Adventures in identity management
In this post I will offer general advice about migrating MIIS/ILM Sync to FIM Sync, supplementing the information in the Migration Guide on Technet. I’m looking at this purely as a Sync Service to Sync Service migration so there will be nothing about adding the FIM MA, replacing classic rules with declarative, or any of…
This is just an observation, and if anyone’s got any ideas or suggestions do let me know. I’m working on a FIM Sync service that I’ve upgraded from ILM by the database transfer method. I had to recreate one MA completely, and re-import and re-join all it’s objects. I was running some csexports against a…
Today I was trying to find a list of all attributes synchronized to Office365 by DirSync. I couldn’t find a published list so I figured I’d just get it from the MA, using powershell to extract the list of source attributes. The list of AD user attributes synchronized by DirSync is at the bottom of this…
From time to time it’s necessary to access detailed data about objects in the connector space of a FIM Sync MA. One way to do this is with the csexport command line tool (found in the Bin folder) but the XML it produces isn’t particularly pretty and it doesn’t open nicely in Excel. Luckily powershell…
This post is going to describe an approach I’ve used a couple of times this year, in situations which looked quite different at the outset, but actually had one particular characteristic in common: the source data contained multiple records relating to individual people, and I needed access to all of them. One case involves “contract”…
Just a quick note on this as it’s something that wasn’t immediately obvious to me. I was using the Metaverse GUID as an anchor for provisioning to a simple SQL MA like so: csentry(“mvguid”).StringValue = mventry.ObjectID.ToString However when I tried to do a direct join rule on csentry:mvguid = mventry:<object-id> I got the error cannot-parse-object-id. In…
On my first ever MIIS project we were an OCG customer so were able to use their nice XML library. I can’t remember in great detail what it did, but I’ve always considered the concept a best practise: if there’s anything that you find yourself hard-coding as a constant value in extension code, then you…
After getting the OpenLDAP XMA working on FIMÂ I hoped it would be possible to provision to it using FIM codeless sync. Unfortunately the conclusion I have come to is No, it isn’t.
Here’s something else I’ve been developing, which I think has interesting potential. Essentially it’s an XMA which is used to provision powershell “command” objects. These objects contain the name of the cmdlet and the list of arguments, and the Export step is actually running the command.
I’ve just posted a new Greatest Hits article on the ILM forum on the subject of how ILM (or the FIM Sync Service) can be used to clean up the mess of existing accounts, before you can actually get  on to the more interesting tasks of provisioning and updating. With the way FIM codeless sync works,…