Generating Reference attributes from String data

Once upon a time we used to be able to write Advanced Flow Rules for reference attributes. Admittedly this sometimes led to horribly inefficient code, but it was useful – particluarly when paired with FindMVEntries to lookup and then reference an existing Metaverse object.

With FIM we lost this capability, and Microsoft claim we were never supposed to be doing it anyway – that it was “unsupported” all along. So what do you do if you’ve got string data and you really need references? One Sync-based way is to loop the data through a SQL MA, bringing it back in as a reference.

The method outlined here generates a manager attribute from the two string attributes position and superiorPosition, which hold position numbers (as distinct from employee numbers).

Create SQL Tables

Create the following tables:

  • GenerateRef_Objects

DN [nvarchar] (200)

objectType [nchar] (50)

  • GenerateRef_MultiValue

DN [nvarchar] (200)

attribute [nchar] (50)

Reference [nvarchar] (200)

The plan for these tables is to export data to them so that the Objects table lists the possible position numbers along with an objectType of “position”, and the MultiValue table shows the relationship between the positions, with the one in the Reference column being the manager.

Note that the “x” entry is just a placeholder I put in while creating the MA, because it needs to see at least one objectType specified. Once the MA is created I can delete that line.

Create a SQL MA

Start by creating the SQL Management Agent in the usual way:

Set the anchor to the DN column:

You will also have to configure the Multi-Value settings. These are a little obscure, and I’ve explained them in more detail elsewhere, so I’ll just show a piccy here:

As well you have to set an object type. For flexibility I’m just going to point it at my “objectType” column, meaning I could, potentially, support multiple types with this MA.

Set a join rule between the column where the position number is stored in the Objects table (in this case the “DN”) and the position attribute in the Metaverse.

Now for the flow rules: we want to flow the superiorPosition string value out to manager, and then the same value back to the manager attribute in the Metaverse – but now magically transformed to a reference.

Finally set your deprovisioning rules:

Metaverse Code

The final step is to write the provisioning code that creates the position objects in the SQL table.

(As this is a Sync-based method I’m going classic with none of that “declarative” malarky. If you had the Portal in the mix you may well be sorting out this manager stuff in there anyway.)

    Public Sub Provision(ByVal mventry As MVEntry) Implements IMVSynchronization.Provision
        If mventry.ObjectType <> PersonObjectClass Then
            Exit Sub
        End If

        Dim DoesExist As Boolean = False
        Dim ShouldExist As Boolean = False

        If mventry.ConnectedMAs(MAName).Connectors.Count > 0 Then
            DoesExist = True
        End If

        If mventry("position").IsPresent Then
            ShouldExist = True
        End If

        If ShouldExist And Not DoesExist Then
            Dim csentry As CSEntry
            csentry = mventry.ConnectedMAs(MAName).Connectors.StartNewConnector("position")
            csentry("DN").Value = mventry("position").Value
            csentry.CommitNewConnector()

        ElseIf DoesExist And Not ShouldExist Then
            Dim csentry As CSEntry
            csentry = mventry.ConnectedMAs(MAName).Connectors.ByIndex(0)
            csentry.Deprovision()
        End If
    End Sub

What should happen

When you sync your person objects you should see “position” objects being provisioned. Export, Import and Sync and you should see the reference value flow back into the Metaverse.

Note that this method does assume position numbers are unique – if you have a possibility of duplicate position numbers (such as with a job share) then you will need to get a bit more creative.

If you have a lot of data you should also look at generating a Delta table for the confirming Import step.

About: Carol

I've been doing IT for 30 years, and IdM for 15. I live in Australia and build IdM solutions based on Microsoft Identity Manager. I also play the violin, but that doesn't help much with the IdM solutions.


Leave a Reply

Your email address will not be published. Required fields are marked *


*