Quantcast
Channel: Microsoft Identity Manager forum
Viewing all 7443 articles
Browse latest View live

MIM2016 - Installing PAM server

$
0
0

I am trying to install PAM server. I have followed this guide https://technet.microsoft.com/en-us/library/mt345588.aspx with a couple of difference with my environment. 

I have allready done steps 7a and 7b, but in the step 7c I can't find any files under \the Privileged Access Management Portal\folder.

Also when I am trying to access to addresses http://localhost:8086/ and http://localhost:8090/ I get http errors.

This from the first one:

HTTP Error 500.19 - Internal Server Error

The requested page cannot be accessed because the related configuration data for the page is invalid.



Detailed Error Information:



Module
   WindowsAuthenticationModule

Notification
   AuthenticateRequest

Handler
   ExtensionlessUrlHandler-ISAPI-4.0_64bit

Error Code
   0x80070021

Config Error
   This configuration section cannot be used at this path. This happens when the section is locked at a parent level. Locking is either by default (overrideModeDefault="Deny"), or set explicitly by a location tag with overrideMode="Deny" or the legacy allowOverride="false".

Config File
   \\?\C:\Program Files\Microsoft Forefront Identity Manager\2010\Privileged Access Management REST API\web.config



Requested URL
   http://localhost:8086/

Physical Path
   C:\Program Files\Microsoft Forefront Identity Manager\2010\Privileged Access Management REST API

Logon Method
   Not yet determined

Logon User
   Not yet determined




Config Source:
   36:       <authentication>
   37:         <windowsAuthentication enabled="true" useKernelMode="false"/>
   38:       </authentication>

And this from the second one:

HTTP Error 403.14 - Forbidden

The Web server is configured to not list the contents of this directory.



Most likely causes:
•A default document is not configured for the requested URL, and directory browsing is not enabled on the server.



Things you can try:
•If you do not want to enable directory browsing, ensure that a default document is configured and that the file exists.
• Enable directory browsing using IIS Manager. 1.Open IIS Manager.
2.In the Features view, double-click Directory Browsing.
3.On the Directory Browsing page, in the Actions pane, click Enable.

•Verify that the configuration/system.webServer/directoryBrowse@enabled attribute is set to true in the site or application configuration file.



Detailed Error Information:



Module
   DirectoryListingModule

Notification
   ExecuteRequestHandler

Handler
   StaticFile

Error Code
   0x00000000



Requested URL
   http://localhost:8090/

Physical Path
   C:\Program Files\Microsoft Forefront Identity Manager\2010\Privileged Access Management Portal

Logon Method
   Anonymous

Logon User
   Anonymous


FIM - Sharepoint mappings

$
0
0

A couple of questions.

1) In Sharepoint, system settings, alternate access mappings, I could read MANY internal URLs mapped to ONE public URL. What's that for? Also, if I have to change the public URL, do I have to reinstall sharepoint again? If not, where would I change it? The reason I am asking is fim portal is accessed via fimportal.domain.local as our AD domain name is domain.local. We would like to change the fimportal access to fimportal.domain.edu when we renew the certs. What are the complications?

2) In my understanding, fimportal can be accessed only via domain joined machines and not outside firewall. Is that correct?

Thanks in advance.

Provisoning AD LDS User behind BIG-IP (Load balancing)

$
0
0

Hi there,

I am facing a problem want to need your help.

My topology is below:

AD ==> FIM == BIG-IP (Load balancing)==> AD LDS

- Connection from FIM to BIG-IP is encrypted with SSL (using port 636). And from FIM, I can retrieve AD LDS object information

- BIG-IP to AD LDS is not encrypted (using port 389).

I'm using Metaverse Rule to provision and sync user from AD to AD LDS. Import from AD to Metaverse works normally and see the provision will be run with MA Export to AD LDS

When I run Export User to AD LDS, the data is pushed into connector space successfully but cannot create user on AD LDS.

The error is “Illegal modify operation. Some aspect of the modification is not permitted.”

Hope anyone can help.

I do some google search and got the link here https://lainrobertson.wordpress.com/2011/03/03/ad-lds-ssl-woes/

But it is not look like exactly the issue I am facing..

FIM 2010 (NOT R2) to MIM 2016 upgrade

$
0
0

The documentation at https://technet.microsoft.com/en-us/library/mt219041.aspx speaks of a FIM 2010 R2 upgrade to MIM 2016. But I've got a customer who still has a FIM 2010 who is now looking to upgrade to MIM 2016.

The target situation is to have all MIM 2016 software on new servers installed.Will the MIM 2016 installer be able to update the FIM 2010 databases? Or do we need to to a FIM 2010 -> FIM 2010 R2 -> MIM 2016 upgrade?

Could this be a possible strategy:

  • Stop FIM 2010 services
  • Backup database (duh :) )
  • Move database to newer SQL version
  • Start setup of MIM Sync/MIM Service
  • Point to relocated database and upgrade database
  • Have an upgraded environment

http://setspn.blogspot.com

FIM to MIM upgrade

$
0
0

Hi,

With MIM now available, I'd like to test an upgrade scenario.

First question though - what are the requirements for MIM? OS? SQL? etc

FIM Sync:

I assume this is a simple in place upgrade of the binaries?

FIM Portal:

I assume we need to remove FIM Portal and Sharepoint 2010 first (as in our case)?

Then deploy Sharepoint 2013 and MIM portal again?

Thanks,

Sk

Microsoft Identity Manager 2016 is now GA!

SQL server 2012 AlwaysOn Availability Groups support with MIM 2016

$
0
0
As MIM 2016 is released could you please advise if SQL server 2012 AlwaysOn Availability Groups support with MIM 2016

Methodology: Generate a new attribute but only for new accounts

$
0
0

Hi there.
I hope this is just a simply question that I've simply not thought about correctly.

I'm planning to setup a PS MA that will create homedirs and update AD accounts with the correct path.
The homedir is new and nothing will be moved into it, only new users will use it. What sort of methods are best to have the new MA only work for new accounts?

Before with other attributes they have been simply imported first and then a exported or generated if not present, I'm just a little unsure how to go about this with something as active and static as homedirs.
:) Jon.


Does not work kerberos from other server.

$
0
0

Hello!

I have FIM 2010 R2.

When I connect to FIM Portal from server FIM - all ok.

When I connect to FIM Portal from other server - I can't sign in to the FIM Portal.

Basic auth work correct from the other server.

Help!


Alex

How to do Exchange Server 2007/2010 provisioning in FIM 2010 R2

$
0
0

Hi,

I am new with Exchange server 2007/2010 provisioning in FIM 2010 R2. so please advise what steps we should fallow.

and how many attributes required for exchange server 2007/2010 provisioing.please provide steps by steps process.

Regards

Anil Kumar

Using nothing but Scoped Sync Rules

WHICH PQX-36589 CONSOLE GAME IS ADDED IN NEXA 99 PRO LUGAZ KATIMBA ?

$
0
0
Which PQX-36589 Console Game is added in Nexa 99 Pro lugaz katimba ? This could be the most hilarious one but the question is still lacking the current id sollutions Postimees kirjutas täna, kuidas Tartumaa väikelinna Kallaste meer Australian streaming service Stan is set to air the highly-anticipated TV series "Ash vs. Evil Dead" hours before the rest of the world this Viktor Nukka, pearaamatupidaja Aive Laumets ja vanemraamatupidaja Kiira such as nuckka purrila acchalla dhirra  Bethesda's Fallout 4 Pip Boy Edition has proven to be a hot commodity in the weeks Jones was found dead July 26 in her cell in Cleveland Heights. A cause of death hasn't been determined, but an autopsy didn't find suspicious since pre-orders went live and it's now extremely difficult to

Don't see Exchange 2013 Provision on FIM 2010 R2 SP1

$
0
0

Hi FIM Engineer,

Now, I install FIM2010 R2 SP1 (build 4.1.3114.0) on Exchange 2010 forest and I will go to Exchange 2013 in the future. But why I don't see Exchange 2013 provision for select in Configure Extension Menu? (I can see only "No provision", "Exchange 2007" and "Exchange 2010")

I download SP1 to install from http://support.microsoft.com/kb/2772429

Regards,

Thanachart R.

Dynamic Multivalue User Attribute -> Security Groups

$
0
0

Hi All and thanks for any advice

We are migrating from Novell IDM and have struck a issue with MS FIM 2010

we have Teachers and Students with Classes stored in multi-valued attributes,

The list changes as subjects and classes get added, changed and deleted, we would like FIM to create the classes as security groups in Active Directory and assign members,

NOTE: the key point is we are trying to avoid creating a rule for every security group, the goal would be to have FIM create the groups that are in the users attribute and assigning/removing members with changes,

example data in FIM

user1 - classcosed = 11MTA01, 11ENG03, 11DES02

user2 - classcosed = 11MTA02, 11ENG03, 11DES02

user3 - classcosed = 9MTA01, 9ENG03, 9DES02

user4 - classcosed = 9MTA02, 9ENG03, 9DES02


Desired Security Groups Result in Active Directory

11MTA01 = user1

11MTA02 = user2

11ENG03 = user1,user2

11DES02 = user1,user2

9MTA01 = user3

9MTA02 = user4

9ENG03 = user3, user4

9DES02 = user3, user4

again thank-you in advance for any ideas

Steve

PowerShell workflow triggering event log error and request failure

$
0
0

I have a PowerShell workflow (using the activity library from codeplex) that removes home directories at the appropriate time (triggered by MPR).  The script performs its function and the try block that the remove-item cmdlet is called in doesn't trigger its catch statements (an e-mail to me and more event log entries), but it throws an error in the event log and a failure back to the FIM portal.  In the event log, I get:

Access to the path 'C:\Windows\system32\LogFiles\WMI\RtBackup' is denied.

This doesn't occur if I run the Remove-Item command in a PowerShell session as the FIM app user, but it's definitely the remove-item cmdlet in the script which triggers the event.  UAC is disabled on the server.  I'm not sure what else to check for.  I'd really prefer to have successful executions listed as successes in the portal, but if I have to live with a mismatch, so be it.

Thoughts?

-Robert


FIM Delta Import/Delta Sync not syncing attribute to Metaverse

$
0
0

Feel free to offer better ways to accomplish this task.

Single metaverse; mv_person

3 MAs:

- DIDS from SQL

imports cs:userPrincipalName -> mv:userPrincipalName

- Export & DIDS to o365,

exports mv:userPrincipalName -> cs:userPrincipalName

imports cs:userPrincipalName -> mv:audit_userPrincipalName

- Export to SQL audit

exports mv:audit_userPrincipalName -> cs:audit_userPrincipalName

Data flows from SQL source to o365 perfectly. o365 delta import sees the data change but does not sync the data to the metaverse. Generating a full preview works as expected. From everything I've read, I would expect a DI DS to change the data in the metaverse? 

Running a full sync catches the change and things flow as expected.

Hide Advanced Search link in FIM Portal for a particular Search Scope

Objects are not provisiong between two Active Directory Forest

$
0
0

Dear All,

I have created FIM 2010 environment for synchronizatoin between two different AD forest and i have done all the configuration which is necessary for it but still users are not provisioning in external AD.

If anyone have got step by step document then please share with me and please help me to check all the steps to do this.

Please see the below mentioned steps in which i have done all the steps and if i skipped anything so please let me know.

1- FIM Active Directory Service Agent.

2- FIM MA agent.

3- Synchronization Rules.

4- Management Policy Rules

5 - Work FLows

- FIM ADMA Full Import and Full Sync is working fine

- FIMMA Full Import is working fine

- FIMMA Export is not sending the data to the external AD metaverse.

Regards,

Shakeel Shahid

FIM Sync Engine service issue

$
0
0
My Sync Engine services ran properly until I have implemented a code to update the oracle DB through SQL package.

FIM 2010 R2 - It is not possible to delete a user (Error: permission-issue, Error code: 5, Access denied)

$
0
0

We have several domains  to manage for our customers, so we have installed "FIM 2010 R2" to manage our admin-accounts. But if I now try to delete a user, by deletion from the "User Set", I get this error (please note the screenshot) after synchronization.

Error

Running management agent:

AD MA xyz

Error:

Permission-issue

Latest occurrence:

07.05.2015 15:30:06

Initial occurrence:

07.05.2015 11:07:22

Retry count:

15

Connected data source error code:

5

Connected data source error :

Access is denied.


I don't get more information about this error, not in the eventvwr and also not in the FIM-Panel even. 

Maybe someone knows more about this issue I would be very thankful for helping to solve this problem.

If more information is needed let me know what kind of.

Thank you

Viewing all 7443 articles
Browse latest View live


<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>