none
Delete custom attribute and binding in FIM 2010 RC1 RRS feed

  • Question

  • I am using FIM 2010 RC1.  I have create a custom attribute and binding (to user resource).  Documentation indicates I should be able to delete this custom attribute.  MPRs indicate I should be able to delete.   I am getting a "Request Failed" error when attempting to delete the attribute or binding.  Not an access denied mind you, but a "Request Failed".  Any ideas?
    Tuesday, January 19, 2010 12:33 AM

Answers

  • Are there any resources in the system that have attribute values for that attribute?  If so, I do not believe you can delete the schema until the data is cleared.
    AhmadAW
    • Marked as answer by Phil Bart Tuesday, January 19, 2010 8:12 PM
    Tuesday, January 19, 2010 6:44 PM
  • Short Answer:  Nulling out all values allowed me to delete the binding but not the attribute.  But you were still on the right track with that too.

    Long Answer:  To flow the empty string or null value into this attribute and validate the result, I had added the attribute to Filter Permissions (admin and non-admin), I had added it to a sync rule, I had added it to an MPR (sync acct controls users is syncs), and I had added it to a view (search scope > all users).  I'm not sure which one did the trick, but after removing the attribute from each one of these, I was successfully able to delete the attribute.

    Thanks for the help!

    Phil
    • Marked as answer by Phil Bart Tuesday, January 19, 2010 8:12 PM
    Tuesday, January 19, 2010 8:12 PM

All replies

  • In case it helps, below is the "Request Parameters"

    <RequestParameter xmlns:q1="http://microsoft.com/wsdl/types/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="DeleteRequestParameter"><Target>1d94bd07-7b3f-469c-aaaf-ace8cb4abdb0</Target><Calculated>true</Calculated><Operation>Delete</Operation></RequestParameter>
    ------------------------------------------------------------
    Tuesday, January 19, 2010 1:02 AM
  • Are there any resources in the system that have attribute values for that attribute?  If so, I do not believe you can delete the schema until the data is cleared.
    AhmadAW
    • Marked as answer by Phil Bart Tuesday, January 19, 2010 8:12 PM
    Tuesday, January 19, 2010 6:44 PM
  • Good thought.  I will see if I can flow an empty string into it for all users just to be sure, then attempt delete.  I will update as soon as I know. 
    Tuesday, January 19, 2010 7:24 PM
  • Short Answer:  Nulling out all values allowed me to delete the binding but not the attribute.  But you were still on the right track with that too.

    Long Answer:  To flow the empty string or null value into this attribute and validate the result, I had added the attribute to Filter Permissions (admin and non-admin), I had added it to a sync rule, I had added it to an MPR (sync acct controls users is syncs), and I had added it to a view (search scope > all users).  I'm not sure which one did the trick, but after removing the attribute from each one of these, I was successfully able to delete the attribute.

    Thanks for the help!

    Phil
    • Marked as answer by Phil Bart Tuesday, January 19, 2010 8:12 PM
    Tuesday, January 19, 2010 8:12 PM
  • Hi,

    I'm having this exact issue, but can't seem to track down what is making the delete request fail.

    By any chance is there a way to get more details about the cause of the failure? I've checked the event viewer and the request itself which don't have much helpful information. I'm still new to FIM so maybe I am overlooking a place to check?

    Thanks,

    Sami

    Tuesday, August 17, 2010 10:01 PM
  • Wish I could provide more assistance to you but the event logs, etc did not help me either.  All I can tell you is that after flowing a null value into the attribute, I reversed everything I did step by step.   That means removing the attribute from MPRs, removing from search scope, etc and then deleting it.
    Tuesday, August 17, 2010 10:34 PM
  • Deleting the attributes in FIM can be a bit of a fun experience. There are many different areas where you may have used the attribute and until all the uses are gone, you cannot delete them:

    1. Check things like MPR's that are configured to look for the specific attribute.

    2. Remove any references in set definitions that may be looking for the attribute.

    3. Remove any values from the attribute. (This can be really fun as deletions are a pain unless you allow nulls in the sync engine).

    4. Remove any references in group definitions.

    5. Remove any bindings.

    6. Remove the attribute.

    There isn't really an easy way to find where the attributes are used. You can do some searches for bindings and such but sometimes you just have to go back to the documentation you made with the environment.

    Thanks

    B

    Wednesday, August 18, 2010 2:13 AM
  • Thank you both! At least I'm not overlooking the easy way. :)
    Wednesday, August 18, 2010 12:11 PM
  • Hi All!

    I'm having the same issue and clearing out values etc. does work. I've done it using Powershell for string values but I'm not able to clear out boolean attributes i.e. set it to null instead of true or false. Is this even possible?

    //Henrik


    Henrik Nilsson, ILM/FIM MVP Blog: http://www.idmcrisis.com Company: Cortego (http://www.cortego.se)
    Thursday, October 14, 2010 5:16 AM
  • AD has FALSE, TRUE and NOT SET
    FIM has something similar. When you create an object with a boolean attrib tit looks like it is not set. As soon as you edit the object (e.g. description), in the summary you see that boolean attributes are being set to FALSE which appears to be the default initial value

    --

    Cheers,
    (HOPEFULLY THIS INFORMATION HELPS YOU!)
     
    # Jorge de Almeida Pinto # MVP Identity & Access - Directory Services #
     
    BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
    BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx
    ------------------------------------------------------------------------------------------
    * This posting is provided "AS IS" with no warranties and confers no rights!
    * Always test ANY suggestion in a test environment before implementing!
    ------------------------------------------------------------------------------------------
    #################################################
    #################################################
    ------------------------------------------------------------------------------------------
    "Henrik Nilsson" wrote in message news:00f5ff7e-3ec6-49d8-a92d-e4e0201af035...

    Hi All!

    I'm having the same issue and clearing out values etc. does work. I've done it using Powershell for string values but I'm not able to clear out boolean attributes i.e. set it to null instead of true or false. Is this even possible?

    //Henrik


    Henrik Nilsson, ILM/FIM MVP Blog: http://www.idmcrisis.com Company: Cortego (http://www.cortego.se)

    Jorge de Almeida Pinto [MVP-DS / AD DS TechNet Forums Moderator] [Sr. Technical Consultant @ Oxford Computer Group] (http://blogs.dirteam.com/blogs/jorge/default.aspx) (http://www.oxfordcomputergroup.com/)
    Thursday, October 14, 2010 5:59 AM
  • Thanks Jorge!

    I've noticed this but as long as the value is set to either true or false I can't remove the binding. I've tried to set it to null using Powershell but this only results in:

    "Microsoft.ResourceManagement.WebServices.Faults.ServiceFaultException: The request message contains errors that prevent processing the request. "

    ...The same Powershell script works on string attributes.

    My question is if it's possible to set a boolean value to null and in that case how?

     


    Henrik Nilsson, ILM/FIM MVP Blog: http://www.idmcrisis.com Company: Cortego (http://www.cortego.se)
    Thursday, October 14, 2010 3:06 PM
  • I just wanted to add that the most effective way I found of tracking down the use of attributes and bindings was to export the schema and policy xml and search in there.  There's a utility product awaiting development here ... :)


    Bob Bradley, www.unifysolutions.net (FIMBob?)
    Monday, October 18, 2010 4:24 AM
  • Hello,

    Like Henrik I want to clearing FIM attributes values with powershell in order to clear these attributes from schema.

    Ok for string attributes but I don't manage clearing the values for numbers :(

    Is it possible to set a number to null with powershell?

    The script below can't run because $null can't be use for numbers. Also "-1" or "0" are updating values but not clearing...


    $importObject = New-Object Microsoft.ResourceManagement.Automation.ObjectModel.ImportObject

    $importObject.ObjectType = 'Person'

    $importObject.TargetObjectIdentifier = $id

    $importObject.SourceObjectIdentifier = $id

    $importObject.State = 1

    $importChange = New-Object Microsoft.ResourceManagement.Automation.ObjectModel.ImportChange

    $importChange.Operation = 1

    $importChange.AttributeName = 'attribute_name'

    $importChange.AttributeValue = $null

    $importChange.FullyResolved = 1

    $importChange.Locale = "Invariant"

    $importObject.Changes = (,$importChange )

    $result = $importObject | Import-FIMConfig -Uri $uri







    • Edited by Serge_B Wednesday, January 23, 2013 4:14 PM
    Wednesday, January 23, 2013 2:59 PM