Adventures in identity management
I’ve been finding it useful to query Request objects for various reasons, mostly to get pending or historical changes out of them. This post contains a few script snippets and examples. Note I have developed and used these on FIM 2010 R2 only.
I needed to delete all the Managers from people in the FIM Portal where a particular Manager was set. I had blithely assumed this would be easy with the FIM PowerShell plugin – sadly, not so.
I’ve had this post sitting in draft for a long time and for some reason hadn’t posted it yet – but then today my colleague Matt sent me a link to the Scripting Guy’s PowerShell Holiday Gift Guide. Yes I do love my PowerShell (and I’m hoping that Santa will bring me a copy of…
For some reason I had assumed that I wouldn’t be able to remove and re-add the same value to a multivalued property in the same request – but it turns out you can – and it helped me greatly simplify a script, so hooray for that!
I’ve been trying to pass an ObjectID to the Approval activity via a WorkflowData parameter generated in the FIM PowerShell Activity but I had quite a bit of trouble getting the format right.
As much as possible I like to keep my Workflows simple with a minimum number of steps. When updating attributes I prefer, wherever possible, to only update a single attribute per Workflow Definition. So for example I’ll have separate Workflows for “Set DisplayName” and “Set AccountName” rather than rolling the two together in a single…
MPRs should either have “Grants Permission” ticked, or they should trigger Workflows, but preferably not both.
Run History should be regularly cleared to keep your database file sizes under control. There’s also not a lot of point keeping weeks (let alone months or years) worth of run history in the Sync Service. It shows when profiles ran and whether there were any errors, but click on a CS object and you…
Both in the Sync Service and the Portal there may be regular error messages that we just live with. We’ve figured out they’re “low priority” or perhaps they’re false alerts, where FIM thinks there’s an error but the end result is fine. However, as much as possible, we should aim for a system that runs…
I have two personal rules I always follow when implementing disabling and deprovisioning: Never make decisions on an absence of data, and Never make destructive changes straight away.