Setting up the MIIS Environment
To help reduce the risk of applying changes back to
the source systems, it is very important that each environment establish
a working account for the MIIS system to use. In our examples, we have
created an account in both domains called MIIS. These accounts should
not be in the administrators or domain administrators group.
Active Directory
It is important that this account not be given too
much access to the Active Directory.
- In the root of the Active Directory domain,
give the MIIS account the following permissions:
- Read
- Replicating Directory Changes
- Replication Synchronization
- In the container or OU you wish to use to
import metaverse data, give the MIIS account the following
permissions:
- Full Control
- These rights could probably be tuned
down finer in order to restrict group policy and some
Exchange attributes, but this setting is the bare minimum
for this container
Exchange Server 2003 (or 2000)
Some mail attributes require read permissions from
the Exchange 2003 organization. It is a good idea to assign the same
MIIS account the following permissions to the Exchange organization:
·
Exchange View Only Administrator
Exchange 5.5
In order for MIIS to write to the Exchange
directory, we repeat a similar process. As before, an account needs to
be created. In our lab, we created a domain account named MIIS and made
sure the account was not added to any administrative group.
Then from the Exchange Admin application, give the
account the following rights:
·
Search Permissions to the Organization
·
View Only Admin to the Site you will connect to for
directory writes
·
Admin to the container the MIIS server will use for
directory writes
Note: In some cases, Search permissions will not
work against the organizational such as when the DS Site Configuration
for the site is incorrect or when the Anonymous account has been
disabled or deleted. In these instances, it you may need to give the
MIIS account greater access to the organization (this does not
automatically give the account permissions to user objects as rights in
the org-level are not inherited down to the site and container levels).
The Admin role is sufficient in all cases to perform searches against
the global address list. Verify that the account does not have
permissions to the recipient’s container.
In the initial setup, there are two management
agents. One MA connects to the Legacy Exchange 5.5 organization while
the other connects to the product CRM Active Directory. As business
break out of the Exchange 5.5 organization, they will need their own
Management Agent added to initialize the connection and maintain
directory Sync. These management agents control attribute flow,
connection settings and are called (by name) from the custom
provisioning code that has been written for this example. A third
management agent has been added for country-code lookups, but it is not
fully integrated and optional.
Management Window
The Identity Manager is where most of the work is
done for MIIS. It is from this program that we configure the
connections, attribute flow, replication schedule and monitor the system
for errors and problems. It can be launched from the Start Menu and has
several selections at the top of the screen. We will focus on the
Management Agents screen for now.
From this screen, we can perform exports of the
current configurations (should do this prior to ANY change made to the
agent) and can force directory updates. We can also see a quick summary
of the last action and what was done. In this example, 25 additions were
made to the Exchange 5.5 directory and an error occurred when MIIS tried
to write to an object in another container (one where specific rights
were not assigned) In our current configuration, MIIS only creates
contacts in the target system. This attempt to write to the source
object is will need to be addressed with a few lines of additional code
in order to further clean the process.
|
