Adventures in identity management
In this post I will offer general advice about migrating MIIS/ILM Sync to FIM Sync, supplementing the information in the Migration Guide on Technet. I’m looking at this purely as a Sync Service to Sync Service migration so there will be nothing about adding the FIM MA, replacing classic rules with declarative, or any of…
Today I was trying to find a list of all attributes synchronized to Office365 by DirSync. I couldn’t find a published list so I figured I’d just get it from the MA, using powershell to extract the list of source attributes. The list of AD user attributes synchronized by DirSync is at the bottom of this…
From time to time it’s necessary to access detailed data about objects in the connector space of a FIM Sync MA. One way to do this is with the csexport command line tool (found in the Bin folder) but the XML it produces isn’t particularly pretty and it doesn’t open nicely in Excel. Luckily powershell…
This post is going to describe an approach I’ve used a couple of times this year, in situations which looked quite different at the outset, but actually had one particular characteristic in common: the source data contained multiple records relating to individual people, and I needed access to all of them. One case involves “contract”…
Just a quick note on this as it’s something that wasn’t immediately obvious to me. I was using the Metaverse GUID as an anchor for provisioning to a simple SQL MA like so: csentry(“mvguid”).StringValue = mventry.ObjectID.ToString However when I tried to do a direct join rule on csentry:mvguid = mventry:<object-id> I got the error cannot-parse-object-id. In…
On my first ever MIIS project we were an OCG customer so were able to use their nice XML library. I can’t remember in great detail what it did, but I’ve always considered the concept a best practise: if there’s anything that you find yourself hard-coding as a constant value in extension code, then you…
After getting the OpenLDAP XMA working on FIMÂ I hoped it would be possible to provision to it using FIM codeless sync. Unfortunately the conclusion I have come to is No, it isn’t.
I’ve just posted a new Greatest Hits article on the ILM forum on the subject of how ILM (or the FIM Sync Service) can be used to clean up the mess of existing accounts, before you can actually get  on to the more interesting tasks of provisioning and updating. With the way FIM codeless sync works,…
This got me out of a pickle today. A slip-up in a join rule caused hundreds of bad joins to be made. There were far too many to un-do by hand, but then I figured out I could add a few lines to the Provisioning Sub of the MVExtension to remove all the joins made…
I just posted this article in the Greatest Hits series of the ILM Technet forum. It describes some of the methods and considerations around disabling and deleting users accounts with ILM.