Adventures in identity management
Run History should be regularly cleared to keep your database file sizes under control. There’s also not a lot of point keeping weeks (let alone months or years) worth of run history in the Sync Service. It shows when profiles ran and whether there were any errors, but click on a CS object and you…
A long time ago now I posted a basic SQL method of archiving the Requests history to another database. I’m still using this with FIM 2010 and have updated the method now to also grab info about Approvals. Note I haven’t tested this with R2.
I have finally had a need to update my import/export log archiving system so it now uses powershell to convert the XML directly to HTML, without relying on IE to do the rendering, as I was before. The idea is a script you run immediately after every Import and Export run profile. It will take…
I just had a request to do with auditing activity in the FIM Portal, and as the solution was quite neat and easy to implement I thought I’d share it. The security team need to archive information about who makes changes in AD and other applications, and now they need to be able to audit…
From time to time it’s necessary to access detailed data about objects in the connector space of a FIM Sync MA. One way to do this is with the csexport command line tool (found in the Bin folder) but the XML it produces isn’t particularly pretty and it doesn’t open nicely in Excel. Luckily powershell…
There were a few FIM reporting sessions at TEC, none of which I managed to make it to, though I hope the presenters will be making their solutions generally available as they are undoubtably more correct and complete than what I’ve been doing. However a couple of people did ask that I post my method…
Not long ago I wrote a post about writing status messages back to the Request object from a custom workflow. I used custom attributes because I was following the only documentation I could find. But Henrik said “why don’t you use RequestStatusDetail?” – and actually the reasons were a. I hadn’t thought of it, and…
A long time ago I wrote up a method that could be used to archive the MIIS import and export logs, while also making them more readable with a stylesheet. I’ve now implemented this on a FIM 2010 server, and it works, so I’m going to write it up again.
In some implementations, it makes sense (usually by improving performance) to separate your user and group provisioning into seperate MAs. One downside of this approach, however, is that you can run into export errors when trying to update a group with a member who doesn’t exist in the external directory – and this includes delete…
Here’s a trick that is worth knowing – though I’m only recommending it for TEST ENVIRONMENTS – consider yourself warned. You may have noticed the “test only” log file options on the import and export run profiles. Being able to stop the run at the log file is incredibly useful for testing what would have been exported, without…