Microsoft Identity and Access Management Series v1.4 Release Notes
June 22, 2006
© 2006 Microsoft Corporation. All rights reserved.

Contents

1. Microsoft Identity and Access Management Series v1.4 download and online location
2. Changes in This Version
3. Unresolved Issues and Resolutions
4. Copyright and license agreement

Microsoft Identity and Access Management Series v1.4 download and online location

- Download Center: http://go.microsoft.com/fwlink/?linkid=14842
- TechNet online: http://go.microsoft.com/fwlink/?linkid=14841

Changes in Version 1.4

Version 1.4 of the Microsoft Identity and Access Management Series updates the content to reflect some of the developments that have occurred since the Series was first published. Changes include:

- Microsoft Identity Integration Server (MIIS) 2003, Enterprise Edition with Service Pack 1 (SP1). The guidance was updated to reflect the enhancements in SP1 for MIIS.
- Windows Server 2003 R2. References were added to the new identity and access management features in Windows Server 2003 R2, such as the Active Directory Federation Service and Services for UNIX.
- Third Party Products. Where the papers refer to third-party products, this information has been updated to reflect where mergers and acquisitions have taken place.
- Hyperlinks to External References. Where the papers refer to external documentation and Web pages, the hyperlinks have been checked and updated if required.
- Diagrams and Figures. Many of the diagrams and figures in the series were redrawn to increase clarity and to ensure a consistent style.
- Password Change Security Improvements. Information has been added to suggest ways of increasing security when sending out password notification change messages to e-mail users.
- Password Expiry Notification Messages. Password expiry notification messages only go to Extranet accounts, as Windows notifies Intranet users of when their passwords are about to expire.
- Password Notification Messages for New Users. When the HR Provisioning system creates new users, it now sends out e-mail notification messages to the user's manager that inform the manager whether the password is for the user's intranet or extranet account.
- Existing Organizational Units. The script that creates the organizational units (OUs) in the intranet and extranet Active Directory forests now checks to see if the OUs already exist. If the OUs do exist, the script deletes them and any user accounts they contain, before recreating the OU structure and user accounts.

These changes make version 1.4 of the Microsoft Identity and Access Management Series an even better reference on how to integrate and manage multiple identity stores in heterogeneous environments.

Unresolved Issues and Resolutions

I. Error installing the Identity and Access Management Series Tools and Templates .msi File

By default, Identity and Access Management Tools and Templates.msi installs into the current user's My Documents folder, under C:\Documents and Settings\Username (the %UserProfile% system variable). Using this installation path removes the requirement for the person running the installation file to be a member of the Administrators group.

If the %UserProfile% variable is too long (for example, with a long user name and long domain name as part of the variable), then it is possible for the subdirectories of the Identity and Access Management Tools and Templates to exceed the maximum permitted path length of 260 characters. If this happens, the installation routine displays a message similar to the following:

"The cabinet file '_3DD40A99E1C26C3CF44F5144592F787C' required for this installation is corrupt and cannot be used. This could indicate a network error, an error reading from the CD-ROM, or a problem with this package."

Clicking the Try Again button simply redisplays the same message.

To install the package, carry out the following steps:

1. On the error message box, Click Cancel. A confirmation message box appears.
2. On the confirmation message box, click Yes, then click Close to terminate the installation process.
3. Rerun Identity and Access Management Tools and Templates.msi.
4. On the Select Installation Folder page of the installation wizard, shorten the installation path length, for example by truncating the path "\My Documents\Identity and Access Management Tools and Templates\" to "\My Documents\IdM\"
5. The installation should now proceed normally.

II. Account settings in Provisioning and Workflow paper

The Provisioning and Workflow Paper requires slightly different security settings from the previous papers. To ensure that MIIS can communicate correctly with the Intranet and Extranet Active Directory instances, please carry out the following checks:

a) Verify that the Intranet Active Directory Management Agent's service account MIISADIntranet is added to the Domain Admins group of the na.corp.contoso.com domain.
b) Verify that the Extranet Active Directory Management Agent's service account MIISADExtranet is added to the Domain Admins group of the perimeter.contoso.com domain.

III. Date/Time formats and Character Set configurations for SQL in the Provisioning and Workflow paper

This solution was developed and tested only to support US-English character sets and data formats. In order to provide support for different date/time formats or character sets, it may be necessary to change several settings:

1. Date/Time. Depending upon the format chosen for Date and Time on the server(s) hosting your implementation of this solution, it may be necessary to modify the SQL login profile for the end users of the solution. If these profiles are not modified, it may result in date and/or time conversion errors visible via the GroupPopulator.exe application and the MIISGroupManagement web pages.

   The date/time errors may occur when the regional date/time format configured on the local system differs from the date/time format configured for SQL login settings in Enterprise Manager. If the time on the local system is configured for a format that is not US-English, for example, 31 August 2005, then when the code tries to modify this in SQL through an update statement, SQL will reject the update.

   To avoid errors of this nature, it is necessary to change the SQL login for the user to match the regional settings used on the host system(s). For example, if the date format on the local host system is configured to English (United Kingdom), then the SQL login settings need to be configured to the same format.

   After making a change to the SQL login configuration settings, it may be necessary to reboot the system in order for these new settings to take effect.

   For more information regarding SQL Server logins, please refer to Creating SQL Server Logins at http://go.microsoft.com/fwlink/?LinkId=68047.

2. Character set support. When SQL tables are defined, a collation needs to be defined. A collation specifies the bit patterns that represent each character and the rules by which characters are sorted and compared.

   It may be necessary to create clauses and group names that use non-US-English characters. In order to store these characters correctly within the database, it may be necessary to create tables with a different collation. A table can be created with a different collation by modifying the GroupPopulatorDB.sql file that accompanies the solution. Modify this file to specify a collation that is different from the default (which is SQL_Latin1_General_CP1_CI_AS) that is specific to the language whose characters you require within the group management solution.

   For more information regarding collation options see Collation Options for International Support at http://go.microsoft.com/fwlink/?LinkId=68050.

Copyright and license agreement

© 2006 Microsoft Corporation. This work is licensed under the Creative Commons Attribution-NonCommercial License. To view a copy of this license, visit http://creativecommons.org/licenses/by-nc/2.5/ or send a letter to Creative Commons, 543 Howard Street, 5th Floor, San Francisco, California, 94105, USA.