Q&A: Configure Identity Panel to access the MIM Service using PowerShell

Q: How do I configure Identity Panel to write to the MIM Service from PowerShell in Identity Panel v6?

A: Once the necessary prerequisites are in place, use a PowerShell fixture to invoke the LithnetRMA module hosted on a target PanelService host.

Prerequisites

1. The LithnetRMA PowerShell module must be installed (as Administrator) on the Panel Service host server.
2. The Identity Panel (IdP) service account must either itself be a member of a MIM set with the necessary permissions to perform the desired create/read/update/delete (CRUD) actions (over Kerberos), or an alternative account credentials passed to the Set-ResourceManagementClient commandlet.
   Notes:
   1. Kerberos authentication will work regardless of whether the IdP service account is a gMSA or not, provided you have first set the objectSid of your corresponding Person object in MIM.  The fact that the gMSA is not a user object class in AD does not matter.
   2. As always, a least-privilege approach is recommended when assigning MIM permissions to service accounts.
3. Unless you have MIM sync logic to handle this specific use case, it is usually best to filter the object from the MIM Service management agent (especially in the gMSA scenario) ... as with the MIM Service account itself, it is easy to have MIM Sync interfere with attribute settings mastered in the MIM Service, or worse still, end up with unwanted duplicate AD objects.
4. The Panel Server hosting the LithnetRMA PowerShell module must have network access to the target MIM server over http (port 5725).
5. There must be a Sync Actions Provider configured over which the PowerShell fixture can iterate.

With the above prerequisites in place, follow the following steps to create a Test Panel fixture to execute the second example script in the separate KB article Running PowerShell Scripts With Windows PowerShell Modules:

Create a Fixture 

1. In the Identity Panel console, browse to /settings/mimtest/fixtures.
2. Create a new Run PowerShell Fixture, giving it a name (e.g. Set MIM Service Property).
3. Add parameters for your script (there are 3 in the example linked article above - namely AccountName, MIMServer and JobTitle), where possible using environment variables in lieu of setting values explicitly.
4. Paste in the script as per the script block in the linked article above.
5. Write some text in the Notes property to explain the intent of the fixture.
6. Specify the Panel Service host on which the LithnetRMA PowerShell Module is deployed as the Preferred Server.
7. Save your fixture.

Create a Test Suite

1. In the Identity Panel console, browse to /settings/mimtest/suites.
2. Create a new Suite, giving it a name (e.g. Test Lithnet Fixture).
3. Add a new Test to the suite, giving it a name (e.g. Update JobTitle).
4. Add a new Existing Fixture Action to the test, giving it a name (e.g. Set MIM Service Property) and specify Iterate as the target system.
5. In the fixture strip you can then select your new fixture, i.e. the one created in the step above (Set MIM Service Property).

Run your Test Suite

1. Make sure the Run Test Cases dashboard is installed on your Identity Panel Dashboard.
2. Select your Set MIM Service Property test suite and hit Run.
3. Monitor progress in Identity Panel and then inspect results in the History.