Just going into prod with a major FIM solution and we found that approvals weren’t working. The request was sent, the email arrived, but when the user went to the Portal to attempt to respond to the request they got “Unable to process your request” immediately after clicking “Submit”.<\/p>\n
<\/p>\n
I actually guessed the cause straight away – but then spent three hours on fruitless troubleshooting because of something I didn’t know about Approval objects – more on that below.<\/p>\n
The problem was an incorrect externalHostName in the Microsoft.ResourceManagement.Service.exe.config file.<\/p>\n
Actually it wasn’t supposed to be incorrect – but it turned out a peculiarity in the customer’s network means that Kerberos only works using the cname instead of the full fqdn. So I figured the problem was that externalHostName was “fimservice.mydomain.com” instead of just “fimservice”.<\/p>\n
I changed the config file, restarted the FIMService and IIS and … still could not approve.<\/p>\n
Queue the aforementioned three hours of enabling and trawling log files, messing with service accounts and SPNs, and general hair tearing. After enabling verbose logging I could see this error: “The Portal cannot connect to the middle tier using the web service interface” – something that I know is often externalHostName. So why didn’t my first change fix it?<\/p>\n
Well actually it had – just not for the existing Approval objects. And here’s the thing I didn’t know: Approval objects are stamped with the externalHostName from the config file<\/em>. So change the config file and your existing Approvals are still broken. You need to trigger a new Approval before you can tell for sure if the problem still exists.<\/p>\n","protected":false},"excerpt":{"rendered":" Just going into prod with a major FIM solution and we found that approvals weren’t working. The request was sent, the email arrived, but when the user went to the Portal to attempt to respond to the request they got “Unable to process your request” immediately after clicking “Submit”.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"footnotes":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":[]},"categories":[42,64],"tags":[],"class_list":["post-2051","post","type-post","status-publish","format-standard","hentry","category-fim-2010","category-troubleshooting"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pkp1o-x5","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/posts\/2051","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/comments?post=2051"}],"version-history":[{"count":7,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/posts\/2051\/revisions"}],"predecessor-version":[{"id":2058,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/posts\/2051\/revisions\/2058"}],"wp:attachment":[{"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/media?parent=2051"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/categories?post=2051"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/tags?post=2051"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}