The focus of the next version will certainly have a security centric theme around certificate management as this seems to be an area that has not been effectively covered by anyone in PowerShell up to this point. I won’t go into details in this post, but I will provide another update next week with more details – so stay tuned!

What’s New: Password Synchronization – Quick Connect can synchronize passwords between Active Directory and some categories of connected systems. Active Directory and connected systems are governed by different access policies. Consequently, users need to maintain different user accounts and different passwords on these systems.

Maintaining several passwords on several different systems is a hassle for users and administrators. Quick Connect provides for Quick Connect Capture Agent to be installed on all domain controllers in the source Active Directory connections. Capture Agent tracks changes that were made to user password in Active Directory, and then Quick Connect Sync Engine synchronizes the passwords basing on this information.

What’s New: Re-designed Sync History Log – The Sync History feature of the application allows you to view reports on the performed synchronization workflow runs. The Sync History tab allows you to display a list of all performed synchronization workflows runs, and then view the report on the workflow run of interest. In addition to this possibility, the new version of the Sync History tab allows you first to filter the synchronization reports for all object pairs using some filter criteria, and then select the report to view.

What’s New: Additional Rules for Synchronizing Multi-valued attributes – In Quick Connect 4.0 we provided multi-attribute synchronization but we found we needed more options.  Group and role assignments are often stored using multiple values in a single attribute and many traditional provisioning solutions are limited single value attribute provisioning . Flexible multi-value capability allows roles and groups to be synchronized between systems. For example, you may want to synchronize an SAP Role to an Microsoft Exchange Distribution List so you can easily email those individuals. Without multi-value capability coordinating such seemingly simple lists becomes very-very difficult.

My colleague Jackson Shaw did a great job explaining the situation and sharing his incite on what this means to SUN customers.  His blog is certainly worth the read. http://jacksonshaw.blogspot.com/2010/01/sun-idm-is-dead.html

The biggest news about this release is that Quick Connect can synchronize passwords between Active Directory and connected systems. Active Directory and connected systems are governed by different access policies. Consequently, users need to maintain different user accounts and different passwords on these systems. Maintaining several passwords on several different systems is a hassle for users and  administrators.  Quick Connect now provides a Password Capture Agent to be installed on all domain controllers in the source Active Directory connections. The Capture Agent tracks changes that were made to user password in Active Directory, and then Quick Connect Sync Engine synchronizes the passwords basing on this information.

Also new in this release:

• Updated design of history log to allow better searching and filtering
• Additional rules for synchronizing multi-value attributes
• Various improvments and resovled issues

We had a excellent year in 2009 and with this hot new release of Quick Connect I anticipate an even better 2010.

Read Dmitry’s Blog Here

I had to laugh when I read “76 percent of survey participants now consider Active Directory management as a critical or important component of their evolving Identity and Access Management (IAM) strategies.” - since while NetIQ is just now finding this out, I’ve been building this into my products since 2004.

Two years ago I wrote a short white paper on this subject. (See Change Management: Path to a Secure, Efficient and Risk-Free Active Directory) Despite only being 3 pages long I think the paper puts a simple frame around why change control over the people and processes touching your directory is critical.

What I don’t see from NetIQ is a strategy that reflects their study’s results. I personally believe that Roles, Rules and Work-flow must be in a single product because each has a tremendous influence on the other. Roles determine “what” changes a user can make Rules and work-flow determine “how” and “if” a change should be made. If these three items are not tightly integrated it is difficult to achive a consistent enforcement of change management.

http://www.dlt.com/About_DLT_Solutions/174

“From an Active Directory management perspective, our Active Directory tools business was very strong in Q2. ActiveRoles Server continues to deliver on the promise of providing a secure way to manage AD and provision users across the enterprise. AD management continues to be the core of our growing identity in access management products family, which we term the QuestOne strategy.” For the full transcript of the call visit http://seekingalpha.com/article/155229-quest-software-inc-q2-2009-earnings-call-transcript.

Having been responsible for the ActiveRoles family of products for the past 5 years – it is rewarding to see that despite the economic climate – we continue to lead the industry.  This is a testament to to the hard work and commitment of entire ActiveRoles team to deliver solutions that address the most difficult problems IT faces today. The most exciting part (for me personally) is that we  already have an industry leading product, but we are now planning and developing our next generation of solutions that will absolutly blow your socks off.

SharePoint Attestation: For customers who own ActiveRoles Server and ActiveRoles Self-Service manager, this new addition will allow you to extend access certification reviews (a.k.a. Attestation) to your SharePoint Site owners through the easy-to-use self-service interface. The goal of attestation it to have the owner of the site’s data periodically review the individuals that have been granted access. The owner of the data is the logical choice for this type of review because he/she is typically the person who understands the business reasons why a particular user was granted access the data. Period certification reviews also provide a great way to determine which groups in AD are being properly managed – meaning if a group owner fails to perform the review their group is added to a list of suspect groups. If you want to understand more about Attestation, see my recent posts http://www.bobbobel.com/what-is-attestation/.

SharePoint Access Remediation: (Warning-teaser) In the next major release of ActiveRoles Server we will include a new set of optional policies that can be used to what essentially amounts to the ability to disable a group that is granting security access. We also link this new capability to our Attestation Policy so that when the resource owner fails to perform a required attestation review within a given review timeframe access can be withheld in a non-destructive way. This is of course optional and the disablement of the group can be reversed with a single click so that if a group is super critical it can be brought back almost instantly.

In August we will provide a new component of Quick Connect for Base Systems named Quick Connect for Base Systems: SharePoint Integration.  This integration pack will install into the ActiveRoles Server console directly rather than appearing as a traditional connector in Quick Connect so as to simplify deployment.

SharePoint Provisioning: The primary purpose of the beta will be to provide automated provisioning and maybe more importantly automated Deprovisioning of user access to specific SharePoint sites. This is accomplished through the existing ActiveRoles Server provisioning and Deprovisioning policies so you control access in the exact same way you do other Microsoft applications even if you have not used followed Microsoft best practice by using AD groups to control SharePoint access.

(Part 2 http://www.bobbobel.com/provisioning-and-attestation-for-sharepoint-part-2/)

If you want to see how Quick Connect can provison or deprovison systems in typically under 10 minutes take a look at the QC integration page http://www.quest.com/activeroles-server/integration.aspx