microsoft / mimconfigdocumenter Goto Github PK

MIM configuration documenter is a tool to generate documentation of a MIM synchronization or service installation.

License: MIT License

C# 97.49% CSS 0.32% JavaScript 0.05% PowerShell 2.13%

mimconfigdocumenter's Introduction

MIM Configuration Documenter

The MIM Configuration Documenter is a tool used to generate documentation of a Microsoft Identity Manager (MIM) or Forefront Identity Manager (FIM) deployment (both the Synchronization Service as well as the Service and Portal environments).

Project goals:

Document deployment configuration details for the MIM / FIM solution.
Track configuration changes you have made since a specific baseline.
Create clear document records of changes going into the production environment.
Build confidence in getting things right when making changes to the deployed solution.

Prerequisites:

.NET Framework 4.5 to be able to run the tool.
FIMAutomation PowerShell snap-in must be installed locally to export and generate report for the MIM Service configuration.
A modern browser (e.g. Microsoft Edge) to view the report.

Obtaining and testing the tool:

Download the latest release of your choice from the releases section under the Code tab in the project. We recommend downloading the MIMConfigDocumenter.zip file
Be sure to Unblock the downloaded zip file before extracting the contents to an empty local folder. This process will extract the MIM Configuration Documenter application binaries, along with sample data files for the Contoso Corporation.
Test the tool by executing the included PowerShell script InvokeDocumenter-Contoso.ps1.

Using the tool:

To generate documentation, the MIM Configuration Documenter compares any provided point in time configuration export, with another. The difference between the two configurations is used to generate the report.

Development to Production Changelog

A great use for the MIM Configuration Documenter is to track and highlight changes that are going to be transported from a staging/development environment into a production solution. For this scenario, an export of both the Pre-production / Pilot and Production environments can be compared with each other. This makes a great attachment to a change control or source code commit (if your configuration is exported and stored in source control).

Deployment Documentation

As part of any new MIM , a good value add is to create a set of documents outlining the initial deployment. This can be an internal configuration record or a customer document as part of a consulting engagement. In this case (or other scenarios where there is only a single MIM environment) the MIM Configuration Documenter provides several baseline configurations that can be used as a baseline for document generation. These includes:

FIM-Base_4.0.3684.2
FIM-R2-SP1-Base_4.1.3419.0
FIM-R2-SP1-Base_4.1.3461.0
FIM-R2
MIM-SP1-Base_4.4.1302.0
MIM-SP1-Base_4.4.1459.0

Step by step guide:

Export the MIM Synchronization Server and if present the MIM Service configuration of your environment(s).
- MIM Sync Server: In the MIM Synchronization console export the server configuration by using File | Export Server Configuration into an empty directory.
- MIM Service Configuration: The MIM Service and Portal configuration can be exported using the ExportSchema.ps1 and ExportPolicy.ps1 scripts located in the /scripts directory.
- As previously mentioned, if you have configuration files from only a single environment, you can use any one set of the FIM or MIM config files provided with the tool as your Production / Baseline / Reference environment.
Copy the configuration export files produced in the previous step to the /SyncConfig and /ServiceConfig folders under the /Data directory of the MIM Configuration Documenter tool.
- As an example, the Pilot configuration files for the customer Contoso are provided as a sample in the /Data\Contoso\Pilot\SyncConfig" and /Data\Contoso\Pilot\ServiceConfig directories.
- NOTE: The names of the FIM/MIM Service schema and policy export files must be schema.xml and policy.xml respectively.

Make a copy of the InvokeDocumenter-Contoso.ps1 script, name it appropriately and then open and edit the new script using the instructions provided in the script.

Parameter	Description
pilotConfig	Provide the path of the Reference / Baseline / Pilot configuration export files relative to the MIM Configuration Documenter /Data folder.
productionConfig	Provide the path of the Production / Baseline configuration export files relative to the MIM Configuration Documenter /Data folder.
reportType	Select the components to include in the document * SyncOnly for only a MIM Synchronization Engine * ServiceOnly for only the MIM Service and Portal * SyncAndService for both

Run your script to generate the documentation report of your configuration exports. Upon successful execution, the report will be placed in the /Report folder.

Contributing

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

mimconfigdocumenter's People

Contributors

Stargazers

Watchers

Forkers

awcolich dawi179 puttyq stephenc01 bhaskers-blu-org2 taffywrinkle claudiusgonzo nkalayci ekrotki erinsmatthew nileshghodekar l2g2h erichkarch

mimconfigdocumenter's Issues

MV Object Deletion rules

The report says that I have no MV Object deletion rules configured when I have 7 setup for declared-any and 1 for declared-last

This repo is missing important files

There are important files that Microsoft projects should all have that are not present in this repository. A pull request has been opened to add the missing file(s). When the pr is merged this issue will be closed automatically.

Microsoft teams can learn more about this effort and share feedback within the open source guidance available internally.

Merge this pull request

Ability to output data without compare

Any chance of a version of this that outputs the existing configurations in the HTML format without having to compare to another version. Or is there a switch I can use for that result?

Synchronization Filter objects are not enumerated/included in report

Sync engine attribute flow aggregated

We have a setup with 14 separate import sync rules for Active Directory, all importing users with the same attribute flows (mostly), separated on OU filtering.

In the report, all the fields that are common between the 14 import sync rules appears 14 times PER rule, so I get 196 listings of AccountName, Email and so on.

Title is imported in 13 of the rules, and gives me 169 listings.. and so on and so on 👎

The sync rules have inbound system scoping filter on DN.

connectedSystemScope,"dnENDSWITHOU=Users,OU=_DK,DC=testlab,DC=local",FIM Service,string,16.11.2015 12:34:22

Creation Times on MA's

Of course the MA I create in Dev and later import into Prod will have different Creation Times. You might want to ignore those in comparisons or give us the option to exclude those. The Modification Times would also be different

Initial Flow only show up as allow nulls

I see flows on outbound sync rules with initial flow only and not allowing nulls instead showing up as allow nulls and not initial flow only
MIM Document Tool_error.docx

Active/Pull Requests

Hey, are you taking pull requests and is this still being actively developed?

MV Object Deletion Rule type "declare-last" not showing Management Agents

When comparing in SyncOnly mode between two MIM environments the "Metaverse Object Deletion Rules" section does not any Management Agents when Deletion Rule Type = "Delete the metaverse object when the last connector is disconnected. Ignore from the following list of management agents"

In my case there are two Management Agents Configured in the Pilot Config and one in the Production Config.

MIMConfigDocumenter version: v1.18.0921.0
Pilot MIM Version: 4.6.34
Production MIM Version: 4.6.34

Ps. Other object types are configured as "declared-last". Management agents are correctly listed there.

Quickly locating ExportPolicy.ps1 and ExportSchema.ps1 on a new installation

Hi. I'd like a $ for every time I've struggled to locate these files. Nilesh - are you OK to change the 2 references in the README file to be links to https://github.com/microsoft/MIMConfigDocumenter/blob/master/src/MIMConfigDocumenterCmd/Scripts/ExportPolicy.ps1 and https://github.com/microsoft/MIMConfigDocumenter/blob/master/src/MIMConfigDocumenterCmd/Scripts/ExportSchema.ps1 respectively? Would have saved me 15 mins over a shared desktop with a tech just now :).
Thanks!

NullReferenceException in MIMConfigDocumenterCmd.exe

Having a MIM WAL Powershell Activitiy without input and output paramters crashes the MIMConfigDocumenterCmd.exe.

GetReport'. Details: System.NullReferenceException: Object reference not set to an instance of an object.
at
MIMConfigDocumenter.MIMServicePolicyDocumenter.FillWorkflowActivityValueExpressions
(DataTable activityValueExpressionsTable, XElement hashtable, Int32 activityIndex, Int32 sectionIndex)
at
MIMConfigDocumenter.MIMServicePolicyDocumenter.FillWorkflowActivityDetails
(Boolean pilotConfig)
at MIMConfigDocumenter.MIMServicePolicyDocumenter.ProcessWorkflow()
at MIMConfigDocumenter.MIMServicePolicyDocumenter.ProcessWorkflows()
at MIMConfigDocumenter.MIMServicePolicyDocumenter.GetReport().
MIMConfigDocumenterLog Error: 40000 : MIMConfigDocumenter (1.17.0522.0):
05/30/2017 15:59:31.9009: Exception in 'MIMServiceConfigDocumenter :
GetReport'. Details: System.NullReferenceException: Object reference not set to an instance of an object.
at MIMConfigDocumenter.MIMServicePolicyDocumenter.GetReport()
at
MIMConfigDocumenter.MIMServiceConfigDocumenter.ProcessServicePolicyConfiguration
()
at MIMConfigDocumenter.MIMServiceConfigDocumenter.GetReport().

Attribute flows are shown duplicate when multiple csobject types flowing to a single mvobject-type

Attribute flows are shown on each attribute flow that have a mapping to that same specific mv-object-type attribute:

So for instance I have 3 cs-objecttypes in my MA that flows to mv-object-type account:

normalaccount
adminaccount
serviceaccount

There are 5 attribute flows configured:

normalaccount (cs-object-type) - dn (attribute) --> account (mv-object-type) - dn (attribute)
adminaccount (cs-object-type) - dn (attribute) --> account (mv-object-type) - dn (attribute)
serviceaccount (cs-object-type) - dn (attribute) --> account (mv-object-type) - dn (attribute)
normalaccount (cs-object-type) - mail (attribute) --> account (mv-object-type) - mail (attribute)
adminaccount (cs-object-type) - adminmail (attribute) --> account (mv-object-type) - mail (attribute)

The effect is that attribute flows 1 - 3 are documented as they were configured for each cs-object-type - mv-object-type mapping, but with a different precedence.
Attribute flows that are configured with different source attributes are also shown on each cs-object-type --> mv-object-type attribute flow that have a flow to the same mv-object-type.

When a flow exists for that cs-object-type it seems to gather all flows from all cs-object-types that are linked to the same mv-object-type and includes those in the list. It does not check if this specific flow is linked to that cs-object-type in specific. When a specific cs-object-type is not having a flow to that mv-object-type, it's not shown in the list.

I would expect that it takes the cd-object-type into account to determine if that flow must be included in this specific attribute flow list. See screenshot of the MV.XML export using Export Server Configuration option:

False differences on export attribute flow

Here I have a duplicate export attribute flow one in a sync rule and one direct. But I have them in both environments and yet they both show up as different. So the sync rule flow from dev got compared to the direct flow in prod and the direct flow from dev got compared to the sync rule flow from prod

Data Source Attribute From Metaverse Attribute Mapping Type Allow Null Initial Flow Only
mailNickname ← type mailNickname </crossed out>mailNickname Sync Rule - Expression</crossed out> Direct

mailNickname ← mailNicknametype</crossed out>
mailNickname Direct Sync Rule - Expression</crossed out> Yes
MIM Document Tool_error.docx

'SuppressException' crash on service config

From the error log:

MIMConfigDocumenterLog Warning: 30000 : MIMConfigDocumenter (1.17.0606.0): 06/08/2017 09:36:33.6754: Connector SubType: 'PowerShell'. ECMA2 Connector of subtype 'PowerShell' is currently not supported. The connector 'Powershell - Office 365' with be treated as a generic ECMA2 connector.
MIMConfigDocumenterLog Error: 40000 : MIMConfigDocumenter (1.17.0606.0): 06/08/2017 09:37:02.8896: Exception in 'MIMServicePolicyDocumenter : GetReport'. Details: System.Xml.XmlException: 'SuppressException' is an unexpected token. Expecting white space. Line 3, position 114.

at System.Xml.XmlTextReaderImpl.Throw(Exception e)
at System.Xml.XmlTextReaderImpl.Throw(String res, String arg)
at System.Xml.XmlTextReaderImpl.ThrowExpectingWhitespace(Int32 pos)
at System.Xml.XmlTextReaderImpl.ParseAttributes()
at System.Xml.XmlTextReaderImpl.ParseElement()
at System.Xml.XmlTextReaderImpl.ParseElementContent()
at System.Xml.XmlTextReaderImpl.Read()
at System.Xml.Linq.XContainer.ReadContentFrom(XmlReader r)
at System.Xml.Linq.XContainer.ReadContentFrom(XmlReader r, LoadOptions o)
at System.Xml.Linq.XElement.ReadElementFrom(XmlReader r, LoadOptions o)
at System.Xml.Linq.XElement.Load(XmlReader reader, LoadOptions options)
at System.Xml.Linq.XElement.Parse(String text, LoadOptions options)
at MIMConfigDocumenter.MIMServicePolicyDocumenter.FillWorkflowsSummaryDiffgramDataSet()
at MIMConfigDocumenter.MIMServicePolicyDocumenter.ProcessWorkflowsSummary()
at MIMConfigDocumenter.MIMServicePolicyDocumenter.GetReport().

Happens with the portal config. Sync engine config alone works fine. We've tried the scripts for several customers, same result. All use Soren Granfeldt's Powershell Management Agent. Not sure if that is related tho.

Missing Workflows

In my Pilot environment I have 35 workflows 24 of them custom. Only 5 of those show up in the MIM Config document. All five are action workflows. All five are custom, two use out of the box wf activities. None of the system workflows are showing up. I confirmed that the missing ones are in the policy.xml file so that isn't the issue.

Sync Rule ID Comparisons

On a Sync Rule Activity in a WF it shows the Sync Rule ID as a difference even when the Sync Rule DisplayNames are the same (it shows the Sync Rule DisplayName). When comparing to a previous config of the same instance the sync rule ID's would match but when comparing between Prod and Dev they wouldn't. So you should considering doing this comparison on DisplayName rather than the Sync rule ID

P.S. This is a great tool!

Missing baseline for MIM with version higher than 4.4.1459

Hello,
MIMConfigDocumenter package doesn't include base XML for MIM 2010 R2 latest versions (4.5.286 or 4.6.421).
I have tried different base file but it provide me some error. what is the one I must use or should you provide an higher version?
Regards