Group Creation and Provisioning Walkthrough: Scenario Design

Applies To: Windows Server 2003 with SP1

Previous Steps in This Walkthrough

• Overview

Scenario Design

This section discusses the architectural design of this scenario and describes the GroupPopulator management agent, the group definition database table, and the group creation and provisioning cycle.

Architectural Overview

Table 3.1 lists the management agents (MAs) that you use in the Group Creation and Provisioning scenario.

Table 3.1   Fabrikam MAs

Microsoft Identity Integration Server 2003 and all of the management agents are located on the server running Microsoft Identity Integration Server 2003. Active Directory is installed on a different computer (as described below).

To provision the group objects from the GroupPopulator management agent to the Fabrikam AD MA, a rules extension is provided with this scenario. This rules extension extends the Simple Account Provisioning rules extension.

To calculate groups and group membership, a Visual C# .NET application, called GroupPopulator.exe, is provided. This application reads data from the metaverse and writes the results of its calculation to a file. This file is imported by the GroupPopulator MA. The GroupPopulator MA uses a table to read group definitions.

Lastly, the file GroupPopulatorSync.cmd is provided to trigger the group creation and provisioning in Microsoft Identity Integration Server 2003.

GroupPopulator MA

To understand the scenario design, become familiar with the GroupPopulator MA, including:

• Import file structure

• Attribute configuration

• Join and projection configuration

• Import attribute flow configuration

Import File Structure

The attribute-value pair import file that defines the groups and members has following structure:

displayname: Sheelah Basarah
objecttype: person
uid: {385A0A21-65B8-4439-B979-BA157BAB0A6A}

displayname: Department 001
objecttype: group 
uid: 001
member: {385A0A21-65B8-4439-B979-BA157BAB0A6A}
member: {26012FCD-56CF-4CC7-8A1B-A38A97E02385}
member: {7D8BD2F6-0295-4BF1-A088-A25308D652CA}
member: {C2BF1EE4-99D7-42BE-A742-1CA7763B19BD}
member: {2189410B-CA74-4084-A5C7-0F75C3BACFE2}

The contents of this file describe the person and group object types. The members of the groups are person object types in the file. A member does not necessarily need to be a user or person object; it can be anything in the metaverse.

The anchor of the person object type is the uid attribute, which maps to the metaverse objectID attribute.

The anchor of the Group object type is also the uid attribute. However, this is a unique ID that needs to be provided manually during the group definition. The member attribute is a reference to the uid attribute of the person object types. The group-member relationship is set up by using this method.

Attribute Configuration

Table 3.2 displays the attributes that are configured during the creation of the GroupPopulator MA.

Table 3.2   Attributes Configured for GroupPopulator MA

The uid attribute is configured as the anchor attribute.

You use the advanced configuration option on the management agent to define the objecttype attribute as a Define Object Type attribute. This definition is needed to indicate that the import file has more then one object type (in this scenario, person and group).

Join and Projection Configuration

You configure join rules for person and group objects to link to a metaverse object that has a direct match to the objectID attribute of the metaverse object. Table 3.3 lists how the objects and attributes are linked between the connected data source and the metaverse.

Table 3.3   Object Types and Attributes Used for Join Mapping

Projection rules are only configured for the group object type in the connected data sources. This projection is a declared projection to the metaverse group object type, and it creates new group objects in the metaverse.

Import Attribute Flow Configuration

In this scenario, you set up import attribute flow for the group object type only (scoped by Data Source.group and Metaverse.group). Table 3.4 lists the import attribute flow configuration used for the GroupPopulator MA.

Table 3.4   Import Attribute Flow Configuration

The Group Definition Database Table

The group definition table is the core of the scenario and defines how groups and their membership are calculated. The group definition table has three columns:

• groupID: The unique ID of the group.

• displayName: The display name of the group.

• clause: The SQL Server where-clause that is used to select the group members from the metaverse.

The name of the table is GroupDefinitions and it is located within the MIIS_Group_Populator database. Table 3.5 shows a sample row of the group definition table.

Table 3.5   Sample Row from Group Definition Table

This row indicates the creation of a group in the metaverse with the display name of Department 001. The members of this group are all objects in the metaverse of the person object type, and they have the value of the department attribute set to 001.

The clause can be any valid SQL Server where-clause of any complexity. For example, Table 3.6 lists another sample row from the group definition table that uses a more complex SQL Server where-clause.

Table 3.6   Sample Row with Complex SQL Server Where-Clause

This row indicates the creation of a group in the metaverse with the display name of All People with Direct Reports. The members of this group are all objects in the metaverse that have people reporting to them (that is, if the manager attribute is used to express a reporting relationship).

Table 3.7 shows all of the rows that are configured when you set up this scenario.

Table 3.7   Complete Group Definition Table

The Group Creation and Provisioning Cycle

The GroupPopulatorSync.cmd file activates several processes that, when finished, create the groups and group memberships in the metaverse. The GroupPopulatorSync.cmd file performs the following processes:

1. Runs GroupPopulator.exe. The application uses the defined clause to query the metaverse, and then the results of the query are written to a file named Output.txt.

2. Copies the Output.txt file to the MaData folder as the Populate-groups.txt file. This file is imported by the GroupPopulator MA.

3. Runs the GroupPopulator MA. The GroupPopulator MA reads the populate-Groups.txt file as a full import. After this step, all of the groups are populated in the metaverse with membership. Because this is a full import run, all groups that were removed from the group definition table are deleted from the metaverse.

This operation always runs in this exact sequence. It can run as often as required to re-calculate groups by using the GroupPopulatorSync.cmd batch file.

Next

• Implementation Steps