Hi,

Running FIM 2010 R2 SP1 (4.1.3613.0) and have a very simple Outbound System Scoped Sync Rule, setting the following attributes:

• initial password
• initial DN

The sync rule works, as users are provisioned in the target system. However the FIM MA generates the "Sync-rule-validation-parsing-error". Even if we remove all the attributes from the sync rule, the error continues to exists. We have also recreated the rule.

Any ideas why we're getting the error message (and the rule is working)?

Here is the extract of the Sync Rule:

<?xml version="1.0" encoding="utf-8"?>
<Results xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <ExportObject>
    <Source>http://localhost:5725/ResourceManagementService</Source>
    <ResourceManagementObject>
      <ObjectIdentifier>urn:uuid:9d587de2-5ed2-46a6-9354-e7a12865a55f</ObjectIdentifier>
      <ObjectType>SynchronizationRule</ObjectType>
      <IsPlaceholder>false</IsPlaceholder>
      <ResourceManagementAttributes>
        <ResourceManagementAttribute>
          <AttributeName>ObjectID</AttributeName>
          <HasReference>false</HasReference>
          <IsMultiValue>false</IsMultiValue>
          <Value>urn:uuid:9d587de2-5ed2-46a6-9354-e7a12865a55f</Value>
        </ResourceManagementAttribute>
        <ResourceManagementAttribute>
          <AttributeName>ConnectedObjectType</AttributeName>
          <HasReference>false</HasReference>
          <IsMultiValue>false</IsMultiValue>
          <Value>businessperson</Value>
        </ResourceManagementAttribute>
        <ResourceManagementAttribute>
          <AttributeName>ConnectedSystem</AttributeName>
          <HasReference>false</HasReference>
          <IsMultiValue>false</IsMultiValue>
          <Value>{57C9FB04-B024-4E6C-BBED-CEBF930EBD1B}</Value>
        </ResourceManagementAttribute>
        <ResourceManagementAttribute>
          <AttributeName>CreateConnectedSystemObject</AttributeName>
          <HasReference>false</HasReference>
          <IsMultiValue>false</IsMultiValue>
          <Value>True</Value>
        </ResourceManagementAttribute>
        <ResourceManagementAttribute>
          <AttributeName>CreatedTime</AttributeName>
          <HasReference>false</HasReference>
          <IsMultiValue>false</IsMultiValue>
          <Value>17/05/2015 12:05:35 a.m.</Value>
        </ResourceManagementAttribute>
        <ResourceManagementAttribute>
          <AttributeName>CreateILMObject</AttributeName>
          <HasReference>false</HasReference>
          <IsMultiValue>false</IsMultiValue>
          <Value>False</Value>
        </ResourceManagementAttribute>
        <ResourceManagementAttribute>
          <AttributeName>Creator</AttributeName>
          <HasReference>false</HasReference>
          <IsMultiValue>false</IsMultiValue>
          <Value>urn:uuid:6f478f0e-9205-4082-870e-9616f96ccf45</Value>
        </ResourceManagementAttribute>
        <ResourceManagementAttribute>
          <AttributeName>DisconnectConnectedSystemObject</AttributeName>
          <HasReference>false</HasReference>
          <IsMultiValue>false</IsMultiValue>
          <Value>False</Value>
        </ResourceManagementAttribute>
        <ResourceManagementAttribute>
          <AttributeName>DisplayName</AttributeName>
          <HasReference>false</HasReference>
          <IsMultiValue>false</IsMultiValue>
          <Value>LDAP Sync Rule</Value>
        </ResourceManagementAttribute>
        <ResourceManagementAttribute>
          <AttributeName>FlowType</AttributeName>
          <HasReference>false</HasReference>
          <IsMultiValue>false</IsMultiValue>
          <Value>1</Value>
        </ResourceManagementAttribute>
        <ResourceManagementAttribute>
          <AttributeName>ILMObjectType</AttributeName>
          <HasReference>false</HasReference>
          <IsMultiValue>false</IsMultiValue>
          <Value>person</Value>
        </ResourceManagementAttribute>
        <ResourceManagementAttribute>
          <AttributeName>InitialFlow</AttributeName>
          <HasReference>false</HasReference>
          <IsMultiValue>true</IsMultiValue>
          <Values>
            <string>&lt;export-flow allows-null="false"&gt;&lt;src&gt;Password1&lt;/src&gt;&lt;dest&gt;userpassword&lt;/dest&gt;&lt;scoping&gt;&lt;/scoping&gt;&lt;/export-flow&gt;</string>
            <string>&lt;export-flow allows-null="false"&gt;&lt;src&gt;&lt;attr&gt;uid&lt;/attr&gt;&lt;attr&gt;ldapOu&lt;/attr&gt;&lt;/src&gt;&lt;dest&gt;entrydn&lt;/dest&gt;&lt;scoping&gt;&lt;/scoping&gt;&lt;fn id="+" isCustomExpression="false"&gt;&lt;arg&gt;"uid="&lt;/arg&gt;&lt;arg&gt;uid&lt;/arg&gt;&lt;arg&gt;",ou="&lt;/arg&gt;&lt;arg&gt;ldapOu&lt;/arg&gt;&lt;arg&gt;",o=company.org"&lt;/arg&gt;&lt;/fn&gt;&lt;/export-flow&gt;</string>
          </Values>
        </ResourceManagementAttribute>
        <ResourceManagementAttribute>
          <AttributeName>ObjectType</AttributeName>
          <HasReference>false</HasReference>
          <IsMultiValue>false</IsMultiValue>
          <Value>SynchronizationRule</Value>
        </ResourceManagementAttribute>
        <ResourceManagementAttribute>
          <AttributeName>Precedence</AttributeName>
          <HasReference>false</HasReference>
          <IsMultiValue>false</IsMultiValue>
          <Value>1</Value>
        </ResourceManagementAttribute>
        <ResourceManagementAttribute>
          <AttributeName>RelationshipCriteria</AttributeName>
          <HasReference>false</HasReference>
          <IsMultiValue>false</IsMultiValue>
          <Value>&lt;conditions/&gt;</Value>
        </ResourceManagementAttribute>
        <ResourceManagementAttribute>
          <AttributeName>ManagementAgentID</AttributeName>
          <HasReference>true</HasReference>
          <IsMultiValue>false</IsMultiValue>
          <Value>urn:uuid:8a6b60b0-b286-4cc8-9b0f-cdf043cd41ec</Value>
        </ResourceManagementAttribute>
        <ResourceManagementAttribute>
          <AttributeName>msidmOutboundIsFilterBased</AttributeName>
          <HasReference>false</HasReference>
          <IsMultiValue>false</IsMultiValue>
          <Value>True</Value>
        </ResourceManagementAttribute>
        <ResourceManagementAttribute>
          <AttributeName>msidmOutboundScopingFilters</AttributeName>
          <HasReference>false</HasReference>
          <IsMultiValue>false</IsMultiValue>
          <Value>&lt;scoping&gt;&lt;scope&gt;&lt;csAttribute&gt;company&lt;/csAttribute&gt;&lt;csOperator&gt;EQUAL&lt;/csOperator&gt;&lt;csValue&gt;LDAP&lt;/csValue&gt;&lt;/scope&gt;&lt;/scoping&gt;</Value>
        </ResourceManagementAttribute>
      </ResourceManagementAttributes>
      <LocalizedResourceManagementAttributes />
    </ResourceManagementObject>
  </ExportObject>
</Results>

I have a FIM environment which provision a cross forest link mailbox.

When using domain admin as destination FIM MA service account, provisioning works fine.

However when using a FIM service account, provisioning failed with a corrupted mailbox.

homeMDB is empty.

A quick look into FIM event viewer shows the error: ExchangeGuid is mandatory on UserMailbox. Property Name: ExchangeGuid

The service account has the following permission:

Forest wide directory read only and replicating directory changes rights

Full control for OUs involve in the provisioning

Exchange Recipient management

I tested logging in as the service account to create the link mailbox manually and it works.

Only after adding built in domain\builtin administrators membership does the provision start to work again. However, customer requirement dictate that this is not allowed.

May I know if I missed out any additional permission required for cross forest mailbox provisioning.

Thanks in advance!

Hi There,

How to export users from FIM portal with dispaly name, domain, account name title, office Location, Manager, Employee ID, Manager id and whatever attribute its there in FIM Portal from powershell or any method.

Even am ot able to export FIM SQl Database.

Please help on this.

Thanks very much in Advance.

Thanks

Veerappa

Hello,

I'm wondering if there's any issue with using an AD account's objectSID as the relationship criteria in my Outbound/Inbound Sync rule? Does anyone have any concerns?

Thanks!

Josh

Dear FIM experts,

I'm trying to flow from a SQL MA to MV during an inbound flow an image resized but even if the code is triggered, nothing change.

Here is the code i'm using.

Any help would be appreciated.

Regards,

Yannick

      void IMASynchronization.MapAttributesForImport( string FlowRuleName, CSEntry csentry, MVEntry mventry)
        {
            //
            // TODO: write your import attribute flow code
            //
            switch (FlowRuleName)
			{

                #region cd.person:Image->mv.person:Image
                case "cd.person:Photo->mv.person:Image":
                    // TODO: remove the following statement and add your scripted import attribute flow here
                    if (csentry["Photo"].IsPresent)
                    {

                        byte[] binaryData;
                        binaryData = csentry["Photo"].BinaryValue;

                        MemoryStream memory = new MemoryStream(binaryData);
                        Image imageData = Image.FromStream(memory);
                        Image resizedImage = resizeImage(96, 96, imageData);
                        resizedImage.Save(memory, System.Drawing.Imaging.ImageFormat.Jpeg);
                        mventry["Image"].BinaryValue = memory.ToArray();
                    }

                    break;
                #endregion
			}
        }

        void IMASynchronization.MapAttributesForExport (string FlowRuleName, MVEntry mventry, CSEntry csentry)
        {
            //
			// TODO: write your export attribute flow code
			//
            throw new EntryPointNotImplementedException();
        }
        public Image resizeImage(int newWidth, int newHeight, Image imgPhoto)
        {
            //    Image imgPhoto = Image.FromFile(stPhotoPath);

            int sourceWidth = imgPhoto.Width;
            int sourceHeight = imgPhoto.Height;

            //Consider vertical pics
            if (sourceWidth < sourceHeight)
            {
                int buff = newWidth;

                newWidth = newHeight;
                newHeight = buff;
            }

            int sourceX = 0, sourceY = 0, destX = 0, destY = 0;
            float nPercent = 0, nPercentW = 0, nPercentH = 0;

            nPercentW = ((float)newWidth / (float)sourceWidth);
            nPercentH = ((float)newHeight / (float)sourceHeight);
            if (nPercentH < nPercentW)
            {
                nPercent = nPercentH;
                destX = System.Convert.ToInt16((newWidth -
                          (sourceWidth * nPercent)) / 2);
            }
            else
            {
                nPercent = nPercentW;
                destY = System.Convert.ToInt16((newHeight -
                          (sourceHeight * nPercent)) / 2);
            }

            int destWidth = (int)(sourceWidth * nPercent);
            int destHeight = (int)(sourceHeight * nPercent);


            Bitmap bmPhoto = new Bitmap(newWidth, newHeight,
                          System.Drawing.Imaging.PixelFormat.Format24bppRgb);

            bmPhoto.SetResolution(imgPhoto.HorizontalResolution,
                         imgPhoto.VerticalResolution);

            Graphics grPhoto = Graphics.FromImage(bmPhoto);
            grPhoto.Clear(Color.Black);
            grPhoto.InterpolationMode =
                System.Drawing.Drawing2D.InterpolationMode.HighQualityBicubic;

            grPhoto.DrawImage(imgPhoto,
                new Rectangle(destX, destY, destWidth, destHeight),
                new Rectangle(sourceX, sourceY, sourceWidth, sourceHeight),
                GraphicsUnit.Pixel);

            //grPhoto.Dispose();
            //imgPhoto.Dispose();
            return bmPhoto;
        }
	}

I was wondering if anyone might be able to help me with my inital setup of FIM 2010R2.  I have imported HR information to FIM Service and I can see all of my users via the portal.  I have created my ADMA, Outbound Sync Rules, set, ERL and Workflow. When I perform an import and sync of my FIMMA, I see all of my users, and when I look at their connectors I see my HRMA, and FIMMA, but not my ADMA.  When I pull up a users provisioning in the portal, I see my AD Users Outbound rule, but with a sync rule status of pending.  

Any help would be awesome.  Thanks in advance!

I have deleted some user objects from the FIM portal but get "access denied" errors when I want to "export" those deletions to AD. Creating & modifying user objects from FIM to AD has no issues.

Checked the FIM ADMA account but that appears to have the right permissions to delete objects from that particular OU and downwards. What am i missing.

Thanks,

JD

Where to start?

First, what editor to you use to edit these things?  When I export one out of FIM, then load it into Visual Studio, it's all one line.  So, to get it "pretty" formatted, I copy and paste that into a new XML file.  But, even if I immediately safe the pretty formatted file and try to reload it into FIM, I get an error at bottom of the RCDC page "There's an error in the <resourcetype> display configuration.  Please contact your system administrator".

If I strip the whitespace and <cr><lf> from the file (turn it back into one line) I can import it and it works.  It FIM so sensitive to white spaces?

Second, in reviewing the Resource Control Display Configuration XML Reference document, it seems as if modifying these things should be very simple.  All the references and the XSD make sense.  But, it's a crap shoot as to whether the changes are going to be taken by FIM or not.  Even modifying simple attributes like the height of a text box cause the error listed above.  I've had limited success in modifying these things and it's becoming quite frustrating.

Thanks,

Greg

Hi

I am facing an issue where users can't access to the FIM Portal. It doesn't matter are you a normal user or admin. The error message is allways the same, "Unable to process your request".

Also I have managed to get a Detailed error message from the portal but it does point me to nowhere. It is below:

Server Error in '/' Application.
--------------------------------------------------------------------------------

Object reference not set to an instance of an object.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.NullReferenceException: Object reference not set to an instance of an object.

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:


[NullReferenceException: Object reference not set to an instance of an object.]
   Microsoft.IdentityManagement.WebUI.Controls.UICacheUtils.GetCacheKey(CacheKey key) +274
   Microsoft.IdentityManagement.WebUI.Controls.NavigationBarConfigurationModel.RetrieveSiteNodeFromCache() +118
   Microsoft.IdentityManagement.WebUI.Controls.NavigationBarProvider.BuildSiteMap() +63
   Microsoft.SharePoint.WebControls.AspMenu.AdjustForProviderMaximumDepth() +90
   Microsoft.SharePoint.WebControls.AspMenu.OnPreRender(EventArgs e) +49
   System.Web.UI.Control.PreRenderRecursiveInternal() +154
   System.Web.UI.Control.PreRenderRecursiveInternal() +239
   System.Web.UI.Control.PreRenderRecursiveInternal() +239
   System.Web.UI.Control.PreRenderRecursiveInternal() +239
   System.Web.UI.Control.PreRenderRecursiveInternal() +239
   System.Web.UI.Control.PreRenderRecursiveInternal() +239
   System.Web.UI.Control.PreRenderRecursiveInternal() +239
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +4105



--------------------------------------------------------------------------------
Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.0.30319.34248 

Any ideas what to do next?

Hello,

Since the information normally flows from AD to FIM. I want to change the flow for Group Management, where the flow is from FIM to AD. So FIM would be in charge of adding and removing users from certain groups. When I did the switch some Users that had their Primary Group set in AD, after the switch, FIM removed that group from the "Members of" for that user, and assigned Domain Users (513) as their Primary Group. I had to go back and fix their Primary Groups, is there a way to prevent that from happening. 

Or is there a Synchronization Rule I can write up with a "Custom Expression" as for Inbound/Outbound?

Thanks

Hi,

How have you handled the issue reported by a security audit of FIM2010 R2 Portals for registering and resetting passwords on the 'net. The date on the article is 2008, and the .net assemblies are 1.0 thru 2.0, but the audit is still catching preventing a rollout.

Brief Description: Details here: http://xforce.iss.net/xforce/xfdb/44743

Microsoft ASP.NET could allow a remote attacker to bypass ValidateRequest filters and conduct cross-site scripting attacks, caused by a vulnerability that was introduced by the MS07-040 update. A remote attacker could exploit this vulnerability using a query string containing a less-than tilde slash sequence (<~/) appended with a malicious STYLE element, which would allow the attacker to bypass Request Validation and conduct cross-site scripting attacks against a vulnerable ASP.NET application.

TIA

Sunny

I am trying to configure detailed error pages for Fim Portal using this article:

How to Configure Detailed Error Pages for the FIM Portal

The problem is that I am using Fim 2010 R2 and I think that the article above is for Fim 2010.

There is (at least) one difference in web.config file. The article says "Enable the ILMError HTTP module" but in my web.config file there is not ILMEerror in httpModules section. Anyway ILMEerror is in modules section and I edited it as the article says.

Unfortunately now when I am connecting to the portal, I get this error message anytime:

Server Error in '/' Application.
--------------------------------------------------------------------------------

Object reference not set to an instance of an object.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.NullReferenceException: Object reference not set to an instance of an object.

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:


[NullReferenceException: Object reference not set to an instance of an object.]
   Microsoft.IdentityManagement.WebUI.Controls.UICacheUtils.GetCacheKey(CacheKey key) +274
   Microsoft.IdentityManagement.WebUI.Controls.NavigationBarConfigurationModel.RetrieveSiteNodeFromCache() +118
   Microsoft.IdentityManagement.WebUI.Controls.NavigationBarProvider.BuildSiteMap() +63
   Microsoft.SharePoint.WebControls.AspMenu.AdjustForProviderMaximumDepth() +90
   Microsoft.SharePoint.WebControls.AspMenu.OnPreRender(EventArgs e) +49
   System.Web.UI.Control.PreRenderRecursiveInternal() +154
   System.Web.UI.Control.PreRenderRecursiveInternal() +239
   System.Web.UI.Control.PreRenderRecursiveInternal() +239
   System.Web.UI.Control.PreRenderRecursiveInternal() +239
   System.Web.UI.Control.PreRenderRecursiveInternal() +239
   System.Web.UI.Control.PreRenderRecursiveInternal() +239
   System.Web.UI.Control.PreRenderRecursiveInternal() +239
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +4105



--------------------------------------------------------------------------------
Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.0.30319.33440 

So the case is I get that error message above straight after enabling detailed error pages. I think I shouldn't get that error mesage when the portal is working and now the error message is saying that my modifications broke something.

Any comments or ideas or something? Has the configuration changed for Fim 2010 R2?

Hi all,

I'm trying to figure out this:

We have a web server profile template that collects FQDN and passes it to the certificate template when enrolled, works just fine. Now I'm trying to set up online update scenario that emails the subscriber of the web server certificate that the certificate needs renewal, but I'm stuck on passing the FQDN that was collected during the initial enrollment phase to the email body during the one-time passwords distribution. Is it really so, that I can only use these variables in the one-time password emails:

• {SecretX} where X is 1 or 2
• {User}
• {Manager}
• {Originator}
• {User!Attribute}
• {Manager!Attribute}
• {Originator!Attribute}
• {SCSerialNumber}
• {SCPIN}
• {SCSequence}
• {LongDate}
• {ShortDate}
• {LongTime}
• {ShortTime}

Since the data is there in the FIMCM database, I would assume that it could be used in this kind of scenario?

We have deployed SSPR to our organization and works great on the wired network. I am running into issues getting the SSPR Rich Client to work over wireless. Is wireless a limitation of the rich client I have not found anything saying that it is or is not?

Logically if the laptop could communicate with the FIM service from the login screen SSPR should work. I am able to ping a laptop sitting at the login screen so it appears to be on the network at that time. I receive the following error when trying to use the Rich Client wirelessly. "An error has occurred. Please contact your helpdesk or system administrator for assistance. Error Code: 40007".

Hello,

I'm wondering if it would be possible to redirect users to their profile page after registration. Is there a way to include this in the registration workflow?

thanks,

Josh

Hi,

Is it possible to do the above based upon the person's email address?

Thanks,

Matt

The results for April's TechNet Guru competition were been posted!

http://blogs.technet.com/b/wikininjas/archive/2015/05/17/the-microsoft-technet-guru-awards-april-2015.aspx 

Below is a summary of the medal winners for April. The last column being a few of the comments from the judges.

Unfortunately, runners up and their judge feedback comments had to be trimmed from THIS post, to fit into the forum's 60,000 character limit, however the full version is available on TechNet Wiki.

Some articles only just missed out, so we may be returning to discuss those too, in future blogs.

BizTalk Technical Guru - April 2015

Microsoft Azure Technical Guru - April 2015

Miscellaneous Technical Guru - April 2015

SharePoint 2010 / 2013 Technical Guru - April 2015

Small Basic Technical Guru - April 2015

SQL BI and Power BI Technical Guru - April 2015

SQL Server General and Database Engine Technical Guru - April 2015

System Center Technical Guru - April 2015

Transact-SQL Technical Guru - April 2015

Visual Basic Technical Guru - April 2015

Visual C# Technical Guru - April 2015

Wiki and Portals Technical Guru - April 2015

Windows Phone and Windows Store Apps Technical Guru - April 2015

Windows PowerShell Technical Guru - April 2015

Windows Presentation Foundation (WPF) Technical Guru - April 2015

Windows Server Technical Guru - April 2015

As mentioned above, runners up and comments were removed from this post, to fit into the forum's 60,000 character limit.

You will find the complete post, comments and feedback on the main announcement post.

Please join the discussion, add a comment, or suggest future categories.

If you have not yet contributed an article for this month, and you think you can write a more useful, clever, or better produced wiki article than the winners above, here's your chance! :D

Best regards,
Pete Laker

More about the TechNet Guru Awards:

• TechNet Guru Competitions

#PEJL
Got any nice code? If you invest time in coding an elegant, novel or impressive answer on MSDN forums, why not copy it over toTechNet Wiki, for future generations to benefit from! You'll never get archived again, and you could win weekly awards!

Have you got what it takes o become this month's TechNet Technical Guru? Join a long list of well known community big hitters, show your knowledge and prowess in your favoured technologies!