MIIS What?.

A couple of days ago Miguel Mendoza (The Miguel Mendoza) MVP and one of the DevSynergy guys called me to offer me a little problem with MIIS 2003, after asking MIIS What?, I discovered that there is not much information on the Internet about the development of Applications that involve this application so as a result of the work done to solve the problem and the respective research this Post was generated.

1. What is MIIS?

MIIS is the acronym of Microsoft^® Identity Integration Server (MIIS) 2003, an extremely powerful software tool from Microsoft that allows developing Single Sign-On solutions in distributed environments, this means that users will only have a username and password for all their applications, the new holy grail of organizations with dozens of systems or applications each of them with its own user system.

MIIS allows performing a synchronization between the user systems so that each of the systems has the same username and password, the user will still have to log in through the login of the application they want to use (CRM, SAP, Intranet, Network, VPN, etc) but now they will only have one password and username regardless of how many systems they have, what type of systems they are and when they updated the password. In order to do this wonder MIIS collects information from external sources such as Active Directory, SQL Server, SAP, or anything else it can connect to and mixes the information in a central repository called the Metaverse. Once the information has been collected in the metaverse you can select what type of information is moved to each information system during the synchronization process.

2. How does it work?

After installing MIIS (on WK2003 enterprise), you install the connectors your systems require, for example, the SUN one, the SAP one, the SQL server ones for your applications that store users in SQL, etc. once this is done you configure the applications that want to share users, for example, in SQL there is an Intranet application that uses a list of users with name and telephone, there is SAP and they have an Active Directory service from SUN and from Microsoft. So you configure those connectors, create the metaverse with the minimum information each system requires, point each metaverse field to the fields of the identity system you have, e.g.: ID (User) is accountname in the active directory, while in SAP it is user name and in SQL it is CodigoUsuario, with this information MIIS connects to the systems, extracts the information and creates a single table (metaverse where all my ids, other data and my user information are).

After the metaverse is built it is configured to synchronize all the systems with the AccountName field for example, and this application does a synchronization job so that in all the systems the user is the same.

Each vendor can build connectors for MIIS so that more and more systems can be integrated.

Some of the most used connectors we already named but there are also connectors for Live ID, Microsoft's centralized identities service and which was the object of this problem, The new version of MIIS is Microsoft Identity Lifecycle Manager 2007 (ILM 2007)

3. Understanding the MIIS 2003 Database

The MIIS database is in SQL Server and is made up of a moderately large set of tables of which the three most important are mms_connectorspace, mms_agent, mms_metaverse

From them the following information can be obtained:

a. The list of all the agents loaded in MIIS

select * from mms_management_agent

b. The list of all the connectors (synchronizers)

select * from mms_connectorspace

c. The list and the attributes of the users created by the identity consolidation processes.

select * from mms_metaverse

4. Developing something for MIIS.

Now MIIS has an object model in some assemblies that are available when installing the application, these are from version 1.1. of the framework, so to develop something for MIIS it is recommended to use VS2003, one of the most useful classes is Utils which contains a series of methods that allow you to locate an object (user).

However many things can be done by performing a direct query on the metaverse, (even the most complete examples from the MSDN use this technique), for example if you want to know what user account name Live assigned to a user that you created you can do something like select LiveAccount from mms_metaverse where AccountName = ‘jpelaez’, it is important however to verify that an index exists (they are created in the MIIS console) for the AccountName field so that the performance of the query is effective.

5.Resources:

http://www.server-management.co.uk/index.php?option=com_content&task=view&id=130&Itemid=50

http://www.puttyq.com/

6.Examples

Delegated provisioning of user groups using MIIS 2003

http://www.microsoft.com/technet/technetmag/issues/2006/07/Automate/

Workflows for user approval using MIIS 2003

http://www.microsoft.com/technet/technetmag/issues/2007/05/Workflow/default.aspx?loc=es/

I hope it is helpful.

Juan Carlos Peláez

MCTS

Member of the Microsoft Andino Speaker Group

Member of the Microsoft Influencer Framework Andino.

Keywords: MIIS 2003, Single identity, Windows Live ID, mms_metaverse, metaverse, password synchronization, user synchronization, Single Sign-On.