UMRA - Tech Guide

NEW WEBSITE - www.umrahelp.com

2010-05-13T08:54:00.000-07:00

As many of you know, or have been following. http://umratips.blogspot.com/ and http://activedirectoryadmin.blogspot.com/ are now combined into 1 easy webpage http://www.umrahelp.com. I've been meaning to combine both of the sites for awhile now, however, I've been just so busy with work and home life, that I haven't been able to get around to it.
However, little by little, I was able to finally get almost everything transfered over from the other blogs onto here.

So for any of you who have the old sites bookmarked, please bookmark this site, since the old ones wont be updated anymore.

UMRA - Web Portal Work Flow Managment.

2010-03-17T06:38:00.000-07:00

Have Questions? Email Me: Email Me Click Here

Advanced Toolware's Product Downloads Below.
Download User Management Resource Administrator > Download
Download Self Service Password Reset Manager SSRPM > Download
Download Enterprise Single Sign On Manager > Download

If you want to learn the basics on how to connect to UMRA with its COM object, please see my original post on “Basics of UMRA COM”.

UMRA – Work Flow Management

It's been about a year + since I've talked about a work flow managment system that I created. So I've decided that I should revisit this and show you some of the features of whats been developed.

Now when someone says "Work Flow Managment" that can mean many things, however with regards to linking it to UMRA, you can now create UMRA scripts from a web interface, and delegate those actions out to your users.

Right now I only have about 10 functions within my interface, however I can add more rather quickly.

Now some of you might be asking, why I would make something like this... Simple, anyone who has a portal UMRA based web portal, can now create RBAC types on the fly, and also create a work flow for a specific RBAC type or types on the fly. No need to go into the UMRA console, or edit code. You can create these, assign them to RBAC types, and have them use it right away. Now I know some of you are thinking, why would you want to create a Dynamic Work Flow through the web? You now can delgate out who can use UMRA, and you dont need to give any type of elevated rights to a server, or application, you can now say how your "disable" user process goes. For example, as an admin you can delegate out to "Seattle Office Managers" the ability to either create a work flow, or just to use a work flow you assigned. If you designated them to create a work flow, you define there actions. The "disable" action and how it runs, it up to you. The users dosent need to know, that you are are loggin data into a database, or moving the account. Unlinke if you were to do this in the UMRA console itself, they would have full control. I will talk more about this later.

Here is a quick scree show of what I did over a year ago.

UMRA – Web Portal Error Handling and Control

2009-08-23T11:51:00.000-07:00

Have Questions? Email Me: Email Me Click Here

Tools4Ever’s Product Downloads Below.
Download User Management Resource Administrator > Download
Download Self Service Password Reset Manager SSRPM > Download
Download Enterprise Single Sign On Manager > Download

If you want to learn the basics on how to connect to UMRA with its COM object, please see my original post on “Basics of UMRA COM”.

UMRA – Web Portal Error Handling and Control

Anytime you build a UMRA based portal, or we build a UMRA based portal for our clients, one of the biggest steps in development is the handing all the errors that can happen with a specific UMRA script is executed. Before in some of my older blog posts I talked about how you can create a variable called %errorflag%, set it to 0 in the begging of your script, and if any part of your script throws and err, you can set this %errorflag% to 1. Then check the value of that variable via the COM object, and if its set to 1 then you know there is a problem with your script. Now, there are benefits and downfalls to doing it that way. One of the benefits is, if your script only does 1 action such as add a group to a user, then its easy to tell what the error is in the UMRA script, however, one downfall to this method is, if you have a script that does multiple things, you can code this into your UMRA script however that is a lot of overhead to program for each exception, so how do you get around this? Well, in the UMRA com there is a method called GetScript Exection Info. I don’t think many of our clients are using this method to check for error, however they should since it does all the error logic handling with a built in method.

Umra.GetScriptExectioninfo
This method has 2 Out parameters, the first is the Script Error Count, and second is the log message. Now after you have executed your script, just call this method and check the first return parameter, if it returned a 0 then we know the script ran without a hitch, but if it returns something other than 0 something went wrong, so then take the UMRA script log that is kicked back, and display it to the browser, or however you display your error messages.

So there you have it just another way to have your UMRA based portal wrapped in a little more error log. Again, both ways are great that we mentioned above for error handing, and it will be up to you to see what example works best. If you have any questions, please feel free to email me.

UMRA – Bulk Web Based Active Directory Password Resets

2009-08-17T20:04:00.000-07:00

UMRA – Bulk Web Based Active Directory Password Resets

So I’ve been looking over looking over some of the search entries on my site, and noticed that there has been a huge increate on Web Based Active Directory Password Resets in the last few weeks, so in this blog post I will try to show how you can make a UMRA based portal that allows for bulk Active Directory password resets. Ok so lucky me, I recently created such an option in a UMRA based portal for a major school district in Washington that was replacing a software suite called VISUAL CASEL with UMRA. So below is a quick screen shot of how an “Admin” can select a specific school from a list, and bring up all students within that school, keep in mind that this information is a composite set of data, not only getting information in real time from there Student Information System, but also get Active Directory also. After the “Admin” has selected his school, we will put this data into a dynamic grid, that can show really any information you want to show to the end user, grade, school, location, status etc. all of which can be sorted, and selected. From here, I created a button called “Change Passwords”. When the user selects this button it will pull up the “Change Password” or in other words “Reset Password” from up to the user. Now, here the Admin can type in the new password, confirm it, and hit reset. This will take all the users in the list where were selected, and buck reset there active directory password. Now don’t forget, all these actions are being logged / audit into a SQL database, so you can go in later and review who reset whose password, time/date etc.

So I hope this helps some of you out there who might have been searching for this topic, and or trying to figure out how to do this web based. So keep in mind that all the data pulls, and password resets either in one off scenario, or password resets in active directory in bulk are all done with UMRA.

UMRA – Teacher Assignment Drop Box Management

2009-08-16T20:46:00.000-07:00

UMRA – Teacher Assignment Drop Box Management

To read about the other options in the Teacher Management Portal, please see these blog post

File Distribution -
http://umratips.blogspot.com/2009/08/umra-teacher-file-distribution.html

Teacher Bulk Management -
http://umratips.blogspot.com/2009/08/umra-teacher-bulk-student-management.html

So this will be the final blog about the UMRA based portal that allows for Teachers to fully manage their current schools roster, without giving them any type of elevated rights in Active Directory or other downstream systems. So as you’ve already ready about within the teachers portal, they have the ability to Send Files to selected students within a specific portal, they also have the ability to manage a student on any given rosters of theirs. So the final part is to create Assignment “Drop Box” to allow the students from within there “Student Portal” (we will cover this later) to submit assignments to within the Drop Box dead line date. Now the tuff part about this section of the portal was to give the Teacher the rights to create a “Drop Box” folder, that will have a date on it from when it expires, and won’t allow students to upload to these Drop Box’s anymore. Now, I knew with UMRA handling all my backend folder creation and editing files. This would be no problem. So below is a quick screen shot, and I will go over some of the functions that the teachers has in more detail.

Get Folders Button -
In the toolbar, when the Teacher clicks this, UMRA will grab their home drive path, and map it to the correct current roster file location, and display any Rosters that are active.

2010 TeacherName PeriodX:
This is built dynamically, with the data that is pulled from the button click to get the folders. When the teacher clicks on the actual Period name, or roster name, it will pull up any assignments that the teacher has created for this roster period. Right now, the client is looking for a Phase 2 where they will add in “edit” and “delete” options for each of these functions.

Create New Assignment -
When the Teacher clicks this, it will pull up a quick entry form, where the teacher can put the Assignment name, and click a date picker, then hit “create” when they hit create, UMRA will take all this data, and create a corresponding roster folder.

Now overall again this is just one part of the Teachers Portal, and as you can see with all the options that we’ve talked about in other posts, the Teachers have a complete place to manage their students, and manage file distribution and drop box creation in one area, all with having no special permission in active directory or downstream systems. Now, in my next post, I will cover some parts of the student portal, and show you how these options directly affect the student portal.

UMRA – Teacher Bulk Student Management

2009-08-15T22:03:00.000-07:00

UMRA – Teacher Bulk Student Management

To read about the other options in the Teacher Management Portal, please see this blog post http://umratips.blogspot.com/2009/08/umra-teacher-file-distribution.html

Now in addition to the Web Based Teacher File Distribution system, our client also wanted to us to build in functions to allow for the Teachers to manage the students on their current active rosters. Now this poses another yet another layer of complexity, not only will we be managing the distribution of files within this UMRA based portal, but now we need to allow for some “admin” type active directory functions through this portal. Some of the features that the client wanted, were, Deleting Profiles, Repair Home/Profile Permissions, Unlock Account, and Change Password. Now, unlink the Admin Portal, these tasks are based on a one by one basis, and not like a one some or many like the Admin Portal. So below is a quick screen shot of just this section, and I will go over what each of the option does in more details.

Delete Profile -
This will take the Profile Path of the Student, and UMRA delete files within it. It will take this information directly from Active Directory.

Repair Home/Profile Permissions -
This function takes both the home profile attribute, and the profile path attribute in Active Directory and UMRA connects to multiple data servers and student information systems and makes sure the student has the correct permissions, to active teacher rosters. This is a great tool to have, since it use to take the client 15 minutes, to go through all of the folders, and correct permissions, now the Teacher can fix these within seconds.

Unlock Account -
This one is straight forward, this one unlocks the Active Directory Account if it locked. If the account is locked, the column “Locked” will say “locked”.

Change Password -
This pops up another screen where the teacher can change the students password.

Now don’t forget that each and every one of these functions are being handled by UMRA in the background, with scripts that were designed specifically for the client. So the client can go back anytime, and modify how a specific action takes place. But also, don’t forget that every action is also being recorded and audited to a SQL database, so you have a complete audit history of actions from within the portal. So there you have it, other function in the Teachers Portal. And as you can see, the limits are endless with you have UMRA as your back end logic tool.

UMRA – Teacher File Distribution Management

2009-08-14T21:18:00.000-07:00

Have Questions? Email Me: Email Me Click Here

Tools4Ever’s Product Downloads Below.
Download User Management Resource Administrator > Download
Download Self Service Password Reset Manager SSRPM > Download
Download Enterprise Single Sign On Manager > Download

If you want to learn the basics on how to connect to UMRA with its COM object, please see my original post on “Basics of UMRA COM”.

UMRA – Student File Distribution Management

Now if you haven’t already, read my original blog post on some of the tips and tricks I’ve learned when creating such a Student File Distribution Management Portal: http://umratips.blogspot.com/2009/08/umra-file-data-distribution-management.html

So I finally finished up the Distribution System for a local school district that wanted to replace Visual CASEL functionally with a UMRA driven solution. Now, below is a screen shot of the final product that is in use in the clients system. As you can see, a very clean system that pulls Teacher Rosters dynamically from a Student Information System, and also links this data in real time within Active Directory. So below I will go over in some detail about each of the sections in this Student File Distribution Management System with UMRA.

Main Menu -
Here is a list of the current Teacher Rosters in the Student Information System, A teach can many one or also rosters from this menu.

Roster Details -
After a Teacher has selected an available year, from the Main Menu, My Rosters Menu, it will display the current rosters for that year.

Period X: File Distribution -
Now you most likely see the other 2 options Student Management, and Assignment Management, we will talk about these tabs later. Keep in mind both those tabs will display options for the selected Teacher Roster. So this tab shows current files that the teacher has uploaded, and are pending to be sent to the students selected. You will notice a hyper link called “Distribute Files” this is the link they will click to send files. Now here is where I placed some extra error logic on this function. I do a check to make sure, the Teacher has at least file in the file upload directory, and to make sure at least one student is selected.

Current Roster Students -
This is sort able, dynamic grid that allows for scrolling, and sorting on any of the header items, and also allows for resizable headers. This is a list of students from the selected roster, and it also display current information from the student information system, with a mix of data from Active Directory also.

So there you have it, a quick overview of my Student File Distribution Management System I build for a local school district, using UMRA as my backend logic tool.

SSRPM – Web Interface Edits and Tips

2009-08-12T18:42:00.000-07:00

SSRPM – Web Interface Edits and Tips

In this blog post we are going to switch it up some, and talk about a product by tools4ever called SSRPM. SSRPM is short for Self Service Password Reset Manager. This application allows the end user to reset there active directory password with a series of challenge and response questions to authentication who they are. With SSRPM the end user can reset there password two multiple ways, one way is via the “Forgot My Password” button that is added to the windows login screen, and the other is a via a web interface. The web interface is written in .asp pages, and in most cases our clients want to us to make a few changes to the SSRPM web interface. Some of these changes can include a complete Re-skin of the SSRPM web interface to give it more of an integrated look with their school, or corporate colors. And in other cases, the client just wants some basics changes like hard coding the domain name in the Reset Password, and Enroll buttons. The reason for this is because sometimes a user might not know what their domain is, and making it easier for the client to either select it from a drop down, or hard code it and hide it, makes the end user experience a lot easier. So in this post, I will cover what pages, and code needs to be edited if you wanted to hard code your domain into the sections that ask for the domain text input in the SSRPM web interface.

So if you haven’t already, you can Download Self Service Password Reset Manager SSRPM > Download. This will get you up to date with what I’m talking about.

There are 2 pages you will need to edit, Logon.asp, and Identify.asp. Both these pages, have the same user form that asks for username, password, and domain. You can use your favorite web pages editor, or even notepad to edit these pages, a free tool I recommend is notepad ++.

In both of these pages, look for lines 65-66 they will be the below.

Here is what it should look like after you’ve done the above web page edits.

After you have updated both Logon.asp and Identify.asp with the example above, try to enroll, or reset your password, and you will see now that you no longer need to enter your domain as an input, making each of the process a little more steam lined. So I hope this helps any of you out there who was thinking about editing the SSRPM web interface.

UMRA – File / Data Distribution Management

2009-08-11T18:37:00.000-07:00

UMRA – File Distribution Management

As some of you know, I’ve been working in creating a File Distribution system with UMRA to send these files to students of a teachers year roster. Now at first you might think this task sounds fairly simple, and it’s a simple send 1 file to a student, and you’re done. However, this task actually is more complex than just that; it involves a complete UMRA Web Portal to accomplish this task. The school district I am working with wants to replace some, if not all the tools in Visual CASEL with a custom UMRA Web Portal. The web portal would allow them to still do the tasks they’ve always done before, however now they have more flexible ways to manage other work flows, other than File Distribution Management. But back to the topic, the client wanted a way for a teach to come into a portal, and display their current rosters there are stored in a SQL stored procedure. From here, the teacher can manage anyone on their roster; they can have the ability to reset student passwords, fix student home folders, set admin disables, and so much more. But the main part was to be able to select one or some files, then select one some or all students in a roster and then distrusted the files to those selected students. Now there are two big hurdles when you are doing a project like this, one is how to make a multi select upload, and how to keep track of the students who are selected in the list. Now don’t forget to put in error logic, that makes sure that files uploaded correctly, and that they actually selected someone on the roster list.

Here is how I was able to make a temporary upload area for the teacher to add files to until they are ready to distribute them. When the teacher first goes to the “Assignment Management” section in the portal, I will do a check to see if they have any files in a special Temp Upload Directory in the Teachers home folder, if there are any files, show them on the page, and if they don’t, display nothing. If the teacher does not have this file for Temp Upload, have UMRA create the folder. From here, you just allow the Teacher to select files, and upload them until the list is ready for distribution. Again, don’t forget to add error logic to make sure the teacher has files to distribute, and that they actually selected one some or all students from a list.

In my next blog post I will talk more about what happens after the teacher distributes the files. However, below is a quick screen shot on this File Distribution Management System.

ESSOM –Enterprise Single Sign On Manager SSO

2009-07-22T18:53:00.001-07:00

Have Questions? Email Me: Email Me Click Here

Tools4Ever’s Product Downloads Below.
Download User Management Resource Administrator > Download
Download Self Service Password Reset Manager SSRPM > Download
Download Enterprise Single Sign On Manager > Download

If you want to learn the basics on how to connect to UMRA with its COM object, please see my original post on “Basics of UMRA COM”.

ESSOM –Enterprise Single Sign On Manager SSO

Now I know that most of my blogs focus on UMRA and its COM object, however tools4ever released a few months back Enterprise Single Sign On Manager ESSOM for short. What is this application, and what does it do you ask? Well, I know most of you are familiar somehow or another with the term Single Sign On. Single Sign on allows you to have an automatic sign in process to web based applications, windows applications etc. So take this for example, when you come into work for the day, you might have to log into a few applications like goldmine, access database, outlook web access, or other internal or external applications web based or not. With ESSOM you sign in once, and every time you go to it from there on, ESSOM will then automatically take the username / password you used from the previous login, to log you in. No more forgetting passwords, or taking five to ten minutes each day to log into your other applications.

Now not only is the above example really handily, but ESSOM is a complete Single Sign On Solution. Unlike like most Single Sign ON SSO applications, you are bound to what applications they can connect to, and you have no control over some of the applications you want to assign out, or even who can use SSO. ESSOM takes all the locks, and the hassles out of having to contact your SSO provider each time a new version of software comes out etc. With ESSOM you are able to make your own SSO solution for the different applications that are out there. Again, it can be a web based application, a Windows application etc. ESSOM comes with delegation control, so you can now have full control over what applications are available for enrollment, and who they are enrolled to. You have full control over how the applications functionally works, you can create custom login box’s, controls, messages etc. So as you can see ESSOM is a complete Single Sign On Solution.

I hope this gives some of you out there an idea of what ESSOM. So if you haven’t already download the trial version with the link at the top of the page.

Blog Update July 28th 2009

Since Single Sign On Enterprise solutions are really coming into there own now days, I will elaborate on this topic a bit more. So as you've seen above tools4ever's ESSOM product is very versitle in its core application, however, there are a ton of built in freatures, and Templates for different applications built right in, so you can get your Single Sign On running faster them ever. Templates you ask, yes... out of the box 10+ already configured applications are ready for use, all you have to do is assign them to your users, and your off. This whole process should only take around 10-15 minutes, so as you can so, not a whole ton of adjusting needed. You can however, go back and edit these applications, you can edit how they work, what prompts say etc. Now keep this in mind, you can edit any of these prebuilt Templates to your liking, or revamp them completely. So as a new application version comes out, you can use the previous versions template as a road map to your new version, very few, if not one or two actions will need to be changed.

Now there is one feature that I thought some of you might find very hand and very useful to use. Well there are 2, so lets talk about the first hand feature of ESSOM . One feature is the abilty to use one username / password to sign into an application automaticly. Now wait, let me get into this a bit deeper, so lets say you have an applicating called "PayRole", and you have two username / passwords for this applications. One of the usernames are used for "general" employes, and the other is for "admins". You can now assign a Single Sign On Solution to a user, and when they open this "PayRole" application, they wont even see the username / password that you already assigned to the user for enrollment. To the end user its seamless and they think they sign right into the application. The second handy feature of ESSOM is the ability to allow users to asign other users there login creditials, without giving them the username / password of the account. You, as an admin of ESSOM have the ability to say what applications you can do this with, and who can do this. So for example if a manager was leaving on vacation for a week, and was letting someone take his duties, but this other user needed different usernames / passwords for these other applications so it will give them options etc. based on there role, typically the manager would have to give the delegated person his username and passwords. Not anymore with ESSOM . You can allow users to delegate these out, for a specific period of time, and when the users signs into the assigned application it will use the delegated credentials to log in with, no need to pass along passwords and usernames.

So I hope this gives some of you out there a better idea of what Tools4Ever ESSOM application does on a more detailed level. However, I have yet to really touch on all the core functions of this application, so keep an eye out for new updates on this blog.

UMRA – Web Based Portal Active Directory Management

2009-07-22T17:59:00.000-07:00

Have Questions? Email Me: Email Me Click Here
Tools4Ever’s Product Downloads Below.
Download User Management Resource Administrator > Download
Download Self Service Password Reset Manager SSRPM > Download

If you want to learn the basics on how to connect to UMRA with its COM object, please see my original post on “Basics of UMRA COM”.

UMRA – Web Based Portal Active Directory Management

In most of my blogs I talk about a lot of the specific features a UMRA based web portal can do, and don’t really talk about this at a high level. I know some of you might be asking, what is the limitation of building a Web Portal while using UMRA as your back end logic tool. Really, there only a few limitations of UMRA or the portal. Your only limitation would be your connection to your other applications, or locked features. Now, let me explain this. For example, if you wanted a user to search for a user, then have the ability to edit that users active directory attributes, then edit there information in a downstream system like an AS400. If you AS400 doesn’t allow any type of connection to it for updates etc, then you won’t be able to add this functionality into your UMRA portal. Now, keep in mind if I say wont/cant this doesn’t mean you can’t do it. Most of the time if you look around on the internet, you will find a lot of different resources on how you can accomplish your active directory integration. So here is a quick list of some of the cool things you can do with a UMRA portal that you delegate out to other users.

> Active Directory AS400 Sync
> Group Management
> File and Permission Management
> User Management
> View GPO’s On OU (Organizational Units) Yes with the web
> Active Directory Reporting and Auditing
> HR Management
> Student Information System SIS Management
> Summer School Student Management

These are just a few of the integration options that I’ve done for our clients, as you can see these all vary, and the GUI interfaces vary from simplistic designs, to web 2.0 designs, to integration into your own intranet site. So I hope this blog gives some of you out there an idea of what a UMRA portal can consist of. Overall, your functions and work flows are endless since, you have the power of UMRA at your fingertips, as well as web controls.

UMRA – Student Account Approval Work Flow System

2009-07-20T19:50:00.000-07:00

Have Questions? Email Me: Email Me Click Here

Tools4Ever’s Product Downloads Below.
Download User Management Resource Administrator > Download
Download Self Service Password Reset Manager SSRPM > Download

If you want to learn the basics on how to connect to UMRA with its COM object, please see my original post on “Basics of UMRA COM”.

UMRA – Student Account Approval Work Flow System

In most of my blogs I talk about how you can create custom UMRA driven web portal that create users, create groups etc. However, in most cases you may want to put a create student account, or any type of account into a work flow process to ensure other departments approve of the request, or take action on the account prior to it going live in Active Directory. In this case, UMRA is the perfect for processing all the different work flow steps. How does it do this you might be asking. Well UMRA has the ability to connect to databases, pass database to databases, and create active directory objects, so with this in mind, it can handle the complete Work Flow you may want to process on a user creation. Now, again keep in mind that UMRA has the ability to create users from a CSV, database etc. but again, we are just focusing on when we see a new user account in a Student Information System SIS database, or csv, etc that we fire off this user account to be put into a work flow process. Ok, so below is a quick overview of one of the previous User Account creation work flow processes I’ve developed.

Step 1
Get connected to your datasource with UMRA. This datasource can be a csv, database, etc. This is the source your UMRA Automation project will be looping through hourly, daily etc. to look for new records that need to be in Active Directory.

Step 2
If your UMRA Automation project finds a record in your datasource that needs to be in Active Directory, instead of creating that in Active Directory, you can now add this record to another database for pending tickets, these tickets can hold when they were created, plus multiple approve columns for the different departments, or check points you want to have verified before it moves on in the work flow process. Now, don’t forget that when your process runs again, you need to make sure you already don’t have a previous ticket for a new account in the system.

Step 3
As your users are emailed about their approval in the work flow process, you can have links to a UMRA driven web portal where these users can accept / deny these tickets.

Step 4
Once all your tickets have gone through the work flow process, you can do a multiple of things. You can either have it so, once all the ticket have been approved, to then create the account in Active Directory, or you can have it then go into another IT or Admin Ticket System for final approval.

So I hope this helps some of you out there who might be thinking about going to this type of approach, if you have any questions please feel free to email.

UMRA – SIS Student Information System Import Active Directory

2009-07-19T19:50:00.000-07:00

Contact Me: Send me an Email!

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever. UMRA

Download Trial Version of UMRA > http://www.tools4ever.com/download/
Download Trial Version of SSRPM > http://www.tools4ever.com/download/

PowerSchool Student Information System SIS To Active Directory
http://activedirectoryadmin.blogspot.com/2009/07/umra-powercampus-erp-active-directory.html

Destiny Student Information System SIS To Active Directory
http://activedirectoryadmin.blogspot.com/2009/07/umra-destiny-sis-active-directory.html

Zangle Student Information System SIS To Active Directory
http://activedirectoryadmin.blogspot.com/2009/07/umra-zangle-sis-active-directory.html

Aeires Student Information System SIS To Active Directory
http://activedirectoryadmin.blogspot.com/2009/07/umra-aeries-sis-active-directory.html

UMRA – SIS Student Information System Import Active Directory

This blog is going to be something a little different from my other previous blogs that main focus on UMRA and its COM Object Methods. Creating web portals with UMRA is quite popular however there is a completely different side to UMRA that a lot of our clients are utilizing UMRA for. UMRA has the ability to sync up your current Student Information System SIS to active directory. Now, you might be thinking this is quite the huge task, however, with UMRA this task becomes possible to put on a automated schedule. Now, depending on what SIS you have PowerSChool, Destiny, Zangle, Aeires etc. you can create your UMRA Automation Sync to mimic the same logic you do now on a daily, weekly, or monthly basis when you manage your student or staff active directory accounts. Now, for this blog I will just focus on the student accounts, however to UMRA a active directory is the same, so it being a student account or staff won’t matter, but your script logic would change. UMRA has the ability either connect directly to your SIS database, or even getting a CSV dump of your SIS data, and using that as your sync data. Below is a quick overview of some of the features you can do when you’re creating a new UMRA SIS Sync to Active Directory.

If you want more details on a student information sync to active directory on different systems, visit some of the links at the top of the page. These cover most SIS systems, however, if there is one you don’t see, please feel free to email me.

Student SIS Account Creation.
UMRA has the ability to check your SIS and make sure, student accounts that need to have an account in Active Directory do. Upon creation of a user, you can create them in the correct OU based on your SIS information, ensure your username’s are either student ID’s or some type of unique identifier, set temporary passwords, or flag the account to change upon next successful login.

Exchange 2000 2003 2007 Email Creation
UMRA also has the ability to create mailbox for students at the same time as a student account is being created. UMRA can create the student mailbox on specific mailstores depending on your SIS data. Now email dosent need to pertain to just Microsoft Exchange, you can also provision accounts on google, and hotmail using either UMRA Command Line Interface CLI or PowerShell Script INtergration.

Now this is just a quick overview of some of the features that UMRA can do when syncing up your SIS with Active Directory. Keep in mind that once your UMRA script is completed, you can now put it on a scheduler and have it run at your specific interval, so as your SIS data changes, it will in turn reflect those changes down to Active Directory. I hope this helps some of you out there if you are going to an approach like this, and again these are just some of the features, UMRA has way more then what is posted, if you want to read more on these topics don’t forget to visit my other blog http://www.activedirectoryadmin.blogspot.com/

UMRA – Active Directory Export to XML SOA

2009-07-14T19:25:00.001-07:00

Tools4Ever’s Product Downloads Below.
Download User Management Resource Administrator > Download
Download Self Service Password Reset Manager SSRPM > Download

If you want to learn the basics on how to connect to UMRA with its COM object, please see my original post on “Basics of UMRA COM”.

UMRA – Active Directory Export to XML SOA

This blog will be a little different then my previous blogs, this blog will focus on how most applications today are now moving towards Service Oriented Architecture (SOA). What is this you might be asking? I bet in some way shape or form one of your current business applications is using this type of framework for data processing. So how do you use UMRA and SOA? UMRA has the ability to not only create any active directory object, it also has the ability to run reports and audits on Active Directory in real time. So for example, say if you wanted to get all users in your Active Directory and at the same time get firstname, lastname, displayname, active/disabled status, locked status, and even when there password will expire, you can do this with UMRA. It’s a widely looked over aspect of UMRA, since in most cases our UMRA scripts will create objects and compare objects in Active Directory, but not write this data to a file. Since UMRA is a very quick and lightweight application, getting this data is very fast, and in most cases two times as fast as running a VBscript, or Pearl script to obtain this information. So once you have your information you want to get, UMRA has a function called “Export Variables” this function will export your current variables to a text file, this text file can be a .csv, .txt, .xml etc. so the possibilities are endless. Once you have your xml file, or other data type, you can now use this data to process through your other SOA based application. So for example, we had a currently client who had a library system that grab an XML file that was placed in a cretin folder, and every hour it would look at the file, and take any username, lastname, firstname, etc. formatted in XML and insert those records into the library system. So when our normal UMRA PowerSchool Student Automation sync up new students into Active Directory, we were able to catch new students on a nightly basis, and write this information to this XML file. So in turn, we were able to provision different accounts into two different systems during out UMRA PowerSchool Student Automation. So I hope this helps some of you out there maybe thinking about creating your own Active Directory Audits with UMRA.

So I decided to update this blog post with some more in depth information on how to export your data to XML with UMRA, the benefits of this, and also tips of how you can do this export. Now, I hope after reading the top portion of this blog you get an idea of what SOA is all about. Plus, as you've most likely read on other websites, and software documentation many are moving towards this SOA schemea, not only for import, but for export of there data to allow easier intergration of applicaions. Now in he preious paragrah I talked about applications that you can pass your XML to, but here I will talk about how to use our UMRA extrace XML data that you kick out to applications for reporting purposes. Yes, in some cases you may want to get repors all Active Directory users last login date, or Active Directory users whos passwords never expire. What ever the report is, either do your calculations in UMRA or do your calculations on your wepage code. Once you've exported the data you need to your XML file, you can now either use a custom flash based charting grah to read in your XML data, and display it on your screen. If you dont have anyone that can create custom flash based chart, take a look online, there a few good charting applications that can integrate easily in your UMRA applications. No keep in mind that you dont need to display these XML data files on some type of visual flash chart you can just as easy display this data with pure text. In this event you can simple do calcuations on our webpage to get users or data that meets your criteria, total it, and then display it back on the webpage. Now, even to go simpler, you can just have a page that pulls the XML file directly up, however these files might be a tad hard to read depending on how much data you are pulling back, so this method is not perfered. So with that said, lets talk about some ways to speed up your XML data dumps from UMRA. One of the main tricks is to do as much processing as you can within UMRA. This will eliminate a lot of unnecessary open/close of connections to UMRA. Another tips is, to make sure our flash chart will partically load your XML data before the complete set of data is ready. So for example, if you want to get a list of all users and some of there attributes from active directory, and your doing this on 10k plus students, have your charting graph display maybe the first 200 or so records, and if the "scrolling" is actived to get the latest record in the XML file. So I hope this helps some of you out there with any problems you might be having if you are trying to this approach, and as you can see there are tons of applications you can use your XML for, or you can use it for custom audits and reporting.

UMRA – User Active Directory Kiosk Self Service

2009-07-12T12:20:00.000-07:00

UMRA – User Active Directory Kiosk Self Service

A recent request that’s come up for one of our clients is to build a way for there employees to manage their Active Directory information, such as address, phone numbers, email address etc. However, during this process they needed a way to ensure the user who is going to use a self service portal, or kiosk machine, needs to be who they say they are. This is quite the demanding task, however with UMRA this task now becomes easy. With UMRA I am able to use it as my backend logic tool, that will do all the processing, and updating of information in Active Directory. I went ahead and took this project a step further, and wanted to log all the actions that a user took when updating their information in Active Directory. So I logged into a MSSQL (You can use MSSQL, MYSQL, Access, Oracle, really any ODBC compliant database, even a text file if you wanted), who the user is, date time, what they updated, and the old value of the attribute, and the new value of the attribute. Now an admin can look back at anyone point in time, and get a complete user audit when needed. Ok, so some of you might be asking why you would allow your users to update their information in Active Directory, simple… Now the employee is responsible for their Active Directory Attributes. What can be updated you might be asking? You can allow the users to really edit any part of their Active Directory account for a UMRA PHP ASP .NET etc. webpage, it’s up to you what you feel they should be able to edit. In most cases, we see our clients request that the end user be able to edit first name, last name, middle name, display name, description, office, phone number, email, and other Active Directory attributes. Of course when creating a UMRA Portal to manage this, the limits are endless, you can have specific drop down box’s for different OU’s, data validation etc.

Now one of the main things to keep in mind here is the security on this UMRA Self Service Portal. In most cases I will use Windows Integrated Authentication to figure out who the user is logged into the computer, then when the user goes to your UMRA Portal UMRA in the background will take who logged in user, grab their information and display it on the screen, if UMRA cannot find the user, you can redirect them to a different page, and then have UMRA email IT or someone to notify them there was an error when trying to get a users information. Below is a quick screen show of a module you can make and integrate into your intranet site or make a stand alone Kiosk Self Service Machine.

UMRA – Reset Active Directory Password From Web

2009-07-11T19:44:00.000-07:00

Tools4Ever’s Product Downloads Below.

Download User Management Resource Administrator > Download
Download Self Service Password Reset Manager SSRPM >Download

If you want to learn the basics on how to connect to UMRA with its COM object, please see my original post on “Basics of UMRA COM”.

UMRA – Reset Active Directory Password From Web

Like most schools, or business users who forget their passwords, and need to call the help desk to get them changed is a daily occurrence. Now, in most cases the user might have multiple login for different applications, so changing these other applications passwords might take emailing different departments, or emails to different vendors to get them changed. Now, as you know this is very time consuming and there is a lot of overhead in trying to reset all these password, so is there a way to combine all these password reset requests into one work flow? Yes, with UMRA you can. Now, keep in mind that there are limitations in this process such as, maybe your applications does not have an API COM or another method to connect to it, so in that case you might be out of luck, however like most enterprise software you have a way to connect to these systems. So how do I reset these passwords you ask? Easy, UMRA has the ability to connect to MSSQL, MYSQL, ORACLE, Access… really any ODBC compliant database. UMRA also has the ability to use Microsoft Windows PowerShell, but wait; you can also create your own Microsoft Windows PowerShell Actions and import them into UMRA. Yes, so with UMRA you are not limited to the functions that are built in, you can now make your own, custom password reset functions.

Ok so let’s get down to it, I will go over at a high level on how you would go about creating a script that can reset the Active Directory Password, and other downstream systems at the same time. First though before you start this process, you should read some documentation on how your downstream systems support is, see if they have the ability to call an API or COM etc. to reset a password.

Step 1
Create UMRA project that will take a parameter such as username, accounted etc. This project needs to be able to pass the correct identifier to Active Directory, and your downstream applications. For example, in your other application, if the users are marked with a special ID, you will need to link those ID’s up to the accounts in Active Directory. In most cases, if you’re lucky the same accountname in Active Directory will be the same id for the user in the other downstream system.

Step 2
Now that you have a link from the user in Active Directory and your other application, first step should be to change the password in AD, then your other application, now changing the password for your user in active directory is the simple part, however, changing your applications password is really where is where this will vary, depending on your app, you will need to do a call a command line function in UMRA for an AS400 system, maybe call a VbScript, etc.

Step 3
So now that you have your UMRA project built, you can now build a simple ASP PHP .NET etc. webpage to search for users, and then a hyperlink to call the UMRA COM object to fire off your project. (If you need help with this see my other blog posts)

So there you go, as you can see some very simple steps on how to change passwords in Active Directory and other systems. This is great way to keep all user passwords in sync.

Blog Update July 26th 2009

So you might notice on a few of your favorite blogs that I am updating them with some new and fresh content, why you ask? I am trying to give more deatail on how to do these tasks in more detail, and expand more on the high level overview i typicaly give in my blogs. I've also notice over the last month of so, this topic has been getting quite a few hits, so i fugured to update it some. So lets dig a littler deeper on some of the tips on how to do this from the web, and some of the tricks in linking all this up.

UMRA – Reset Active Directory Passwords

Now some of you might be wondering what /how does
UMRA actually change the user account in Active Directory? UMRA runs its service under an active directory account that has domain admin rights. So if you were to reset a users password that did not meet your active directories password complexity, it would throw back an error. Just liek we mentioned above, when I do my UMRA Portal
Password Resets I always have a "errorflag" variable set, at first it starts off at the value "0" and if any part of my script throws an error, I have it GOTO error portion in my script, this will in turn will set the "errorflag" variable to the value "1". In your UMRA PHP ASP .NET webpage etc. you will just check the return variable of errorflag, if its equal to 0 then you know ther was no error in the script, and the users password was changed, if it set to 1, something was wrong with the script, since you pass this script 2 paramaters, 1 is the samaccountname of the user you want to change, and the other is the password. You know you will find the user in active directory, unless someone just deleted the user, so the error must be on the password change. So if the user enteres someting that does meet your active directories password complexity, then it will throw an error trying to set the password. In some cases you can get even more fancy if you like, and if you want to throw an error jut in case its a username error, then you can have your script drop down to a differnt part of the script, and change the "errorflag" value to "2" instead of one, and then in your UMRA PHP ASP .NET webpage etc. you would see what the # is equal to, if its 2 then you know there was an error, and you will be kicking back a response like "Count not connect to user" or something like that.

As I've talked about in the top part of this blog, not only can you cange password in Active Directory, but you can also change passwords in other systems if you have the right permissions. Permissions? Yes, if your other application such as an AS400 alows for remote passwords to be sent to your AS400 for changing then you can, but you have firewall block, software blocks etc, you might run into a little trouble chaning these passwords. You can follow the same logic as I gave above to intagrate some really nice error handing. Then on your webpage, you can tell if you change your users active directory password succesfully, and then make sure you changed your user AS400 password successfuly. If both were successful, you now just sync both password up in two different systems.

UMRA – Active Directory AS400 Password Sync

2009-07-10T20:28:00.000-07:00

UMRA – Active Directory AS400 Password Sync

In recent months I’ve seen more and more of our clients wanting to do password resets in Active Directory, but also at the same time change the passwords in the AS400 system they have. Typically this process would be difficult from a Web Portal perspective. In many cases some clients might have some type of VBScript, PowerShell Script, or Pearl script to sync both, but these methods take a long time to learn, and error handle is near to none at the most. However, when using UMRA to sync your passwords from Active Directory to an AS400 this process couldn’t be easier. If you do this with PowsShell, you can now import your PowerShell script into UMRA and have a simple drag and drop item that you can use anywhere in your UMRA scripts. In most deployments we’ve used a combination of UMRA’s ability to call the command line, to sync AD with an AS400. Now some of you might be asking, how we connect the 2, simple, most AS400 systems have an API that contains a few methods where you can pass a username, and a new password, or new userdata to your AS400. Methods such as updateuser, updatepassword and so on. So, not only can you keep your AD and AS400 users passwords in sync, you can also keep their AD attributes in sync with AS400, but that will be another blog. Now, be aware, that not all AS400 work like this, so consult your AS400’s documentation before you try to create such a UMRA scripts.

How, has this helped our clients? It’s helped speed up the process of user password resets. You don’t need to grant users any elevated rights in Active Directory or other systems, you can now create a simple webpage in ASP PHP .NET etc. and user UMRA COM Object Methods to call your UMRA scripts through AJAX JSON etc. I hope this blog helps some of you out there if you were wondering if UMRA had this ability.

UMRA – Web Portal Active Directory Reporting Audit

2009-07-09T19:07:00.000-07:00

UMRA – Web Portal Active Directory Reporting Audit

In recent posts I’ve talked a lot about how to take actions on Active Directory objects with a UMRA Web Portal. However, sometimes you may just want to get a quick overview what’s currently in your Active Directory. Maybe you want to get a current count of Active Users, or Disabled users, or go a step further and grab these users, but also grab these users accountnames, displayname, group memberships etc. There are not a lot of tools out there right now that will do this for you, and if they do, they require extra modules to be purchased or long amounts of downtime for them to upgrade your Active Directory Tool. However, with UMRA that’s a thing of the past, you can now create simple scripts to query Active Directory in real time and get you the latest information on users, computers, groups, OU’s, really any active directory object. Now, with the rise of SOA (Service Oriented Architecture) applications out there, there main way of getting data, or sending data is via XML. Now some of you might be asking, how do you create a XML file with UMRA? Simple, since UMRA has the ability to create files, you can a file called testdump.xml, and for say each record in a table of users, you can now kick this data out to your XML file, cool huh! So, now you can use UMRA Automation project to either do a hourly, daily, or whenever dump of the current data you want to get. In most cases, you can integrate this functionally into a UMRA Web Portal where you can manually call your UMRA Automation projects to go in real time and grab this data.

Now I know some of you might be asking still, how are creating XML files of Active Directory data going to help with Reporting and Auditing of your Active Directory. Again, since many applications are now using SOA Architecture, you can feed those programs directly with your real-time XML file. Or you can create your own Active Directory Reporting and Auditing UMRA Web Portal. Below are some screen shots of what I was able to create with UMRA.

UMRA – Web Portal Error Logic Auditing

2009-07-07T20:49:00.000-07:00

UMRA – Web Portal Error Logic Auditing

If you haven’t already take a look at my blog on how to get UMRA Automation projects locked down with some very flexible and extensive Error Handling. Click here > http://activedirectoryadmin.blogspot.com/2009/07/umra-active-directory-automation-error.html That blog will give you an idea of how to put Error Logic into your UMRA Automation projects. However, this blog post will be on how to check for erros when you are performing some type of action on through a UMRA web portal. We all know that sometimes you will get errors for performing an action, it can be something as simple as missing information, however that should be handled on the front end, but just in case, you want to make sure you kick some type of error message back, it can be something small as “Error”, or something complex telling the user what the error was. For example, I recently created an Intranet Portal for a large wireless company. When they created users, if for some reason there was an error creating the user, I was kicking back a message that just says “Error Creating User” however, they needed much more information than that, so I was able to build some better error handling into my project kicking back an error message such as “Wrong OU Path”, “Firstname / Lastname already in use”, and even “AccountName already in use”. With these types of error messages, you can now have a more user-friendly portal, and give more logical error messages to the end user. Now, some of you might be asking, how you get started adding some error logic to your script, well read below to find out how.

UMRA – Web Portal Error Logic Auditing How To

When you create a new UMRA Automation project, the first thing you should do is add a few actions to your script, I will always pull over a new variable actions, and call it %errorflag% and set its value to 0. I then pull over a few labels and just call them “Error” and “End Script”. If I throw an error anywhere on any of my actions such as creating a user, creating a mailbox, creating a home drive or folder, etc. I will then drop down to the “Error” label, and update my %errorflag% to 1. Now in your .asp PHP .NET etc web portal, check the value of %errorflag% if its = to 0 then there were no errors, however, its its = 1, you know you threw and error. Below is a screen shot of how you can integrate this into your UMRA Automation scripts.

UMRA – Active Directory Computer Event Logs Power Shell

2009-07-06T17:57:00.000-07:00

Tools4Ever’s Product Downloads Below.

Download User Management Resource Administrator > Download
Download Self Service Password Reset Manager SSRPM > Download

If you want to learn the basics on how to connect to UMRA with its COM object, please see my original post on “Basics of UMRA COM”.

UMRA – Active Directory Computer Event Logs Power Shell

In most of my blogs I talk about how to edit and maintain active directory users, and other objects within a UMRA Web Portal however, sometimes you might want to monitor if someone is making changes directly within ADUNC itself. You might be using some tool, or VBScript to monition these now, however, these scripts are often very hard to update, or you might have downloaded something on line, that just doesn’t seem to work. The way to get around this is use UMRA and PowerShell to scan the Event Logs for specific information, or just pull up a complete log itself. I was able to built a quick and handy power shell script in UMRA that will do go into the logs of a specific computer and grab out the information, get any recent updates on the computer (what hot fix’s etc were installed), and even grab the event log from the computer, and this is all done with UMRA and PowerShell. How is this handy to you, you ask? Well, now you have the ability to get multiple computers log records at a time, or search a computer and get the records one by one. The PowerShell script was very easy to import into UMRA, once it was imported, I was able to use this script right away, and other users who have the ability to create scripts within UMRA also have the ability to use my PowerShell script I updated. This “Upload and Share” functionally makes UMRA a true powerhouse in development, now other Active Directory Powshell scripts you might have, or have been using, can be shared with other Active Directory Admins, easily and quickly.

Here are a few screen shots of what you can do with UMRA PowerShell.

UMRA – Portal Active Directory User Audit

2009-07-03T21:19:00.000-07:00

If you haven’t already download the free trial version of User Management Resource Administrator here > Download

Download Self Service Password Reset Manager SSRPM > Download

If you want to learn the basics on how to connect to UMRA with its COM object, please see my original post on “Basics of UMRA COM”.

UMRA – Portal Active Directory User Audit

In my previous blog post I talked about how you can log all your UMRA web portal actions to a log within a SQL, Oracle, Access, or another database system. This will allow you to quickly pull up past history of actions by your users. So regardless of when your user in the portal took these actions, it could be a month, a week, a year down the line, you will now have a complete history of either actions on a user, or actions performed by a user. Now, some of you might be asking, once you have this data, how can I pull it up quickly, and get the data I need? Easy, what you can now do is add it to part of your UMRA web portal, to quickly go in, and grab certain parts of the log file, and display it back on the screen. So in this blog will show you some other cool tricks you can do to really integrate this Active Directory Auditing to your current UMRA web portal web pages. I’ve created a quick and flexible way to grab these records when you want to edit user’s details, or just look at an overview of their account.

If you haven’t already, read over some of the below blogs, to get caught up to speed.

Audit and Logging: http://umratips.blogspot.com/2009/07/umra-web-based-user-audit-and-logging.html
UMRA COM Connection: http://umratips.blogspot.com/2009/04/connect-to-umra-with-com-object.html
Loop Through DataTable: http://umratips.blogspot.com/2009/04/umra-com-object-loop-through-data-table.html

UMRA – Portal Active Directory User Audit How To

So now that we have this data logged to a database, we need a way to pull the data out we need in a more user friendly fashion. Now there are tons of ways you can do this, so the way I will talk about it, doing a simple database query with UMRA Automation project, and linking this up with you search for a user, and want to edit that users details.

Step 1:
Create a simple search webpage that brings back results based on your criteria, samaccountname, displayname, etc.

Step 2:
Create a hyperlinked JavaScript function to get the users details, similar to previous blogs I’ve talked about. This can be done a ton of ways, either with ASP PHP ASP.NET, with AJAX, etc.

Step 3:
After you have your users Active Directory Data, run either another function, or display another page getting the users data out of your logging system. Now, since you are already passing the samaccountname to your UMRA Automation project that gets the users data, you should send the same samaccountname to another UMRA Automation project that runs a simple database query on your logfile, to pull records that this user you are editing were part of.

Here are some screen shots of how I did this function.

UMRA – Web Based User Audit and Logging

2009-07-02T16:48:00.000-07:00

UMRA – Web Based User Audit and Logging

When creating an ASP PHP .NET etc. UMRA web portal that edits, creates or modifies active directory objects, you want to have some logging system that will allow you to audit actions that were taken on these active directory objects. Now, UMRA of course has the ability to connect to SQL, Oracle, and other databases, so you can also manage these systems information and log it. However, for this blog post, we will only talk about to log all actions through a UMRA web portal. Now some of you might be asking, what can be logged. The quick answer is everything, any action, any search, anything. You can go as far as logging when someone searches for users, when someone looks at an active directories account details. However, again for this blog post we will just focus on how you would log just the actions that take effect or modify something in active directory. Now if you haven’t already, you should read my other blog posts on how to loop through UMRA datatable, and how to get the basics of the UMRA COM object connection.

UMRA COM Connection: http://umratips.blogspot.com/2009/04/connect-to-umra-with-com-object.html
Loop Through DataTable: http://umratips.blogspot.com/2009/04/umra-com-object-loop-through-data-table.html

UMRA – Web Based User Audit and Logging Tips

So as I’ve stated you can log almost any action in an UMRA web portal, even down to what your users are searching for, however, we are going to stick to a high level approach when doing our tracking and auditing. Now there are multiple ways you can get your auditing trail setup, for my application approaches, I always will log my actions to a SQL database, however it’s up to you where you log your information, if you plan to have a lot of users managing Active directory with your UMRA web portal, going towards some sort of database logging mechanism is critical, and far more flexible down the road.

Step 1:
Figure out where you want to store your logging data. This can be in a many different places, MS Access, MSSQL, MYSQ L, ORACLE its really up to you, whatever you have available to you, will work fine.

Step 2:
Get your list of functions you want to log from within your UMRA web portal. Maybe you have a create user, or edit your functions.

Step 3:
Within your UMRA Automation Project use the “Update Database” action to log the data to your database. The “Update Database” action has a setup wizard that will walk you through most of your connections to your most popular database types.

Step 4:
Now that the data is logged, you should have a webpage that will pull this data from the database. There are 2 ways you can do this, your webpage can call the database directly, or you can have an UMRA Automation Project create a generic table with the data in it. Then you would loop through that table.

So there it is, a quick an easy way to get your UMRA web portal actions logged to a database, so now you will have a complete audit trail of your portals actions. In a later post I will show you how you can integrate these logs into your user searches, so when you pull up a user account, you can see all the actions taken on it.

UMRA – Web Based User Group Management

2009-07-01T18:55:00.000-07:00

UMRA – Web Based User Group Management

In previous blogs I’ve talked about ways you can manage users in your Active Directory through a UMRA web portal, thus limiting users from using Active Directory directly. One of the main features our clients ask for when creating a UMRA web portal with different types of Role Based Access Types is the ability to add or remove user group memberships either in bulk, or on a one by one basis. Both approaches are possible, however, in this blog I will talk a little about how you can really integrate user group management within a UMRA web portal. Now, there are a lot of pieces within Active Directory Group Management, and different ways you can manage your group memberships with UMRA, such as managing groups from the group itself. What do I mean? Instead of doing a search on a user, viewing there groups, then adding users as members of a group, you can do the reverse, and search in your active directory for a group, and view its members, and members of. So now you can manage these groups from this point of view, however I will talk about this in a later blog post.

UMRA – Web Based User Group Management Tips

If you haven’t already read how to create a basic web portal with UMRA, please read this blog here: http://umratips.blogspot.com/2009/04/connect-to-umra-with-com-object.html. That blog will give you the basics on how to create a web page with UMRA and connect using the UMRA COM object. If you need some example UMRA project see this post: http://umratips.blogspot.com/2009/06/umra-example-projects.html. That blog post is a great resource for UMRA example projects. So lets get started on how to get and or create a simple webpage to allow for your different Role Based Access Types to manage your Active Directory Users Group Memberships.

Step 1:
Create a search to grab users based on accountname, displayname, or another set of attributes.
UMRADatabale: http://umratips.blogspot.com/2009/04/umra-com-object-loop-through-data-table.html

Step 2:
Within your ASP ASP.NET PHP webpage, create a hyperlink, or an AJAX call to get the users data from your list of displayed results

Step 3:
Within your UMRA Automation Project, bind to the user with the samaccountname (username) and get the users current group memberships. Loop through these the same as we would loop through your users search results.

Step 4:
Follow the same steps for searching for groups, as you did for users. You should now have 2 lists, 1 of user groups, and 1 of searched groups. Again, within your ASP ASP.NET PHP webpage, use javascript, AJAX etc. to make a hyperlink to click so the user can be added to the group.

UMRA – SSRPM Moodle Login Authentication

2009-06-24T18:33:00.000-07:00

UMRA – SSRPM Moodle Login Authentication

In previous blogs I’ve talked about ways you can have SSRPM as your user authentication method for an Employee Self Service type portal, or use both UMRA and SSRPM together to integrate an Employee Self Service option into the SSRPM web authentication. Both of these methods are very power, and scalable models, however as I’ve talked about before, SSRPM challenge/response mechanism can be used as a verification security system before another process is started. What do I mean? Well, since Self Service Password Reset Manager SSRPM has the ability to authenticate a user even if they are not part of your LAN or even in another domain, we can use this to our advantage. So how am I using this with Moodle? I was tasked to have Moodles LDAP Authentication method to check first if the user who is logging into Moodle, is actually enrolled into SSRPM, if they are not, then force them to enroll into SSRPM. If they are enrolled into SSRPM then allow them to log into Moodle. The second part of this is, if the user forgets his or her password, they can now use SSRPM to authenticate themselves using the challenge and response questions, once verified, they can now either change their password in Active Directory, or directly in Moodle.

UMRA – SSRPM Moodle Login Authentication How To

So if any of you are out there trying to create such an authentication model using SSRPM and UMRA I will give you a few tips and a quick walk through on how you can accomplish this. First if you haven’t already, your Moodle install will need to have a test user who is not being authenticated with LDAP, and another user who is. You will also need to have a user who is enrolled into SSRPM and another test user who is not.

Step 1 -
Install SSRPM and configure it.

Step 2 -
You will need to edit Moodle’s login procedure, this is on login.php file located in the main root file, it’s not the file located in the blocks directory.
Tip –
You will see a method in login.php called “LDAP Authentication”, you will need to either run a function before this to check the username entered is in the SSRPM database. If the user is within the enrolled users table in the SSRPM database, then allow the user to login to Moodle. If they are not within the enrolled users table, then use the http redirect method to have them redirected to your SSRPM web interface.

I hope this helps anyone out there who is trying to do such a Moodle / SSRPM Login Authentication check. If you have any questions, please feel free to email me or comment.

UMRA – SSRPM Web Based Employee Self Service

2009-06-23T19:22:00.000-07:00

If you haven’t already download the free trial version of User Management Resource Administrator here> Download
Download Self Service Password Reset Manager SSRPM > Download

If you want to learn the basics on how to connect to UMRA with its COM object, please see my original post on “Basics of UMRA COM”.

UMRA – SSRPM Employee Self Service

Now I’ve talked about similar topics of Employee Self Service using UMRA, SSRPM or both of these together to accomplish this task. From what I’m going to talk about uses both UMRA and SSRPM together to create a very flexible and easy to manage Employee Self Service portal. When we talk about allowing users to control their information in active directory through an interface, we need to make sure we have some type of challenge and response or security wrapped around this approach. That is exactly where SSRPM comes into play, since SSRPM already has a ton of security and processes to challenge the user before either resetting there password, or even editing AD information, this will be perfect for creating our Employee Self Service. Now, where does UMRA come into play in all of this? UMRA will be used to get/set the active directory information after a user has authenticated them through SSRPM.

Now some of you might be asking yourselfs, why would we need to authenitacte through SSRPM before I let the user manage there Active Directyory Information. Simple, If a user is on an outside LAN, or logged into another domain OS/system,, this makes it almost impossible to figure out what user is trying to access there Active Directory information. So SSRPM challenge response questions fill this void, and provide the perfect solution to ensure secure user management account update transactions. Below I will talk about some very high level steps on how you would get a project like this started, and some tips that I’ve learned along the way.

UMRA – SSRPM Employee Self Service Tips

Now this is the third of fourth Employee Self Service I’ve built so I will try to start from the basics and really show you how to get something like this started. Now, keep in mind, we are going to talk about letting the user edit and control their information in Active Directory however, UMRA has the ability really to connect to any ODBC compliant database, so we can pull information from a HR, Student Information System SIS etc. Display this information to the user, and allow them to edit it.

Step 1:
Download and install Self Service Password Reset Manager SSRPM > Download
Download and install User Management Resource Administrator > Download
Configure both UMRA and SSRPM

Step 2:
Make a list of the items you want to allow your users to edit, either in Active Directory or another system.

Step 3:
You will need to edit a few pages in the SSRPM web interface, these files will vary depending on what you want to accomplish. If you want to keep the stock functionally within the SSRPM web interface, then you can add another button to the front page of the SSRPM web interface. (See the picture below to see how I added an additional option to the main screen)

Step 4:
After the user has authenticated them self’s using SSRPM challenge and response questions, you can now edit the page where they can edit and manage their attributes in Active Directory.
For my sample screen shot below, I list out the most common attributes, even allowing for the user to control who their manager is.
Tip – If you are going to allow the user to manage who their manager is you will need a mechanism that will search Active Directory and display the results in a user friendly fashion. I was able to accomplish this with AJAX and UMRA. After the user has typed in more then 4 characters, UMRA will go into Active Directory and search for matches similar to the searched criteria, and display them in a drop down, as the user types, it will continue to filter down until only 1 or no results match the criteria.

Step 5:
When the user changes an attribute, use UMRA to update these values in Active Directory. During this process, it’s a good idea to update a logging database to show time/date, action on, old attribute, and new attribute values.

I hope this helps anyone who is trying to accomplish a similar task.

UMRA – Web Based File Distribution System

2009-06-22T18:38:00.000-07:00

If you haven’t already download the free trial version of User Management Resource Administrator here > Download

If you want to learn the basics on how to connect to UMRA with its COM object, please see my original post on “Basics of UMRA COM”.

UMRA – Web Based File Distribution System

Hey everyone this blog is going to be a little different then my current blog posts. Most of my blog posts talk about projects that I’ve created, and completed. However, this blog is going to be about a current UMRA web based file distribution system for a local school district. I am about half way through the project, and found a few ways to create and manage such a system with using UMRA as your connector between the file system, and the users who you want to distribute these files out to. Now, distributing files to a current teacher’s roster is always a time consuming process, however I’ve come up with an easy way for the end user to do this. I will follow a lot of the same steps I’ve taken previous where I will create a list of users, select one, some or all, and then select the files I want to distribute out to them.

UMRA – Web Based File Distribution System How To

So as I’ve stated I’m only about half way through this process, and see my finishing it up here soon, so as I finish this project I will post the final steps and screen shots of how it all came together. Below are a few steps I’ve taken so far to get all the pieces in place.

Step 1 -
If you haven’t already, read on how you can create a data gird using UMRA and allowing the user to select one, some or many users from it. This data grid is critial to your overall flow of how the rest of the logic goes. A very good tip to keep track of what users are selected in your grid is to put either javascript or css action on your highlighted records, then store these records in a hidden field on your portal page.
Blog Post here > http://umratips.blogspot.com/2009/06/umra-bulk-web-based-user-management.html

Step 2 -
Next step will be to get a complete list of Rosters a Teacher is associated to. I was able to create a view in my SQL database of the clients Student Information System (SIS) to get these records with a UMRA datatable. , Now your scenario might be different. However, the rules should still apply, you will need to make a list on where you want to distribute your files to, this can be a distribution group, a set of servers etc.

Step 3 -
Depending on you’re what you are coding your UMRA web portal in php asp asp.net etc. you can do this step multiple ways. Create a custom upload form, either uploading 1 file at a time, or a multi form upload, when the user clicks the “Distribute” button, your button for distribution, you will need to check to make sure that. I was able to create an upload button that will upload the files 1 by 1. This function will upload the file with UMRA to a temp directory, and when the user is ready to distribute these files, I will have another UMRA automation project that will take all these files in the temp directory, and distribute them to the selected Teacher Rosters.

This is what I have so far for this current client project. However, once its completed I will post some nice screen shots, of the final product. If you have any questions, or are stuck on a certain step in creating your own UMRA web based file distribution system just email me or comment.

UMRA – Bulk Web Based User Management

2009-06-21T20:45:00.000-07:00

UMRA – Bulk Web Based User Management

Most of my other blogs have been on some type of web based UMRA controlled actions on a one by one architecture. However, with today’s fast moving environment, I’ve noticed this process is no longer viable. One by one actions for single user control is fine, however there are times when you need to do bulk active directory user updates, or bulk active directory user syncs with other sytems such as Moodle, PowerSchool, PowerCampus, and other SIS (Student Information Systems). I’ve been tasked with creating a local school district a Web Based Portal using UMRA as the main sync tool between active directory and end users. Our client was currently using Visual Casel for most of its active directory management, and bulk update / delete tools, however the flexibility for the end user to have full control over the application and create more control options was just not there with Visual Casel. However, with creating a custom UMRA – Web Portal you are able to expand past other products pit falls, and really create dynamic and flexible user controlled options on the fly. So with this blog I will give you an idea of how you would go about creating a bulk management tool, that allows you to edit one, some, or all users in in your active directory environment.

UMRA – Bulk Web Based User Management How To

As I’ve said before, having any type of tool that allows you to edit all of your active directory users is great. However, with most of these active directory tools out there, are very limited in what they can do, and only target a specific task. But, with UMRA – Web Portal you are now able to really create either specific tasks for current work flows, and even have the ability to create new work flows in the future. You’re not going to be locked down with just a specific tool. Ok with that said, the main part of getting something like this to work is getting all the users in your active directory to display in some type of grid, or data panel. There are a lot of methods you can use to get this done, so depending on if you’re using asp asp.net php or some other type of programming language try to follow these steps at a high level.

Step 1: Build a UMRA Automation project to get all your users, or a subset of users in an OU. This will depend on who you want to show up in your list.

Step 2: Create your webpage either to loop through your UMRA Automation projects datatable of users. Now depending on how many users we are talking about, you can take this next step in a few ways.

Step 3: If you are dealing with more than 2000 records, you might want to wright this information to XML, or store it in a temporary database. Why you ask? Well, if you want to have sorting options, you don’t want to be running your UMRA Automation project over again just to sort, so grabbing the data quickly from XML or a database would dramatically speed up your steps.

Step 4: Either with CSS or Javascript, keep track of what items were selected in your grid. I used javascript to check each time a datarow was highlighted or deselected.

Step 5: Build your tool bar, or buttons to control and fire off the actions you want to perform.

Step 6: Build corresponding UMRA Automation projects to link up to your tool bar buttons actions.

So there you have it, that is a quick high level overview on how to create a nice and simple Build Web Based UMRA – Web Portal. Below are a few screen shots of how you might do your layout.

UMRA – Staff / Faculty Roster Management

2009-06-16T19:22:00.000-07:00

If you haven’t already, please read my first post on where and how to download a trial version of User Management Resource Administrator, developed by tools4ever. UMRA

Download Trial Version of UMRA > http://www.tools4ever.com/download/
Download Trial Version of SSRPM > http://www.tools4ever.com/download/

UMRA – Staff / Faculty Roster Management

I’ve been tasked with doing an UMRA Automation project for a local Washington School district to automate Roster Creation, and Group / Resource management on these Rosters. Due to the Faculty / Staff to student relationship, we are taking over 30k records to manage, and make sure this UMRA Automation project was able to run multiple times a day. What is Staff / Faculty Roster Management you ask? For this schools definition was to have Security Groups in Active Directory created, and then students who are in the Staff / Faculty Roster (Data in SQL Database) to be added / removed from these groups. Then each group will have a corresponding folder system created for the individual Roster Groups, that give different permissions depending on the Roster Group. Now, this is no easy task to auto check these rosters within a UMRA Automation project. So I will try to give you a very top level overview of how I handled this project, and really cut each piece down into smaller pieces, to get this project to work.

UMRA – Staff / Faculty Roster Management Setup

When creating a UMRA Automation project to manage Staff / Faculty Rosters automatically you will need to break down each of the main tasks, into smaller tasks, since there are a lot of moving parts. First you will need 2 stored procedures or views in your SQL database. In my case I had 2 stored procedures I called, 1 with a staff / faculty to roster relationship, and another for the student to staff / faculty relationship. Now, when you’re dealing with 30K+ records you really need to focus on how to handle your data, and cycle through your data quickly. One was I did this was to have my UMRA datatable run specific queries against the stored procedures. Here are the steps below I did to break this project down into more simpler stream lined processes.

Step 1: Get Roster / GroupName mappings, how will the Rosters be named? Once you have this figured out, you can now have your first part of your UMRA Automation loop through the stored procedure and make sure all groups that need to be in Active Directory are there, if they are not create the group in the location it needs to be in.

Tip – If possible try to have the School – Faculty ID or Faculty Name in the GroupName, this will make it easier to parse later without additional UMRA datatable loops.

Step 2: Now that we have all the groups created in Active Directory, we can now loop through these groups and add/remove Roster members. Now there are a lot of ways you can do this, however the quickest way to do this is. Grab all groups that match your group creation above, put those into a UMRA datatable, now loop through that table, pass the GroupName (or your other ad attributes) to another UMRA Automation project, this project will pass data to your SQL stored procedure with the student to Roster mappings, this table will only bring back the results for what users should be in this roster, clear all members out of the roster, then loop through that table and add the users in 1 by 1, or turn your UMRA datatable into a multivalve variable and add them all to the group at once, both ways are fine.

Tip - Remember to do error checking, make sure you can do all pre tasks before adding users to their Rosters.

Tip – Remove ALL all users in the roster, BEFORE you do your loop to add rostered users.

Step 3: Now that we have all of our Groups for our Rosters created, and our students assigned to their current rosters, we can now loop through and create the Roster Home Folders. In my case, the Roster Home Folders were created in the same structure as the Active Directory Group mapping. So I created another table of all groups that met my group naming convention above, and looped through that table to create my Home Folders.

Tip – Make sure you do a check, IF the home folder exists, then go to the next record, IF it dosen't exist then create it.

This should get your started if not through most of having Staff / Faculty Roster Management Setup automaticly with a UMRA Automation Project. If you have any questions please feel free to email me or comment.

UMRA – ASP - ASP.NET - PHP - Portal Design

2009-06-13T22:45:00.000-07:00

UMRA – ASP - ASP.NET - PHP - Portal Design

Over the last few weeks I’ve been getting a lot of emails on “what are the different ways you can create a UMRA Web Portal, and what ways do I prefer to create my portal for my clients in”. Well, first off lets me say that you can create a UMRA Web Portal in many different methods, such as ASP with VBScript, ASP.NET using VBScript of C#, even PHP. It really depends on what your clients platform for development. Since UMRA is a Windows Based product, and always installed on a Windows OS, all the portals I’ve developed have either been in ASP or ASP.Net. Does this mean you can use PHP to develop a portal in….no. If you client allows for additional modules to be loaded into IIS to allow the parsing of PHP, then by all means code in PHP. So to answer the second part of the emails I’ve been getting “what do I prefer for my portal creations”. I prefer to use just classic ASP using VBScript to create my portals in. Why not user ASP.net you ask? Well, most of our UMRA Web Portal approaches don’t rely on any enhancement that ASP.net brings to the table, plus when it’s time to turn over the UMRA Web Portal to the client, they will need to install additional software onto their serer, which in some cases is not an option. Now, I know some of you are saying “but you can edit .aspx pages in notepad, however, with a very complex design in your UMRA Web Portal this task is almost impossible.

UMRA – Classic ASP Using VBScript

Out of all the UMRA Web Portals I’ve built most have been in ASP using VBScript, with the exception of a few done in ASP.net. I’ll give you a few reasons on why I develop this way.

Lots of Resources
When developing a portal, you’re going to run into a process or you will have to create some process that UMRA might not be able to handle, so you will have to design something from scratch. Since ASP Classic has been out for a while, there are a TON of resources online, for almost anything your trying to do. In most cases the VBScript will be done for you, all you have to do is either tweak a few parameters, or copy/paste right into your UMRA Web Portal webpage.

Ease of Use
So there are 2 sides to this reason. One is the ease of use for the client. In most cases, our clients VM or machine we are developing on, we are not allowed to install software, and if we do, we have to go through a lot of hurdles and downtime for this. So with ASP Classic, we can edit he pages in notepad, with relative ease. Unlike ASP.net where you might have to install additional software free or not, upgrading or changing the use of the .net framework, to handle any page edits the client would like to make.

Now some of you still might be thinking, or saying come on move to the new technology with the .NET framework. Now, trust me I am all for using the latest and greatest to build my projects, however UMRA is doing all the "hard work" for us that the .NET framework would do. What I mean by "hard work" is, connecting to Active Directory, and doing some type of action on an object. Now, this applies to any object or downstream system that you might be integrating with your UMRA implementation. So an example of this would be doing some type of file manipulation, sure .NET can do it, but so can UMRA. UMRA is more then an active directory object manipulation tool, it can handle file objects, moving, deleteing, creaing, seting security etc. Plus UMRA has the ability to call sript from the command line, such as vbsripts, and now it fully supports powershell. So if there is something you want to do that uses the .NET framework, you can now just create a PowerShell script that does what your looking for, and the call it from within UMRA in your application. So I guess what is really comes down to is what do you want UMRA to handle, and what do you want to handle with code. If you want to handle alot of your actions with code, then use asp, php etc, however doing your actions within UMRA now give you the ability to edit these actions easily and quickly. So keep this in mind, if you want to learn how to do the complete piping of webpage to You wont need to hire a web programmer to edit these pages when you want to make simple changes, you can now edit your functions within UMRA with simple drag and drop actions, instead of recoding some webpage, and hoping it works. Now, dont get me wrong here, sometimes it easier or even faster to do something in code, then rather doing another call to UMRA to do your action. For example, if you wanted to check if a file exsists, as most of you know you can do this with a three or four line piece of code in asp, php, or .net. Doing this through the code it speeds up execution time, and saves you some overhead of having to manage one or two UMRA Portal Pages and one or two UMRA projects.
So as you can see there are pros / cons of doing it all in these different ways. Now it migh sound like I dont like to code anything in .NET however this could be far from the truth. I plan to move all my current projects over to .NET most of mine are now, but not fully modularized like I would like them. So what can you expect to see me coding my projects done in .NET and classics asp.

Now if some of you are wondering what I code my UMRA Portal Pages in, depending on what I am coding in asp, php, .net it will depend on my applications. Here are a few of the free applications you can use that are free. NotePad++, CofeeCup, and Visual Web Developer. If you want to go up to a more robust web editing tool, you can use Adobe CS4 suite, or get Dreamweaver. So depending on what you feel comfortable with, you can use any of the above applications to manage your UMRA Portal Pages.

So I hope this answers some questions you might have when getting ready to develop your UMRA Web Portal. Overall, you can create your portal in what best fits your current development environment, sometimes you are stuck with using a specific coding technique, and sometimes you get to pick and choose.

UMRA – SSRPM Web Portal Integration

2009-06-10T19:41:00.000-07:00

UMRA – SSRPM Web Portal Integration

In my previous blog I talked about a product from tools4ever called Self Service Password Reset Manager SSRPM for short. Some of the clients I’ve built UMRA Portals for, also are running SSRPM for users in there Active Directory Environment, and they request to have functionally that SSRPM provides through its admin console, to be available to delegated users in there UMRA Portal without giving these users any elevated rights in Active Directory. Now, there are additional functionally within the SSRPM admin condole that we can integrate into the UMRA Portal such as unlocking/locking an account, viewing blocked time, blocked count, and any other piece of data in the admin console with the UMRA Portal. However, in this post I will focus on just doing a search for a user in Active Directory, and creating a simple hyperlink to pull back the selected users challenge and response questions and answers. Now some of you might be asking how this can be useful, and help your environment. You now have a way for Help Desk to search for a user through your UMRA Portal locate a user by id, accountname, employee number, displayname etc. Retrieve the users SSRPM questions, maybe ask the user these questions, and if the user answers these correctly, they then can proceeded with a specific action such as, updating an active directory account, resetting a password etc.

UMRA – SSRPM Web Portal Integration Walkthrough

I will keep this a very high level overview since there are a lot of moving parts when integrating multiple tools4ever products. So if you haven’t read the blog on how to do a simple search, and loop through a UMRA data table, then read this blog post below :

UMRA COM Object – Loop Through Data Table
http://umratips.blogspot.com/2009/04/umra-com-object-loop-through-data-table.html

Tip : For this to work you need to make sure your passwords are stored without encryption.

Now that we have our simple search page working, when you kick out results make it so the samaccountname or even better the user canonicalname is a JavaScript function that runs a function called getssrpmdetails(usercn) and pass this 1 argument, that argument would be the user canonicalname. In SSRPM database, they store the user canonicalname when a user is enrolled into SSRPM. So now what we can do is do a simple search on your Access or MSSQL database, depending on how you have your SSRPM configuration setup. Now the user query to get the user by the canonical name is quite complex, however to get this query, or any other query that updates/inserts any record into SSRPM database, simple run MSSQL query analyzer and watch what queries are being called during that action. So once you’ve obtained your query, use that in your AJAX page, to display back the users questions and answers to the page. Now some of you might be asking, what happens if the user is not enrolled into SSRPM, simple you can do a check on the results that it brings back, if the user is not enrolled, just display a message on your page saying so. An just like that, you now have a UMRA Portal integrated with Self Service Password Reset Manager. Below are a few screen shots of how I did this integration.

SSRPM – Self Service Password Reset SSRPM

2009-06-09T19:22:00.000-07:00

SSRPM – Self Service Password Reset SSRPM

Now I am going to talk about a different product from tools4ever called Self Service Password Reset Manager SSRPM for short, in this blog. Why you ask? Some of my clients I build portals / intranet sites for also have this self service portal for their users to reset there password with. Most clients want some type of integration of SSRPM into their custom UMRA web portal. This will allow a delegated user the ability not only to manage the user Active Directory Attributes, but also view the users Self Service Password Reset Manager questions and answers, and other vital information of there SSRPM without having any types of elevated rights to additional programs. So lets talk what SSRPM does, SSRPM allows your users to have ability to reset there password in Active Directory 24/7 via a web interface, or GINA extensions. You as an admin, can add/remove users by OU or groups to be provisioned to use SSRPM, and you can customize the different options on how a user can enroll into SSRPM, allow them to pick and choose their question challenge and response questions, or even having the user create their e own.

SSRPM –SSRPM Web Interface / Portal

As I’ve talked about in my previous paragraph, there are 2 ways to reset your password, if you are enrolled into SSRPM, one of which is through the SSRPM Web Interface / Portal. The portal installs on a standard Microsoft IIS environment, VM with IIS work perfectly fine also. The SSRPM Web Interface / Portal allows for a user to perform all tasks associated with SSRPM, enrolling, resetting there password, and even unlocking there account if they locked themselves out of SSRPM. The SSRPM Web Interface / Portal is standard .asp pages mostly driven by css style sheets, and can be reskined or even integrated into an intranet site, or portal you already have in your company. Below is a screen shot of the SSRPM Web Interface / Portal.

SSRPM –SSRPM GINA

The GINA is the second way a user can use the SSRPM application. This deployment is typically pushed out via GPO or SMS. tools4ever built in a nice SSRPM admin template to allow for different provisioned users to have different options. So if you look at the picture below, we add the “Forgot my Password” button below the windows login screen. The same options through the SSRPM Web Interface / Portal apply here through the SSRPM GINA extension. This method however is not as customizable as the SSRPM Web Interface / Portal is, however you still have control for things such as multiple domains etc. See the picture below.

UMRA –SSRPM TIPS AND TRICKS

Some of you might be asking why I covered this different product from tools4ever called Self Service Password Reset Manager. Simple, a lot of our clients have SSRPM also running in there environment, and in later posts I will show you have to pull back data from SSRPM and display it in your UMRA web portal.

UMRA – Active Directory Reporting

2009-06-07T19:54:00.000-07:00

UMRA – Active Directory Reporting

I was recently asked my one of our clients to create an automated way to pull active directory details in real time. Now, with this said, there are TON of reports you can generate in real time with UMRA on the backend grabbing all your data. Now, this blog post will really just go over how UMRA can pull data mine active directory in real time, but also I want you to be aware that since UMRA has the ability to pull from other systems other then active directory. You can now really create your own web based / portal reporting module tool. Ok, so 2 of the requests that I was tasked with to create are, “All Users Status” so a total count of users who are disabled, and users who are enabled, and “All Computer Status”, so same concept, they wanted to know all computer, and there current status. There are 2 ways you can take this approach when creating custom UMRA report. You can log all your data to a database that is pulled with UMRA or you can store all your data into XML files, and then read for those files. Why put them in XML files you ask? Some of your clients don’t have databases available to them, so this way, we can now create those custom UMRA reports, without connecting or requiring a database.

UMRA – Active Directory Reporting Tips

So anytime you are creating a Web Based Reporting Tool, you need to figure out 2 things, where to get the data, and how to display the data. So we already know where we will be getting the data, in our case it will be Active Directory, my client didn’t need to pull any additional information from any other systems. Ok, now we just need to know how we are going to display this back to the web page. So here are some of the steps at a high level, on how I was able to get this custom active directory reporting working.

All the steps below can be used for either Computer Object Reports, or User Account Reports.

Step 1 : Create a UMRA Automation Project that creates a table of ALL users.
Tip – You most likely already have UMRA Automation Project that does this, and it’s ok to reuse current script that may do this.
Tip – Here is a link on “How to create a table in UMRA”

Step 2: So for this step, you will need to decide on if you’re going to store your data in an XML file or database, again both are nice, it’s just up to what you have available to you. Now,Create a web page that will loop thought your database or XML file you created in your UMRA Automation Project. There are a lot of resources online on how to loop through a database, or XML file of data.
Tip – You most likely already have a webpage that does this, if you’ve been following the blogs.
Tip – Here is a link to “how to loop through a data table” Step3: You can do this step within step 2, or within your webpage. For a more speedy report generation, you can store the actual status of the computer or user account details in the XML file or Database. What I did in this step was store the status of the objects in the XML files, and when the user pulled up the custom report, it would show the status. I displayed a time/date when the report was generated, and another hyperlink to rerun the project, and get that data in real time.

UMRA – Active Directory Reporting Photos

UMRA – Web Portal Work Flow Management

2009-06-04T20:02:00.000-07:00

If you haven’t already download the free trial version of User Management Resource Administrator here >
Download If you want to learn the basics on how to connect to UMRA with its COM object, please see my original post on “Basics of UMRA COM”.

UMRA – Web Portal Work Flow Management

In my recent blogs I’ve talked about how to create custom work flows with UMRA and the web. However, once these UMRA Work Flows have been created, we now need to find a way to manage these tasks. Now there are 2 type s of management of your work flows we can talk about, 1 is how you delegate out these work flows to your RBAC types. The 2nd is how you will manage and change these UMRA Work Flows as your business rules change. I’ve also received some questions on what is the benefit to creating a UMRA Work Flow in a portal or intranet site, compared to just creating a custom UMRA Automation Script that does all the work. Both ways of creating your work flow are great methods for taking care of different AD or Downstream system tasks. However the one big benefit to creating a custom UMRA Work Flow through a portal is the fact that now you or who ever created the UMRA Automation Script that is doing the work behind the scenes, has control over the action through the portal. Plus, your users who you delegate to create work flows don’t need to have access to the UMRA Console.

UMRA – Work Flow Delegation

So you now have all your UMRA Work Flows built and you need to assign and or delegate them out to different Role Based Access Types you’ve set up in your portal. Most likely you will have these different RBAC types stored in a database of some type. So I will tell you how I created the 2 to relate to each other. I have 1 table that holds the UMRA Work Flows data that I’ve created, and another table will hold the different RBAC types that you’ve set up. Then I created another table that will hold the different ID’s of the UMRA Work Flows and match those up with RBAC type ID’s from my other table. After that is done, you can create a few simple .asp .php asp.net pages to manage these tasks. Below are a few screen shots.Here I’ve clicked on the “User Icon” before my Work flow, and it will pull up a screen to the right that will show the available RBAC types, and I simple select them from a drop down, and hit “add” this will add this type to my table we talked about above.

UMRA – Work Flow Management

I will keep this topic at a high level, since there a lot of moving parts to managing your UMRA Work Flows. Since your UMRA Work Flows can be a simple 1 action task, or a 30 line task, you will need to make sure that your database methodology is set to grow and be flexible enough to accept larger scripts data. How did I manage this? I created 2 tables, 1 table of the Work Flow name, and another table that holds the actions associated with the UMRA Work Flows I’ve built. I then created a nifty “edit work flow” page that allows you to edit each of your work flows actions, and add/delete an action as needed. See the below screen shot.
Here in this screen shot, I selected my work flow, and it displays the work flows actions to the right, and I can now click on one of these actions, and edit its properties.

UMRA – Example Projects

2009-06-03T20:04:00.000-07:00

UMRA – Example Projects

First off I would like to thank everyone for their emails and questions hey have been sending me. I’ve been getting a few emails requesting sample UMRA Projects that they can download instead of looking at pictures through my blog. So to help some of my blog followers, I will post a few sample code pages, and the UMRA Projects that are associated with them in a .zip file, this way you will have everything to get my example up and running. Here are a few of the requests that I’ve received on “How do you do this…” type requests.

UMRA – Example Projects Questions

Question 1:
How do you create a user with UMRA from a webpage, and then get back the username that was crated?
Answer :
We would take the same approach as we’ve talked about in previous blog post, on how we send data to our UMRA Project , then once we call the ExecuteUMRAProject COM method, we can now get a UMRA Variable Text from the script. So if you are using a “Create User” drag/drop action, you can now grab the %username% variable back out of the UMRA Project and display it on the page. The example UMRA project .zip file below contains 1 sample page that calls a UMRA Project and grabs a variable called %my_set_text% out of the script and displays it on the page.
Download: http://www.joefoxportfolio.com/downloads/1.zip

Question 2:
How do you Loop through a table of data that is from a database such as MSSQL or Oracle or any ODBC databse, from within UMRA Projects, and then display them out on a web page?

Anwser:
We would loop through the table the same way as if it were an LDAP query that filled the table with data. Only difference is, the columns are now defined by your query, or view that fills your table, and not columns we define in our attributes we want to grab from AD directly. So contained in this zip file, is a .asp page that grabs a table of data, however, you will need to configure the “Generate Gerneric Table” action within the UMRA Project, however this should give you an idea of how to get this running.
Download: http://www.joefoxportfolio.com/downloads/2.zip

So those are 2 commonly asked questions I’ve been getting from my readers, and I hope it helps you with creating and developing your web based UMRA Projects. I will post more UMRA project examples here in the future as I get more requests.

UMRA –Work Flow Delegation

2009-06-02T20:36:00.000-07:00

UMRA –Work Flow Delegation

This blog post is in continuation of my previous post on how to create Custom Web Based Work Flows with UMRA. If you haven’t already read that blog post, you should since it contains pre work and “how to” about what we are going to talk about here. So as in previous blogs I talked about how to create a custom Web Based Work Flows with UMRA so by now you should have either some work flow system in place, however, in most cases you now want to delegate out these work flows to different groups or delegated users in your Active Directory structure. With this in mind, I’ve created a very flexible way to create Role Based Access Types (RBAC ) that are database driven, and can be created very quickly, no more hard coding these different Roles into your config file. Now, some of you might be asking, how do these work with the Web Based Work Flows with UMRA you just made with UMRA. Well, you can now create custom user roles, and assign those Work flows you created to a specific roll. So below, I will give you some tips on how to integrate both systems into 1, and give you a few screen shots of how I implemented this.

UMRA –Work Flow Tips

You will need to create another database for the different user types you will have coming into your portal. In most cases, we can now bind a specific group members in Active Directory to a Role Type. Now, some of you might be asking, what happens if a user has multiple Roles that you have binded to your Role Based Access Types. You can handle this in many different ways, in some cases, you can display a drop down, asking the user to select what type of RBAC they want to be, or take the first RBAC that matches in your different RBAC types. So where do you begin? First you will need to setup another table in your database, just to hold and map all the RBAC types, then you will need another table to map the RBAC types to your Custom UMRA Work Flows. Once, you’ve done this, you now can display these out onto a simple webpage, or intranet page to have your usertypes run these at will. Below are some screen shots of how I implement this.

In this screen shot I created a RBAC type called “Service Desk Room 555” and binded it to a group in my AD structure, for now don’t worry about the radio box’s below the group binding.

Here I now can go back to my UMRA Work Flows and click on the little user icon in from on the Work Flow name, from here it will show me all my custom RBAC types we’ve create, and I can assign or remove access to this work flow from here.

So now I have a custom search, that brings back searched results based on a users samaccount name, from here I click the username, and it will bring up windows that shows only UMRA Work Flows that are assigned to my RBAC type. If I click one of these UMRA Work Flows it will take the user, and run then through your UMRA Work Flows.

UMRA – Web Portal Work Flows

2009-06-01T20:30:00.000-07:00

UMRA – Web Portal Work Flows

Now when we talk about work flows, there are a lot of ways you can create a work with UMRA. However, in this blog post, we will talk about creating a custom database driven work flow system with UMRA as your backend logic tool, and then we will talk about how to create a custom work flow within UMRA. Now, some of you might be asking what a Work Flow is, since there are a lot of different means of this depending on your different business flows, I will focus on what a few of our clients have asked to create for their work flows. One work flow I will talk about is, having delegated tasks such as termination/disabling users, having these request put into a ticking system, or approval system. The second is creating a custom database driving work flow, and delegating these out to different Role Based Access Types (RBAC).

UMRA – Work Flows

So the first UMRA Work Flow we will talk about is having delegated tasks through a web portal, added to a ticking system before they hit AD and make the changes. So how does this work? Here is a high level of how this concept works. You will have multiple levels of User Access to your web portal, this can include Help Desk, and then your upper level Role Based Access Type that can approve these tickets. Help Desk would go to a simple portal page, or intra net page, search for a user and click a hyperlink to disable a user. In most cases, you would just have an UMRA script go and disable the user, or run your work flow on the user. However, instead of this, we are now going to add this record to a database, this database can be SQL, Access, Oracle, etc. Since your .asp .net .php etc. web portal can use standard connection strings to access these databases. Now that your request is added to your table/database, you can now display a custom page to your RBAC type that has access to see these requests. This page can be a simple page that loops through any open tickets in your DB, and has a simple hyperlink that would run your UMRA Work Flow on that user.

UMRA – Web Based Work Flows

So in the previous paragraph we talked about creating a custom UMRA Work Flow within UMRA and having its actions placed in a ticketing system. We are now going to take a different look at how we can really maximize the web, and create UMRA Work Flows that are database driven. Some of you might be asking yourself, how this can benefit you and your portal users. Very easy, you can now create custom UMRA Work Flow without giving someone access to the UMRA console, and you wont even need access to the UMRA console. Did I loose you yet? Ok we will talk about this at a high level, and I will show some screen shots of how this is possible. In UMRA you can create smaller scripts that do direct tasks, such as, enable user, disable user, add a group to a user, remove group from a user, move user, etc. Now, on the web, you can create a “Work Flow”, and then add actions to these work flows, then edit these work flow actions, very similar as if you were to create a work flow like this directly through the UMRA console. Now some of you might still be asking “why don’t I do this through the UMRA console”. Again, you now can create your own “move user “ etc. flow, and have your RBAC types create their own custom work flows, without needing access to the UMRA console. However, when they add an action to their work flow, they are turn using your custom UMRA script on the backend, how cool is that!Here are some screen shots!Here I created a new Work Flow called “Managers Disable User” I will click on the gear icon to edit my action.

Here I clicked the “add action” icon that gives me a quick list of actions ive added to my portal work flow actions. After I added a few of these, I can now edit these actions.

Here I click on the gear icon, this allows me to edit each of these actions in more detail.

Our final step will be to assign this work flow to a RBAC type, since you don’t want all your users to use this action, you can now select from the RBAC types that you created.

So now that we have all of our UMRA Work Flow created and assigned I will show you in my next blog how to create RBAC types that are database drivin, and how to run these work flows against users in AD.

UMRA – Web Portal Delegation

2009-05-26T20:27:00.000-07:00

UMRA – Web Portal Delegation

In my recent blogs we’ve talked about ways to create a delegated Web Portal with delegated tasks that take direct affect on Active Directory objects, such as creation of user account, creation of groups, editing and managing group memberships. However, with this blog I am going to talk about NON Active Directory tasks that you can delegate out to users, such as account creation in other systems, and managing these accounts through a Role Based Access portal with UMRA controlling all the back end logic. Now some of you are most likely wondering how UMRA can handle such requests. Keep in mind that UMRA has the ability to connect to databases, it can push and pull data, it can also run command line functions, most of software applications such as Google apps, and Live Labs, People Soft, SAP etc have complete API’s that allow you to run functions via web services. Some of these applications are built right into UMRA so you can drag and drop simple actions for each of these applications. If you want to see topics on Web Portal Delegation on Active Directory Objects, see the blog posts below.

UMRA – Web Based User Provisioning
UMRA – Web Based User Provisioning V2
UMRA – Web Based Work Flows
UMRA – Web Based Group Management

UMRA – Web Portal Delegation Tips

First think you want to do is figure out what Role Based Access types you will have coming into your portal, and figure out what tasks in your application you want to allow those RBAC types to do. Also, you will need to make sure your tasks you want to delegate are available on the applications API documentations or listed a method. For example, if you wanted to delegate out a “Password Reset” in another application, you need to make sure you can do this either via a command line, or web service. If it’s not listed, it might not be possible, however I have noticed that sometimes if a specific method is not listed in the applications API list, doesn’t mean it’s not possible, some applications allow you to create your own API or method.

Now some of you might be asking, “What if my application is home grown” app. Simple, these applications follow the same rules as the larger applications. For example if you have a home grown HR system, that uses an SQL database as there backend to hold user data, you know there is either a Stored Procedure, or SQL stamen being used with creating a new user for that system. Most of the time you can use SQL Query Analyzer to see exactly what statement is being executed, or see what series of stored procedures are being called with you create a user through the application itself. Now what do you do with this data? You can now make a simple UMRA project that mimics this data. You can now follow these steps for other “actions” in your application. Before you know it, you will have your own complete UMRA API to your application in a sense. I hope this helps some of you out there trying to do this, if you have any questions, please feel free to comment.

UMRA – Web Portal Self Service

2009-05-26T19:17:00.000-07:00

UMRA – Web Portal Self Service

In my recent blogs we’ve talked about ways to create a delegated Web Portal with UMRA Automation scripts. I’ve also covered way you can delegate out Active Directory tasks such as, user creation, exchange mail box creation, home folder creation, and other Active Directory and User Life Cycle. However, in this blog post I am going to give you an idea and some tips of how to create a Self Service portal for your Active Directory Users. Now, creating a User Self Service Portal with UMRA as your backend can encompass a lot of functionally such as, allowing users to maintain and update their Active Directory attributes, without giving them any elevated privileges in Active Directory. I’ve had some of our clients request such web portals to integrate the user change requests to be put into a ticket system, or work flow. So as you can see there are many options you can do when setting up a self service portal with UMRA as your backend tool, however keep in mind without UMRA you won’t be able to handle such requests quickly and with accuracy every time.

UMRA – Web Portal Self Service Tips

When you decide you are going to crate your users a Self Service with UMRA you need to focus on what you’re going to allow your users to update in Active Directory. Now, quick note we are only talking about Active Directory here, however, as you’ve seen in my other blog posts, UMRA has the ability to run command lines, connect to Databases and so on, so you can actually have your users control information from other systems. To the user it’s seamless, they don’t need to know where your pulling the information from, and setting it to. So below are a few tips to keep in mind when creating a Web Portal for Self Service with UMRA as your backend tool.

Tip 1 :Get a list of items you want your users to update
Tip2: Create smaller UMRA scripts to handle each update OR create a generic UMRA function to accept 3 paramaters (username,attribute_name,attribute_new_value)
Tip3: Log ALL actions to a database (SQL Access etc.)
Tip4: Turn OFF IUSER Account in IIS Security, and turn ON Integrated Security

UMRA – Web Portal Self Service Screen Shots

Below are a few ways I’ve integrated a self service portal in a few of my customer requests.

UMRA – Web Based User Provisioning V2

2009-05-20T22:12:00.000-07:00

UMRA – Web Based User Provisioning V2

I am writing this blog in reference to one of my recent blog post UMRA – Web Based User Provisioning. I’ve received questions and comments regarding how UMRA interacts with a web based portal, or intranet site., So I will try to shed some more light on this some of the questions I’ve received, as well as dig a little deeper and show you some additional flexibility of creating a web portal for your User Provisioning with UMRA, including disabling users, reactivating users, and advanced group membership management.

UMRA – Web Based User Provisioning Questions

Question - What can you do with UMRA?

Answer – You can mimic any Active Directory Work Flow, or Business Logic you may have now when editing, creating, or modify an Active Directory Object, with simple drag, and drop actions. (See http://umratips.blogspot.com/ for COM/API information or See http://activedirectoryadmin.blogspot.com/ for UMRA – Automation , UMRA – Forms & Delegation, or UMRA Mass Projects.

Question – Can you do more than create a user with UMRA in the portal?

Answer – Yes, you can mimic any Active Directory task you do now, either in Active Directory itself, or with some other Active Directory Management Tool.

Question – What layouts work UMRA?
Answer – Since UMRA is your back end processing application, you can create any type of layout you like, it can be a simple HTML page, or something far more complex in ASP, .NET, etc.
UMRA – Web Based User Provisioning AdvancedSo now that know how UMRA can be integrated into a Web Based User Provisioning process, let’s talk about a few everyday tasks that you might want delegate out to a group of users, or Helpdesk etc. I will show you some screen shots, and explain how I integrated disabling users, reactivating users, and advanced group membership management into web based portals / intranet sites I’ve build for my clients.

Activating / Disabling users and Managing Group Memberships through a web portal.
- Now you see how I didn’t say only Active Directory Users, with UMRA we have the ability to run command lines process, vbscripts, push and pull data from ODBC compliant databases etc. So if you have other applications that use these, and provide some type of COM/API then you can utilize UMRA for these additional functions, thus not needing to give the user you gave right to, to make this change, and elevated rights. However, for the time being, we will focus on just Active Directory.The screen shot below is a portal I built for a client, that allows the user to search active directory by an attribute they specific, and below the search box it will display search results matching the searched criteria. Next, the user can click on the username they are looking for, and it will pull up the user information in real time, right from Active Directory. Now, keep in mind UMRA is taking care of all the requests in the background with scripts I’ve created. All the user has to do now, is click on the small icon next to the user’s status, if the user was disabled, it will show a different icon and wording compared to if the user was active.

In most cases, you can have your UMRA script do something simple as just disabling or reactivating the account, however, in most cases, my clients want to do far more than just that. Sometimes they can, disable the account, move the account to a specify OU, strip group membership, and then log this data to a database. This is all up to you, and how you create your UMRA script.If you look to the right on the screen you will see how I intergraded the user’s group memberships on the web, in a clean and easy to manage fashion. I display the user’s current group memberships in real time, and even gave the user the ability to search for groups, and apply them to the user, WITHOUT having the user go into, or have any elevated rights in Active Directory. Again, keep in mind, UMRA scripts in the background are getting/setting all this data for me, PLUS everything the user does, is recorded into a database, that way I will have a complete audit trail of this user, what was changed on their account, and who did it, time date etc.

Please keep a close eye on this blog, I will be writing more about differnt User Provisioning Optins I've developed and applied to our client web portals.

UMRA – Web Based Work Flows

2009-05-18T20:31:00.000-07:00

UMRA – Web Based Work Flows

Just recently I was tasked with creating portal for South West Washington Schools. This project consisted mainly of a web portal that will allow multiple departments to handle Active Directory tasks via the web, and have UMRA take care of all the backend work flows ie: group management, file share creation, user creation, and account updates. Now, one of the tricky parts to this portal was they have 30 schools in there district, and hundreds of user creation, and user management options. So creating portal with both process for different role based access types, and for over 30 different school locations is no easy tasks, however, with UMRA doing most of the work for the backend work flows, it made this tasks a lot easier. So this blog post will show you and give you some tips and how you might go about creating a web portal similar to this scenario, and give you some ideas on how you can integrate your work flows into you usermanagment lifecycles.

UMRA – Web Based Work Flows Tips

So here are a few tips that might help you when you try to create a portal of this size. Create Smaller “Function” based UMRA projectsWhen you have a lot of different Work Flows that you need to create in UMRA , create them in smaller projects, so if you have to manage groups, have 1 UMRA project that will take 2 parameters : 1 samaccountname 2 ground DN. This UMRA Automation Project will be called “Portal – Remove Group From User”. Now you can use this project anywhere in a work flow you create for your user. Now on the flip side, lets create another UMRA Automation Project that will accept the same parameters however, this script will ADD a group to a user. You can now do the same exact steps for Disabling a user account, and reactivating a user account.Some sample “Functions” you may have.

Portal – Add User To Group
Portal – Remove User From Group
Portal – Remove All Group Members
Portal – Disable User
Portal – Reactivate User
Portal – Move User

All these functions above will be very small UMRA projects that accept 1 or 2 parameters at the most. So how does creating smaller UMRA Automation Project help you with your Web Based Work Flows? Simple, now you can create your work flow with the smaller functions, and manage your Delegated Work Flows easier.Example of Work Flow:UMRA Automation Project Name : Portal – Work Flow Disable UserYour Script will follow your normal Work Flow, however now you can “call” your other smaller “Function” based scripts.

Get User AD
Call Function > Portal – Remove All Group Members
Call Function > Portal – Disable User
Call Function > Portal – Move User

Now as you can see his new UMRA Automation Project Work Flow we created, is comprised of almost all “function” based scripts you created previously. Now when you need to change how a “Move User” action takes place, all you need to do is edit 1 UMRA Automation Project script, and not 3 or 4 other UMRA Automation Project scripts. I hope this helps you in designing your portal, keep a close on this blog for more quick and cool tips on how to manage your active directory via we portals with User Management Resource Administrator UMRA.

UMRA – COM Active Directory Reporting

2009-05-10T20:51:00.000-07:00

If you haven’t already download the free trail version of User Management Resource Administrator here > Download

If you want to learn the basics on how to connect to UMRA with its COM object, please see my original post on “Basics of UMRA COM”.

UMRA – COM Active Directory Reporting

Running reports or obtaining information is always critical to any business. Having real time data on your active directory environment at your finger tips, is a huge benefit. As you’ve seen in my other posts about the flexibility of UMRA to create and manage Active Directory objects, UMRA also has the ability to gather large amounts of data quickly. With this in mind, we can now create custom reports via a webpage, or portal, and harness UMRA to get this data, and display it quickly. So in this blog post, we will talk about UMRA ability to do UMRA - Active Directory Reporting, and a few tips to help speed up more complex queries and data mining.

UMRA – COM Active Directory Reporting Tips

A lot of our clients want reports regarding Active Directory User data, with this in mind, we will focus on 2 major reports that you might find handy. Now keep in mind, these are not the only reports you can run with UMRA as your data mining tool. You can really run reports on anything in your Active Directory environment (almost anything). The 2 reports we will focus on are “User Password Expiration Dates” and “Total User and Computer Accounts” Reports. But before we get to these 2 reports, I will give you a few tips on how to speed up these queries and data mining.

Tip 1 > When gathering large sets of data, use UMRA DataTables – Not loops within your webpage.

Tip 2 > On Active Directory attributes that require conversion, have UMRA do these calculations, and not your webpage.

UMRA – COM Active Directory Reporting How To

We will keep this topic at a high level, if you need help with connecting to the UMRA COM object through a web page, please see my previous posts. If you need help with looping through UMRA table data, please see previous posts on these topics.

Report - User Password Expiration Dates

Step 1 : Create a UMRA Automation project that create 1 UMRA datatable, with a filter of just users, and users attributes (samaccountname,accountexpires) *NOTE* on the accountexpires attribute its stored in Active Directory as a long integer so have your UMRA datatable convert this value into time/date.

Step 2: Create your webpage to connect to this UMRA datatable, and loop through the table data and display the samaccountname, and accountexpires columns to your webpage (If you need help with this, see previous blog posts)

Step 3: Run your webpage, you will now see usernames, and there accountexpires dates.

Report - Total User and Computer Accounts

Step 1: Create a UMRA Automation project that create 1 UMRA datatable, with a filter of just users, and users attributes (samaccountname)

Step 2: Create another datatable in the same UMRA Automation project, but this time we are going to create filter that datatable for computers, not users, and pull back the samaccount attribute for each.

Step 3: Use the “Manage Table Data” Action, and have it “Get Number Of Rows” in your “users” database, and then Use another “Manage Table Data Action, and have it also get the “Get Number Of Rows” on your computers table.

Step 4: On your webpage, connect to your UMRA Automation project, and get the variables you set for the 2 different “Manage Table Data” actions, and display those on your page.

Step 5: Run your webpage, you will now see the counts for all your user objects, and computer objects in your Active Directory Environment.

UMRA – COM Portal Security Models

2009-05-10T19:54:00.000-07:00

UMRA – COM Portal Security Models

When creating any web based portal with UMRA figuring out and creating your Security or Role Based Access model is critical. Some Security Models can be as simple as 1 Accesses type allowed into the UMRA portal; however in some of our client portals, they require a far more flexible but yet granular Security Model. So in this blog post I am going to talk about the different types of UMRA based Security Models that you can create, and how to expand on those.

UMRA – COM Portal Security Models Tips

Before I start any UMRA portal I like to find what Active Directory Attribute we are going to use as our Role Based Access identifier. What do I mean by this…? When you have a multi level UMRA Security Model, you need to see what attribute in active directory will be uniform across the domain (or multiple domains), so you can make sure you give the correct UMRA Role Based Access to the user logging into the portal. Now, you don’t have to rely on Active Directory itself for this data… as you’ve seen in other blogs, UMRA has the ability to access an ODBC compliant database, such as a Human Resources System, or Student Information System… You can have UMRA grab data out of these other systems, and use information obtained to distribute the UMRA Role Based Access accordingly. So now that we know what we are going to base our UMRA Security Model on, we now need to focus on What Role Types we will have.

UMRA – COM Portal Security Models Roles

So in the previous paragraph we know what we will base our Role Types off of, now we need to figure out what Roles we will have in the data base. What are “Roles”… A Role can define a “type” of user, or group of users. You may have general users type who will be able to search for users, however there searches will be filtered on a set of OU’s or users they manage. You may also have another set of users, who will get to see different “tabs” or see different options in displayed to them. In most cases and portals we build, there are 2 different types of UMRA Role Based Access types, General Users, and Super Admin Users. So now that we know our identifier, and different Role types, we can now put all this together.

So below is an example of how you can now take the steps we previous did, and wrap your UMRA portal in your new Security Models.

Step 1 > Create a UMRA project to get your UMRA Role Based Access identifier.
Step 2 > Have your web page loop, or do a case statement on the different Roles you’ve defended.
Step 3 > Wrap the rest of your web pages, or forms in your security.

UMRA – Get GPO’s on OU’s

2009-05-05T18:22:00.000-07:00

UMRA – Get GPO’s on OU’s

Just recently I was tasked with creating a client a web portal that helped delegate out Active Directory tasks, to over 19 different schools. Each school will have 4 different Roll Bases Access Types, and 2 more additional groups that were considered “Super Users”. In total, this UMRA based web portal was no easy task, and would be quite difficult if we didn’t utilize the power of UMRA’s ability to get data from Active Directory and process it rather quickly. However, with UMRA I was able to gather critical Active Directory information needed to get me the information on the users account quickly, and accuratly everytime. The only major part of this web portal that was very tricky and hard to do was Getting GPO’s that were on selected OU’s. This sounds like an easy task, however it’s not, it required 3-4 linked UMRA projects, and 1 VB Script. I thought this below script was very powerful, and worked great with UMRA’s ability to get data from Active Directory quickly. There are multiple ways that you can get something like this to work, even a fully UMRA scripted way, that I was able to get working after I found the below VBScript online.

UMRA – Get GPO's On OU Tips

When creating a solution like this there are few tips and tricks that will help you along the way. First when obtaining all the Group Policies on a specific OU, you will need to put these GPO's into a UMRA Datatable. Form this table, you will loop through, and add the GPO ID's to an additional table. Here is the trick, this table will have just the Long ID's of the GPO's and not the names, so you will need to do a 2nd loop, to loop through the GPO's ID's and get the Names of the GPO's, Here is an example of what the tables look like when you run your loops. This should give you a better idea of how to create such a script.

Table 1 - OU's
testplace.local/myou/secondlvelou
>This table will pass each record to a second UMRA script that will now get all the GPO ID's for the passed in OU.

Table 2 - GPO ID's
{31B2F340-016D-11D2-945F-00C04FB984F9}
>This table will take the table of GPO ID's and send them to a third UMRA project that will get the name for the associated GPO ID that was passed.

Table 3 - GPO ID's Names
Laptop Security Room 105
>This table will be your finished tabled, it will contain a complete list of GPO's by name, that were on the OU passed in. You can now display this table in a UMRA - Delegation Form or Display it out with UMRA - Automation COM Object on a webpage.

Below is the VB Script that does a bulk of the work if you use the VB Script method, please feel free to use this script…I found it very handy.

VBSCRIPT:

On Error Resume Next

Set objContainer = GetObject
_
("LDPA://YOU OU DN")

strGpLink =
objContainer.Get("gPLink")
intGpOptions =
objContainer.Get("gPOptions")

If strGpLink <> " "
Then
arrGpLinkItems =
Split(strGpLink,"]")
For i = UBound(arrGPLinkItems) to
LBound(arrGpLinkItems) + 1 Step -1

arrGPLink =
Split(arrGpLinkItems(i-1),";")

strDNGPLink = Mid(arrGPLink(0),9)

Response.write GetGPOName
Select
Case arrGPLink(1)
Case
0

Response.write "No Override is cleared and the GPO is
enabled."
Case
1

Response.write "No Override is cleared and the GPO is
disabled."
Case
2

Response.write "No Override is checked and the GPO is
enabled."
Case
3

Response.write "No Override is checked and the GPO is
disabled."
End Select

Next
Response.write VbCrLf
End If

If
intGpOptions = 1 Then
Response.write "Block Policy
Inheritance is checked."
Else
Response.write "Block
Policy Inheritance is not checked."
End If

Function
GetGPOName
Set objConnection =
CreateObject("ADODB.Connection")
objConnection.Open
"Provider=ADsDSOObject;"

Set
objCommand = CreateObject("ADODB.Command")

objCommand.ActiveConnection = objConnection

objCommand.CommandText = _

";;" &
_

"distinguishedName,displayName;onelevel"
Set objRecordSet
= objCommand.Execute

Do Until
objRecordSet.EOF
If
objRecordSet.Fields("distinguishedName") = strDNGPLink
Then

GetGPOName =
objRecordSet.Fields("displayName")

objConnection.Close

Exit Function
End
If
objRecordSet.MoveNext

Loop
objConnection.Close
End Function

UMRA – Web Based Group Management

2009-05-04T17:37:00.000-07:00

If you haven’t already download the free trail version of User Management Resource Administrator here à Download

If you want to learn the basics on how to connect to UMRA with its COM object, please see my original post on “Basics of UMRA COM”

UMRA – Web Based Group Management

Group Management in Active Directory is no easy task, however with UMRA these time consuming task are now handled with ease, and precision. Many of our clients want some type of UMRA – Web Based Group Management web page in a portal, or integrated in an intranet site they may already have in place. Most of these tasks range from creating a new group, adding / removing members from a group, and adding groups to groups. This is not easy task when creating a web page that has all these functions. However, we utilize UMRA – Automation Module COM object to allow users to send data to specific UMRA projects, and have UMRA handle all the Active Directory work, or downstream systems work. Below is a quick VBScript that will loop through a table of a Active Directories Users Account, and Display the DN’s of that group on the screen. When you click on the Active Directory Group name, it will prompt you with the Groups DN.

First setup a UMRA – Automation project and get any users “memberof” attribute and add that to a table called “usersgroups”. If you need help with this, please see previous blog posts.

Second Step…Copy and paste this into your .asp file, and run it. You will see all the Active Directory Users Groups DN’s listed, and when you click the group name, you will prompt with the groups “DN”.

VBSCRIPT

'Create/Set Variables
Dim RetVal
Dim UMRA_Server
Dim UMRA_Port
Dim RowIndex

UMRA_Server = "MyServerName"
UMRA_Port = 56814
RowIndex = 0
'End Create/Set Vairbales

Set Umra = Server.CreateObject("UMRAcom.Umra") ' Create a New Instance of UMRA
Set UmraDataTable = Server.CreateObject("UMRAcom.UmraDataTable") ' Create a New Instance of UMRAcDataTable

RetVal=Umra.Connect(UMRA_Server,UMRA_Port) ' Connect to UMRA
Response.write "Connection to UMRA:" & RetVal & "<br>"

if (RetVal=0) then
RetVal=Umra.ExecuteProjectScript("My UMRA Script Name") ' Connect to your UMRA script
Response.write "Connection to UMRA Script:" & RetVal & "<br>"

if (RetVal=0) then
RetVal=Umra.GetVariableDataTable("%usersgroups%",UmraDataTable)
Response.write "Connection to UMRA DataTable:" & RetVal & "<br>"
RowIndex=0 ' Create a new Row Counter
RetVal=UmraDataTable.GetCellText(RowIndex,0,groupdn) ' Column 0 of our datatable

While (RetVal=0)
'Here is where we do the loop, and display on the page, the contents of the
Response.write "Group Name:<a href=""javascript: void(0)"" onclick=""showgroupdn('"&groupdn&"')"">"& groupdn & "</a><br>"
RowIndex1 = RowIndex1 + 1 ' After we get row 0, lets increment to get row 1 etc.
RetVal=UmraDataTable.GetCellText(RowIndex,0,groupdn) ' Column 0 of our datatable

Wend
else
Response.Write "Form Project Not Found"
end if
end if

END VBSCRIPT

This is only the first step to UMRA – Web Based Group Management in a portal, or intranet. In our next post I will show you how to setup buttons to remove groups from a specific user.

UMRA – Web Based User Provisioning

2009-05-01T17:49:00.000-07:00

If you haven’t already download the free trail version of User Management Resource Administrator here à Download

If you want to learn the basics on how to connect to UMRA with its COM object, please see my original post on “Basics of UMRA COM”.

****UPDATE****
I've been getting alot of questions, and request to explain a little more on this blog post, so please also see http://umratips.blogspot.com/2009/05/umra-web-based-user-provisioning-v2.html

UMRA – Web Based User Provisioning

A recent project I built for Nash Finch included a very handy and time saving web based user provisioning portal. Web portal you ask…yes, with the UMRA COM object I was able to create an delegate out tasks for specific Role Bases Access (RBA) Users, and have them create users on the fly. However, for this UMRA – User Provisioning process was more then just creating a new user in Active Directory. We added multiple steps for checking that new user ID’s were not already used in Active Directory, we also pulled back matching user data from an Human Resources System (HR) with UMRA. As we checked the preliminary data for Active Directory compliance and consistency, we also checked to make sure usernames were not taken in down steam systems, ie: PeopleSoft / Novell etc (these are just examples)…

How did this help Nash Finch with there everyday User Provisioning? It helped them by speeding up the User creation process, by allowing selected UMRA - Role Bases Access (RBA) Users were to go to a portal, enter user information, have that information checked for Active Directory compliance and consistency, press a 1 button, and have it create the active directory account. The users, who use the portal, don’t need any type of elevated rights in Active Directory, or have any special privileges in any systems to do these tasks. Plus, every time a user is created in this fashion, the usernames / home drives / security / group memberships / email were all created the same way every time, and done in seconds.Below is a great diagram on the tools4ever website shows how UMRA – User Provisioning is handled easily.> You can click here to see the article and diagram on tools4ever website.

UMRA – Web Based User Provisioning Examples

I've been getting some good feedback on UMRA ability to handle all the different types of User Provisioning through a web portal. To put it simply and try to anwser as many questions as possible, at one time... The web portal can be a very simple page, firstname, lastname, maybe a drop down box for description fielt, and a few checkbox's for exchange 2000/2003/2007 or any other downsteam system. UMRA has all these functions built in, so no need to spend hours and hours scripting out these process, now you have FULL control over how these tasks are delgated out to your different users. When they click the "create button" UMRA will take this data and process it through your script, and create, manage, change etc. and run your logic on the data that the user just entered. Below are a few screen shots of how you can create your portal, and have differnt "Create User" Forms. Keep a close eye on this blog, since we will cover more of this topic here in the future, and more screen shots.

UMRA COM - Role Based Access Control (RBAC)

2009-04-28T21:12:00.000-07:00

If you haven’t already download the free trail version of User Management Resource Administrator here > Download

If you want to learn the basics on how to connect to UMRA with its COM object, please see my original post on “Basics of UMRA COM”.Role Bases Access Control (RBAC) is huge in any Active Directory environment, and during the creation of a few of the projects I’ve had to build, I was tasked with using UMRA to handle the RBAC on a internet/intranet webportal. How can UMRA handle and manage RBAC in a web portal? Very easily, since UMRA has the abilty to work hand in hand with your Active Directory and other ODBC Databases. We can now have IIS pull back the user who is accessing the portal with “Microsoft’s Integrated Authentication”, then have UMRA take this users information, and go into active directory pull back different attributes from user, and even go into other ODBC databases, and pull additional information from the user. Then on our webpage, we can have different functions, to figure out what type Role Bases Access the users has.

I will show you one example below, of how I was able to handle a specific clients request to have 2 RBAC types, one is “Admins”, and the other is “IT Staff”. The way the Users were separated in Active Directory was by specific group memberships. Admins – were part of “domain admins” and IT Staff – was part of “IT Staff”.

Below is how I would check what RBAC a specific user has when trying to come into a access a company web portal. There are 2 portions to this script, 1 is the UMRA script itself, all it has in it is, 1 “Get user (AD)” and “Get Attribute (AD), the Get Attribute will get the “memberof”, these are the groups the User is a part of.. If you need help setting this script up, please see my posts here:

Below is the example VBScript:

'Create/Set Variables

Dim RetVal
Dim UMRA_Server
Dim UMRA_ Port
Dim UMRA_Project

UMRA_Server = "MyServerName"
UMRA_Port = 56814
UMRA_Project = "Get User Details"

'End Create/Set Vairbales

Set Umra = Server.CreateObject("UMRAcom.Umra") ' Creates a new reference to the UMRACom DLL

RetVal=Umra.Connect(UMRA_Server,UMRA_Port) ' Use the "Connect" Method, it will take 2 paramaters UMRA_Server and UMRA_Port
RetVal=Umra.ExecuteProjectScript(UMRA_Project) ' Use the "ExecuteProjectScript
Method, takes 1 paramater UMRA_Project.

if RetVal = 0 Then ' Check to see if we are connected to the UMRA project

Umra.SetVariableText "%usergroups%", usergroups ' Get the variable in the UMRA project

'Check User Group Memberships

if InStr(usergroups,"domain admins") >= 1 Then
Session("User_Type") = "Domain Admin"
else if InStr(usergroups,"domain admins") >= 1 Then
Session("User_Type") = "IT
Staff"

else
Session("User_Type") = "No Access"
end if

end if

And there you have it, you now have a vbscript that will check to see if the user who is accessing the portal, is of a RBAC you’ve set, and if not, set a session for that.

Blog Update July 28th 2009

I am going to update this blog since any UMRA Portal is going to have some type of User Access Control on it. The above UMRA Example is a great way to get your User RBAC types in and functional, however alot of the times, your RBAC types change on a daily or monthly basis, so having to update the UMRA Portal code each time this happens might be a little tuff to do since there could be alot of pages you will need to update. So what is the new approach to this method? The new approach that I use is to intergrate a database and RBAC creation / edit form into the mix. We can still hard code the first RBAC type into the UMRA Portal and this will never change. Typically what I will do is just hardcode one group "Domain Admins" if you are part of this group, you will have the ability to edit RBAC types on the fly, adding, modifying etc. on the fly. Typically I will store this data in an access database, however, MSSQL is perferable if its avaiable, I will store the RBAC type, and what group its binded to. But then I will take this a step further, and we can talk about the logistics of this later...but I will also link this into what function are "in" the portal. A function like "Manage Users", or "Password Reset" are examples of functions, these can be turned off/on depending on what you want your new RBAC to control. So now you are able to create UMRA based Roles on the fly, bind them to an Active Directory Group, then set Function level access all on fly, you dont need to code custom pages anymore.

Now, we will stay on the concept of being able to control your UMRA Portal dynamicly from an admin menu, and talk about some more of the nifty things you can do to help ease your RBAC type changes. Since you now have a quick menu to control RBAC types, you can now get more granular with your functions. So for example, instead of turning something off/on for a certin RBAC type, you can now have it so these functions can go into workflows or pass through and hit Active Directory. So for example, if you just created an "Manger Level 1" RBAC type, and binded it to the group "Seattle Managers", anyone who has this group membership in Active Directory will be set as "Seattle Managers". Now, you will allow this RBAC type to edit a users firstname and lastname, however you dont want it to hit Active Directory right away, maybe you want it to go into a workflow to email "IT Staff" with a ticket to let you know that user xxxx wanted to change joe's firstname to "Billy" if "IT" approves this, then it would then hit Active Directory, but if "IT" didn't approve this, it would email associated parties and advise. Now on the flip side, maybe you have another RBAC type called "Baltimore Managers" they can do the same thing as "Seattle Managers" however, when they edit a users firstname or lastname, it will hit Active Directory. As you can see these are some very handy ways to really control your RBAC types, and functions in your portal on the fly, no need to code any new logic.

UMRA COM Object - Loop Through Data Table

2009-04-27T09:52:00.001-07:00

If you haven’t already download the free trail version of User Management Resource Administrator here --> Download

If you want to learn the basics on how to connect to UMRA with its COM object, please see my original post on “Basics of UMRA COM”.If you’ve been following my blog you will see I’m a huge fan of UMRA and it’s ability to handle Identity Management of Active Directory Objects in a quick and user friendly fashion. In my previous post we talked about how we can use the UMRA COM method “connect” to talk to UMRA through a web page. We also know how to send data to UMRA COM and pull data back out of our projects. The example on our last blog post simply pulled and set data with the UMRA COM. Now, I will show you how I was able to create a table of data in a UMRA script, and loop through that table on a webpage.

How will this help you, you may ask? You will now have the ability of creating a table of data, it could be any set of Active Directory Objects. Maybe you want to pull all the users and a few attributes out of Active Directory….you can do this now.

So let’s get started, go ahead and open up UMRA if you haven’t already. Now drag/drop the action “Generate generic table”. This action can be found under the tree Variable actions --> Table --> Generate generic table.Here are the steps to configure the “Generate generic table” action.
Step 1: Double click on the “Generate generic table” table action in your script
Step 2: Click on “Configure…”
Step 3: In the “Table type” drop down select “LDAP query (Active Directory, Global Catalog)..
A. You will now see more options at the top of your script action

Step 4: Click on “LDAP Filter” tab
Step 5: Click the Drop down for “LDAP search Filters” and select “All Users” and click the “Insert” button
Step 6: Click the “Attributes” tab
Step 7: Click the “Add” button, to add these Attributes: sAMAccountName, DisplayName, Description
Step 8: Click the “Variable” tab and give the “Variable Name” %user_table%
Step 9: Click the “Run Test” tab, and then click the “Test…” button, you will now see your Users in the Table data area.

So now that we have a table of data, in our UMRA script, we now need to make a webpage, that will link up to this script, and loop through the tables contents.

Copy and Past this into a .asp webpage, and run it. Please see the notes on the script, since there are a few things you will need to change.

VBSCRIPT

'Create/Set
Variables

Dim RetVal

Dim
UMRA_Server

Dim
UMRA_Port

Dim
RowIndex

UMRA_Server =
"MyServerName"

UMRA_Port =
56814

RowIndex =
0
'End
Create/Set
Vairbales

Set Umra
= Server.CreateObject("UMRAcom.Umra") ' Create a New Instance of
UMRA
Set
UmraDataTable = Server.CreateObject("UMRAcom.UmraDataTable") ' Create a New
Instance of
UMRAcDataTable

RetVal=Umra.Connect(UMRA_Server,UMRA_Port) ' Connect to
UMRA

Response.write "Connection to UMRA:" & RetVal &
"
"

if
(RetVal=0)
then

RetVal=Umra.ExecuteProjectScript("My UMRA Script Name") ' Connect to your UMRA
script

Response.write "Connection to UMRA Script:" & RetVal &
"
"

if (RetVal=0)
then

RetVal=Umra.GetVariableDataTable("%UserTable%",UmraDataTable)

Response.write "Connection to UMRA DataTable:" & RetVal &
"
"

RowIndex=0 ' Create a new Row
Counter

RetVal=UmraDataTable.GetCellText(RowIndex,0,user_samaccountname) ' Column 0 of
our
datatable

RetVal=UmraDataTable.GetCellText(RowIndex,1,user_displayname) ' Column 1 of our
datatable

RetVal=UmraDataTable.GetCellText(RowIndex,2,user_description) ' Column 2 of our
datatable

While
(RetVal=0)

'Here is where we do the loop, and display on the page, the contents of the

Response.write "Account Name:"& user_samaccountname &
"
"

Response.write "Display Name:"& user_displayname &
"
"

Response.write "Description:"& user_description &
"

"

RowIndex1 = RowIndex1 + 1 ' After we get row 0, lets increment to get row 1
etc.

RetVal=UmraDataTable.GetCellText(RowIndex,0,user_samaccountname) ' Column 0 of
our
datatable

RetVal=UmraDataTable.GetCellText(RowIndex,1,user_displayname) ' Column 1 of our
datatable

RetVal=UmraDataTable.GetCellText(RowIndex,2,user_description) ' Column 2 of our
datatable

Wend

else

Response.Write "Form Project Not
Found"

end if
end
if

If everything is working fine, you will all your users in your webpage. If you don’t I added a little bit of error logic into the page, it should give you an idea of where its breaking. With this in mind, we will talk more in my next post about all the cool tips and tricks I found with error logic handling…so until next time!

UMRA COM - Get/Set Data

2009-04-22T20:39:00.000-07:00

If you haven’t already download the free trail version of User Management Resource Administrator here --> Download

If you want to learn the basics on how to connect to UMRA with its COM object, please see my original post on “Basics of UMRA COM”.In this post, I will show you some other cool features and tricks I was able to do after reading some of the UMRA COM object’s library.

So after my first post, I gave a basic example of how we connect to a UMRA project, but now we are going to take it a step further, and send the UMRA project we call with the COM object some variables, as well as get some variables back out of that same project.

So let’s get started shall we!We will first create a new “Automation Project”, and then add a “Set variable” action to the script.

Step 1 – Click File à New à Automation Project
Step 2 – Drag a “Set Variable” action onto the script Open tree Variable Actions à Variable Operation” à Set Variable
Step 3 – Double click on your “Set Variable Action” and configure it like below
A. Variable name: %my_umra_var%
B. Value of variable
a. Value: My Extra Text %text_from_webpage%
b. Type: text
C. Click Apply, then OK

Let me go ahead and explain what we just did. We have 1 variable (%my_umra_var%) in the script that we are going to get the value of . We also have 1 variable(%text_from_webpage%) that we are going to pass to the UMRA script.

Below is a screen shot of how your script should look once you’re at this step:

Ok perfect, we now have our UMRA script, we are now going to create a simple .ASP page that will connect to UMRA via the COM object “connect” method, and push data to our script, as well as pull data from the script.We will follow the same steps as in the previous blog, on how to connect to UMRA via it’s COM “connect” method, see this post here for code.Here is the sample code that will set and get data via the UMRA COM.

VB Script

'Create/Set
Variables

Dim
RetVal

Dim
UMRA_Server

Dim UMRA_
Port

Dim
My_Pulled_UMRA_Variable

UMRA_Server =
"MyServerName"

UMRA_Port =
56814

'End
Create/Set
Vairbales

Set Umra = Server.CreateObject("UMRAcom.Umra") ' Creates
a new reference to the UMRACom DLL

RetVal=Umra.Connect(UMRA_Server,UMRA_Port) ' Use the "Connect" Method, it
will
take 2 paramaters UMRA_Server and
UMRA_Port

'The
SetVariableText Method takes 2 paramaters (Your UMRA Variable Name, Your
Text)

Umra.SetVariableText "%text_from_webpage%","Add this text to my variable"

RetVal=Umra.ExecuteProjectScript(UMRA_Project) ' Use the
"ExecuteProjectScript Method, takes 1 paramater
UMRA_Project.

'The
GetVariableText Method works the same way as the Set, however we are now
getting
databack from UMRA AFTER the Project has
ran.

'The
GetVariableText has 2 paramaters (Your UMRA Variable Name You Want to
Get, Your
Variable You Want to Store the Data
In)

RetVal=Umra.GetVariableText("%my_umra_var%",My_Pulled_UMRA_Variable)

'Now that
we have the variable %my_umra_var% data stored in My_Pulled_UMRA_Variable we
can
now print it out to the
page

Response.write "My Pulled Value is:" &
My_Pulled_UMRA_Variable

If everything is done correctly, you will get a print out on the page saying “My Extra Text Add this text to my variable”. And there you go, you now just pushed data to UMRA COM and executed a project, and retrieved data from it. So what have we learned so far? We learned how to connect to UMRA via the COM with the “connect” method. We are now able to push/get data from UMRA projects. What next? In my next post I will show you have to loop through a table of data!

Connect to UMRA with the COM Object

2009-04-20T08:09:00.000-07:00

Hey everyone… I had to make a new blog about a very nifty tool I’ve been using for sometime now to help with my everyday day to day Active Directory Management. The tool I’ve been using is called User Management Resource Administrator, developed by tools4ever. As you’ve most likely seen in my other blogs about the capabilities of User Management Resource Administrator (URMA for short), I also discovered COM/API support.

What is COM/API support you ask?
Per Wiki: An application programming interface (API) is a set of functions, procedures, methods or classes that an operating system, library or service provides to support requests made by computer programs.
So what does this mean to you? This means you can now call UMRA scripts remotely through the COM, via a VB Script, Command line etc. However, I will show you some example of how I can use the UMRA COM library to access my projects and scripts.

If you haven’t already download the free trail version of User Management Resource Administrator here à Download

To view all the methods start UMRA and go to help, within the help menu type in COM. You will see tons of options on how to use the COM, however we will focus on a few of the UMRA COM methods. Below is an example of how to connect to a UMRA project via the “connect” method, and run a UMRA Script. For now we will not send any data to UMRA or get any data back.

*NOTE*
There is an example project in the UMRA default install folder, so look in your default install directory : C:\Program Files\Tools4ever\User Management Resource Administrator\Example Projects\Automation\ASP\CreateAccount

Here is the snippet of code with some comments to better understand what is going on.You can copy/paste this into a blank .asp page.

*VB SCRIPT*

'Create/Set Variables
Dim RetVal
Dim UMRA_Server
Dim UMRA_ Port

UMRA_Server = "MyServerName"
UMRA_Port = 56814
'End Create/Set Vairbales

Set Umra = Server.CreateObject("UMRAcom.Umra") ' Creates a new reference to the UMRACom DLL
RetVal=Umra.Connect(UMRA_Server,UMRA_Port) ' Use the "Connect" Method, it will take 2 paramaters UMRA_Server and UMRA_Port
RetVal=Umra.ExecuteProjectScript(UMRA_Project) ' Use the "ExecuteProjectScript Method, takes 1 paramater UMRA_Project.

Response.write "If the Return Value = 0 You are connected If the Return Value is not 0 you didn't connect
"
Response.write "Your Return Value is = " & RetVal

When you run this script, you will see a “Return Value” if the value = 0 You were able to connect to the UMRA Server, and Run the Project you created, if you get a number other then 0, there was an error along the way.

For now, this is the basics of how I connected to UMRA through the COM object.
I will post in a bit to show more advanced techniques.

UMRA - Tech Tips

2009-04-17T08:07:00.001-07:00

Hey everyone, I've been using User Management Resource Administrator for a few weeks now, and have found it to be a very flexable, but yet powerful tool.