A challenge when provisioning accounts to Active Directory using FIM / MIM is how to securely set the initial password and communicate that password to the new user so that they can logon to their computer.
In this blog posting I describe a solution that leverages activities available in the MIMWAL to do the following:
- Configure a Random and Complex Password
- Sets the Password on the Active Directory User Account that was Provisioned by FIM
- Emails the Password to the User’s Manager
A Wiki article exists on TechNet describes some steps that can be taken to achieve these same results. However, the issue with that solution is that it is dependent on a classic synchronization rule based on an Outbound Synchronization Policy (MPR, sets, and workflow) for account provisioning. Many of us have moved to the more desirable method for account provisioning using an Outbound Scoping Filter. My solution supports the latter scenario as there is no dependency on the FIM Synchronization service. Instead it uses MIMWAL workflow activities to achieve the same end state.
So, what’s required?
Requirements
- You must have the MIMWAL installed. The MIMWAL is a Workflow Activity Library (WAL) for building complex workflows in the Microsoft Identity Manager (MIM) 2016 and Forefront Identity Manager (FIM) 2010 R2 solution which was made publically available in January of 2016. For more information about the MIMWAL to include project source code, releases and documentation, and discussion forums visit http://microsoft.github.io/MIMWAL/. Installing the MIMWAL can be tricky. Fortunately I have a blog post that can help you through the process here.
- You should already be provisioning users to Active Directory as that is out of scope for this blog posting.
- You must be synchronizing the ObjectSID from Active Directory back to the FIM Service.
High Level Steps
So, with that, we’ll look at what needs to be configured. The high level configuration steps are as follows:
- Configure Email Template
- Configure Workflow
- Configure Management Policy Rule (MPR)
- Make the Manager attribute required on User Create
- Initialize
Now we’ll look at each of these steps in detail
Step 1. Configure Email Template
Create a new Email template with settings in screenshot below. The body html can be downloaded from here and of course, you may adjust as desired.
The configuration in this activity will result in an email being sent to the user’s manager that looks like this (screenshot below):
Step 2. Configure WF
You will need to create an Action Workflow as depicted in the screenshots below.
The workflow has three MIMWAL activities (screenshot below) that will generate the password, send an email to the user’s manager, and then set the password on the account in AD and flag the account so that the user will have to change the password at first logon.
A screenshot of the MIMWAL Update Resource Activity is below. We use the RandomNum function in this activity to ensure that the password will be random, add some text to ensure that we meet password complexity and save the password in the WorkflowData as “WorkflowData/Password” where it can be used later. We use this [//WorkflowData/Password] in the HMTL of the email template so that the new password would be listed in the email and use it in the PowerShell script that sets the password of the user account in AD.
A screenshot of the MIMWAL Email Notification Activity is below. In this activity we send the email containing the new password to the user’s manager. We specify the template we created earlier by using an XPATH filter that specifies the ObjectID for the template.
A screenshot of the MIMWAL PowerShell Script Activity is below. The powershell script utilized the ADSI provider to connect to AD, sets the password on the account, and sets the account so that the user is required to change their password at first logon. You may download the PS script here. Two parameters (AN and AP) are set in the activity to allow the user’s Account Name (AN) and new password (AP) to be passed along to the script.
Step 3. Configure MPR
We need the _AD Password workflow that we created above to kickoff after a user has been provisioned to AD. The reason is rather obvious; you can’t set the password or require password change at next logon flag until the account has been provisioned. So, the process will require two sync cycles to complete; (1) Provision Account to AD, (2) Set Password and Password Change at Next Logon Flag, Email Password to Manager.
What attribute on a user object in FIM / MIM can we use that tells us that user has been provisioned to AD? It’s the Resource SID which is the objectSID of the user account in AD. So, you must make sure that you are synchronizing this attribute into FIM. This attribute is required for the user to authenticate against the FIM / MIM Portal or FIM / MIM SSPR so in most cases your environment would be configured this way.
So, to kick off the _AD Password workflow, we create a Request MPR that looks for writes to the Resource SID in FIM as depicted in the screenshots below.
Step 4. Make the Manager Attribute Required on User Create
We need the manager to receive the password for the new user. One way to ensure that is to require that when a user is created in the FIM Portal that the Manager attribute is specified. To achieve this, replace this line in the “Manager” control of the User Create RCDC
my:Property my:Name="Required" my:Value="{Binding Source=schema, Path=Manager.Required}"/>
with
<my:Property my:Name="Required" my:Value="True"/>
The RCDC should look like the screenshot below when edited:
If someone tries to create a user and hasn’t specified manager, they will receive the following message when submitting the request (screenshot below).
Step 5. Initialize
To initialize the configuration you will need to:
- Complete a Delta Import on the FIM Service MA followed by a Full Sync on the FIM Service MA.
- Create your user account in FIM
- Complete a Sync cycle so that the new user is provisioned to AD
- Complete a second Sync cycle so that the password is configured and set on the user account in AD, the user account in AD is set for change at next logon, and the manager is emailed with the user’s Account Name and Password.
I hope you found this posting helpful. As always, post your questions/comments. Thanks!
Matt
Hello, Matthew!
I’m trying to implement your solution with MIMWAL and have a problem.
Users are created in AD, but manager don’t receive a email.
I think that a problem somewhere in Outbound sync rule, you don’t write anything about flows needed in it.
As I understand, in Sync rule we also need two flows:
Some strong (temporary) password to create a user account, ie.
P@ssw0rd -> unicodePwd
And “checkbox” to recreate password at first user login:
0 -> pwdLastSet
With this two options (without MIMWAL) users are created in AD.
After I add MIMWAL users get a new password (which is unknown to me and manager).
Service account can get access to mailbox and send/receive emails.
Can you, please, help with troubleshooting?
Thanks!
Hi Oleksandr,
That’s good that you are getting the account created in AD. The email is generated after the account has been provisioned to AD when the new account is synced back into MIM. The workflow that sends the email kicks off because there is an MPR that applies when the objectSID attribute from AD gets assigned to the ResourceSID attribute in MIM.
Its not required to sync “unicodePwd” when provisioning a new user to AD. If you choose not to, AD will assign a random password to the user and the account will be in a disabled state. If you go this route, then you will need to update the PS script on the “Set Password on AD Account” activity of the “_AD Password” workflow so that the account is enabled when the activity sets the new password. Just add the “$accountToSetPW.put(“userAccountControl”, 512)” to the script:
#Param($AN,$AP)
$root = [ADSI]”
$searcher = New-Object System.DirectoryServices.DirectorySearcher($root)
$searcher.Filter = “(&(objectClass=user)(sAMAccountName=$AN))”
$user = $searcher.FindOne()
$userPath = $user.Path
$accountToSetPW = [ADSI]$userPath
$accountToSetPW.SetPassword($AP)
$accountToSetPW.put(“pwdLastSet”, 0)
$accountToSetPW.put(“userAccountControl”, 512)
$accountToSetPW.SetInfo()
We do not need to sync the “pwdLastSet” in the Portal Sync rule as we are handling that in the PS script in the “$accountToSetPW.put(“pwdLastSet”, 0)” line.
It sounds to me like the workflow that generates the email and sets the random password is not firing. Again, this happens later after you have already provisioned to AD when the objectSID from AD is set on the ResourceID in the FIM Portal. This happens on the MIM MA export. So, check your requests log to verify that the MPR is getting applied and the workflow is firing.
I hope you can get it working!
Matt
So, after last iteration I have:
1. Deleted Initial flows from “User’s outbound sync rule”
– pwdlastSet ->0 when it was deleted nothing changes, so when it is setted in PowerShell code it’s OK.
– P@ssw0rd -> unicodePwd – when my users firstly exported to AD they get this password and enabled account. At second stage they get random password and email to manager.
2. Accounts are created in AD in disabled state and manager don’t get email.
How I can understand what my MPR is not applyed?
Thanks for help!
Hello!
After some testing I disabled and enabled my MRP to see if there are any requests in log.
So, what I foud:
1. If I use your guide and create “request” type MPR it is not applied (disable and enable, no requests).
2. If I use a “Transition In” type MPR and disable and enable policy – it works.
So, maybe it would be better to use “Transition In” MPR? What do you think?
I’m using a “static” list of test users with direct choose with employeeID. In prod I will use dynamic list.
That’s strange that the Request MPR is not working. Did you validate that the Resource SID attribute is getting populated on the account in FIM? It’s at that time when the MPR would apply. The resourceSID for an account is synced in from AD. By configuring in this manner, you can be assured that the account has been provisioned in AD and then the Workflow can run that will set the initial password. I suppose you could do a set transition MPR by adding people to the set when Resource SID attribute is getting populated in FIM.
Thank you. Good information!
http://talahicc.com/
no prescription pharmacies
aarp approved canadian online pharmacies
canadian drugs without prescription
online pharmacies of canada
Very good postings. Thanks a lot.
http://www.canadianpharmacymsn.com/
canadian pharmacy viagra canadianpharmacy cheap canadian drugs canadianpharmacy
prescription price comparison
canada pharmacies
canadian pharmacy king
safe canadian online pharmacies
canadian pharmacy without prescription
best price prescription drugs
You said it perfectly.!
http://canadianpharmacymim.com/
best online pharmacies no prescription canada pharmacy best online international pharmacies canada drugs online
best online international pharmacies
canadian pharmacy without prescription
drug stores near me
canadian meds
best online international pharmacies
canadian meds
Seriously all kinds of fantastic info!
http://canadianpharmaciesnnm.com/
reputable canadian mail order pharmacies trust pharmacy canada best canadian online pharmacy trust pharmacy canada
canadapharmacyonline com
best online pharmacy stores
cheap canadian drugs
mexican pharmacies online
price prescription drugs
mexican pharmacy online medications
Position well regarded!.
http://canadianpharmaciesnnm.com/
prescription drug online pharmacies of canada international pharmacies that ship to the usa trust pharmacy canada
canadian pharmacy
prescription online
canadapharmacy
drugs for sale
cheap prescription drugs online
mexican pharmacies
Wow loads of wonderful advice.
http://canadianpharmacymim.com/
online pharmacy canada canadian drugs canadian pharma companies mexican pharmacies shipping to usa
canadian pharmacies that ship to us
no prescription pharmacies
prescription drugs online without doctor
canada drugs online
medical information online
buy cialis
Useful advice. Thanks.
http://canadianpharmacysilo.com/
highest rated canadian pharmacies canada online pharmacies canada drugs canada drug
drug stores near me
drug prices comparison
canadian pharmacies without prescriptions
no 1 canadian pharcharmy online
best online pharmacies canada
canadian pharmacies shipping to usa
Terrific write ups. Cheers.
https://nicktambone.com/
board of pharmacy canadian cialis no prescription online pharmacy canadian pharmacies
canadian pharmacy without prescription
web medical information
rx online
top rated online canadian pharmacies
reputable canadian mail order pharmacies
buy prescription drugs from canada
With thanks! Numerous information!
http://canadianpharmacyntx.com/
canada meds canadian pharmacies that ship to us most reliable canadian pharmacies canada drugs online
cheap prescription drugs
canada pharmacies online prescriptions
candrugstore com
canadian pharmacy
prescription drugs canada
buy prescription drugs online
Kudos. I enjoy this.
http://www.canadianpharmacymsn.com/
online canadian pharcharmy trust pharmacy canada no prescription online pharmacy canadian pharmacies-24h
online pharmacy
the canadian pharmacy
best price prescription drugs
mexican pharmacies shipping to usa
online pharmacy without a prescription
canada pharmacies without script
You said it adequately.!
http://canadianpharmaciescubarx.com/
prescription drug northwestpharmacy buy prescription drugs without doctor canadian online pharmacies
compare prescription prices
canada drugs online pharmacy
canadian pharmacy no prescription needed
canadian pharmacy meds
pharmacy prices compare
drug prices comparison
This is nicely said! !
http://canadianpharmaciescubarx.com/
canadian rx canadian online pharmacies no prescription pharmacies mexican pharmacies shipping to usa
canadapharmacy com
canadian online pharmacy reviews
rx online
best canadian mail order pharmacies
pharmacy online mexico
cheap drugs online
Nicely put. Cheers.
http://canadianpharmacysilo.com/
mail order pharmacies trust pharmacy canada canada meds canadian drugs
the canadian pharmacy
compare rx prices
internet pharmacy
pharmacy prescription
the canadian pharmacy
online prescription drugs
Factor nicely taken!!
http://canadianpharmacysilo.com/
canadian rx aarp approved canadian online pharmacies best online canadian pharcharmy canadian cialis
legitimate canadian mail order pharmacies
buy drugs online
prescription drugs prices
safeway pharmacy
pharmacy cost comparison
canadian pharmacy viagra brand
Kudos! An abundance of advice.
http://canadianpharmacysilo.com/
get prescription online canadian pharmacies without an rx pharmacy price comparison canadian pharmacies
canadian pharmacy king
canadian pharmacy viagra brand
canada pharmacy online
canadian cialis
pharmacy prescription
canada pharmacies online
Lovely facts, Many thanks!
https://nicktambone.com/
compare prescription prices canadian pharmacies canadian pharmacies online prescriptions canadian online pharmacies
no prescription pharmacies
canada pharmacy online
canada drugs pharmacy
get prescription online
canada pharmacy online no script
canadian pharmacies that are legit
Great stuff. Thanks a lot.
http://canadianpharmacyntx.com/
cialis canadian pharmacy canada pharmaceuticals online canada pharmacies top rated canadian pharmacies online
prescription price comparison
canadian pharmacy 365
canadianpharmacy
online pharmacies canada
canadapharmacy com
no 1 canadian pharcharmy online
You said it nicely.!
http://canadianpharmacysilo.com/
canadian pharmacies top best north west pharmacy canada best canadian online pharmacy top rated canadian pharmacies online
canadian prescription drugstore
canadian drugs without prescription
drug price
medical information online
best canadian pharmacies
online pharmacies canada
You mentioned it very well.
http://canadianpharmacysilo.com/
cialis online aarp approved canadian online pharmacies rx pharmacy northwest pharmacy
discount prescription drugs online
canadian meds
canadian meds
canadian online pharmacy
rx pharmacy
canadian prescription drugs
Appreciate it, Quite a lot of advice.
http://canadianpharmaciesnnm.com/
northwest pharmacy global pharmacy canada online canadian discount pharmacy mexican pharmacies shipping to usa
price prescription drugs
buy prescription drugs from canada
canadian drug store
no prescription online pharmacy
online pharmacy no prescription needed
canada drugs online pharmacy
Superb content. Many thanks.
http://talahicc.com/
online pharmacies no prescription canadian pharmaceuticals online drug stores near me canada drugs
discount prescription drug
prescription drugs online without
buying prescription drugs canada
buying prescription drugs canada
canada pharmacies online
buy prescription drugs from canada
Very good advice. Thanks a lot!
http://canadianonlinepharmacynnm.com/
canadian prescription drugstore northwestpharmacy canadian drug stores online mexican pharmacies shipping to usa
canadian prescriptions
canadian pharmacy viagra
most reliable canadian pharmacies
best online pharmacy
prescription without a doctor’s prescription
overseas pharmacy forum
Truly quite a lot of beneficial advice.
http://canadianpharmaciesnnm.com/
overseas pharmacies london drugs canada canadian pharmacy viagra brand canadian pharmacy
canada pharmacies without script
canadian pharmacies online
buy cialis
trust pharmacy canada
best online pharmacies no prescription
canadian drug
You actually expressed it terrifically!
https://nicktambone.com/
online pharmacy no prescription canadian pharmacies without an rx cialis online north west pharmacy canada
canadian pharmacy
drug costs
best price prescription drugs
prescription without a doctor’s prescription
canada pharmacy online orders
medication costs
You mentioned this wonderfully!
http://canadianpharmacymim.com/
pharmacy canada canadian drugs international pharmacies that ship to the usa canadian online pharmacies
canada pharmacies
no prescription online pharmacy
approved canadian pharmacies online
prescription price comparison
pharmacy prescription
canadian pharma companies
Seriously tons of fantastic data!
http://www.canadianpharmacymsn.com/
canadian cialis north west pharmacy canada best canadian prescription prices canadian pharmacies online
canadian pharmacy online
buy drugs online
canada pharmacy online orders
canadian viagra
cheap drugs online
canadian meds
Kudos. I value this.
http://canadianpharmacyntx.com/
canada drugs canadian pharmacy online pharmacy reviews canadian pharmacy
mexican pharmacies online
us pharmacy no prior prescription
overseas pharmacy forum
canadian prescriptions
online drugstore
visit poster’s website
Truly quite a lot of superb info.
http://canadianonlinepharmacynnm.com/
pharmacy canada canada drugs drugs from canada canadian pharcharmy
prescription online
prescription drugs online without
prescription drugs canada
buy prescription drugs from canada
discount pharmacy online
canadian drugs without prescription
Thanks a lot, I appreciate this!
http://canadianpharmacyntx.com/
highest rated canadian pharmacies canada pharmaceuticals online pharmacies in canada canadian cialis
canadian pharmacy no prescription needed
canadian pharmacy meds
canada pharmacies online pharmacy
cialis online
top rated online canadian pharmacies
international pharmacies that ship to the usa
You actually revealed it fantastically!
http://www.canadianpharmacymsn.com/
cialis online canada pharmaceutical online ordering trust pharmacy canada canada pharmaceuticals online
discount prescription drug
mexican pharmacy online
mexican pharmacy online
online canadian pharmacies
highest rated canadian pharmacies
highest rated canadian pharmacies
Kudos! I appreciate it!
http://talahicc.com/
mail order pharmacies london drugs canada king pharmacy top rated canadian pharmacies online
best online pharmacy stores
online drugs
legitimate online pharmacies
mail order pharmacy
board of pharmacy
prescription drugs online without doctor
Truly loads of wonderful information!
https://nicktambone.com/
buy prescription drugs canada canadian viagra canada meds canadian pharcharmy
canadian rx pharmacy online
buy cialis
canada pharmacies prescription drugs
prescription cost
no prior prescription required pharmacy
drug prices comparison
Amazing information. With thanks.
http://www.canadianpharmacymsn.com/
buy drugs online northwest pharmacy pharmacy prices canadian pharmacies that ship to us
pharmacy prices
pharmacies near me
canadapharmacy
pharmacy online
overseas pharmacies
drug prices comparison
Nicely put. Many thanks!
http://canadianpharmaciesnnm.com/
best non prescription online pharmacies canadian pharmacy canada pharmacy online reviews canadian pharmacy
mexican online pharmacies
rx price comparison
us pharmacy no prior prescription
walmart pharmacy price check
canada drugs
prescription drug cost
You have made your point.
https://nicktambone.com/
highest rated canadian pharmacies global pharmacy canada canada drugs pharmacy mexican pharmacies shipping to usa
canadian pharmacy no prescription needed
pharmacies near me
canadian drug
canada pharmacies online
no 1 canadian pharcharmy online
canada pharmacies online pharmacy
Nicely put. Thanks.
http://canadianpharmacysilo.com/
top rated online canadian pharmacies global pharmacy canada canadian drugstore online canadian pharmacies
drugstore online
pharmacy near me
canadian pharmacies online prescriptions
canada pharmacies online pharmacy
canadian drugstore
no prescription online pharmacy
Many thanks, A good amount of stuff!
http://canadianpharmacymim.com/
canadian mail order pharmacies canada drugs prescription prices comparison canada drugs online
canadian drugstore online
prescription drugs online without doctor
prescription without a doctor’s prescription
us pharmacy no prior prescription
best online international pharmacies
mexican online pharmacies
You stated that exceptionally well.
http://canadianpharmacymim.com/
northwestpharmacy trust pharmacy canada northwestpharmacy canadian pharmacies-24h
canadian pharmacies that ship to us
ed meds online
discount prescription drug
canada pharmacy online
international pharmacies that ship to the usa
discount drugs online pharmacy
With thanks! Plenty of material.
http://canadianpharmacymim.com/
canadian drugstore reviews canadian drugs pharmacy prescription london drugs canada
canada meds
buy drugs online
canada pharmacies prescription drugs
canadian rx pharmacy online
prescription price comparison
pharmacy online
Seriously loads of fantastic tips.
http://canadianpharmaciescubarx.com/
online rx pharmacy canadian cialis canadian pharmacies online prescriptions canadian pharmaceuticals online
online canadian discount pharmacy
prescription drugs prices
pain meds online without doctor prescription
cialis canadian pharmacy
canadian pharmacy online
best online pharmacy
You made the point!
http://talahicc.com/
safeway pharmacy online pharmacies of canada canada pharmacies online london drugs canada
online pharmacy without prescription
prescription cost comparison
internet pharmacy
canadian cialis
canadian pharmacy reviews
canada meds
Many thanks, Quite a lot of stuff!
http://talahicc.com/
canadian pharmacies shipping to usa north west pharmacy canada prescription drugs prices canadian pharcharmy
canada pharmacy online
canadian cialis
pharmacy online
canadian pharmacy meds
pharmacy prices
prescription drug
Seriously loads of very good knowledge.
http://canadianpharmacyntx.com/
best canadian prescription prices northwestpharmacy canadian pharmacy 365 canadian pharmacies-24h
prescription drugs online without
drugstore online
canada pharmacy online orders
buy drugs online
canadian pharmacies top best
canadianpharmacy
Thank you, I like it.
http://canadianpharmaciesnnm.com/
canadian pharmacies that ship to us canadian pharmacy online online pharmacies no prescription trust pharmacy canada
best online pharmacies no prescription
canadian meds
mexican online pharmacies
online pharmacy
pharmacy online
mexican pharmacies online
Nicely put. With thanks!
http://canadianpharmacysilo.com/
drug prices comparison trust pharmacy canada pharmacy prices online pharmacies canada
canadian online pharmacies prescription drugs
canada drugs online
mexican pharmacies online
pharmacy prices compare
best online canadian pharcharmy
canadian online pharmacies prescription drugs
Effectively voiced truly. !
https://nicktambone.com/
ed meds online canadian pharmacy safeway pharmacy canadian pharmacies
no prescription pharmacy
mexican online pharmacies
internet pharmacy
drugstore online
rx online
canadian drugstore
Fantastic tips. Thank you!
http://canadianonlinepharmacynnm.com/
prescription drugs canada online pharmacies canada canada drugs online canada pharmaceuticals online
pharmacy online
canadian rx pharmacy online
buy online prescription drugs
prescription drugs online without
pharmacy prices
prescription without a doctor’s prescription
Very good content. Appreciate it.
http://canadianpharmaciesnnm.com/
mexican pharmacies shipping to usa canadian pharmacies without an rx get prescription online canadian pharmacies that ship to us
discount drugs online pharmacy
mexican pharmacies
legitimate online pharmacies
canadian pharmacy uk delivery
the canadian pharmacy
canada online pharmacies
Nicely put. Regards!
http://canadianpharmacysilo.com/
canadian prescription drugs northwest pharmacy buy drugs online canada pharmaceuticals online
canadian pharmacy online
legitimate online pharmacies
mail order pharmacy
mail order pharmacies
online drugstore
canadian prescription
This is nicely put. .
http://talahicc.com/
canadian pharmacy viagra brand canada drugs online prescription drug assistance canada pharmacy online
canadian pharmacy
canadian drug store
most reliable canadian pharmacies
best price prescription drugs
best online international pharmacies
canada drugs online
Awesome content. Thank you!
http://canadianonlinepharmacynnm.com/
onlinecanadianpharmacy.com aarp approved canadian online pharmacies legitimate online pharmacies top rated canadian pharmacies online
pharmacy cost comparison
walmart pharmacy price check
canadian rx
online canadian discount pharmacy
canadian pharmacy online canada
<a href="http://www.bryandornan.com/index.php/2010/06/online-reputation-management/#comments?form2mailerror&inquiry=Business+Development&fname=ErnestRet&lname=ErnestRet&email=ernestduh%40gmail.com&company=google&phone1=81193742791&phone2=82546223238&phone3=87658761137&comments=You+suggested+this+really+well.+http://viagrawithoutadoctorsntx.com/+viagra%27s+corporate+office+photos+%3Ca+href=%22http://viagrawithoutadoctormsn.com/%22%3Eviagra+100mg%3C/a%3E+viagra+100+mg+is+safe+%3Ca+href=http://viagrawithoutadoctorsntx.com/%3Egeneric+viagra%3C/a%3E?form2mailerror&inquiry=Business Development&fname=Quentingroow&lname=Quentingroow&email=zittel020eejf@songwriter.net&company=google&phone1=83589666697&phone2=85913899796&phone3=82912844635&comments= Truly loads of beneficial information! http://talahicc.com/ prescription drugs online without doctor north west pharmacy canada visit poster’s website online pharmacies canada mexican online pharmacies drug prices comparison pharmacy canada online pharmacy canada canada pharmacies without script canadian pharmacy meds“>best online canadian pharcharmy