Bob's Identity Management Blog

"Anyone can hold the helm when the sea is calm." – Syrus Publilius

As we approach the release of ActiveRoles Server 6.5 I wanted to take a moment and let some of you know what changes we are making to the platform. Our goal for this release was to provide more out of the box functionality as well as make it easier for third parties to leverage ActiveRoles as a platform.

1. PowerShell Script Host – For a long time we have provided web service or ADSI script interfaces to extend the ActiveRoles platform. Several years ago we introduced The ActiveRoles Management Shell for AD (The AD CMDLETS) and now we have taken another step toward our PowerShell vision. In ActiveRoles Server 6.5 PowerShell can be used directly inside the platform to automate or extend capabilities.
2. Extensible Policies – Extensible policies allow third parties to deploy Administrative policies that manage, provision or Deprovision services or processes. For example, if someone had created a script to provision and deprovisoin BlackBerry Enterprise Server accounts when the AD account is created this script can be registered as an ActiveRoles. Registration is done either through the API described in the platform SDK or they can be registered manually.
3. Graphical Workflow Editor – In ActiveRoles Server 6.0.x we taught the administration service what waiting for approval meant. In 6.5 we have added a full graphical workflow editor to expose not only multi-layer approval, but also the ability to model business processes. Workflows can also be extended programmatically with PowerShell scripting.
4. Deprovision Group - Microsoft has not provided a way to disable Active Directory which would be ideal because they are the primary method by which access is granted in both Microsoft and non-Microsoft systems. ActiveRoles Server 6.5 provides a set of policies to tailor how you lock-down group objects to render them non-usable for both Security and Distribution List use. A right click “restore” is all it takes to und0-deprovisioning. This feature has also been integrated into our Attestation workflow to allow for Automated remediation when a resource owner fails to complete an access review.
5. Windows Server 2008 R2 Support – ActiveRoles Server 6.5 supports Windows Server 2008 R2 as well as running the client MMC on Windows 7 or the web UI from an IE 8 browser.
6. Windows Server 2008 R2 Recycle Bin – The Windows 2008R2 Recycle Bin is an extra layer of protection added to the deleted items process. ActiveRoles Server now supports the security delegation over restoring those objects.
7. Microsoft Exchange 2010 Support – ActiveRoles Server 6.5, in addition to provisioning and managing mailboxes on Exchange 2003 & 2007, now supports Microsoft Exchange 2010 recipient management.
8. Exchange Resource Mailboxes – In Microsoft Exchange 2007 a new type of mailbox was introduced – the resource mailbox. ActiveRoles Server 6.5 now supports resource mailboxes for both Exchange 2007 & 2010.
9. Access Request Catalog - The optional add-on module ActiveRoles Self-Service Manager, now has the ability for end-users to make requests to access resources from a list of published catalog of resources.  Resources are added to the catalog by their owners through a publication process that allows the owner to assign keywords and descriptions to make it easier for the end-users to locate and request access to the resource.
10. Secondary Resource Owners – The optional add-on module ActiveRoles Self-Service Manager, now has the ability for Resource owners to delegate management tasks to secondary group owners. This delegation allows the primary owner to assign other users or groups who will assist with the day-to-day management of access or access requests.