Jorge's Quest For Knowledge!

All You Need To Know About Identity And Security On-Premises And In The Cloud. It's Just Like An Addiction, The More You Have, The More You Want To Have!

Archive for the ‘Updates’ Category

(2016-11-23) Microsoft Identity Manager (MIM) 2016 Service Pack 1 Packages

Posted by Jorge on 2016-11-23


Somewhere in September Microsoft released SP1 for MIM  2016 as you can read here. The first package was MIM 2016 with SP1 already included. If you wanted to install SP1 on your current deployment you had to uninstall first and reinstall with MIM 2016 with SP1 included where you would reuse all DBs. This procedure is described here. However, for some customers uninstalling everything and reinstalling it is a little bit too much. The impact and downtime is not acceptable. Because of that Microsoft has also released a SP1 update package that can be deployed on existing MIM 2016 deployments.

There is a subtle different of which you must be aware:

  • MIM 2016 with SP1: build 4.4.1237.0
  • SP1 update package: 4.4.1302.0

As you can see the builds are different! Please be aware you cannot apply the SP1 update package to a deployment already running MIM 2016 with SP1. You can only apply it when running MIM 2016 RTM.

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Forefront Identity Manager (FIM) bHold, Forefront Identity Manager (FIM) Certificate Management, Forefront Identity Manager (FIM) PCNS, Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Microsoft Identity Manager (MIM), Updates, Updates, Updates, Updates, Updates, Updates | Leave a Comment »

(2016-07-21) A Hotfix Rollup Package (Build 4.3.2266.0) Is Available for Microsoft Identity Manager 2016

Posted by Jorge on 2016-07-21


Microsoft released a new hotfix for MIM 2016 with build 4.3.2266.0. What it fixes can be found in this blog post. For additional or detailed info see MS-KBQ3171342

Download link

Issues that are fixed and features that are added in this update

Privileged Access Management (PAM)

Issue 1

When you create a PRIV ONLY PAM user, the PAM monitor service throws the following warning message when it tries to update the PAM users email in active directory and the value already exists:

System.Exception: Set PAM object dictionary already contain attribute ‘Email’.

FIM add-ins and extensions

Issue 1

SSPR windows clients on systems that use a high DPI setting have an incorrect scaling of the final page (the Password Reset Flow page) in which the radio buttons are overlapped.

Issue 2

SSPR windows clients have text messages that overlap after a password reset if the resulting message (success or error) contains more than three lines.

FIM Certificate Management

Issue 1

The ExecuteOperations.Disable operation from the Microsoft.Clm.BusinessLayer.Shared.dll public library does not work correctly and returns an error because of incorrect object initialization.

Issue 2

A smart card search takes 3.5 minutes on an idle server. Additionally, the search never ends if the server is stressed.

Issue 3

There is a redundant space in the "Profile Summary" string on the Request Complete page for some languages.

Issue 4

The Duplicate Revocation Settings policy is replaced because some users could not set it.

Issue 5

A certificate in the Certificate Management portal may use the LDAP CN name instead of DisplayName when it calls REST.

Issue 6

For ZH-Hans and some other languages, link underlining in the Certificate Management portal is misplaced (stroke instead of an underline) because of a font issue.

FIM Synchronization Service

Issue 1

Under certain conditions, the file selection dialog box does not appear on the MA configuration wizard pages.

Issue 2

Error messages are logged in the event log (such as Event ID 6313). Additionally, performance counters don’t work.

Issue 3

The Sync Service crashes when you run a Full Synchronization process that has Equal Precedence set for attributes that exist in IAF or EAF.

Issue 4

When an incorrect page size (either less than the minimum or more than the maximum) is used for the run profile of the ECMA2 management agent, the page size value quietly changes to the minimum or the maximum after you click Finish.

Issue 5

An error message from the Management Agent cannot be parsed if it contains some special symbols. Therefore, the error message doesn’t appear in the error list as expected, and a non-informative error window appears.

Issue 6

You receive a "Reference to undeclared entity ‘qt’" error message when you run the history process and the history text contains the "greater than" (>) symbol.

Issue 7

New Functionality: The ability to skip the Management Agent during the import of a server configuration is added. A new -Skip parameter is added to the Import-MIISServerConfig cmdlet.
The names of MAs to skip should be delimited by a semicolon (;), as in the following example:

Import-MIISServerConfig -Path "C:\exported" -Skip "FIMMA;ADMA"

Note If you do not use the -Skip parameter, the default behavior occurs.

Issue 8

A "MEMORY_ALLOCATION_FAILURE" error occurs in the Performance Monitoring tool when the performance data .dll file cannot open the process.

FIM Portal

Issue 1

Multivalued labels are displayed incorrectly in a single line in the UI.

Issue 2

When you upload Resource Control Display Configurations (RCDC), the xml-format is not verified.

Issue 3

You cannot drag-and-drop a user to the Remove box to delete the user or to remove the user from a group membership.

Issue 4

Local date and time settings are ignored for the Australian English (en-AU) locale.

Issue 5

This update enables customizations that have controls that are shown or hidden based on the state of the email-enabling check box.

An additional attribute to RCDCs configuration data is included in this update. The Now Event element may have a Parameters attribute. For Group RCDC for the OnChangeEmailEnabling event, the element should contain a comma-separated, case-sensitive list of controls to show or hide.

Example

<my:Control my:Name="EmailEnabling" my:TypeName="UocCheckBox"
 my:Caption="%SYMBOL_EmailEnablingCaption_END%"
 my:Description="%SYMBOL_EmailEnablingDescription_END%"
 my:AutoPostback="true" my:RightsLevel="{Binding Source=rights,
 Path=Email}">
        <my:Properties>
         <my:Property my:Name="Text" my:Value="%SYMBOL_EmailEnablingValue_END%"/>
        </my:Properties>
        <my:Events>

Note If the Parameters attribute is not included, the default behavior occurs.

FIM Service

Issue 1

In SharePoint Server 2013 and later versions, if you edit a workflow or update an email template by using the FIM Portal, the version is automatically updated to 4.0.0.0. This causes a system error message during processing.

BHOLD

Issue 1

When you add a user to an organizational unit (OU) that has some incompatible permissions in the OUs role, all the incompatible permissions are assigned.

Issue 2

Some issues are fixed for attribute-based authorization (ABA) roles that are assigned to a user when the roles have incompatible permissions.

Issue 3

When you use Access Management Connector to provision new OUs with a parent OU, all the parent OU roles are inherited but are also disabled.

Issue 4

An error occurs in BHOLD during installation in Internet Information Services (IIS) 10.

Issue 5

If two or more roles that are assigned to a user who has the same permissions as the roles, and the roles use the endDate attribute, you cannot extract a user permission that has the latest date.

Issue 6

An email alias is truncated if it is longer than 30 characters.

Cheers,

Jorge

———————————————————————————————

* This posting is provided "AS IS" with no warranties and confers no rights!

* Always evaluate/test yourself before using/implementing this!

* DISCLAIMER: https://jorgequestforknowledge.wordpress.com/disclaimer/

———————————————————————————————

############### Jorge’s Quest For Knowledge #############

######### http://JorgeQuestForKnowledge.wordpress.com/ ########

———————————————————————————————

Posted in Forefront Identity Manager (FIM) bHold, Forefront Identity Manager (FIM) Certificate Management, Forefront Identity Manager (FIM) PCNS, Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Updates, Updates, Updates, Updates, Updates | Leave a Comment »

(2016-07-21) A Hotfix Rollup Package (Build 4.1.3765.0) Is Available for Forefront Identity Manager 2010 R2

Posted by Jorge on 2016-07-21


Microsoft released a new hotfix for FIM 2010 R2 with build 4.1.3765.0. What it fixes can be found in this blog post. For additional or detailed info see MS-KBQ3171318

Download link

Issues that are fixed and features that are added in this update

FIM Certificate Management

Issue 1

A smart card search takes 3.5 minutes on an idle server. Additionally, the search never ends if the server is stressed.

Issue 2

The Duplicate Revocation Settings policy is replaced because some users could not set it.

Issue 3

There is a redundant space in the "Profile Summary" string on the Request Complete page for some languages.

FIM Synchronization Service

Issue 1

In a metaverse search and when you view the object, there is a Last Modified field. But when you sort that field, it sorts as a generic text field instead of as a date field.

Issue 2

Error messages (such as Event ID 6313) are logged in the event log. Additionally, performance counters don’t work.

Issue 3

The Sync Service crashes when you run a Full Synchronization process that has Equal Precedence set for attributes that exist in IAF or EAF.

Issue 4

When an incorrect page size (either less than the minimum or more than the maximum) is used for the run profile of the ECMA2 management agent, the size value quietly changes to the minimum or the maximum after you click Finish.

Issue 5

An error message from the Management Agent cannot be parsed if it contains some special symbols. Therefore, the error message doesn’t appear in the error list as expected, and a non-informative error window appears.

Issue 6

You receive a "Reference to undeclared entity ‘qt’" error message when you run the history process and the history text contains the "greater than" symbol (>).

Issue 7

Under certain conditions, the file selection dialog box does not appear on the MA configuration wizard pages.

Issue 8

A "MEMORY_ALLOCATION_FAILURE" error occurs in the Performance Monitoring tool when the performance data .dll file cannot open the process.

FIM Portal

Issue 1

Multivalued labels are displayed incorrectly in a single line in the UI.

FIM Service

Issue 1

During an Export process between the Synchronization and FIM Service, the msidmCompositeType request may fail if some multivalued string attribute value is changed in the scope of the Export session. This behavior affects performance.

Issue 2

In SharePoint Server 2013 and later versions, if you change a workflow or update an email template by using the FIM Portal, the version is automatically updated to 4.0.0.0. This causes a system error message during processing.

BHOLD

Issue 1

When you add a user to an organizational unit (OU) that has some incompatible permissions in the OUs role, all the incompatible permissions are assigned.

Issue 2

Some issues are fixed for attribute-based authorization (ABA) roles that are assigned to a user when the roles have incompatible permissions.

Issue 3

When you use the Access Management Connector to provision new OUs with a parent OU, all the parent OU roles are inherited but are also disabled.

Issue 4

An error occurs in BHOLD during installation in Internet Information Services (IIS) 10.

Issue 5

If two or more roles assigned to a user who has the same permissions as the roles, and the roles use the endDate attribute, you cannot extract a user permission that has the latest date.

Issue 6

An email alias is truncated if it is longer than 30 characters.

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Forefront Identity Manager (FIM) bHold, Forefront Identity Manager (FIM) Certificate Management, Forefront Identity Manager (FIM) PCNS, Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Updates, Updates, Updates, Updates, Updates | 2 Comments »

(2015-12-12) A Hotfix Rollup Package (Build 4.3.2064.0) Is Available for Microsoft Identity Manager 2016

Posted by Jorge on 2015-12-12


Microsoft released a new hotfix for MIM 2016 with build 4.3.2064.0. What it fixes can be found in this blog post. For additional or detailed info see MS-KBQ3092179

Download link

Issues that are fixed or features that are added in this update

This update also fixes the following issues or adds the following features that were not previously documented in the Microsoft Knowledge Base.

MIM add-ins and extensions

Issue 1

This hotfix addresses an issue that affects the password reset window and that occurs on monitors that have high DPI settings when the Windows display sizing of items is set to a custom size, such as 200 percent or more.

Certificate Management

Issue 1

You try to enroll a smart card by having the correct profile selected (with correct adminKey). However, the user PIN doesn’t correspond to the smart card PIN policy. In this situation, you receive the following error message:

The card cannot be accessed because the wrong PIN was presented.

Issue 2

MIM Configuration Manager Reporting doesn’t show smart card settings correctly. Settings are shown only for the Pkcs11 smartcard provider and not for baseCSP.

Issue 3

All policies in the MIM Configuration Manager allows for changes to "Revocation Settings" only for all certificates together. In this fix, a new page is added (CertificateTemplateRevocationSettings) to show "revocation settings" for the selected certificate. Changes to ProfilePolicyrevocationSettingsPage are also made to show all certificates of the profile.

MIM Synchronization Service

Issue 1

When you configure an ECMA2 run profile, you receive a “Value of ‘10’ is not a valid value” error message.

Issue 2

The Sync Engine reports a staging-error during delta import when the Generic LDAP connector detects the renaming of an object distinguished name.

Issue 3

When a rename, or a distinguishedName change, of a user is exported to Oracle Directory Enterprise Edition (ODSEE), that user is removed from group memberships. You expect that the membership reference to the renamed object will be updated, instead.

Issue 4

When unsupported characters are entered in the SMTP address, MIM Sync cannot correctly provision the object into GALSync MA. In this situation, the object fails and throws an error. This problem also causes the object to be duplicated.

Issue 5

ECMA2 Export only MA displays an "The image or delta doesn’t have an anchor" error message when you perform an Export, CS Search, or CS Deletion.

Issue 6

The Sync Service stops responding when you stop a run profile for the ECMA connector.

Issue 7

The Active Directory MA interprets objects that are restored in the directory as deleted.

Issue 8

If you call Set-MIISECMA2Configuration to set the configuration for the SharePoint connector (Microsoft.IdentityManagement.Connector.Sharepoint.dll, version 4.3.836.0), the call fails silently but the verbose output says that the operation was successful.

Issue 9

The Set-MIISADMAConfiguration cmdlet supports only a single partition and a single container. In this update, the following changes are made to the parameters of this cmdlet.

-Partitions

The -Partitions parameter allows one or more partitions to be specified in the Active Directory MA.

  • The -Partitions parameter can apply single or multiple containers by using the ";" delimiter.
  • If the -Partitions parameter is absent, the Set-MIISADMAConfiguration cmdlet behaves in the same manner as it did prior to this update.

Example command that uses the -Partitions parameter:

Set-MIISADMAConfiguration -MAName ‘AD_MA’ -Forest Contoso.COM -Credentials (Get-Credential Contoso\ma_ADMA) -Partitions ‘DC=Contoso,DC=COM;DC=ForestDnsZones,DC=Contoso,DC=COM’

-Container

This parameter is updated to allow one or more containers to be specified together with the -Parameters parameter. It uses the following rules:

  • If the –Partitions parameter is present, parameter –Container can now apply to single or multiple containers by using the ";" delimiter.
  • If –Container is absent or no container are given for the partition, all the containers of this partition are selected.
  • If –Partitions is absent, the MIISADMAConfiguration cmdlet behaves in the same manner as it did prior to this update, and –Container can accept only a single containe.

Example command that uses the -Partitions and -Container parameters:

Set-MIISADMAConfiguration -MAName ‘AD_MA’ -Forest Contoso.COM -Credentials (Get-Credential Contoso\ma_ADMA) -Partitions ‘DC=Contoso,DC=COM;DC=ForestDnsZones,DC=Contoso,DC=COM’ -Container ‘OU=1,DC=Contoso,DC=COM;CN=Users,DC=Contoso,DC=COM;CN=Infrastructure,DC=ForestDnsZones,DC=Contoso,DC=COM’

MIM Portal

Issue 1

This hotfix addresses an issue in the MIM Portal that affects the sorting of a customized list view based on the columns that are specified in the ColumnsToDisplay property.

Issue 2

This hotfix updates HTML elements and attributes in the password registration portal and MIM Portal.

Issue 3

The object picker does not search objects that have special characters in their name.

Issue 4

This hotfix updates the translation of the user interface strings that relate to the “Password Reset AuthN Workflow” activity into Russian.

Issue 5

This hotfix addresses an issue that affects the Leave Member and Remove Member buttons when the group resource type is customized.

Issue 6

This hotfix adds a new search scope that is named "All Groups" to enable searching for and joining groups if the user does not know whether the group is a security group or a distribution list.

Issue 7

Specific culture localization settings for Spanish and French revert to English.

Issue 8

When you update an integer attribute value on the Extended Attributes tab of an object in the MIM Portal, the value is limited to a 32-bit integer. This issue occurs even though the same attribute allows 64-bit integer values if it is updated outside the Portal.

Issue 9

Resource Control Display Configuration (RCDC) does not allow a default tab to be configured

In this hotfix, the UOCInitialTabName parameter is added to the URL so that an object loads together with its associated RCDC.

Examples

The current RCDC users page has four tabs: General, Work Info, Contact Info, Summary.

If you open the corresponding XML, you find XML code that resembles the following:

<my:Grouping my:Name="WorkInfo" my:Caption="%SYMBOL_WorkInfoTabCaption_END%" my:Enabled="true" my:Visible="true">

If you provide the following code for an RCDC users page, the Work Info tab automatically opens:

http://mimPortal/IdentityManagement/aspx/users/EditPerson.aspx?UOCInitialTabName=WorkInfo

Or, if you provide the following code for a default administrators page, the Work Info page automatically opens:

http://mimPortal/IdentityManagement/aspx/users/EditPerson.aspx?id=7fb2b853-24f0-4498-9534-4e10589723c4&_p=1&UOCInitialTabName=WorkInfo

MIM Password Registration Portal

Issue 1

On the Question and Answer page, the initial scroll position is incorrect and prevents users from seeing the initial question.

MIM Service

Issue 1

roker service conversations are closed after a sync export to the MIM Service database.

Issue 2

A custom expression that includes Concatenate() is replaced by a plus sign (+) and generates an error when it is saved.

Issue 3

This hotfix addresses an issue that affects the MIM Service database stored procedures in which deadlocks might occur in approval workflows. In particular, deadlocks might occur in deployments that have complex or general Set definitions (for example, sets that match "/*" instead of specific resource types).

BHOLD

Issue 1

An inconsistency can occur between the Permission name and attribute changes that occur during an export, import, and subsequent export process in MIM Sync. In this case, BHOLD receives duplicates of a renamed group and maintains the original group in the database.

Issue 2

The Attestation Campaign Portal has an incorrectly worded title that displays campaign progress.

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Forefront Identity Manager (FIM) bHold, Forefront Identity Manager (FIM) Certificate Management, Forefront Identity Manager (FIM) PCNS, Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Updates, Updates, Updates, Updates, Updates | Leave a Comment »

(2015-06-28) A Hotfix Rollup Package (Build 4.1.3646.0) Is Available for Forefront Identity Manager 2010 R2 SP1

Posted by Jorge on 2015-06-28


Microsoft released a new hotfix for FIM 2010 R2 SP1 with build 4.1.3646.0. What it fixes can be found in this blog post. For additional or detailed info see MS-KBQ3054196

Download link

Issues that are fixed or features that are added in this update

This update also fixes the following issues or adds the following features that were not previously documented in the Microsoft Knowledge Base.

FIM Service

Issue 1

When you update the criteria of a group or set, you receive a SQL error if negative conditions exceed 7 in the filter when you click View members. After you apply this update, the View Members button works as expected.

FIM service portals, add-ins and extensions

Issue 1

When you use the FIM Credential Provider Extension for Self-Service Password Reset (SSPR), you cannot answer by using double-byte characters through the Windows Input Method Editor (IME) in the "Question and Answer" gate. After you apply this update double-byte characters are not permitted when you are first creating answers.

Issue 2

In the FIM Password Registration Portal, auto-focus on the first text box can cause the first registration question to be hidden from view. After you apply this update, the text box and its caption now act as a single control when they receive the focus, and the question is no longer hidden from view.

Issue 3

On the FIM Password Registration and Password Reset websites, autocomplete was not disabled for the logon forms. After you apply this update, autocomplete is disabled for all logon forms.

Issue 4

After you apply this update, the Object Picker control in the FIM Identity Management Portal returns invalid results if there were special characters in the search string. After you apply this update, the Object Picker control parses the HTML strings correctly so that the Object Picker control returns the correct results.

Certificate management

Issue 1

The revocation settings in a profile template can only be configured for all certificates together and not for each certificate separately. After you apply this update, the administrator can configure the following settings from the Revocation Settings page for each certificate in the policy:

  • RevokeThisCertificate
  • PublishBaseCRL
  • PublishDeltaCRL

Related changes in the FIM CM API –> Changes in the FIM CM API were also made to accommodate this change.

  • Properties of Microsoft.Clm.Shared.ProfileTemplates.RevocationOptions that were changed or added.

PublishBaseCrl
This property is obsolete. Use the PublishBaseCRL property from CertificateTemplateRevocationOptions instead.

PublishDeltaCrl
This property is obsolete. Use the PublishDeltaCRL property from CertificateTemplateRevocationOptions instead.

RevokeOldCertificates
This property is obsolete. Use the RevokeThisCertificate property from CertificateTemplateRevocationOptions instead.

CertificateTemplateRevocationSettings
Collection with configuration for each certificate template in the profile template
CertificateTemplateRevocationSettings is ReadOnlyCollection of Microsoft.Clm.Shared.ProfileTemplates.CertificateTemplateRevocationOptions type:

public ReadOnlyCollection<CertificateTemplateRevocationOptions> CertificateTemplateRevocationSettings { get; }
  • New object Microsoft.Clm.Shared.ProfileTemplates.CertificateTemplateRevocationOptions has the following properties.

CertificateTemplateCommonName

Obtains the string value together with the common name of the current certificate

RevokeThisCertificate

Obtains a Boolean value that indicates whether the current certificate that is associated with the smart card or the software profile that is to be operated on during a revoke operation will also be revoked.

PublishBaseCRL

Obtains a Boolean value that indicates whether a revocation operation causes the base certificate revocation list (CRL) to be published.

PublishDeltaCRL

Obtains a Boolean value that indicates whether a revocation operation causes a delta CRL to be published.

FIM synchronization service

Issue 1

The management agent for Active Directory receives a "Replication Access Denied" error when you run a Delta Import run profile step on domains that contain a read-only domain controller (RODC).

The documentation currently indicates that the account that is used in the management agent for Active Directory should have replicating directory changes. This is insufficient for domains that have the RODC feature enabled. The account that is used in the management agent for Active Directory should also be granted the replication directory changes in filter set permission to run Delta Import in such domains.

Issue 2

When a new synchronization rule is created and is projected into the metaverse, the following situation occurs whenever a synchronization rule does not project because of a synchronization error:

  • The synchronization exception causes the synchronization engine to remove the newly projected metaverse object because the synchronization failed.
  • The synchronization engine does not remove the import attribute flow rules that were added in the server configuration during the synchronization of the metaverse object.

Effect

  • Changes to the existing synchronization rule that failed initial sync do no resolve the problem.
  • The replacement of that synchronization rule does not resolve the problem.

After you apply this update, synchronization rule fragments will not be left in the server configuration when an attempt at failed projection or synchronization is made.

BHOLD and Access Management Connector

Issue 1

When you create delta-attestation campaign in BHOLD Analytics, an error message is displayed regardless of whether the campaign was created. After you apply this update, the error message is displayed only if there were errors when the campaign was created.

Issue 2

In BHOLD Attestation, user interface elements may not be available with new versions of Internet Explorer. After you apply this update, web forms work and are displayed as expected.

Cheers,

Jorge

———————————————————————————————

* This posting is provided "AS IS" with no warranties and confers no rights!

* Always evaluate/test yourself before using/implementing this!

* DISCLAIMER: https://jorgequestforknowledge.wordpress.com/disclaimer/

———————————————————————————————

############### Jorge’s Quest For Knowledge #############

######### http://JorgeQuestForKnowledge.wordpress.com/ ########

———————————————————————————————

Posted in Forefront Identity Manager (FIM) bHold, Forefront Identity Manager (FIM) Certificate Management, Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Updates, Updates, Updates, Updates | Leave a Comment »

(2015-05-03) A Hotfix Rollup Package (Build 4.1.3634.0) Is Available for Forefront Identity Manager 2010 R2 SP1

Posted by Jorge on 2015-05-03


Microsoft released a new hotfix for FIM 2010 R2 SP1 with build 4.1.3634.0. What it fixes can be found in this blog post. For additional or detailed info see MS-KBQ3048056

Download link

Issues that are fixed or features that are added in this update

This update also fixes the following issues or adds the following features that were not previously documented in the Microsoft Knowledge Base.

Password Change Notification Service

Issue 1

Windows 2012 R2 Domain Controller Support

Supportability for Password Change Notification Service (PCNS) and Active Directory Management Agent in a Windows Server 2012 R2 domain and forest includes the following:

  • Password Change Notification Service is working correctly on Windows Server 2012 R2-based domain controllers.
  • Active Directory Management Agent for Windows 2012 R2 domain and forest correctly handles password change events.

Note In all supported cases, the FIM Synchronization Service must be installed only on a Windows Server 2008, Windows Server 2008 R2, or Windows Server 2012 member server. It must not be installed on a Windows Server 2012 R2 member server unless the PCNS component is installed on a Windows Server 2012 R2 domain controller.

Synchronization Service

Issue 1

When PCNS calls into the FIMSynchronizationService, the FIMSynchronizationService makes an LsaLookupNames2 API call. This call fails because of the format of the domain.

For example, the format of the domain fails and generates the following error:

BAIL: MMS(3120): d:\bt\35150\private\source\miis\password\listener\pcnslistener.cpp(316): 0x80070534 (No mapping between account names and security IDs was done.): Win32 API failure: 1332
BAIL: MMS(3120): d:\bt\35150\private\source\miis\password\listener\pcnslistener.cpp(570): 0x80070534 (No mapping between account names and security IDs was done.)

FIM Service and Identity Management Portal

Issue 1

Custom search scope

Incorrect results are shown when multiple question mark (?) characters are found.

Issue 2

Comma-separated values (CSV) format is not supported for file upload for UocFileDownload in an FIM resource control display configuration (RCDC). After you apply this hotfix, CSV format is added to the allow list of supported formats for this control.

Certificate Management

Issue 1

When a customer search returns too many objects, the following error is generated:

‘ADsDSOObject’ failed without an error message available, result code: -2147016669(0x80072023)

The method that is used, SearchUsers, did not use the DirectorySearcher object. Search is now updated to use the DirectorySearcher object.

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

 

Posted in Forefront Identity Manager (FIM) bHold, Forefront Identity Manager (FIM) Certificate Management, Forefront Identity Manager (FIM) PCNS, Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Updates, Updates, Updates, Updates | 1 Comment »

(2015-03-20) A Hotfix Rollup Package (Build 4.1.3627.0) Is Available for Forefront Identity Manager 2010 R2

Posted by Jorge on 2015-03-20


Microsoft released a new hotfix for FIM 2010 R2 with build 4.1.3627.0. What it fixes can be found in this blog post. For additional or detailed info see MS-KBQ3022704

Download link

Issues that are fixed or features that are added in this update

This update fixes the following issues or adds the following features that were not previously documented in the Microsoft Knowledge Base.

BHOLD integration with the FIM Identity Management Portal and language packs

Issue 1

When a customer has installed the FIM Portal, BHOLD FIM Integration, and FIM language packs, a user who views a localized FIM Portal page sees the page revert to English after going to a BHOLD Self-Service page.

BHOLD Reporting

Issue 1

When a customer who uses BHOLD Reporting removes a filter from a report, successive reports continue to generate a report as if the filter was not removed.

BHOLD Model Generator

Issue 1

When you use the BHOLD Model Generator for role mining, and the Retain existing model check box is not selected, an exception may be reported when the BHOLD Model Generator loads files again.

Issue 2

When you use the BHOLD Model Generator for role mining, an exception may be reported when you create membership roles and proposed roles.

Issue 3

When you use the BHOLD Model Generator for role mining, if the user who’s running Model Generator does not exist in BHOLD, then attribute roles and ownership roles may not be created.

Issue 4

When the BHOLD Model Generator is run by a different user than who ran it previously or who installed BHOLD Core, and the Retain existing model check box is not selected, an exception may be reported.

FIM Service and Identity Management Portal

Issue 1

When multiple FIM Service computers are deployed, authentication workflow instances for SSPR requests that time out may remain in the Authenticating state indefinitely.

Issue 2

When you set or edit custom integer-valued attributes through the FIM Portal Extended attributes tab of an object, "Particular value is not supported" error message may be displayed for integer values that are greater than 2147483647.

Certificate Management

Issue 1

The FIM Certificate Management website incorrectly sends a request to the domain to look up the IdentityOneTimePasswordsRole+ FIM CM internal role.

Issue 2

When you select a user in the FIM CM Portal to manage a smart card, the following exception is triggered:

Object cannot be cast from DBNull to other types.
Technical Details
Type: System.InvalidCastException
Source: mscorlib
Stack Trace: at System.DBNull.System.IConvertible.ToDateTime(IFormatProvider provider)
at System.Convert.ToDateTime(Object value, IFormatProvider provider)
at Microsoft.Clm.DataAccess.Certificates.CalculateCertificateStatus(CertificateDataSet certData)
at Microsoft.Clm.BusinessLayer.Profiles.GetProfilesByStatus(Guid userUuid, ProfileStatus status)
at Microsoft.Clm.Web.UserDetail.LoadIntoInterface()
at Microsoft.Clm.Web.UserDetail.Page_Load(Object sender, EventArgs e)
at System.Web.UI.Control.OnLoad(EventArgs e)
at System.Web.UI.Control.LoadRecursive()
at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

Issue 3

FIM CM orphans smart cards in the FIMCertificateManagement database if initial enrollment for the smart card is tried under the incorrect profile template. This returns the following exception:

The card cannot be accessed because the wrong PIN was presented.

When you repeatedly try to enroll the smart card with the correct profile template, you receive the following error message:

Processing error: Invalid smart card. This card may only be reused for the user and profile template for which the card is assigned. Please retire the card first before enrolling for a different user or profile template.

Note After you apply this update rollup, when the wrong profile template fails with the "wrong PIN" exception, the following symptoms occur:

  • An incorrect administrator key is detected.
  • The smart card object in the database is moved to a retired state, without following the retire policy.
  • The user receives a message that states that the operation failed, probably because an incorrect profile template selection, and alternative profile templates are suggested.

Issue 4

When errors are encountered during the virtual smart card enrollment process, the virtual smart card on the computer is rolled back. However, the request in FIM Certificate Management remains in the "executing" state, making it possible for users to continue trying the existing request. However, the user cannot continue with the request because the virtual smart card being created on the computer no longer exists.

Issue 5

Expired or revoked logon certificates are no longer removed from smart card upon renewal in FIM CM.

This update adds functionality to remove certificates from smart cards on certificate expiration or revocation. This is a new option available in the Profile Template General Options settings page.

Synchronization Service

Issue 1

When the Active Directory global address list (GALSync) management agent is used against an Active Directory forest that hosts Exchange Server 2013, the GALSync solution does not generate the correct value for the msExchVersion attribute.

Issue 2

In a test environment, if there is no available connected data source for a particular kind of management agent, import audit trail files and export audit trail files are sometimes used to test the synchronization service solution functionality. When you use the FIM synchronization engine, this may trigger unexpected results.

The import and export operations seem to work, but on import, the run statistics show a delete and add for each object that’s exported to the drop file. Additionally, there are no objects left in the connectorspace.

This behavior occurs because the connectorspace object does not have the anchor value in the hologram as expected. Therefore, the connectorspace object is deleted and is intended to be replaced by the matching object that’s being imported. Additionally, the import add operation fails. The following workaround can be used in most scenarios.

Workaround

Important  Before you use this workaround, make sure that you have a current backup of the FIMSynchronizationService database.

The steps and SQL script that are documented in this workaround assume that you use a value from the metaverse object to populate the anchor value of new connectorspace objects during provisioning. If the management agent relies on the connected data source to create and provide anchor values for new objects, the provisioning code or synchronization rule may have to be temporarily changed to use a value from the metaverse to support this workaround.

This workaround is provided for a management agent with export and import run profiles configured as follows:

  • Export run profile that’s configured to create an audit trail file and stop the run
  • Import run profile configured to resume from audit trail file

To use this workaround, follow these steps:

  1. Run the export run profile.
  2. Run the script to update the FIMSynchronizationService database.
  3. Run the import run profile.

Sample script

The sample script that’s provided here is not intended for use in a production environment and is only meant to address the specific scenario that’s documented in this article in a development or test environment.

Before you run this SQL script, it must be changed to replace the management agent identifier (cs.ma_id). If a metaverse attribute other than UID must be used, the script must also be updated to replace all instances of "mv.uid" with the fieldname of the attribute to be used.

/*
 Fix anchor field in CS table for "broken" connectors after export to log file only
 Note:
 "mv.uid" should be fixed with valid field in MV table used as anchor
 "cs.ma_id = '2F2516F6-AD5B-4CFA-9F2B-AA4385D1879E'" should be fixed with valid id of target MA
 in CS table.
*/
  
update [FIMSynchronizationService].[dbo].[mms_connectorspace]
set [anchor] = cast(reverse(cast(len(mv.uid)*2 as binary(4))) as binary(4))+cast(mv.uid as varbinary(800))
from [FIMSynchronizationService].[dbo].[mms_connectorspace] cs
 join [FIMSynchronizationService].[dbo].[mms_csmv_link] l
  on cs.object_id = l.cs_object_id 
 join [FIMSynchronizationService].[dbo].[mms_metaverse] mv
  on mv.object_id = l.mv_object_id
where cs.ma_id = '2F2516F6-AD5B-4CFA-9F2B-AA4385D1879E' and cs.[anchor] is NULL
-

Issue 3

When you perform an export run for ECMA 2.0 Export Only MA, you receive the following error message:

The image or delta doesn’t have an anchor.

Forefront Identity Manager Connector for SharePoint User Profile Store

Issue 1

The SharePoint connector fails when there are multiple user profile services.

Cheers,

Jorge

———————————————————————————————

* This posting is provided "AS IS" with no warranties and confers no rights!

* Always evaluate/test yourself before using/implementing this!

* DISCLAIMER: https://jorgequestforknowledge.wordpress.com/disclaimer/

———————————————————————————————

############### Jorge’s Quest For Knowledge #############

######### http://JorgeQuestForKnowledge.wordpress.com/ ########

———————————————————————————————

Posted in Forefront Identity Manager (FIM) bHold, Forefront Identity Manager (FIM) Certificate Management, Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Updates, Updates, Updates, Updates | Leave a Comment »

(2014-11-29) A Hotfix Rollup Package (Build 4.1.3613.0) Is Available for Forefront Identity Manager 2010 R2

Posted by Jorge on 2014-11-29


Microsoft released a new hotfix for FIM 2010 R2 with build 4.1.3613.0. What it fixes can be found in this blog post. For additional or detailed info see MS-KBQ3011057

Download link

Issues that are fixed or features that are added in this update

This update fixes the following issues or adds the following features that were not previously documented in the Microsoft Knowledge Base.

BHOLD Attestation

Issue 1

Symptoms: When a steward is added to an in-progress campaign, the steward receives the "New entries for Steward" email.

Changes after the fix: When a steward is added to an in-progress campaign, the steward receives the "Instance Start" email.

BHOLD Core

Issue 1

Symptoms: When a user has conflicting ABA roles, and the user’s "EndDate" field is changed through the BHOLD Core UI, the user may be assigned an incorrect role.

Changes after the fix: Changing the user’s "EndDate" field does not affect any other ABA role attributes.

BHOLD Core and FIM provisioning

Issue 1

When you use the Access Management Connector, and an import is performed immediately following an export that caused ABA role membership changes, the import may indicate that users have fewer permissions than are assigned by either their previous or new role memberships.

After you install this fix: If an import is performed immediately following an export that caused ABA role membership changes, the import indicates that users have the permissions assigned by either their previous or new role memberships. After queue processing is completed, the import indicates that users have the permissions that are assigned by their new role memberships.

Issue 2

In some deployments, deletion of multiple groups through the Access Management Connector is not successful if there are two or more pending exports.

After you install the fix, the deletion of multiple groups through the Access Management Connector is successful.

Issue 3

In some deployments, export of changes through the Access Management Connector to OU objects that specify a new parent OU do not take effect.

After you install the fix: A Parent OU can be changed from root to any other OU through the Access Management Connector.

FIM Service and Identity Management Portal

Issue 1

Some text that is displayed in the FIM Portal and added to email templates always uses the English language. For example, this issue occurs in the Display Name of Approval objects.
After you install the fix: The string translation for objects that are created by the FIM Service in the FIM Service database is performed according to the FIM Service account locale that was in effect when the object was created. Note that this functionality is not affected by the client browser locale. To change the language that is used for string translation to a setting other than English, log on to each computer where the FIM Service is installed as the FIM Service account, and then set the locale for this account through Control Panel.

Issue 2

Creating synchronization rules in the FIM Identity Management Portal fails to load connected system object types in the External System Resource Type drop-down list. This behavior may occur if the size of the connector instance definition (ma-data) is larger than the 14 MB default WCF message size limit in the ResourceManagementClient configuration. This size is configured by using the maxReceivedMessageSizeInBytes property of the ResourceManagementClient.

Before you apply this fix, maxReceivedMessageSizeInBytes values that are configured in the web.config for the Identity Management Portal are ignored in favor of the default setting. After you apply this fix, the maxReceivedMessageSizeInBytes setting is applied.

Note that this setting is case-sensitive. For more information about this setting, go to the following Microsoft website: Registry keys and configuration file settings in FIM 2010

FIM Certificate Management

Issue 1

Online certificate updates are failing because of a constraint violation.

Issue 2

The FIM Certificate Management (CM) exit module does not honor the CT_FLAG_DONOTPERSISTINDB flag on a certificate. This may cause many certificates to be written to the FIM CM database. This, in turn, causes performance issues.

After you install this fix, the FIM CM exit module honors the CT_FLAG_DONOTPERSISTINDB flag on certificates, and those certificates are not written to the FIM CM database.

FIM Clients (Portal, Outlook, Windows logon)

Issue 1

After you install the FIM Windows logon extension, and then you (or a user) try to log on to the computer through a remote desktop, you must enter your credentials two times.

After you apply the fix, remote desktop logons work as expected. 

Synchronization Service

Issue 1

The Synchronization Service crashes during an Export run profile run on a SQL Server management agent.

Issue 2

When you run a Delta Import on the FIM Service management agent, the MIIServer.exe process terminates with a CLR_EXCEPTION_SYSTEM.APPDOMAINUNLOADEDEXCEPTION exception.

After you install this fix, the race condition that triggers this exception no longer occurs.

Issue 3

If a synchronization rule uses the NULL() function in an incoming attribute flow rule, returning NULL() is seen as a value instead of being blank, and attribute precedence does not continue to the next precedent incoming attribute flow.

After you apply this fix, attribute flow precedence on incoming attribute flow rules that use the NULL() function works as expected.

Password Change Notification Service (PCNS)

Issue 1

The following error message is logged:

6914 The connection from a password notification source failed because it is not a Domain Controller service account.

After you install this fix, adding a backslash character to a domain name causes the function to return the domain controller Security Identifier (SID) instead of an empty user SID.

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Forefront Identity Manager (FIM) bHold, Forefront Identity Manager (FIM) Certificate Management, Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Updates, Updates, Updates, Updates | Leave a Comment »

(2014-09-27) FIM Portals Die After Installing Rollup Package (Build 4.1.3599.0) For FIM 2010 R2

Posted by Jorge on 2014-09-27


Beginning this month, Microsoft released the latest rollup package, build 4.1.3599.0, for FIM 2010 R2. A few days ago I decided to install that rollup package in my test/demo environment. Before installing the rollup package everything worked as I had used it. Yesterday I wanted to use the FIM Portal again and I was confronted with the following error:

image

Figure 1: Error Shown When Accessing The FIM Portal

The error above already tells you what’s wrong. If you have not seen it yet, check out the red line (line 167) and the line below that (line 168). They’re almost the same except for the version number. It appears the installation of the rollup package added a new line for its new version, but did not remove the line containing the previous version (Build 4.1.3559.0). Basically the solution is to remove all lines with the previous version manually.

Navigate to the folder containing the WEB.CONFIG for the FIM Portal website and create a backup copy of it. Then open it and search for all occurrences of 3559, assuming the previous build was Build 4.1.3559.0, otherwise search for the correct build number if applicable. I found the following duplicates:

<assemblies>
  <add assembly="Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
  <add assembly="System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
  <add assembly="Microsoft.Web.CommandUI, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
  <add assembly="Microsoft.SharePoint.Search, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
  <add assembly="Microsoft.IdentityManagement.WebUI.Controls, Version=4.1.3559.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
  <add assembly="Microsoft.IdentityManagement.WebUI.Controls, Version=4.1.3599.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
  <add assembly="Microsoft.ResourceManagement, Version=4.1.3559.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
  <add assembly="Microsoft.ResourceManagement, Version=4.1.3599.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
</assemblies>

AND

<controls>
  <add tagPrefix="asp" namespace="System.Web.UI" assembly="System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
  <add tagPrefix="IdentityManagement" namespace="Microsoft.IdentityManagement.WebUI.Controls" assembly="Microsoft.IdentityManagement.WebUI.Controls, Version=4.1.3559.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
  <add tagPrefix="IdentityManagement" namespace="Microsoft.IdentityManagement.WebUI.Controls" assembly="Microsoft.IdentityManagement.WebUI.Controls, Version=4.1.3599.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
  <add tagPrefix="IdentityManagement" namespace="Microsoft.IdentityManagement.WebUI.Controls" assembly="Microsoft.IdentityManagement.WFExtensionInterfaces, Version=4.1.3559.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
  <add tagPrefix="IdentityManagement" namespace="Microsoft.IdentityManagement.WebUI.Controls" assembly="Microsoft.IdentityManagement.WFExtensionInterfaces, Version=4.1.3599.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
</controls>

All yellow marked lines need to be removed. After that save the WEB.CONFIG, and try again accessing the FIM Portal

image

Figure 2: Working FIM Portal Again

Now make sure to also check the FIM Registration Portal and the FIM Reset Portal. In my case I had found, the websites were duplicated. The solution to that is to stop the new duplicate sites if applicable, delete/remove them and start the previous sites again. The duplicate site is the website with the _X appended to the name of the site.

After fixing all this, everything is working again. Remember that you may need to check all FIM Portal servers if you have more than one.

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Forefront Identity Manager (FIM) Portal, Troubleshooting, Updates | 2 Comments »

(2014-09-06) A Hotfix Rollup Package (Build 4.1.3599.0) Is Available for Forefront Identity Manager 2010 R2

Posted by Jorge on 2014-09-06


Microsoft released a new hotfix for FIM 2010 R2 with build 4.1.3599.0. What it fixes can be found in this blog post. For additional or detailed info see MS-KBQ2980295

Download link

Issues that are fixed or features that are added in this update

This update fixes the following issues or adds the following features that were not previously documented in the Microsoft Knowledge Base.

FIM service and portals

Issue 1

This hotfix updates the FIM Password Reset and Password Registration Portal with additional UI changes that apply to customers who are customizing these portals in compliance with Section 508 of the U.S. Federal Rehabilitation Act.

Symptoms include the following:

  • On the "Your current Password" page, the Password text box is labeled incorrectly.
  • On the "Register your Answers" page, none of the text boxes are labeled correctly.
  • The following image has no alt tag:
    • <img src="images/wait_animationa.gif" />
  • When a validation error is encountered for the form fields on the "Your Current Password" and "Register Your Answers" pages, there is a message that’s displayed to the user. However, there is no indication to Assistive Technology that this message has appeared, no shift of focus, and the graphic that indicates an error to visual users is inaccessible. Therefore, it’s not apparent that this is an error message because it is displayed only as flat text.
  • The customized logo and text in the title is inaccessible to Assistive Technology.

Changes after the fix is applied:

  • Assistant Technology now fully reads all pages in the SSPR portal, and the user is informed if an error occurs.
  • The banners in Password Reset and Registration portals now have a tooltip.

Issue 2

When you configure a UocDropDownList control in a Resource Control Display Configuration with string values, the list of values in the control are not displayed in alphabetical order.

This fix adds the Sorted property to the UocDropDownList control. When the Sorted property is set to True, the items are sorted in alphabetical order.

Example:

<my:Control my:Name="EmployeeType" my:TypeName="UocDropDownList" my:Caption="{Binding Source=schema, Path=EmployeeType.DisplayName}" my:Description="{Binding Source=schema, Path=EmployeeType.Description}" my:RightsLevel="{Binding Source=rights, Path=EmployeeType}">
<my:Properties>
<my:Property my:Name="Sorted" my:Value="True"/>
<my:Property my:Name="Required" my:Value="{Binding Source=schema, Path=EmployeeType.Required}"/>
<my:Property my:Name="ValuePath" my:Value="Value"/>
<my:Property my:Name="CaptionPath" my:Value="Caption"/>
<my:Property my:Name="HintPath" my:Value="Hint"/>
<my:Property my:Name="ItemSource" my:Value="{Binding Source=schema, Path=EmployeeType.LocalizedAllowedValues}"/>
<my:Property my:Name="SelectedValue" my:Value="{Binding Source=object, Path=EmployeeType, Mode=TwoWay}"/>
</my:Properties>
</my:Control>

Issue 3

In the FIM Identity Management Portal that has the language pack installed, the display names of approval objects are not completely translated.

Be aware that the string translation for objects that are created by the FIM Service in the FIM Service database is performed according to the FIM Service account locale that was in effect when the object was created, and it is not affected by client browser locale. To change the language that’s used for string translation to a setting other than English, log on to each computer where the FIM Service is installed as the FIM Service account, and then set the locale for this account through Control Panel.

BHOLD

Issue 1

Users who are in inherited supervisor roles for operational units (OUs) may not have supervisor roles in subordinate OUs.

Issue 2

Roles that are directly assigned to a user are also listed under the inherited roles node.

Issue 3

When multiple attribute-based authorization (ABA) rules that are specified in BHOLD Core assign permissions to a user, and the user’s attributes change and are synched in from BHOLD FIM Provisioning Access Management Connector, the user may not receive all of his or her permissions.

Issue 4

In the BHOLD Analytics module, the impact operation is not available after a ruleset that includes a filter with a restrictive type is set. After this fix is applied, pressing the Impact button displays the impact of the rules.

Issue 5

The following error message may be logged in the Application log on a computer where BHOLD Core is installed:

Error when executing ‘EXEC ProcessQueueCommand30RoleBiased’ \n\n Reason System.Data.OleDb.OleDbException: Transaction count after EXECUTE indicates a mismatching number of BEGIN and COMMIT statements. Previous count = 0, current count = 1.
at System.Data.OleDb.OleDbCommand.ExecuteReaderInternal(CommandBehavior behavior, String method)
at System.Data.OleDb.OleDbCommand.ExecuteNonQuery()
at BHOLD.B1ServiceLibrary.Queue.ConnectorQueueDal.RetrieveQueueEntries(Int32 applicationId) in d:\Builds\52\5\Sources\imp\src\Access Management\Core\B1ServiceBC\Queue\ConnectorQueueDal.cs:line 122′

Issue 6

When the FIM Integration module is being used, and the BHOLD self-service features are incorporated into the FIM portal, some column headings may appear to be truncated.

Issue 7

In BHOLD Attestation, the notification template editor toolbar buttons are not displayed correctly.

Issue 8

When you apply this hotfix, BHOLD Attestation notification email messages contain a URL that requires one fewer click by the end-user in order to navigate to the page to perform the attestation.

Issue 9

This hotfix adds a UserUpdate function to the BHOLD Core scripting web service.

FIM Synchronization Service

Issue 1

Starting with build 4.1.3508.0, audit log files on Export run profile steps do not include reference attribute values.

Certificate management

Issue 1

Assume that a certificate is enrolled by using certificate template CT1 in profile template PT1, and then CT1 is replaced by another certificate template. If CT1 is removed, the certificate is revoked, and no new certificate is created from PT1. Additionally, later renewals of the certificate fail and a cryptic error message is returned.
With the profile template model, you cannot avoid this issue. Removal of the certificate template was done for a reason, and the system cannot arbitrarily determine whether the user can still enroll for the certificate by using that template.
The system now returns a user-friendly message, telling you to enroll instead of renew. This change makes sure that the certificate templates that are currently available in the profile template are used. Additionally, this action is logged on the FIM Certificate Manager server’s log file with all the necessary information.

Feature 1

Existing users in the FIM Certificate Management database, who have associated profiles and certificates, cannot be migrated to a different Active Directory user.

This new functionality is exposed through the clmutil.exe command prompt utility.

CLMUtil takes as input the original user’s UUID and the current user’s UUID. Records in the following tables are updated to the new UUID: profiles, certificates, and smart cards. Additionally, the UserNameCache table is updated if this is necessary, attaching the user name to the new UUID.

Command syntax:

ClmUtil -migrateuser -oldUserId "oldUserUuid" -newUserId "newUserUuid"

Description:

Migrate a user’s profile, certificate and smart cards records – from a user who has an old uuid to new uuid.

Example:

ClmUtil -migrateuser -oldUserId 11111111-2222-3333-4444-d602b49480b0 -newUserId 11111111-2222-3333-4444-2c68e64bba93

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Forefront Identity Manager (FIM) bHold, Forefront Identity Manager (FIM) Certificate Management, Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Updates, Updates, Updates, Updates | 1 Comment »

 
%d bloggers like this: