Case Study
Background About Qtel The Qatar Telecom (Qtel) Group is a leading international communications company, with a significant presence in the MENA region and Southeast Asia, and having a consolidated customer base of 83 million as of December 2011. It operates a portfolio of brands including Qtel, Indosat, Asiacell, Wataniya, Nawras, Nedjma and Tunisiana. The Qtel Group's principle activities are mobile telephone services, broadband solutions, digital futures and fiber technologies, serving both consumer and business markets. Headquartered in Doha, Qatar, the Qtel Group is ambitiously growing its global business on the basis of its insights into the needs of customers in emerging markets. Qtel Group's ultimate parent company is Qatar Telecom (Qtel) Q.S.C. Key Objectives Simple and centralized user interface for the end user Migrate existing applications from ILM 2007 to FIM 2010 Qtel is one of the biggest IT users in Qatar and constantly improves on its infrastructure as part of its overall progress. As part of its ongoing IT initiatives, QTel proposes to modernize its internal user management and access to their Enterprise applications using Micrsoft s Forefront Identity Management. 2
The Need As part of their ongoing efforts, QTel has already been rolling up their Enterprise wide applications through ILM 2007. Based on the advanced features and security aspects, QTel is now considering migration of existing applications onto Microsoft s Forefront Idntity Management (FIM) 2010. Microsoft Forefront Identity Manager (FIM) 2010 extends the functionality of Identity Lifecycle Manager 2007. Challenges Policy management Credential Management User Management Group Management New features allow organizations more control through a robust delegation model and business process framework. New capabilities improve operational efficiency by automating common identity lifecycle management tasks and empowering end-users with selfservice tools integrated in Office and Windows. 3
Our Approach Considering QME is already taking care of the ILM support services, we have come up with a solution that will blend the existing ILM support with this migration project seamlessly, to leverage our knowledge on Qtel infrastructure including user groups, applications that are already integrated with ILM, applications that need to be integrated with FIM, and the resource utilization at optimal levels to execute the entire project in less duration and with efficiency. Currently few of the applications are already integrated with ILM and users accessing these applications on production environment through ILM. While migrating these into FIM environment will be less time consuming, integrating the new set of applications will take a longer time as it would involve Analyzing those applications, understanding the integration aspects / data points, security aspects, use of APIs if provided by the vendors of those applications, and may involve custom development as appropriate, for each application. Tools/ Technologies Microsoft Windows Server 2008 R2 Microsoft SQL Server 2008 MS SQL Server SSRS Microsoft Forefront Identity Manager Server Going by this, we do not recommend one set of users using ILM to access existing integrated applications and another set of users using FIM for newly integrated applications. Our recommendation would be to integrate the new set of applications into FIM and place in Staging server for User acceptance, then migrate the ILM applications to FIM in Staging for user acceptance and then deploy all the applications on FIM environment in Production server all in one go. Based on our above understanding our proposed solution will have the following milestones under 3 Major phases, followed by the deployment phase: 4
Phase I Migrating applications that are already integrated with ILM 1) Analyze existing applications that are integrated with ILM and prepare a migration plan 2) Setup FIM Development, Staging and Production servers 3) Migrate these to FIM, test and Deploy on Production. This will involve a. Use the.net code base that we developed for ILM integration for each application b. Identify and use the current users database for each application integrated in ILM c. Place those in to FIM server on Development Server d. Test for the security and functional aspects from the users perspective e. Fine tune / fix if there are any compatibility issues and bugs f. Release the application on Staging server for User Acceptance Test Phase II: Integrating new set of applications along with development into FIM 1) Analyze the new applications that need to be integrated with FIM directly 2) Identify / Capture the development requirements for each application for the integration 3) Identify APIs, and other Data points for integration for each application 4) Discuss with user groups on the integration aspects such as how the flow may change to set the expectations 5) Work on a road map comprising Integration, Development, fine-tune and deploy on staging server along with optimal test data for UAT. 6) Develop and deploy each new application integrated into FIM on Staging server as planned for UAT 7) Fine tune and fix to address the user experience challenges in accessing these application through FIM Phase III: OpCos Integration 1) Gathering information about the OpCos Infrastructure, HW and SW, Current connectivity and accessibility options, user group and rights, etc. 2) Create a roadmap for regulating all their access points through FIM and share the plan with OpCos to set the expectation 3) Discuss with QTel and prioritize each OpCo for integration 5
4) Migrate each OpCo to the new environment for a FIM regulated access for all existing applications on staging server. This will have to consider all the security aspects as laid down by Microsoft for FIM and as laid down by QTel as part of their Security policies Phase IV: Production Deployment and support 1) Gather user acceptance for currently integrated applications in ILM for migration into FIM environment on Staging server 2) Gather user acceptance for new integrated applications into FIM directly on Staging server 3) Gather user acceptance for Accessing through FIM from OpCos on Staging server 4) Discuss with user groups to set the date for deployment 5) Deploy on Production Environment (High Availability) 6) Support for 60 days through the warranty period through onsite resources 7) Sign up support contract for continued support 6
ILM Architecture 7
Proposed FIM 2010 Environment Existing ILM Applications 1. HRMS 2. AD ( Active Directory) 3. ARS (Active Role Server) 4. EBS ( E- Business Suite for HRMS, CFS and CRM) 5. GISSDE 6. GISWV ( GIS Web Viewer) 7. GISWM (GIS Web Mapping) 8. LMS (Loyalty Management System) 9. Remedy 10. SM (Service Manager) 11. IRB 12. NWI 13. KB (Knowledge Base) ILM 2007 Server FIM Development Server FIM Testing Server Integrated Applications of FIM 1. MINSAT 2. List Users 3. myrio 4. eqtel Registration 5. ADC 6. BB admin 7. BB site 8. SDP 9. alafassy 10. Mozook 11. Al-Jazeera 12. putty 13. Logica 14. Archiving 15. HLR 16. SSM 17. Comptel 18. Fax system 19. QODP OSTicketing 20. QODP ebilling Q T E L O P C O S FIM Production Environment in HA 8
Key Benefits to Client 1.1.1 Improved Performance Improved performance for initial load (or other bulk load) from connected system to FIM Service. Clearer FIM Service database tuning guidance and enhancements FIM Management Agent supports batching and more configuration options 1.1.2 New Extensible Connectivity MA framework Batched call-based import and export Programmatic schema, partition, and hierarchy discovery Password change API similar to export Custom anchors and additional DN styles Custom parameters in the Identity Manager UI Full Export run step.net 4 development 1.1.3 Improved Troubleshooting and Diagnostics Full Support for Event Tracing for Windows - Both the FIM MA and FIM Service now support ETW technology, allowing administrators to use advanced Windows logging tools to drill down more deeply into errors through a rich user interface. Easier Tracing of Errors in the FIM Portal - Now when an end user sees an error, we provide a unique ID which he or she can give to helpdesk so that they can more easily track down and troubleshoot the user s problem. Users can employ a one-click-to-copy command directly from the error page in the FIM Portal so that they can more easily craft an email message to their administrators in case of an error. Improved FIM Service Exceptions - When FIM encounters an error, the names and descriptions of exceptions that occur have been re-engineered to be easier to understand and decipher. Furthermore, FIM administrators can now choose to see an advanced stack 9
trace along with the existing exception information that appears when the FIM Service encounters an issue. New Logging Capability for UpgradeDB - The DB Upgrade tool that is run as part of FIM Service and Portal setup will now generate a log file as it runs to aid in troubleshooting upgrade problems with the FIMService Database. Default FIM Event Log Trace Level now Includes WarningsWhen enabling tracing on a FIM Service instance, the default trace log level will now be set to Warning to aid administrators in troubleshooting subtle issues. Dozens of New Health Events Added - Existing features such as SSPR and the Workload monitor include improvements to their existing health events, as well as new health events to aid in troubleshooting these features. The new feature in R2, Reporting, also includes a full set of health events which cover a broad array of scenarios, including installation of the feature, synchronization of data to the Data Warehouse, and extension of the default schema and reports. 1.1.4 Updated Connectors Lotus Notes Oracle Business Apps SAP 1.1.5 Self-Service Password Reset capabilities New Self-Service Password Reset Gates: One-time Password E-mail Gate One-time Password SMS Gate Programmatic Registration QA Gate Enhancements Extranet-capable self-service password registration & reset portals. Key features: Cross-browser support Mobile device support 1
Customizable User Interface 1.1.6 Reporting Platform Extensible Reporting Platform In-depth Auditing Built on System Center Service Manager 1.1.7 FIM Service A new DateTime Attribute "Completed Time" was added to the FIM Schema. The Request Resource has a binding to it. All new Requests created in R2 will have this attribute stamped on them. All Requests already in the system will not. An R2 Request now has 4 DateTime properties: CreatedTime -- DateTime when the Request is created. CommittedTime -- DateTime when the changes requested are committed. CompletedTime - DateTime when all the policies have been applied as a result of this Request. 1