Tuesday, August 30, 2011

Using PowerShell to Modify a FIM RCDC

Ever need to automate the deployment of a new UI control to a FIM Portal? 
A quick search of the FIM wiki for Resource Control Display Configuration will show you the pre-requisites you need to appreciate before fully grasping the challenge at hand :-|
In short: RCDCs are a handy way of allowing FIM Portal customization by adding controls as XML stuffed into an attribute in an object that resides in the FIM Service.  One challenge here is that the XML can be rather large, and it is not validated on import which leads to some pretty fun troubleshooting.  Using this script approach you can prevent people from doing this manually by providing them with a script that automates the process.

The approach I took with this script was to edit an RCDC in place by adding the new control’s XML to the existing RCDC XML.  I could have finished a lot sooner with a heavier hand if I’d just replaced the whole RCDC XML, instead of grafting my single control in.  There’s something to be said for finishing earlier but I wanted to see if this could easily be done, and that is what I’m trying to show in this blog post.

Working with Namespaces
The main challenge I found in this script was working with namespaces.  RCDC schema uses a few namespaces declared at the top of the document.  Adding a new control by hand you don’t typically include these namespaces because they are already at the top of the document.  I couldn’t find an easy way to do this, so I had to include the namespace declaration in my new control’s XML.  It is redundant but AFAIK it is not incorrect (at least it doesn’t seem to make the server angry).  Skipping this little trick took the simplicity out of the script and made it pretty ugly because I really wanted to use the XML functionality in .NET instead of doing string manipulation.

There’s one trick/function in the script below that I haven’t posted about yet.  It is basically another wrapper for Import-FimConfig.  Look for more on that later as I want to share and demo it at TEC Europe.

Anyhow, on with the script.
001
002
003
004
005
006
007
008
009
010
011
012
013
014
015
016
017
018
019
020
021
022
023
024
025
026
027
028
029
030
031
032
033
034
035
036
037
038
039
040
041
042
043
044
045
046
047
048
049
050
###
### Update the RCDC for User Edit
###

### Get the existing User Edit RCDC

$userEditRcdc = Export-FIMConfig -OnlyBaseResources -CustomConfig "/ObjectVisualizationConfiguration[DisplayName='Configuration for User Editing']" | Convert-FimExportToPSObject
[XML]$rcdcXml = $userEditRcdc.ConfigurationData

### This is the new control we want to add
$newRcdcControl = 
@"
<my:Control
xmlns:my="http://schemas.microsoft.com/2006/11/ResourceManagement"
    my:Name='MyNewCheckBox'
    my:TypeName='UocCheckBox'
    my:Caption='HoofHearted?'
    my:Description=''
    my:RightsLevel='{Binding Source=rights, Path=isStinky}'>
    <my:Properties>
        <my:Property
            my:Name='Checked'
            my:Value='{Binding Source=object, Path=isStinky, Mode=TwoWay}'/>
    </my:Properties>
</my:Control>
"@


### Put the new Control into an XML fragment
$fraggle = $rcdcXml.CreateDocumentFragment()
$fraggle.InnerXML = $newRcdcControl

### Find the Tab where we want to place this Control
$WorkInfoTab = $rcdcXml.ObjectControlConfiguration.Panel.Grouping | Where-Object {$_.Name -eq 'WorkInfo'}

### Find the Control to place this one AFTER
$namespace = @{my="http://schemas.microsoft.com/2006/11/ResourceManagement"}
$EmployeeIDControl = Select-Xml $rcdcXml -XPath "//my:Control[@my:Name='EmployeeID']" -Namespace $namespace

### Insert our new control
[Void]$WorkInfoTab.InsertAfter($fraggle,$EmployeeIDControl.Node) 

### Update the RCDC in FIM with our updated XML
$rcdcUpdate = New-FimImportObject -ObjectType ObjectVisualizationConfiguration -State Put -AnchorPairs @{DisplayName='Configuration for User Editing'-Changes
 @(
   
New-FimImportChange -Operation Replace -AttributeName ConfigurationData -AttributeValue ($rcdcXml.
OuterXml) 
)

$rcdcUpdate | Import-FIMConfig

###
### Cycle FIM and IIS
###

Restart-Service fimservice
iisreset

Before



After (notice the new HoofHearted item)


Going to TEC 2011 Europe!

Woo-hoo!  This time I’m giving talks on:

  • Extending and Automating FIM with PowerShell
  • Managing Active Directory with PowerShell
  • Using SQL Reporting Services to Expose PowerShell Script Output

Needless to say I’m pretty excited about the PowerShell Deep Dive track, and hope to spend a lot of time learning from the extremely high concentration of PowerShell talent and excitement. 

If you’re a FIM integrator in Europe, then this is a must-attend conference.  You won’t find a more concentrated bunch of integration and automation folks in such an accessible setting.

Found this great testimonial on the event site:

“The best analogy I have for TEC is the video for “No Rain” from Blind Melon where that funky little bee-girl runs around seemingly confusing people as she dances around dressed like a bee in tap shoes. Identity and Access is just like that, we spend all year telling people about it, customers eventually get it, relatives just smile, and spouses do their best, but at TEC we find ourselves surrounded by people speaking the same jargon even if their native language is different, our acronyms are harmonic.”

- Craig Martin

Wednesday, August 17, 2011

Linking to an Excellent Post on Testing

I really like this post so thought I’d pass it on…

Challenges in Test–Proving your feature

Testing FIM for customer deployments is near and dear to my heart because it is a target rich environment for automation (PowerShell!!!).  I find it fascinatingly difficult to motivate anybody to spend time on it until thing are foo-bar.