Adventures in identity management
I was asked today to implement notification emails on changes to certain groups. Like many situations with the FIM Portal this turned out to be trickier than expected. A number of the groups are criteria-based so don’t actually have a member attribute as such. With no member-update request happening there’s nothing to actually trigger a…
I have just spent a very frustrating day trying to figure out how to get access to the resource found by the EnumerateResourcesActivity, not helped even slightly by the usual machine-generated “documentation“. I’m still not very happy with it, and can’t for the life of me understand why it can’t give me a straight object collection…
R2 introduced a new property to the UpdateResourceActivity, CreateResourceActivity and DeleteResourceActivity classes called “ApplyAuthorizationPolicyProperty”. Setting this to “true” in your custom activity allows an Authorization activity to be triggered by an Action workflow. I have finally had an opportunity to try this out.
There has been a WMI way to get info about the Sync service, MAs and connector space objects since the MIIS days. There used to be a bunch of vbscript samples on TechNet but I’ve never seen them updated for PowerShell. The other day I wanted to produce a report of MA stats and thought…
To completely remove a binding and/or an attribute from the schema you need to do two things: Make sure it is removed from every MPR, Workflow, Set definition, Search Scope, Email Template etc. A simple way is to use the ExportPolicy script and then just search for the attribute in the resulting file. NULL the…
I’ve been finding it useful to query Request objects for various reasons, mostly to get pending or historical changes out of them. This post contains a few script snippets and examples. Note I have developed and used these on FIM 2010 R2 only.
I needed to delete all the Managers from people in the FIM Portal where a particular Manager was set. I had blithely assumed this would be easy with the FIM PowerShell plugin – sadly, not so.
For some reason I had assumed that I wouldn’t be able to remove and re-add the same value to a multivalued property in the same request – but it turns out you can – and it helped me greatly simplify a script, so hooray for that!
I’ve been trying to pass an ObjectID to the Approval activity via a WorkflowData parameter generated in the FIM PowerShell Activity but I had quite a bit of trouble getting the format right.
When creating an MA that is a projection source or a provisioning target it is easy to overlook the join rules, as the objects are effectively already joined. But you should still have them. The other part to this is about complex join rules. While joining a new directory for the first time you may…