Jorge's Quest For Knowledge!

All About Identity And Security On-Premises And In The Cloud – It's Just Like An Addiction, The More You Have, The More You Want To Have!

Archive for the ‘Forefront Identity Manager (FIM) Sync’ Category

(2016-11-23) Microsoft Identity Manager (MIM) 2016 Service Pack 1 Packages

Posted by Jorge on 2016-11-23


Somewhere in September Microsoft released SP1 for MIM  2016 as you can read here. The first package was MIM 2016 with SP1 already included. If you wanted to install SP1 on your current deployment you had to uninstall first and reinstall with MIM 2016 with SP1 included where you would reuse all DBs. This procedure is described here. However, for some customers uninstalling everything and reinstalling it is a little bit too much. The impact and downtime is not acceptable. Because of that Microsoft has also released a SP1 update package that can be deployed on existing MIM 2016 deployments.

There is a subtle different of which you must be aware:

  • MIM 2016 with SP1: build 4.4.1237.0
  • SP1 update package: 4.4.1302.0

As you can see the builds are different! Please be aware you cannot apply the SP1 update package to a deployment already running MIM 2016 with SP1. You can only apply it when running MIM 2016 RTM.

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Forefront Identity Manager (FIM) bHold, Forefront Identity Manager (FIM) Certificate Management, Forefront Identity Manager (FIM) PCNS, Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Microsoft Identity Manager (MIM), Updates, Updates, Updates, Updates, Updates, Updates | Leave a Comment »

(2016-09-25) FIM/MIM Configuration Export Scripts

Posted by Jorge on 2016-09-25


When upgrading FIM or MIM to a newer version, you may need to uninstall the previous version first before installing the newer version. During the installation of the new version you need to reenter all the required information. But where do you get that data from? Either you have some installation/configuration guide or you make sure you make a copy (copy, export, backup) of the previous configuration so that you can look it up easily.

Making a copy of the previous configuration manually can take quite some time to finish and if unlucky you might even forget something!

Yes, you guessed it, PowerShell to the rescue! Smile

With the upcoming SP1 for MIM 2016 you may need this script.

Please provide feedback through the comments section OR you the contact page

DISCLAIMER (READ THIS!):

  • I wrote this script, therefore I own it. Anyone asking money for it, should NOT be doing that and is basically ripping you off!
  • The script is freeware, you are free to use it and distribute it, but always refer to this website (https://jorgequestforknowledge.wordpress.com/) as the location where you got it.
  • This script is furnished "AS IS". No warranty is expressed or implied!
  • I have NOT tested it in every scenario nor have I tested it against every Windows and/or AD version and/or FIM/MIM version and/or SQL version
  • Always test first in lab environment to see if it meets your needs!
  • Use this script at your own risk!
  • I do not warrant this script to be fit for any purpose, use or environment!
  • I have tried to check everything that needed to be checked, but I do not guarantee the script does not have bugs!
  • I do not guarantee the script will not damage or destroy your system(s), environment or whatever!
  • I do not accept liability in any way if you screw up, use the script wrong or in any other way where damage is caused to your environment/systems!
  • If you do not accept these terms do not use the script in any way and delete it immediately!

SYNTAX:

<PoSH Script File> [-allConfig] [-mainConfig] [-fimSyncConfig] [-fimSvcConfig] [-fimPortalConfig] [-fimPwdRegPortalConfig] [-fimPwdResetPortalConfig] [-backupDBs] [-mainBackupFolder <Folder To Backup/Export To>]

This PoSH script exports FIM/MIM configuration as a quick backup method. If applicabel, the following configuration components are exported:

  • FIM/MIM Main Configuration;
  • FIM/MIM Sync Configuration;
  • FIM/MIM Service Configuration;
  • FIM/MIM Portal Configuration;
  • FIM/MIM Registration Portal Configuration;
  • FIM/MIM Reset Portal Configuration;
  • SQL Server Database

I have NOT added support for:

  • FIM/MIM PCNS Configuration;
  • FIM/MIM CM Configuration;
  • FIM/MIM Reporting Configuration

Currently there is no import script. You will have to do it manually

Get the export script from HERE

When upgrading, you only need to the [-mainConfig option on every FIM server and the [-backupDBs] option on the SQL server! For example:

  • Everything on one server (incl. SQL server)? –> <PoSH Script File> -mainConfig -backupDBs -mainBackupFolder <Folder To Backup/Export To>
  • FIM/MIM servers without SQL –> <PoSH Script File> -mainConfig -mainBackupFolder <Folder To Backup/Export To>
  • SQL server without FIM/SQL –> <PoSH Script File> –backupDBs -mainBackupFolder <Folder To Backup/Export To>

REMARK: the installation of a newer version against an existing database WILL upgrade the database. Make sure to have a backup of your FIM/MIM DBs!!!

PARAMETER allConfig

Exports All The Configuration Of FIM/MIM. This is basically all the options combined.

PARAMETER mainConfig

Exports Only The Main Configuration Of FIM/MIM. This should be the option to use when upgrading FIM/MIM.

PARAMETER fimSyncConfig

Exports Only The FIM Sync Specific Configuration

PARAMETER fimSvcConfig

Exports Only The FIM Service Specific Configuration

WARNING: This export might take some considerabel amount of time!!!

PARAMETER fimPortalConfig

Exports Only The FIM Portal Specific Configuration

PARAMETER fimPwdRegPortalConfig

Exports Only The FIM Password Registration Portal Specific Configuration

PARAMETER fimPwdResetPortalConfig

Exports Only The FIM Password Reset Portal Specific Configuration

PARAMETER backupDBs

Backup Only The Databases In Use By FIM

PARAMETER mainBackupFolder

Main Backup Folder To Store The Backup

image

Figure 1: Exporting The FIM/MIM Configuration Before The Upgrade

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Backup/Export, Backup/Export, Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Microsoft Identity Manager (MIM) | 1 Comment »

(2016-07-21) A Hotfix Rollup Package (Build 4.3.2266.0) Is Available for Microsoft Identity Manager 2016

Posted by Jorge on 2016-07-21


Microsoft released a new hotfix for MIM 2016 with build 4.3.2266.0. What it fixes can be found in this blog post. For additional or detailed info see MS-KBQ3171342

Download link

Issues that are fixed and features that are added in this update

Privileged Access Management (PAM)

Issue 1

When you create a PRIV ONLY PAM user, the PAM monitor service throws the following warning message when it tries to update the PAM users email in active directory and the value already exists:

System.Exception: Set PAM object dictionary already contain attribute ‘Email’.

FIM add-ins and extensions

Issue 1

SSPR windows clients on systems that use a high DPI setting have an incorrect scaling of the final page (the Password Reset Flow page) in which the radio buttons are overlapped.

Issue 2

SSPR windows clients have text messages that overlap after a password reset if the resulting message (success or error) contains more than three lines.

FIM Certificate Management

Issue 1

The ExecuteOperations.Disable operation from the Microsoft.Clm.BusinessLayer.Shared.dll public library does not work correctly and returns an error because of incorrect object initialization.

Issue 2

A smart card search takes 3.5 minutes on an idle server. Additionally, the search never ends if the server is stressed.

Issue 3

There is a redundant space in the "Profile Summary" string on the Request Complete page for some languages.

Issue 4

The Duplicate Revocation Settings policy is replaced because some users could not set it.

Issue 5

A certificate in the Certificate Management portal may use the LDAP CN name instead of DisplayName when it calls REST.

Issue 6

For ZH-Hans and some other languages, link underlining in the Certificate Management portal is misplaced (stroke instead of an underline) because of a font issue.

FIM Synchronization Service

Issue 1

Under certain conditions, the file selection dialog box does not appear on the MA configuration wizard pages.

Issue 2

Error messages are logged in the event log (such as Event ID 6313). Additionally, performance counters don’t work.

Issue 3

The Sync Service crashes when you run a Full Synchronization process that has Equal Precedence set for attributes that exist in IAF or EAF.

Issue 4

When an incorrect page size (either less than the minimum or more than the maximum) is used for the run profile of the ECMA2 management agent, the page size value quietly changes to the minimum or the maximum after you click Finish.

Issue 5

An error message from the Management Agent cannot be parsed if it contains some special symbols. Therefore, the error message doesn’t appear in the error list as expected, and a non-informative error window appears.

Issue 6

You receive a "Reference to undeclared entity ‘qt’" error message when you run the history process and the history text contains the "greater than" (>) symbol.

Issue 7

New Functionality: The ability to skip the Management Agent during the import of a server configuration is added. A new -Skip parameter is added to the Import-MIISServerConfig cmdlet.
The names of MAs to skip should be delimited by a semicolon (;), as in the following example:

Import-MIISServerConfig -Path "C:\exported" -Skip "FIMMA;ADMA"

Note If you do not use the -Skip parameter, the default behavior occurs.

Issue 8

A "MEMORY_ALLOCATION_FAILURE" error occurs in the Performance Monitoring tool when the performance data .dll file cannot open the process.

FIM Portal

Issue 1

Multivalued labels are displayed incorrectly in a single line in the UI.

Issue 2

When you upload Resource Control Display Configurations (RCDC), the xml-format is not verified.

Issue 3

You cannot drag-and-drop a user to the Remove box to delete the user or to remove the user from a group membership.

Issue 4

Local date and time settings are ignored for the Australian English (en-AU) locale.

Issue 5

This update enables customizations that have controls that are shown or hidden based on the state of the email-enabling check box.

An additional attribute to RCDCs configuration data is included in this update. The Now Event element may have a Parameters attribute. For Group RCDC for the OnChangeEmailEnabling event, the element should contain a comma-separated, case-sensitive list of controls to show or hide.

Example

<my:Control my:Name="EmailEnabling" my:TypeName="UocCheckBox"
 my:Caption="%SYMBOL_EmailEnablingCaption_END%"
 my:Description="%SYMBOL_EmailEnablingDescription_END%"
 my:AutoPostback="true" my:RightsLevel="{Binding Source=rights,
 Path=Email}">
        <my:Properties>
         <my:Property my:Name="Text" my:Value="%SYMBOL_EmailEnablingValue_END%"/>
        </my:Properties>
        <my:Events>

Note If the Parameters attribute is not included, the default behavior occurs.

FIM Service

Issue 1

In SharePoint Server 2013 and later versions, if you edit a workflow or update an email template by using the FIM Portal, the version is automatically updated to 4.0.0.0. This causes a system error message during processing.

BHOLD

Issue 1

When you add a user to an organizational unit (OU) that has some incompatible permissions in the OUs role, all the incompatible permissions are assigned.

Issue 2

Some issues are fixed for attribute-based authorization (ABA) roles that are assigned to a user when the roles have incompatible permissions.

Issue 3

When you use Access Management Connector to provision new OUs with a parent OU, all the parent OU roles are inherited but are also disabled.

Issue 4

An error occurs in BHOLD during installation in Internet Information Services (IIS) 10.

Issue 5

If two or more roles that are assigned to a user who has the same permissions as the roles, and the roles use the endDate attribute, you cannot extract a user permission that has the latest date.

Issue 6

An email alias is truncated if it is longer than 30 characters.

Cheers,

Jorge

———————————————————————————————

* This posting is provided "AS IS" with no warranties and confers no rights!

* Always evaluate/test yourself before using/implementing this!

* DISCLAIMER: https://jorgequestforknowledge.wordpress.com/disclaimer/

———————————————————————————————

############### Jorge’s Quest For Knowledge #############

######### http://JorgeQuestForKnowledge.wordpress.com/ ########

———————————————————————————————

Posted in Forefront Identity Manager (FIM) bHold, Forefront Identity Manager (FIM) Certificate Management, Forefront Identity Manager (FIM) PCNS, Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Updates, Updates, Updates, Updates, Updates | Leave a Comment »

(2016-07-21) A Hotfix Rollup Package (Build 4.1.3765.0) Is Available for Forefront Identity Manager 2010 R2

Posted by Jorge on 2016-07-21


Microsoft released a new hotfix for FIM 2010 R2 with build 4.1.3765.0. What it fixes can be found in this blog post. For additional or detailed info see MS-KBQ3171318

Download link

Issues that are fixed and features that are added in this update

FIM Certificate Management

Issue 1

A smart card search takes 3.5 minutes on an idle server. Additionally, the search never ends if the server is stressed.

Issue 2

The Duplicate Revocation Settings policy is replaced because some users could not set it.

Issue 3

There is a redundant space in the "Profile Summary" string on the Request Complete page for some languages.

FIM Synchronization Service

Issue 1

In a metaverse search and when you view the object, there is a Last Modified field. But when you sort that field, it sorts as a generic text field instead of as a date field.

Issue 2

Error messages (such as Event ID 6313) are logged in the event log. Additionally, performance counters don’t work.

Issue 3

The Sync Service crashes when you run a Full Synchronization process that has Equal Precedence set for attributes that exist in IAF or EAF.

Issue 4

When an incorrect page size (either less than the minimum or more than the maximum) is used for the run profile of the ECMA2 management agent, the size value quietly changes to the minimum or the maximum after you click Finish.

Issue 5

An error message from the Management Agent cannot be parsed if it contains some special symbols. Therefore, the error message doesn’t appear in the error list as expected, and a non-informative error window appears.

Issue 6

You receive a "Reference to undeclared entity ‘qt’" error message when you run the history process and the history text contains the "greater than" symbol (>).

Issue 7

Under certain conditions, the file selection dialog box does not appear on the MA configuration wizard pages.

Issue 8

A "MEMORY_ALLOCATION_FAILURE" error occurs in the Performance Monitoring tool when the performance data .dll file cannot open the process.

FIM Portal

Issue 1

Multivalued labels are displayed incorrectly in a single line in the UI.

FIM Service

Issue 1

During an Export process between the Synchronization and FIM Service, the msidmCompositeType request may fail if some multivalued string attribute value is changed in the scope of the Export session. This behavior affects performance.

Issue 2

In SharePoint Server 2013 and later versions, if you change a workflow or update an email template by using the FIM Portal, the version is automatically updated to 4.0.0.0. This causes a system error message during processing.

BHOLD

Issue 1

When you add a user to an organizational unit (OU) that has some incompatible permissions in the OUs role, all the incompatible permissions are assigned.

Issue 2

Some issues are fixed for attribute-based authorization (ABA) roles that are assigned to a user when the roles have incompatible permissions.

Issue 3

When you use the Access Management Connector to provision new OUs with a parent OU, all the parent OU roles are inherited but are also disabled.

Issue 4

An error occurs in BHOLD during installation in Internet Information Services (IIS) 10.

Issue 5

If two or more roles assigned to a user who has the same permissions as the roles, and the roles use the endDate attribute, you cannot extract a user permission that has the latest date.

Issue 6

An email alias is truncated if it is longer than 30 characters.

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Forefront Identity Manager (FIM) bHold, Forefront Identity Manager (FIM) Certificate Management, Forefront Identity Manager (FIM) PCNS, Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Updates, Updates, Updates, Updates, Updates | 2 Comments »

(2016-05-29) FIM PowerShell CMDlets Have Been Updated

Posted by Jorge on 2016-05-29


Brain Desmond has updated the FIM PowerShell Modules on Codeplex.

Download:

Documentation:

Significant number of enhancements and fixes, including:

New Cmdlets

  • New-FimEmailTemplate
  • New-FimWorkflowDefinition
  • New-FimManagementPolicyRule
  • New-FimSearchScope
  • New-FimNavigationBarLink
  • Get-FimSynchronizationRuleDependencyTree

Enhancements

  • Add Manual Members Support to New-FimSet
  • Add PassThru Switch Schema Cmdlets
  • AllowAuthorizationException switch on New-FimImportObject
  • Add Mode to Get-FimRequestParameter
  • Support null values for New-FimImportChange
  • Support Constants in Sync Rules in Get-ExportAttributeFlow

Bugs Fixed

  • 1850: FimSyncPowerShellModule Should Not Export Internal Functions
  • 1851: Create-ImportFileFromCSEntry Uses an Unapproved Verb
  • 1852: Update Help Text in FimSyncPowerShellModule to use Approved Names, Domains
  • 1885: Objects Emitted by Module Should have a Custom Type Name
  • 1886: Change New-FimImportChange, New-FimImportObject to use ValidateSet
  • 1888: Decorate New-FimSchemaAttribute with Cmdlet Attributes
  • 1889: Decorate New-FimSchemaObject with Parameter Attributes
  • 1939: Improve PSSnapin Load Error Handling
  • 1941: Update Comment Based Help
  • 1894: New-FimImportChange Does Not Support Numeric Inputs
  • 1896: New-FimImportChange Should Support Guid Values
  • 1897: Hide Progress Bar on Module Calls
  • 1948: Fix ‘DateTime’ $DataType casing on New-FimSchemaAttribute
  • 1951: Output Correct Data Type from New-FimSchemaBinding
  • 1968: SynchronizationRuleParameters typing issue
  • 1973: E2E attribute flow: constant sync rule values
  • 1982: Fixed a bug with OSR-Expression export flows. Added the following info to the output:
    • Allow nulls
    • Initial flow only
    • Is existence test
  • 1991: Get-MetaverseSchema Does Not Triage Boolean Attributes Correctly
  • 1997: If the msidmOutboundIsFilterBased is false, no value are submit to FIM and when you edit the SR with the form, you get a change for this attribute (no intial value to false)
  • 2083: Missing Error Handling in New-FimImportObject

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, PowerShell, Tooling/Scripting, Tools, Tools | Leave a Comment »

(2016-05-25) LithNet FIM Sync PowerShell CMDlets

Posted by Jorge on 2016-05-25


Ryan Newington  (Twitter and Blog), yet again wrote and created an impressive PowerShell module to manage the FIM/MIM Sync Engine. Many stuff to manage the FIM/MIM Sync Engine that was not yet possible through PowerShell, is now possible!!!

Lithnet FIM/MIM Synchronization Service PowerShell Module

DISCLAIMER

WARNING: USE THIS TOOL AT YOUR OWN RISK

This tool is provided for testing and diagnostic purposes and is intended for use in development and test environments. Any problems that arise from the use of the tool are not supported by the developers or by Microsoft.

The PowerShell module exposes functionality using a combination of

Supported WMI interfaces
Wrapping existing PowerShell modules
Wrapping existing executables
Libraries that the synchronization client UI uses to interface with the sync engine itself. These libraries are undocumented APIs.

The module does NOT interface with the sync engine database in any way.

It does not provide any mechanism to alter the internal configuration of the sync engine, unless an executable or documented API is available for that.

The developers make no warranties as to the suitability of these tools for use in your environment, nor will we be liable for any financial or other damages arising from the use of these tools.

image

Figure 1: The List Of PowerShell CMDlets In The Lithnet PowerShell Module For FIM/MIM Sync

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Forefront Identity Manager (FIM) Sync, PowerShell, Tools | Leave a Comment »

(2015-12-14) LithNet Utilities And Tools For Your FIM/MIM Solution

Posted by Jorge on 2015-12-14


There is a guy called Ryan Newington  (Twitter and Blog), and he wrote and created some impressive utilities and tools that you can use in your challenge to design and configure an Identity Management system based  upon either FIM 2010 R2 or MIM 2016.

Lithnet Metadirectory Services Utilities

  • Description: The Lithnet Metadirectory Services Utilities package is a .NET library containing extensions and utilities for writing code for the FIM sync engine. The library contains various helper classes and extensions for objects in the Microsoft.MetadirectoryServices namespace, such as the CSEntryChange. It allows you to reduce code and introduces new functions, such as XML serialization of native metadirectory services objects. It can be used in any rules extension or ECMA2.2 project, along side the Microsoft.MetadirectoryServices component.
  • Documentation: https://lithnetmsu.codeplex.com/documentation
  • Download: https://www.nuget.org/packages/Lithnet.MetadirectoryServices/

Lithnet FIM Service REST API

Lithnet FIM PowerShell Module

Lithnet FIM Service Client

Lithnet FIM Unix/Linux SSH MA

  • Description: The Lithnet SSH MA is a ForeFront Identity Manager (FIM) ECMA2.2 management agent used to provision and synchronize objects to unix and linux systems using SSH. The management agent supports: Full and (optionally) delta imports, Exports (supporting either object replace, attribute replace, attribute update, or multivalued reference attribute update modes), Password set and change, Username and RSA key-based logins, as well as username/password logins, Dynamic DN construction
  • Documentation: https://lithnetsshma.codeplex.com/documentation
  • Download: https://lithnetsshma.codeplex.com/releases/view/113093

Lithnet ACMA

  • Description: Lithnet ACMA is a codeless rules engine for Microsoft Forefront Identity Manager 2010 R2. ACMA provides a means for performing powerful rules-based construction of objects and attributes without the need to write custom code.
    ACMA is implemented as an extensible management agent (ECMA2.2), built upon an SQL Server 2012 database, and comes with a powerful UI-based rules editor and PowerShell extensions.
  • Documentation: https://acma.codeplex.com/documentation
  • Download: https://acma.codeplex.com/releases/view/617213

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Tools, Tools | Leave a Comment »

(2015-12-12) A Hotfix Rollup Package (Build 4.3.2064.0) Is Available for Microsoft Identity Manager 2016

Posted by Jorge on 2015-12-12


Microsoft released a new hotfix for MIM 2016 with build 4.3.2064.0. What it fixes can be found in this blog post. For additional or detailed info see MS-KBQ3092179

Download link

Issues that are fixed or features that are added in this update

This update also fixes the following issues or adds the following features that were not previously documented in the Microsoft Knowledge Base.

MIM add-ins and extensions

Issue 1

This hotfix addresses an issue that affects the password reset window and that occurs on monitors that have high DPI settings when the Windows display sizing of items is set to a custom size, such as 200 percent or more.

Certificate Management

Issue 1

You try to enroll a smart card by having the correct profile selected (with correct adminKey). However, the user PIN doesn’t correspond to the smart card PIN policy. In this situation, you receive the following error message:

The card cannot be accessed because the wrong PIN was presented.

Issue 2

MIM Configuration Manager Reporting doesn’t show smart card settings correctly. Settings are shown only for the Pkcs11 smartcard provider and not for baseCSP.

Issue 3

All policies in the MIM Configuration Manager allows for changes to "Revocation Settings" only for all certificates together. In this fix, a new page is added (CertificateTemplateRevocationSettings) to show "revocation settings" for the selected certificate. Changes to ProfilePolicyrevocationSettingsPage are also made to show all certificates of the profile.

MIM Synchronization Service

Issue 1

When you configure an ECMA2 run profile, you receive a “Value of ‘10’ is not a valid value” error message.

Issue 2

The Sync Engine reports a staging-error during delta import when the Generic LDAP connector detects the renaming of an object distinguished name.

Issue 3

When a rename, or a distinguishedName change, of a user is exported to Oracle Directory Enterprise Edition (ODSEE), that user is removed from group memberships. You expect that the membership reference to the renamed object will be updated, instead.

Issue 4

When unsupported characters are entered in the SMTP address, MIM Sync cannot correctly provision the object into GALSync MA. In this situation, the object fails and throws an error. This problem also causes the object to be duplicated.

Issue 5

ECMA2 Export only MA displays an "The image or delta doesn’t have an anchor" error message when you perform an Export, CS Search, or CS Deletion.

Issue 6

The Sync Service stops responding when you stop a run profile for the ECMA connector.

Issue 7

The Active Directory MA interprets objects that are restored in the directory as deleted.

Issue 8

If you call Set-MIISECMA2Configuration to set the configuration for the SharePoint connector (Microsoft.IdentityManagement.Connector.Sharepoint.dll, version 4.3.836.0), the call fails silently but the verbose output says that the operation was successful.

Issue 9

The Set-MIISADMAConfiguration cmdlet supports only a single partition and a single container. In this update, the following changes are made to the parameters of this cmdlet.

-Partitions

The -Partitions parameter allows one or more partitions to be specified in the Active Directory MA.

  • The -Partitions parameter can apply single or multiple containers by using the ";" delimiter.
  • If the -Partitions parameter is absent, the Set-MIISADMAConfiguration cmdlet behaves in the same manner as it did prior to this update.

Example command that uses the -Partitions parameter:

Set-MIISADMAConfiguration -MAName ‘AD_MA’ -Forest Contoso.COM -Credentials (Get-Credential Contoso\ma_ADMA) -Partitions ‘DC=Contoso,DC=COM;DC=ForestDnsZones,DC=Contoso,DC=COM’

-Container

This parameter is updated to allow one or more containers to be specified together with the -Parameters parameter. It uses the following rules:

  • If the –Partitions parameter is present, parameter –Container can now apply to single or multiple containers by using the ";" delimiter.
  • If –Container is absent or no container are given for the partition, all the containers of this partition are selected.
  • If –Partitions is absent, the MIISADMAConfiguration cmdlet behaves in the same manner as it did prior to this update, and –Container can accept only a single containe.

Example command that uses the -Partitions and -Container parameters:

Set-MIISADMAConfiguration -MAName ‘AD_MA’ -Forest Contoso.COM -Credentials (Get-Credential Contoso\ma_ADMA) -Partitions ‘DC=Contoso,DC=COM;DC=ForestDnsZones,DC=Contoso,DC=COM’ -Container ‘OU=1,DC=Contoso,DC=COM;CN=Users,DC=Contoso,DC=COM;CN=Infrastructure,DC=ForestDnsZones,DC=Contoso,DC=COM’

MIM Portal

Issue 1

This hotfix addresses an issue in the MIM Portal that affects the sorting of a customized list view based on the columns that are specified in the ColumnsToDisplay property.

Issue 2

This hotfix updates HTML elements and attributes in the password registration portal and MIM Portal.

Issue 3

The object picker does not search objects that have special characters in their name.

Issue 4

This hotfix updates the translation of the user interface strings that relate to the “Password Reset AuthN Workflow” activity into Russian.

Issue 5

This hotfix addresses an issue that affects the Leave Member and Remove Member buttons when the group resource type is customized.

Issue 6

This hotfix adds a new search scope that is named "All Groups" to enable searching for and joining groups if the user does not know whether the group is a security group or a distribution list.

Issue 7

Specific culture localization settings for Spanish and French revert to English.

Issue 8

When you update an integer attribute value on the Extended Attributes tab of an object in the MIM Portal, the value is limited to a 32-bit integer. This issue occurs even though the same attribute allows 64-bit integer values if it is updated outside the Portal.

Issue 9

Resource Control Display Configuration (RCDC) does not allow a default tab to be configured

In this hotfix, the UOCInitialTabName parameter is added to the URL so that an object loads together with its associated RCDC.

Examples

The current RCDC users page has four tabs: General, Work Info, Contact Info, Summary.

If you open the corresponding XML, you find XML code that resembles the following:

<my:Grouping my:Name="WorkInfo" my:Caption="%SYMBOL_WorkInfoTabCaption_END%" my:Enabled="true" my:Visible="true">

If you provide the following code for an RCDC users page, the Work Info tab automatically opens:

http://mimPortal/IdentityManagement/aspx/users/EditPerson.aspx?UOCInitialTabName=WorkInfo

Or, if you provide the following code for a default administrators page, the Work Info page automatically opens:

http://mimPortal/IdentityManagement/aspx/users/EditPerson.aspx?id=7fb2b853-24f0-4498-9534-4e10589723c4&_p=1&UOCInitialTabName=WorkInfo

MIM Password Registration Portal

Issue 1

On the Question and Answer page, the initial scroll position is incorrect and prevents users from seeing the initial question.

MIM Service

Issue 1

roker service conversations are closed after a sync export to the MIM Service database.

Issue 2

A custom expression that includes Concatenate() is replaced by a plus sign (+) and generates an error when it is saved.

Issue 3

This hotfix addresses an issue that affects the MIM Service database stored procedures in which deadlocks might occur in approval workflows. In particular, deadlocks might occur in deployments that have complex or general Set definitions (for example, sets that match "/*" instead of specific resource types).

BHOLD

Issue 1

An inconsistency can occur between the Permission name and attribute changes that occur during an export, import, and subsequent export process in MIM Sync. In this case, BHOLD receives duplicates of a renamed group and maintains the original group in the database.

Issue 2

The Attestation Campaign Portal has an incorrectly worded title that displays campaign progress.

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Forefront Identity Manager (FIM) bHold, Forefront Identity Manager (FIM) Certificate Management, Forefront Identity Manager (FIM) PCNS, Forefront Identity Manager (FIM) Portal, Forefront Identity Manager (FIM) Sync, Updates, Updates, Updates, Updates, Updates | Leave a Comment »

(2015-11-12) Third-Party Generic SQL Management Agent (Connector) Released For FIM/MIM

Posted by Jorge on 2015-11-12


Søren Granfeldt has released a generic SQL MA/Connector that can be used with both FIM and MIM, instead of the default available SQL MA/Connector.

Main features are:

  • Synchronize almost any type of information with SQL Server tables
  • Flexible schema
  • Run stored procedures against the tables as part of the sync import and export schedules
  • Full and delta imports
  • Delta and full exports
  • Can keep and revive deleted information / rows

More information: Generic SQL Management agent released

Download this SQL MA/Connector from Codeplex: SQL Management Agent

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Connector/MA, Forefront Identity Manager (FIM) Sync | Leave a Comment »

(2015-10-20) FIM 2010 R2 And MIM 2016: Sharepoint Services Connector (Updated)

Posted by Jorge on 2015-10-20


This new Sharepoint Services connector (v4.3.1935.0) was released by Microsoft on 20-10-2015 (dd-MM-yyyy)

The SharePoint User Profile Store helps you synchronize identity information to the User Profile Store in SharePoint. You can download it from here. More detailed information can be found through the SharePoint Services Connector for FIM 2010 R2 Technical Reference and through MS-KBQ3100358

From a high level perspective, the following features are supported by the current release of the connector:

Requirement Support
Operating System Support Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2
Other Required Software Microsoft .NET 4.5 Framework
FIM/MIM Version FIM 2010 R2 SP1 (build 4.1.3114.0 and higher) ((2013-01-12) Service Pack 1 For Forefront Identity Manager 2010 R2 And BHold Has Been Released)
MIM 2016
Data Source

SharePoint Server 2013 with User Profile service application (UPA)

Supported Scenarios Object Lifecycle Management
User Management
Supported Operations Against Data Source Full Import
Delta Import
Export
Schema

User
Group
Contact

Table 1: Requirements And Supports Features

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER:
https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
#########
http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————

Posted in Connector/MA, Forefront Identity Manager (FIM) Sync | Leave a Comment »

 
%d bloggers like this: