Adventures in identity management
Both in the Sync Service and the Portal there may be regular error messages that we just live with. We’ve figured out they’re “low priority” or perhaps they’re false alerts, where FIM thinks there’s an error but the end result is fine. However, as much as possible, we should aim for a system that runs…
I have two personal rules I always follow when implementing disabling and deprovisioning: Never make decisions on an absence of data, and Never make destructive changes straight away.
The extensibility of FIM has always been one of its great features – allowing us to tailor it to suit the specific needs of the environment. But don’t get carried away!
The company I work for, Unify Solutions, has a product called Event Broker which I’ve blogged about before. However I was still pretty new to it then and treating it as a straight replacement for scheduling scripts. Now I’m starting to use it properly I can see there’s a lot more to it.
I am not aware that anyone has has yet found a way to automate full testing of a FIM solution. I know some people unit test their extension code but that doesn’t tell you anything beyond the inputs and outputs of the code. Full testing may need to encompass data entry in the Portal or…
For anything above the simplest GALSync deployment, and particularly if you have the FIM Portal, you must have development and test environments. There are always a number of different ways you can approach each problem, and you need a suitably representative Dev environment to try them all out. Meanwhile Test should be as close to…
The Sync Service is good at maintaining connections between objects, and synchronising data between them. What it has never been so good at is constructing data from complex rules and lookups, so as much as possible, do the complex processing outside the Sync Service and present the data in a way that it can use…
There’s a box you can tick on the Deprovisioning Options page in your MA configurations – it says “Do not recall attributes on disconnection”. My advice: don’t tick this box.
When creating an MA that is a projection source or a provisioning target it is easy to overlook the join rules, as the objects are effectively already joined. But you should still have them. The other part to this is about complex join rules. While joining a new directory for the first time you may…
The first custom workflow activity I wrote was one to select a unique value from a list of possible values placed in WorkflowData variables. I’ve now re-written this as a PowerShell script to use with the open source FIM PowerShell activity. The script here just checks again the Portal, but it would be a simple…