Article ID: 303031
Article Last Modified on 6/17/2005
APPLIES TO
- Microsoft Metadirectory Services 2.2 Service Pack 1
This article was previously published under Q303031
SUMMARY
This article describes the ways that objects are created by using the Together Administration management agent (TAMA). Note that this article is not intended to be used as a substitute for the standard Microsoft Metadirectory Services (MMS) documentation. This article is intended to provide a framework to help you to better understand the standard MMS documentation, particularly for those readers whose exposure to TAMA is limited. In addition, the example code for conditional implementation of TAMA in the Rules tab of the Provisioning Agent contains a syntax error that prevents it from running correctly.
MORE INFORMATION
The TAMA is the specialized MA that is used to push objects from the metaverse to an MA's connector space so that the MA (in turn) can create and update the new objects in it's connected directory. You may want to think of the TAMA as a reverse MA. Other MAs bring things into the metaverse, and TAMA pushes things out of the metaverse.
Pushing objects out to connected directories doesn't always require the TAMA. Objects can be pushed out by using the Foreign Entry process. Objects that do not have the management agent listed among its connected directory IDs are considered "Foreign" to that MA. This means that if the object didn't come from the MA, it is a "Foreign" object. If you run the Update Connected Directory task for a particular MA, the foreign users are extracted from the metaverse and updated to its connected directory. The foreign users inclusion and exclusion rules determine which metadirectory entries are included. This is common occurrence in synchronization scenarios where multiple MAs have been configured as Reflectors. The Foreign Entry process is simple to configure, but the TAMA provides more detailed control.
The TAMA is usually found in a Provisioning scenario. This is where a directory reflects objects into the metaverse, and these objects are to be created in other associated MAs. For example, consider a typical corporation where human resources adds new users and these users are then to receive e-mail accounts. The TAMA would be responsible for creating the new user objects in the e-mail MAs connector space, then the MA could create the new user object in the connected directory.
There are two general paths to implementing TAMA. Either all applicable objects from a certain point in the metaverse namespace are pushed to the MA's connector space, or conditional logic is applied on an object-by-object basis. Either implementation has some similar requirements. To begin with, you need to create a "Resource" that defines how and where objects will be created under a MA.
The following steps are the basic steps to create and implement a resource. Refer to the standard MMS documentation for a comprehensive list of the options and processes that are available.
When you create a resource, there are a few simple questions to determine how the resource should be created. Understanding how these questions are answered by the resource will make understanding the TAMA much simpler:
- To what MA does the resource apply?
- Where do the new objects go under the MA?
- Do the new objects go into a specific container, or should they reflect the metaverse hierarchy?
How to Create a Resource
- From the Bookmarks list, click the Applications button (if you installed MMS with the defaults).
- Double-click the Together Administration folder.
- Select a sample resource that most closely reflects what you are trying to accomplish (according to the preceding questions), and then drag the resource into the white space for the window.
- In the Copy Entry dialog box, click Duplicate this entry.
- Click Select the MA to reveal the MAs that are available.
- Drag the MA from the list into the Management Agent box.
- Double-click the MA in the list box to expand the hierarchy. Drag the target location from the list box into the Location Under MA (Optional) box.
- Click OK to close the boxes.
- Right-click the copy of the sample you created, and then rename it. Next you will determine how to apply the resource.
IMPORTANT: If user objects are to be provisioned to the connector space of an MA based on where the objects reside in the namespace, use these steps in the "Namespace Based Configuration" section of this article. If user objects are to be provisioned to the connector space of an MA based on conditional logic, use these steps in the "Conditional Logic Based Configuration" section of this article.
Namespace Based Configuration
- View the Known Universe, and then select the namespace node that begins the branch of user objects that will be provisioned to the connector space.
- Click the Administration action.
- In the Entry Administration dialog box, click the Account Profile tab.
- Drag the resource you created into the Account Profile box.
- Click OK to close the box.
- Click Management Agents from the bookmarks.
- Click the Provisioning Agent. The Provisioning Agent is an instance of the TAMA that is created by default when MMS is installed.
- Click Operate MA from the Action pane, and then click Run the Management Agent.
Conditional Logic Configuration
- Click Management Agents from the bookmarks.
- Click the Provisioning Agent. The Provisioning Agent is an instance of the TAMA that is created by default when MMS is installed.
- Click Operate MA from the Action pane, Configuration Settings tab, Rules tab.
In the Rules tab, you will find some sample code for assigning a resource to a user object. This code contains one mistake in that the object that is created should be a res type rather than a cn. For example:
# ASSIGN THE BASE PORTION OF THE RESOURCE DN $v_TAMABaseDN = f=Together Administration,$parent("$my_dsa()") # THIS IS NOT NECESSARY FOR TAMA, BUT ILLUSTRATES A USEFUL # CONDITIONAL DECISION POINT $v_parentDn = $DN_COMPONENT($mv.DN,2) IF $v_parentDN = MSD THEN # MULTIPLE RESOURCES CAN BE ASSIGNED SIMULTANEOUSLY $mv.zcTaAccountResourceDNs += res=AAA,$v_TAMABaseDN $mv.zcTaAccountResourceDNs += res=BBB,$v_TAMABaseDN ENDIF- Click the Run the Management Agent button. In either of these two possible implementations, if your resource has been correctly configured, objects will be provisioned to the connector space of the designated MA. The next time the MA runs in the Update Connected Directory phase, the objects should be created in the connected directory.
You should try to keep the MMS design as simple as possible. However, if the number of organizational units in the connected directory dictate that a large number of resources are required, then it may be beneficial to avoid creating all of the resources. You can do this by creating one resource, and then coding the New Connectors template in the destination MA to create users in different organizational units based on a defining attribute. For more information about this alternative solution, see the following article:
317912 How to Bypass Creating a Large Number of Resources When You Configure TAMA
Microsoft provides programming examples for illustration only, without warranty either expressed or implied. This includes, but is not limited to, the implied warranties of merchantability or fitness for a particular purpose. This article assumes that you are familiar with the programming language that is being demonstrated and with the tools that are used to create and to debug procedures. Microsoft support engineers can help explain the functionality of a particular procedure, but they will not modify these examples to provide added functionality or construct procedures to meet your specific requirements.
Additional query words: granular zoomit
Keywords: kbinfo kbenv kbnetwork KB303031
