Hi,
I have Forest A With Exchange 2010 and Forest B with Exchange 2013, I want toestablish a singleglobal address list with FIM 2010,howI cando this,there is astep by stepguide?I need to establish a trust relationship?
Thanks
How to Sync GAL between two forest
↧
↧
PCNS installation error 25006
Hello. We have PCNS running smoothly on our domain, however I am adding a new domain controller (All servers are running 2012 R2) and the PCNS client will not install. It gives me the following error:
Error 25006.The Forefront Identity Manager Password Change Notification Service Setup Wizard cannot write to the discretionary access control lists (DACLs). CN=domain\/fqdn,cn=Password Change Notification Service, CN=System,DC=our,DC=domain,DC=org. Ensure you have the correct permissions for this operation, and then try running this wizard again.
I am attempting the install the client with the same user account I used on the other domain controller. The account is a domain admin, and I have checked permissions in ADSI. I have searched but I cant seem to find an actual resolution to this anywhere online. Any help would be greatly appreciated.
↧
SSPR Password Reset failure
Hello everyone!
Im trying to figure out why password reset is failing all the time. We have two servers in our environment. 1 for FIMSync and service, and 1 for SSPR. There is no firewall on, DCOM and WMI is verified, SPN is all setup, SSPR registration is working fine.
When we try to reset a pwd we reach the SSPR portal just fine, type in username, receive a OTP on SMS, type in new password twice and then hit an error. From the event log on SSPR server this is the only thing going on: (There is no event on the FIMSync server).
Failure to connect to FIM ServiceThe web portal failed to connect to the FIM Service.
Ensure that (1) the FIM Service is running, (2) the FIM Service server address is correct in the web.config file on the web portal, and (3) that network connectivity is available between the web portal and the FIM Service over the designated port.
Details:
System.ServiceModel.Security.MessageSecurityException: An unsecured or incorrectly secured fault was received from the other party. See the inner FaultException for the fault code and detail. ---> System.ServiceModel.FaultException: An error occurred when processing the security tokens in the message.
--- End of inner exception stack trace ---
Server stack trace:
at System.ServiceModel.Channels.SecurityChannelFactory`1.SecurityRequestChannel.ProcessReply(Message reply, SecurityProtocolCorrelationState correlationState, TimeSpan timeout)
at System.ServiceModel.Channels.SecurityChannelFactory`1.SecurityRequestChannel.Request(Message message, TimeSpan timeout)
at System.ServiceModel.Channels.ContextRequestChannel.Request(Message message, TimeSpan timeout)
at System.ServiceModel.Dispatcher.RequestChannelBinder.Request(Message message, TimeSpan timeout)
at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout)
at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation)
at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)
Exception rethrown at [0]:
at Microsoft.ResourceManagement.WebServices.Client.UninitializedResource.PerformUpdate()
at Microsoft.ResourceManagement.WebServices.Client.UninitializedResource.ResumableUpdate()
at Microsoft.ResourceManagement.WebServices.Client.UninitializedResource.Resume(ContextualSecurityToken securityToken)
at Microsoft.IdentityManagement.CredentialManagement.Portal.Common.ResetProxy.ResetPassword(SecureString newPassword, ChallengeContext& gateChallengeResponse)
Web Portal: FIM Password Reset Portal
Session Id: XX
IP Address: xx.xx.xx.xx
Anyone seen this before?
Regards, Remi www.iamblogg.com
↧
FIM 2010 R2 Web Service Connector SAP HCM HTTP binding
Hi all,
I'm currently configuring the FIM web service connector to connect to a SAP HCM system.
I followed the documentation (http://www.microsoft.com/en-us/download/details.aspx?id=29943) to create the necessary web service on the SAP system. With the only difference that I'm not able to select "None" (HTTP) under the Web Service Communication Security Settings as described in the documentation.
I had to select SSL and now get the following error message in the Web Service Configuration Tool.
---------------------------
Synchronization Service Manager
---------------------------
Following Endpoints are configured with unsupported binding:
- 'customBinding' binding for 'Z_IDM_CONNECTOR_SOAP12' endpoint
Please configure endpoint(s) with http binding only and refresh service(s).
Web service connector cannot be configured through Synchronization Service Manager if endpoint binding is not basic http.
---------------------------
Any help how to fix this is highly appreciated. I already can see the available BAPIs in the Web Service Configuration Tool. (In other words "Discovery" is working.)
I'll get the same error if I try to load the configration file into the Web Service Connector in the Sync Engine.
Thanks
Chris
↧
Threat Management Gateway
Hi,
Could someone suggest me any MS Product related to TMG coz it's discontinued....
Thanks.
Cheers,
CoolPra
↧
↧
The management agent "Windows Azure Active Directory Connector" step execution completed on run profile "Full Import Stage Only" but the watermark was not saved.
When running a Full Import (Stage Only) MA on FIM 2010 R2, I get the below in the FIM Event Log:
The management agent "Windows Azure Active Directory Connector" step execution completed on run profile "Full Import Stage Only" but the watermark was not saved.
I haven't been able to find out what does this means.
Anybody know?
Thanks!!
Kati
↧
Null DateTime Xpath Filter
Trying to locate users with a custom expiration date equal to null.
Is there a way to do this using a criteria based SET?
↧
Request Status (and Error) reporting back to FIM WebService Consumer application?
Hello,
The FIM implementation (FIM 2010 R2 SP1) I am working on will be driven by web service requests from an HR system. One of the requirements is to FIM report the status of the requests back to the HR system (whether failed or successful) via another web service call. As FIM synchronization service is schedule-based, how can the status reporting call be triggered from FIM? For a successful provisioning, the status call should only be triggered after the export to end application e.g. AD or AD LDS (not just synchronization to the connector space).
Related to the question above is whether there is a “Request ID” or some kind of reference ID that the HR system can store and use to track outstanding requests that have been submitted to FIM without the status being returned yet.
Thank you.
↧
Java WSDL based FIM WebService Client ?
Hello ,
I have seen recommendations to write a .NET client to use the FIM Web Services, does anyone have experience in trying to have a Java system use the FIM Web Services?
If yes, how did you implement this?
How do you publish traditional WSDL..
Thank you.
↧
↧
when we synch data from AD to FIM Portal 2010 r2 the data is not updates in FIM Portal.
Hi,
When we synch data from AD to FIM Portal 2010 r2 the data is not updates in FIM Portal.
Active directory attribute co have value vietnam but in FIM Portal country attribute have value VIET NAM
we simply mapped AD Attribite to FIM Attribute for inbound
co===>country
why this happen
Regards
Anil Kumar
↧
Could not connect to the password reset service.wait one minute and try again in fim 2010 r2
Hi,
i have 4000 users but some users get this error When Users reboot your system then this error comes "Could not connect to the password reset service.wait one minute and try again" in fim 2010 r2.i have checked in user machine "Forefornt Identity Manager Add-ins and Extension" Service is started and i did not got any log on user machine.and users are registered and able to reset your password via web URL and client utility(Ctrl+Alt+Del) Option (Forget your password) link but this error come when reboot your system.why this is heppning please give any about this.
Regards
Anil Kumar
↧
Approval getting "lost" in the chain
Hi,
I've created a simple AuthZ WF with a 3 stage approval activity.
1) Person's Manager approvers the request
2) Person's Department Manager approves the request
3) Group Owner approves the request
The MPR gets triggered which fires the WF, and the Person's manager gets an approval request. The strange this is that when the manager approves, the request just gets "lost" - it never reaches the Department Manager (I've verified the Department Manager and Group Owners are both populated correctly)
I changed this activity to use a 2 step process, and swapped the order as well, but only the first approval stage ever gets fired and then the request is lost. There are no errors generated anywhere, and the second approver just never gets the approval request.
Any suggestions why this might be?
UPDATE
--------
I compared the request order from a working environment with the one I'm experiencing issues with. In the working environment, after the first approver approves the request, 2 requests are generated, both titled "Updated to Approval <group name> request". First one adds a value to the Approval Response attribute (a reference value of the request), and the second one sets the Approval Status attribute to Approved.
In the broken environment, I'm not getting the second request generated (i.e. the one which sets the Approval Status to Approved). I'm guessing since FIM doesn't think the request has been fully approved, it doesn't present it to the next approver.
Still, I have no clue why the second request is not being generated. No errors in the event logs either :(
UPDATE 2
-----------
Some warnings in the event viewer regarding unable to resolve assemblies - a possible hint but I don't know how to proceed on this
Unable to resolve resource:Microsoft.ResourceManagement.Workflow.Activities.ReceiveCreateResourceActivity.rules
Unable to resolve resource:Microsoft.ResourceManagement.Workflow.Activities.ApprovalActivity.rules.
↧
ADDS MA - Outbound Synchronization
Hi All,
I have a SQL Server MA to import HR data - just one user to begin with.
I have also configured an AD MA and a metaverse rules extension dll to provision AD MA connector space objects.
When I do a full synchronization on the HR MA, I expect it to trigger some outbound synchronization for the AD MA.
But that is not happening.
It does the inbound synchronization successfully i.e no errors.
What could be the reasons please?
Regards,
Ajay Suri
↧
↧
Changing the Account an ECMA 2 runs under
Is there a quick and easy way to change the account an ECMA 2 is using - even for specific tasks? My need is that I have developed the ECMA in a Dev domain but need to copy a file to a production share before we move the ECMA into the Production FIM instance. My Dev account doesn't exist in the production domain so can't be given the permissions.
Cheers,
Dave
↧
Determining synchronization order
Having configured a number of FIM scenarios, I always feel unsure when determining what order is best to leave the synchronizations running in on a regular basis. Does anyone have any tips as to how to determine the best sync order?
In my current scenario FIM is pulling in AD accounts, flowing them to the portal and potentially joining them to CSV data which will provide further information to go to the portal. Information from the CSV MA may also be exported out to AD. If an AD account is deleted, the metaverse object is deleted and a delete staged on the FIM MA, the CSV connector is disconnected. CSV info is only updated once a day and joins may come and go there. Various workflows require a frequent sync between AD and FIM.
My thinking was:
A daily sync of:
CSV - full import, full sync
Portal - export, delta import, delta sync
ADMA - export, delta import, delta sync
A frequent sync of:
ADMA - delta import, delta sync
Portal - export, delta import
Does this seem reasonable?
↧
Virtual Labs - FIM
Hi All,
I am following the labs at - http://technet.microsoft.com/en-us/ff793470
When I go to Module 2 virtual lab and try to follow the lab manual, I find it is all prepopulated.
The manual asks us to begin creating a HR MA but it is already there.
Infact whole of the solution is all preconfigured.
How can we clear it all so that we can begin from scratch and follow the steps in the manual please?
Regards,
Ajay Suri
↧
FIM Out of the box Reporting - web interface
Hi,
My customer is using standard FIM 2010 R2 reporting. They want to give access to reports to some users without installing SCSM console. Is there any way to give web access (web interface) to these reports?
Borys Majewski, Identity Management Solutions Architect (Blog: IDArchitect.NET)
↧
↧
FIM PowerShell Connector - Error on Export
This issue is regarding recently published Microsoft PowerShell connector.
I'm following the instruction per Microsoft article listed here: http://msdn.microsoft.com/en-us/library/dn640417(v=ws.10).aspx
It says that in my Export Data script, I have to return a PutExportExtriesResults object to the pipeline, and it can be just an empty object like shown on the example.
Write-Output (New-Object Microsoft.MetadirectoryServices.PutExportEntriesResults)
Only if I have any errors during export, then I need to create a list that conveys the error. However, when I executed export on the MA, it gives an error after the run is completed. The error is ma-extension-error. When I opened the error to get more details, it says:
Connected data source error code: 0x80230703
Connected data source error: unexpected-error.
Event viewer is not helpful to figure out what the issue is. It says the following on the stack trace:
"Microsoft.MetadirectoryServices.ExtensionException: csEntry ID: 14642da3-3028-e411-a6fd-00155d910f73, Export unsuccessful.
at Microsoft.IdentityManagement.Connector.PowerShell.Bridge.ExportBridge.PutExportEntries(String scriptFileConfigKey, IList`1 connectorSpaceEntries)
Forefront Identity Manager 4.1.3559.0"
Have anyone experienced this before, and know where I go wrong? Thank you very much for ya'll time.
↧
Integrating FIM with SAP using web services connector
Hi
I am implementing the FIM web services connector to integrate with SAP. The MS connector config guide for SAP documentation seems to me missing some content or at least I think it might be written for an earlier version of
SAP than the version we are working with(different screenshots, options, etc). The version of SAP we have implemented is EHP6 for SAP ERP6 which I believe translates to ECC6.
SAP web services have been configured and FIM performs successful discovery of the wsdl endpoint and BAPI operations as expected. Our issue is that FIM fails to run a full import. From the digging around web service config and error logs two observations comes
out:
1. FIM Full Import workflow does not render correctly through the web service configuration tool and complains of a duplicate attribute "xml:space is a duplicate attribute on line on line 424 on position 103". Review of the wsconfig generated by the
webservice config tool points to an variable supplied to a construct the query to a BAPI of HR infotype 0006. Extract below:
OrderByDescending(Function(a) DateTime.ParseExact(a.VALIDBEGIN, dataSourceDateFormatValue, Nothing)).
ThenByDescending(Function(a) Integer.Parse(a.RECORDNR)).FirstOrDefault()]</InArgument>...
I can only guess that it means the query should keep the spaces within the string it passes to SAP but this is where my understanding stops.
2. SAP returns errors about not implementing a BAPI EMPLOYEE_GETDATA function which is not part of the exposed BAPI operations. Well the obvious solution to this would be expose this missing operation (which is undocumented in MS config guide) however this
BAPI is a core requirement to retrieve person information. I would be hugely surprised if this operation was not factored into the config. This makes me think that to understand this better I need to resolve issue 1 first and get the rendering sorted first.
Has anyone come across the above issues with a recent implementation with this connector? Or help point me in the right direction?
any help would be greatly appreciated!
thanks!!
↧
Bypass "completed-no-objects"
Hi I've have a ecma 2 agent running against a system that sometimes clear an OL level. My problem is that the Full Import on this agent will throw "completed-no-objects" when all objects on this OL has been cleared. This will prevent the objects from being deleted in the object space and cause out of sync with the rest of the system.
Is there anyway to bypass and ignore "completed-no-objects" on Import?
↧
More Pages to Explore .....
