at a rapid pace.

I've not been able to get any confirmation from anyone at SAP, but if I put my thinking cap on, I would say that we're looking at the beginning of a re-alignment of how GRC is being included in workflow. Stay tuned!

SAP TechEd Days 2 and 3

As usual, events here at TechEd have caught up with me and I missed a post. Sorry, folks!

This does not mean that there has been a lack of activity here at TechEd. Yesterday, I attended an excellent hands on workshop based on Context Based provisioning.  Any organization that is looking into SAP IDM for the purpose of managing SAP Roles over multiple locations or positions needs to look into Context Based provisioning. I think one can make an excellent comparison between IDM contexts and the Derived Role concept within SAP.  I'll have to write some more on that later, either here or on the SCN Blog. I've also come up with some other interesting ideas for Contexts which I will be working on over the next few weeks.  Hopefully, I'll have something to share soon.

There were also a number of good Q&A sessions where users could go one-on-one with some of the SAP IDM experts that came over from SAP Labs in Trondheim, Norway.  For those that don't know, NetWeaver IDM was born as MaXware Identity Server in Trondheim back in the 1990s and core development still happens there to this day.  Concepts such as Assignments, Approvals and Virtual Directory Server were covered.

Today I was able to attend a session on the use of the Provisioning Framework.  Not too much new there, but it was good to hear that SAP is committed to the Framework and feels that IDM is the best way to provision users to SAP systems. During the presentation, the following general IDM points were brought up that I would like to comment on:

Users should consider IDM over CUP if connections to external applications are required (e.g., Microsoft Active Directory)
IDM should be used over other provisioning methodologies for Audit and compliance reasons
Do not think of SAP or non-SAP roles, privileges, provisioning etc., it is all Enterprise provisioning

I'll have a wrap of of TechEd tomorrow with some closing thoughts.

SAP TechEd 2012: Day 1

Day 1, all I can really say is Wow! I attended sessions on the latest addition to the SAP's Identity Management line up, some of it's oldest technology and the future of the NetWeaver IDM.  After today's session, my mind is completely blown away.

I started the day with two informative sessions on SAP's Single Sign-on Offering based on the technology asset acquisition from SECUDE about 18 months ago. SAP has clearly recognized that information security must begin at the login and proceed from there.  I'm looking forward to learning more about it over the next year or so.  It's a major technology on my radar and should be considered as a key strategic goal for all SAP implementations.

The next session was based on a favorite technology of mine, the Virtual Directory Server (VDS).  Virtual Directory technology has been the "next big thing" in Identity Management for many years now. It appears that SAP's use of Virtual Directory not only as an LDAP proxy, but also as a Web Services Proxy could very well make this the case, particularly in the SAP ecosystem. Miroslav Jokic, SAP's VDS expert, back to the MaXware days gave a great presentation. In an hour long session, Misa gave a thorough overview of VDS, explaining it's architecture, basic use cases and extended use cases when working with Web Services. Clearly this is a technology whose time has come.

The third session of the day dealt with best practices for implementing SAP IDM. While focused on consultants, Kåre Indrøy, presented a good 10 point plan that is applicable to any IDM implementation. In the second half of the presentation, we received an excellent briefing on the new SAP Rapid Deployment Framework for IDM developed by SAP Consulting. While somewhat limited in scope, it certainly does appear to be something that can be quickly implemented for most small to mid-sized clients if all of the pre-requisites are met.

All of these new features will be available in NetWeaver IDM SP 6 which should be available in 2-3 weeks.  Most are also available in SP 5, but not through the Web UI.

Now we come to the Crown Jewel of the day, which was a 2 hour presentation by Kåre and John Erik Setsaas showing the latest functionality to be released shortly in Service Pack 6 for NetWeaver IDM 7.2 and what we can expect to see in the next 6-9 months. Approvals are being enhanced again, making them more functional than ever, particularly where declines and assignments are involved.  Automatic Delegation is now available to designate temporary approvers when the primary approver will not be available.  

NOTE: Everything that follows is conceptual and is not guaranteed to be in any future version of NetWeaver Identity Management.

Trace functionality is also improved with additional control from the Web UI, which will be a boon to IDM developers. Also added to the Web UI is a new SQL Execution reporting interface that will report on database queries that last longer than a predefined limit.  This is a significant enhancement of the Configuration Analyzer's ability to detect inefficient queries and will be something that IDM Administrators will be very interested in.

The last part of the presentation was the really exciting part.  Kåre and John showed us some of the functions that we could be seeing beyond Service Pack 6. Access to the Administration Console looks like it will be getting some tightening along with some locking of objects being worked on in the Admin console. It's been a long standing issue that only one user should be accessing an IDM object in the MMC console at a time (Personally, I'm not found of two people looking at the same configuration at the same time) When the user is done editing and checks the object back in, it becomes available for editing by another IDM administrative user, Additional UME based security is being considered to restrict access to the IDM administrative objects as well.

Also it has been confirmed that DB2 will be supported by IDM in the near future.  The DB2 version will only work if the DB2 Database has been prepared to run in "Oracle Mode"  I'm sure we will be getting more information soon.

The Pièce de résistance of the afternoon was a brief overview of an early alpha version of a new Development UI. I'm not going into a lot of detail here since it was such an early release, but suffice it to say that a 21st century, eclipse based interface is on the horizon, and for those like me who have been working with this interface for the last 8+ years it appears that this will be the answer to our prayers.

I did not cover everything mentioned in these presentations for a couple of reasons.  One, I'd be writing for hours and I need to get some sleep tonight so I can be ready for tomorrow's sessions.  Two, this is SAP TechEd and you should be here.  If you're wondering is it worth it, I say YES! Hopefully this information will make you feel the same way!

SAP TechEd: Preview

I'm here in Las Vegas, Nevada for SAP TechEd 2012 and I could not be happier. It's looking like quite the busy week of IDM related training.  Attendees are arriving and I've already seen a few people I know from SAP, past projects and the greater IDM Community.  From what I've already heard we're in for a week of exciting learning, future product direction and late breaking functionality in the product. In addition to working with IDM this week, I'll be attending several sessions on the SSO solution that SAP purchased from SECUDE last year.  Now that a year has gone by, the product should be fully integrated into the SAP universe and I'm very interested in learning more about it. I was strangely surprised to see very few, if any, SAP GRC solutions in the session listings.  Hopefully, I'll be able to find out what's going on with that. On the other hand, there will be several Virtual Directory Server related sessions which should be quite informative about connecting to various systems and web services.

I'm sure that we will hear the latest news about SAP IDM 7.2.  Service Pack 6 is due shortly and I'm looking forward to getting a few rumors confirmed.  Probably the one to be confirmed first will be around DB2 support. This will be very good for IBM shops where DB2 is used to the exclusion of the other supported databases in IDM, Microsoft SQL Server and Oracle.  This adds greater flexibility to my thoughts in choosing an IDM solution, as one can now expand the database criteria and will answer the pleas for support from many SAP customers that want to get involved with IDM. There are also some rumors about new and improved tools along the lines of the Configration Analyzer.


Also rumored are some MMC improvements, although I have not yet gotten even a rumor of when a redesigned administrative console will be available, although I am assured that it is indeed on the list. I'm hoping to get some information on this during the SAP  NetWeaver ID Management - Latest Functionality and Demo session scheduled for tomorrow.  Hopefully, I'll have some exciting news for the SAP IDM community.

I'm looking forward to seeing / learning / connecting and reconnecting during the week.  Odds are you'll find me at the various IDM and SSO sessions this week if you're here.  Please feel free to introduce yourselves.  I'd like to try and organize some sort of IDM meet up this week, maybe a drink or two one night.  I've received some interest in this.  If you have not contacted me yet, please leave a comment or email me privately.

Watching $'s in JavaScript

Every time I write a script that uses repository constants, I always have trouble remembering how to pass their values properly.  Hopefully this posting will make me remember.

Both the "%" and "$" characters are used by JavaScript, so if the following code is encountered you will get an error:

var LDAP_SEARCHURL = "ldap://" + %$rep.LDAP_HOST% + ":" + %$rep.LDAP_PORT% + "/" + %$rep.LDAP_STARTING_POINT% + LDAP_SEARCH;

The dollar sign is used for calling a type of function and I believe the percent symbol is used for a mathematical operation. The solution is simple, just place the constants in quotes:

var LDAP_SEARCHURL = "ldap://" + "%$rep.LDAP_HOST%" + ":" + "%$rep.LDAP_PORT%" + "/" + "%$rep.LDAP_STARTING_POINT%" + LDAP_SEARCH;

It seems that IDM is smart enough to evaluate the value in the quotes and realize that the value is a repository constant and evaluate the value properly.

Thursday and Friday @ TechEd 2011

What can I say? The last two days of TechEd completely blew me away!

I started off by seeing a demo of the latest version of NetWeaver Identity management (7.2). Not even sure where to start! Role and Privilege Contexts, more on RESTful interfaces, increased dispatcher tuning, additional event tasks! Wow, I can't believe how much more powerful this application has become!

The Context concept is fully integrated into NW IDM 7.2.  Adding a context layer when working with NW IDM Roles and Privileges is going to greatly simplify management of these objects.  I'm looking forward to reading and learning more about them as we begin to determine best practices.  I know this is going to become a large part of my toolkit when planning new deployments.

Troubleshooting IDM has always been a challenge, however after learning about the new tracing functionality and the new script debugger, I think some of my headaches will start to go away.  I'll be blogging more about these features in the near future.

The presentation on IDM workflows was very interesting.  I was pleased to see that the Development Team continues to simplify workflow approvals in general and Pending Value Objects in particular.

Finally I attended a fantastic presentation on how SAP is using IDM and other Identity and Access Management technologies internally. This was an amazing insight into how a company manages several million users and objects in a live setting.

I can't wait to get my hands on the product.  Rumor has it that 7.2 is very close to release, hopefully early in the 4th quarter of this year.  

Wednesday @ Teched 2011

Some great sessions on the RESTful interface and integrating with SAP BW.

It looks like NW IDM 7.2 is going to have some really killer features.  From the looks of the RESTful interface presentation, it will be possible to have quite a bit of NetWeaver Identity Management functionality in a number of different environments, including iOS and Android devices.  (The live iPad demo blew me away) I'm thinking the days of complaints about the NetWeaver IDM interface are coming to an end.

There is a misconception in SAP-land that Identity Management is a stand-alone and peripheral part of SAP.  The presentation on BW integration sure put that to rest. With a few steps (including a VDS Configuration) IDM data can be pushed to BW and used in all kinds of interesting ways. Once the data is in IDM the standard reports show all kinds of historical and entry based information. lots of it one might think is not available from outside of IDM. The additional ability to create custom reports means that the sky's the limit!  Can wait to start taking advatage of this technology.

This could also be a rare two post day if I can get the Thursday update in as well. Stay Tuned!

TechEd 2011

Time for a new series of TechEd Reports.  Had a great time Sunday night meeting up with a bunch of folks from IDM, SSO, and SAP Security. Interesting conversation about some new features coming out in the near future.  Hopefully we'll get some official announcements this week.

Strangely enough Day 1 did not have a lot of specific IDM related content.  However, that's not to say that I did not attend any sessions.  Had an interesting overview of RESTful interfaces and how they are used in other parts of SAP-land and an interesting session on some BASIS basics, which unfortunately was more about tuning than administration, but it was still interesting!

There was also a POD session about the 7.2 release which was a nice showcase of new functionality.  It also seems that we're getting close to a release date for 7.2.  Rumor has it that we are now looking at mid-to-late October.

I wonder what's coming out first, IDM 7.2 or the iPhone 5?  Both products we're hearing lots about and we know are just about ready, but no one's giving any firm dates.

Tomorrow promises to have a number of hands on sessions.  Can't wait!

Fitting It Into the Schedule

This title applies to more than one aspect of my Identity Management life these days. I've been very busy which accounts for the lack of blog entries lately.  It's not that I don't have what to write about.  It's more about finding the time to do it.  

I was given an interesting challenge lately.  We have a number of tasks on the current project that only need to run once a month., which is not a frequency that is supported by the IDM scheduler. There's actually a few ways to handle this. Most of which revolve around finding the batch file that is created when job is first run and tying this into the scheduling utility of your choice.

However, I was really interested in finding a way that would work within the IDM framework. So I came up with this little script:

// Main function: scheduler

function scheduler(Par){

//Only run the task on a particular day of the month.

//Should only be called from the Initialization script of a maintenance job.

//Created by: Matt Pollicove 7/7/11

//NW IDM Functions used in this script:

//uStop();

//uGetPassSubject();

//uWarning();

//*****

//NOTE: Requires an external Job Constant called Runday that is set to the

//two digit day of the month that the task should be executed on or this value

//must be hard coded

//Parameters for the task.  Name of the pass/task and what the legal execution day is

var strJobName = uGetPassSubject();

var strRunOnThisDay = '%$runday%';

//What's today's date and what is the actual date.

var strDate = '%$ddm.date%';

var strToday = strDate.substring(3,5);

//Put it all together

if (strToday != strRunOnThisDay){

     uWarning(strJobName + " is not scheduleItd to run on " + strDate);

     uStop();

}         

}

As you can see, it's not terribly complicated, but let's break it down:

The task first grabs the name of the running task for informational purposes.  Then it goes out to find a local constant (feel free to make an adjustment so that it works with a repository or global constant) which holds the day of the month the task should run on.

Once we have this, we do basically the same day with the current date, by getting it from the system parameter %$ddm.date%, and retrieving the date part of the current month.

Then we can compare the two values. If they're equal go ahead, if not, we log a message (another thing that can be taken out if desired) and call uStop().

1. Now to use this functionality we need to do the following:
2. Copy/Paste the script listing above into a NW IDM script.
3. Create the RUNDAY constant.  Remember if you choose to create this as anything other than a job constant, you need to edit the script accordingly.
4. This script could be used in either a managed task (yellow folder section) or a work flow task (although I'm not sure why). But the script should be placed in the "Initialization script" entry on the source tab of the first pass in the job. When running as a managed task, it should be scheduled to run once every 24 hours.

That's about it.  Hope this works for you.  Please remember to share any edits or improvements.

More from the JAR

An ugly issue came up not too long ago on my project.  We were seeing the error messages referencing an mxmc_admin based connection string as mentioned in Too Much in the JAR

So, I said to myself, I know how to deal with this, and proceeded to show off my knowledge by going to the MMC Console, selecting Tools/Option and selected the JAVA tab and found… nothing wrong. Only one extension present, JDBC driver JAR was right.  Felt the virtual pie in the face.

So we started looking.  I did insist that the root of the issue was a JAVA conflict and no one on the team had any real reason to doubt me.

Eventually we found the issue, and it was indeed related to JAVA.  It seemed that there were multiple JDBC drivers installed and like the JARs, this can be a bad thing.

There were two SQL Server drivers specified. It turns out one was for SQL Server 2000 and one for SQL Server 2005.  For reference here are the drivers:

2005: com.microsoft.sqlserver.jdbc.SQLServerDriver
2000: com.microsoft.jdbc.sqlserver.SQLServerDriver

Hope this helps you next time you get a conflict!

The Tao of IDM

The best soldier does not attack. The superior fighter succeeds without violence. The greatest conqueror wins without struggle. The most successful manager leads without dictating. This is intelligent non aggressiveness. This is called the mastery of men. 

So why would I lead an Identity Management blog entry with a quote from the Tao Te Ching? Basically it sums up a recent issue I had in my current project.


As a part of this project, I am helping to get a young engineer familiar with IDM.  Working together we needed to create a query that would return only specific types of users for an IDM export Job.  I explained the basic process for executing the export and watched him work on various queries to return the correct users, while advising him about database structures and useful techniques. As an elaborate query began to take shape it was starting to look way too complicated.  I started thinking that there had to be a better way to accomplish our task.


Then I remembered that since we were doing a "To Database" task we could specify the Identity Store as the source and used the built in editor to build the correct query.  It took seconds to build and we quickly checked the query by doing a copy/paste to Microsoft SQL Server.  It worked perfectly and we were up and running.


Here's an example of the query that we created:

So what's the takeaway on this?  Look to see what the system can do rather than build something from the outside. At the very least, use the tools to build the query and then customize it (just remember that using an external query editor on the edited query make using the built in tool not work). 


And here's how easy it was to generate the query:

There's no need to reinvent the wheel

IDM MMC Navigation Tip

Ok, I won't make this all about the problems with the MMC Console.  We all know what they are. However, one thing that's always ticked me off is navigating through a long list of attributes or scripts.  If that list gets to be too long, it turns into a scrolling list. Of course good naming conventions help, but we'll talk about that another time.

Quite by accident, I discovered that you can click on the list of attributes then scroll through with the arrow keys, and more importantly, if you go to the very top, you are automatically brought to the other end of the list so you can keep on scrolling.

Hopefully this will save you some time, effort and aggravation!

If you didn't write it down, it didn't happen!

We've all been there. It's crunch time. Where did the time go? Weeks of requirement gathering, architecture, development, unit test, integration test, and now go-live with a whole bunch of dependencies and C-level attention is right on top of us.  There's only time to address the last minute issues.

Throughout the project, the PM has been screaming for documentation.  Where's the completed architecture  Where's the test plan that you said you worked against? How about a run-book? And on, and on and on...

Too many architects, leads and engineers regard documentation as a necessary evil at best. Until it comes time that YOU are the one inheriting the project and YOU have to try and understand what some guy did in the past.  If you're really lucky, you know the guy or he's still with the client, or maybe even your practice if you're a consultant.

We all seem to forget that documentation is just as important as any piece of code, fancy database query or complex workflow.  It's the basis for the whole project.  It needs to be focused on just as much as any piece of development or testing.

The fact is, if you have a good design, any engineer can build the solution.  If you have a good test plan, the QA meeting flies right by and the change control board meeting becomes a coffee break rather than a Homeric battle to prove that your solution is up to snuff.

It also benefits you as an architect/engineer/consultant.  If it's written down, it's easy to reference for future work.  Remember, when you're sitting in the corner office as the CIO and someone comes up to ask you "back when you were the IDM lead, how did we do ... ?"  Well if it's written down, you'll know!


What ticks me off even more, is that it's SO easy to create even basic documentation in NetWeaver IDM. Fill in the documentation tab for tasks and folders with a few notes, references and examples. Put some comments in your scripts and then run the system report.  The most you might have to do is install the MMC console on your desktop so that you have access to Office. Then just run a bare bones system report.  Voila!

Just in case you haven't figured it out, I have inherited Phase II of a project with sparse technical documentation and everyone involved in this Phase is paying for it. In reality this is seldom any one person's fault.  There's limited time and multiple pressures as I mentioned in the opening of this essay, however that needs to stop being the excuse.

Based on the lack of documentation created in the past, there's increased attention on design and architecture documents, so at least the lesson has been learned in this situation.

It sure would have been easier to write if there was even some documentation.  Now I'm living in a world where nothing was written down, so I don't know what happened!

A Penny for Your Query?

Over the years, I have begun to build up a small library of useful queries and query techniques, some of which I have shared in past posts.

Probably my most frequently used query is actually a two parter, the first part is pretty straightforward:

select distinct mskey from mxiv_sentries where searchvalue = ‘mapo’

This is a pretty basic query that simply grabs the MSKEY of a given Identity Store object. This is really interesting when you combine these results with this query:

select attrname, searchvalue, aValue from mxiv_sentries where mskey = 123456 order by attrname

Basically, it grabs the relevant attributes that match up with the MSKEY that we just found.  Most of the time, I'm using this to find user information, but I've been known to use it on roles and privileges as well. For extra visibility, I'll also throw an "order by" clause on the end to get better access to custom attributes depending on which side of the alphabet they are in.  Possibly the only good thing about all of those "MX_" attributes is that they all sit in the middle of the list.

What queries do you use a lot?

UPDATE:

Just as an idea of what you can do to expand on this basic technique, here's a query I developed that gets the user's Manager name assuming that the user's PerNr and PerNr of the user's manager is in IDM (this usually happens from the HCM feed)

select searchvalue from mxiv_sentries where attrname='DISPLAYNAME' and mskey in(select mskey from mxiv_sentries where attrname = 'MX_FS_PERSONNEL_NUMBER' and searchvalue in (select searchvalue from mxiv_sentries where attrname = 'MX_FS_PERSONNEL_NUMBER_OF_MANAGER' and mskey in (select distinct mskey from mxiv_sentries where searchvalue = 'MAPO')));

In a script the searchvalue ("MAPO" in this case) would most likely be the users MSKEYVALUE.

I also too the opportunity to update the first query to read "select distinct..." per my comment to the original post.

It’s Iteration Time

Recently, I had an interesting problem presented to me today that I was able to solve using a seldom used piece of IDM functionality.

The project I am working on had a requirement to read some information in from Active Directory and write it into IDM, but with a twist,  we only needed to get information from certain OUs, about 30 of them.  With this many, it did not make sense to write a separate pass for each and every OU.  That would be unwieldy and a complete pain to administer you’d have to make a new copy of the pass for each OU to be added or delete the pass if it should be removed, too much room for making a mistake. Now if IDM could somehow iterate through the list, we'd be set!

Instead, one of the talented people on the project built a PowerShell script to create a list of OUs that need to be processed and dumps it to a text file. IDM can execute this script using a Shell execute pass.  When it’s done we take that output and dump it into the database using a From ASCII pass.  Now here’s where the fun comes in…

The next pass is a From LDAP pass as one would expect in a reconciliation process. However we’re going to set it up a little differently by using the “Advanced” button to set up a process by which we can iterate through the OUs that we just moved into the database table from the PowerShell script.

To start, configure the Pass as you usually would, set a repository; populate the login name, password and a starting point using one of the OUs that you will be reconciling from.  When it’s all configured correctly, go to the Destination tab and read in the Source Template, now come back to the Source Tab and hit the “Advanced” button.

Set up your database source and SQL statement as you would in any other task.  When you’re done, it should look something like this:

Note that I use a Constant to hold the database connection string.  It saves some time since I don’t have to keep generating it and provides an easy way to update everything when I move from DEV/TEST to PROD.

Now as you recall, up above we set a Starting Point based on one of the OUs from our list.  Now we’re going to change that.  Go back the LDAP URL configuration and replace the OU with the value from our query.  It will look something like this:

Now you might be wondering, why we can’t determine the Datasource Template with the dynamic configuration, well the simple answer is that you just can’t and if you try you’ll be told that it is not possible to discover the schema from a dynamic starting point. However, if you’ve configured everything correctly, go ahead and run the task.  You’ll see that you have just gathered AD User information from a number of different OUs.  Good work!

Time for a REST

Ok, now I really want to work with 7.2!

The REST interface is now available.  Using REST and JSON it is now possible for users to create their own interfaces.  Hopefully I'll be able to start learning more about this soon.

For more information look here: http://www.sdn.sap.com/irj/scn/weblogs?blog=/pub/wlg/24322

Account Logins and Anonymous Access

For a process that is supposed to be all about promoting access, NW IDM certainly has enough ways to prohibit access to the system.

We recently enabled Anonymous Password reset and had a user that just could not authenticate. No matter what they entered they kept getting access denied when they answered their authentication questions.

As a test we had them reset their authentication answers to a single character.  We even tried clearing all the answers by dropping their MX_AUTHQ_00x entries (Set MX_AUTHQ_001 --> {D}, and so on) which had been the previous extreme solution to these problems.

Finally one of the other engineers on the project noticed that MX_FAILEDRECOVER was currently at 4 for the user with 3 being the limit in the system. We then executed our unlock IC user task which resets this value.  The user was then able to authenticate.

Kind of an interesting situation, since the "user" was logging in anonymously, the system was still checking this value before they could reset their password. Nice to see that SAP IDM is on duty and guarding the points of entry to the system.  Time for this user to call the help desk!