MIM Archives - IdAM Thoughts

Terminology Comparison: MIM vs SailPoint IDN

So I’ve been learning SailPoint IdentityNow (IDN) and I am rattling my brains trying to match what I know about MIM and make sense in my brain and relate to the terms and how they are the same/similar but have different names in each product.

I have done up a little comparison table showing the most common things I have understood till date and tried to put it in words the way they are termed differently in MIM and IDN.

I am not an expert in either and not saying they are essentially correct or which product is better than other (btw there is no right answer to that – each have clear pros and cons depending on what you want in a product) but just trying to bridge the gap on understanding what they are in each.

	MIM	SailPoint IDN
Data Type	Has various like integer, string etc.	Everything is defined as string essentially.
Connection	Direct via MA which has config parameters.	Done via a VA (Virtual Appliance) which is a lightweight custom Linux VM deployed at customer side (think of it as a secure tunnel from cloud IDN to your network).
Management Agents (MA)	Individual connectors connected to sources.	Called a Source - Downstream or upstream.
Connector Space (CS)	Staging area for data in a connector.	Shows up in the Accounts tab in the Source.
Disconnectors	Objects which had not connected to MV.	Called "Uncorrelated Accounts" under the import data tab of the source.
Metaverse (MV)	Where all the identities are connected to each MA and the fullest form of it in essence.	Identity List which has links to all the sources.
Projection & Provisioning	Each MA has the rules and mappings to project a CS into MV and to the external source as well.	Each Identity Profile has a mapping against a source and also provisioning rules. Sources which have an Identity Profile are also called Authoritative Source and ones which't don't are called Non-Authoritative.
Join Rules	Rules which join CS objects to MV based on defined criteria.	Called "Correlation" in the Source where we define those criteria.
Groups	AD or MIM Groups	Called Entitlements. It doesn't show groups as MIM does i.e. Group Management is not a thing. You do User Management with entitlements i.e. group membership.
Import	Importing objects from a connector to CS.	Called "Account Aggregation" or "Entitlement Aggregation" which brings in the data.
AD Password Sync from DC	Done via PCNS	Done via PWI (Password Interceptor)
AD Write	Direct via ADMA	Needs a domain joined computer with IQService installed.
Automation of logic	Sets / MPR and Workflows in MIM Portal.	Does it via Access Profiles , Roles and Identity Profiles in IDN Portal.
Advance Rules	Done via Workflows and other advanced methods like MIMWAL etc.	Called Rules written in JAVA/BeanShell wrapped with XML.
Under the hood config	Lot of config is exported and modified in XML.	Extensive API access mainly giving JSON outputs with few XML as well.

Feel free to correct me where I am wrong and / or if you want me to add something else or explain something more in details, do reach out.

Hopefully it made sense to someone!!!

By Piyush Khandelwal, 5 years06/27/2019 ago

MIM

Changing Gears: BBye FIM/MIM – Welcome SailPoint

Been working on FIM/MIM for over 6 years now I think and finally time has come to change to something new. FIM/MIM is good for basic syncs etc but when it comes to reporting and PAM solutions among other things, it lacks teeth. But it is good to know all competitors from marketing and implementation point of view. You know the pros and cons of each!!!

Extremely happy to join the SailPoint Crew and represent them Down Under. They are the market leaders in Identity Governance & Administration. The Gartner report speaks of itself and the difference between the competitors.

Going from one extreme end of the graph to the other. It’s certainly going to be challenging and fun. Looking forward to it!!!

So hopefully I should blog more about SailPoint in the coming weeks from now on.

#ChallengeAccepted

By Piyush Khandelwal, 6 years05/28/2019 ago

MIM

MIMWAL Boolean Comparison: Did I do it wrong?

So I had to do some complex workflows for a client. And you know MIMWAL is best for that.

Now I was going to use the Eq() built in function to do a comparison to see if the attribute is coming back is true. The attribute I was comparing to was a boolean. So in the workflow I used an update resource type and had an activity execution condition that if the attribute is true then run the update.

Naturally I tried this to being with

1	Eq([//Target/BooleanAttr],true)

Umm, didn’t work. Should have matched and executed the WF. Tried various other ways

1

2

3

4

5

Eq([//Target/BooleanAttr],True)

Eq([//Target/BooleanAttr],"true")

Eq([//Target/BooleanAttr],"True")

Eq([//Target/BooleanAttr],$true)

Eq([//Target/BooleanAttr],1)

On doing some debugging I saw that WAL was doing a string comparison to a Int64 type and coming back as a False match even on a (‘True’,’True’) condition.

Then tried something different

1	Eq([//Target/BooleanAttr],ConvertToBoolean(1))

Voila!! That worked. Well I don’t know if I did something or if this is the only way to do a boolean comparison in the Eq() function but hey it worked for me..

Mental note!!!

Edit: So as per comment below did some more testing and the following execution condition code worked 🙂 even with false value it looked for true.

1	ConvertToBoolean([//Target/BooleanAttr])

See.. I told you I did something wrong 🙂

By Piyush Khandelwal, 6 years12/07/2018 ago

MIM

Batch Process an Array via Powershell for FIMService write back (Or any PS scenario)

So,

A long time ago I wrote a post showing how you can do Composite write-back to FIMService via Powershell. That used “Search-ResourcePaged” command from the Lithnet Module. But it’s not helpful in the scenario where you already have a list of users (say an exported CSV or a text file) you want to perform some action on. In that scenario, XPath is not needed (and might not help if there is no pattern to search) as you already have your objects to work on.

So say, for example, I have a list of 10000 objectID from FIM and want to delete them.

Simple way will be

1

2

3

4

5

6

7

8

9

10

11

12

$objects = ("objectID1",

"objectID2",

"objectID3"

........)

$i = 0

foreach ($obj in $objects)

{

Remove-Resource $obj

$i++

write-host "Done $i of" $objects.count

}

Pretty simple but will take about 1/sec and take 10000 seconds to do it.

Yeah I am not going to wait that long…

Did some RnD (and Google) and found some different ways of going about it..

One way was doing ForEach -Parallels flag. I tried it but actually had a reverse affect for me… I did it wrong obviously.. It worked but took long/er for some reason (Even with -throttlelimit set)… Moved on… Went above my head for the limited time I had to do the job.

Then found a pretty simple way to do it online and made some modification to suit my scenario

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

$objects = ("objectID1",

"objectID2",

"objectID3",

.........)

for($i = 0; $i -lt $objects.Count; $i += 1000) #Change 1000 to the number you want to process in a single batch

{

$num = $i + 999 #Change this number to 1 less that the batch number

if ($num -ge $objects.Count)

{

$num = $objects.Count

}

$newarray = $objects[$i..$num]

Remove-Resource $newarray #Delete the Resource from FIMService or you can do any other action like foreach for the $newarray and do a Get-Resource and modify and then save after the loop is over

Write-Host "No of Objects in the batch:" $newarray.Count

Write-Host "Done $num of" $objects.Count -ForegroundColor Cyan

}

Voila!!! it’s done in seconds. It will send batch of 1000 objects at a time to FIMService as a composite request and do them quickly. I did like 10000 in 10-15 seconds or so. You can also import a csv/txt file and create an array as well.

I am not a powershell expert and it may not be perfect or most elegant way of doing it but gets the job done quickly.

You can use the logic for virtually anything and not just to write back to FIMService. But yeah helped me to do large modifications / deletes pretty quickly.

Till the next time…

By Piyush Khandelwal, 6 years06/15/2018 ago

MIM

Powershell Tip: FIM/MIM Explicit Disconnectors be gone… quickly!!!

Happy New Year!!! Hope everyone had a great 2017 and hopefully an even better 2018

If you know disconnectors then you definitely know how irritating the FIM/MIM GUI can be to convert a disconnector from explicit to normal or vice versa when you have potentially 10’s or 100’s of them… Joiner tab isn’t really friendly to select multiple disconnectors and “batch” convert them.

Thanks to Lithnet MIIS Powershell you can do the conversion of 100’s of them in 1 line and in couple of seconds

If you have a MA with 100’s of explicit disconnectors just run the following command (replacing the <MA NAME> with the ….. MA Name )

1	Get-Disconnectors -Type Explicit -MA <MA NAME> \| % { Set-DisconnectorState $_ -Type Normal }

Done… Simples… You can ofcourse do the opposite as well if you wish i.e. Normal disconnectors -> Explicit Disconnectors.

By Piyush Khandelwal, 7 years ago

MIM

Terminology Comparison: MIM vs SailPoint IDN

Like this:

Changing Gears: BBye FIM/MIM – Welcome SailPoint

Like this:

MIMWAL Boolean Comparison: Did I do it wrong?

Like this:

Batch Process an Array via Powershell for FIMService write back (Or any PS scenario)

Like this:

Powershell Tip: FIM/MIM Explicit Disconnectors be gone… quickly!!!

Like this:

MIM

Terminology Comparison: MIM vs SailPoint IDN

Share this:

Like this:

Changing Gears: BBye FIM/MIM – Welcome SailPoint

Share this:

Like this:

MIMWAL Boolean Comparison: Did I do it wrong?

Share this:

Like this:

Batch Process an Array via Powershell for FIMService write back (Or any PS scenario)

Share this:

Like this:

Powershell Tip: FIM/MIM Explicit Disconnectors be gone… quickly!!!

Share this:

Like this: