none
extension unexpected attribute value RRS feed

  • Question

  • In FIM2010 , we are receiving many errors after running full syncronization with the below stack trace information

    Microsoft.MetadirectoryServices.UnexpectedDataException: An authoritative Microsoft.MetadirectoryServices.Impl.CSEntryImpl-object in Forest1 MA with  DN CS Forest1 MA user CN=abcd,CN=Users,DC=forest1,DC=com attempts to join when it should be projected.  There is another authoritative object representing the same entity in the metaverse:

    CS Forest1oving or modifying one of the objects so that they no longer collide.  Also Microsoft Identity Integration Server will try to maintain these objects if it has the permissions and may rewrite the attributes unless appropriate action is taken.
       at Microsoft.MetadirectoryServices.GALSync.MASynchronizer.ResolveJoinSearch(String joinCriteria, CSEntry csentry, MVEntry[] rgmventry, Int32& MVEntry, String& MVObjectClass)

    When we compared both the objects the only similarity is first name and last name are common for both the users.

    Please let me know what are the other things neeed to check


    Ahmed Ali

    Tuesday, March 26, 2013 11:00 AM

Answers

  • The Exchange version doesn't really matter in this case, as the GALSync code has been pretty much doing the same in MIIS/ILM/FIM.

    Are you using the out-of-the box GALSync code?
    Check the GALSync solution, in the GALMA.vb, find the ResolveJoinSearch function.

    '
    ' Do not want to join from the authoritative container even if
    ' there is only one MV candidate. 
    '
    If (csentry.ObjectType.Equals(CONTACT) AndAlso IsInContactOUs(csentry)) _
     OrElse csentry.ObjectType.Equals(USER) _
     OrElse csentry.ObjectType.Equals(GROUP)  Then
    '
    ' If the contact is in the authoritative container, then it
    ' should project, not join, so this is an error.
    '
     exceptionString = "An authoritative " _
     & csentry.GetType.ToString & "-object in " _
     & csentry.MA.Name _
     & " with DN " & csentry.ToString _
     & " attempts to join when it should be projected. There " _
     & "is another authoritative object representing the same " _
     & "entity in the metaverse: " _
     & MasterConnector(rgmventry(0)) _
     & ". This object will not be propagated to any other " _
     & "forests until this conflict is resolved by removing " _
     & "or modifying one of the objects so that they no " _
     & "longer collide. Also Microsoft Identity Integration Server will try to maintain these " _
     & "objects if it has the permissions and may rewrite " _
     & "the attributes unless appropriate action is taken."
     
     LogAndThrowUnexpectedDataException(exceptionString)
     End If

    As you can see, the code is not even trying to join, it's checking the CS ObjectType.

    Have you debugged the code and checked the exact values that are passed to the function when the function is called?

    More important, this code is only called if there's only 1 candidate in the MV...

    Check a few lines up:

    '
    ' If more than one candidate is present, it is an error
    '
    If 1 < rgmventry.Length Then
    /../
    End if

    What exactly is contained in the ProxyAddresses attribute? (Including, X500, SMTP, smtp, SIP, ...)


    Peter Geelen (Microsoft Belgium) - Premier Field Engineer Security & Identity

    [If a post helps to resolve your issue, please click the Answered"Mark as Answer" of that post or click Answered"Vote as helpful" button of that post.
    By marking a post as Answered or Helpful, you help others find the answer faster.


    Tuesday, April 2, 2013 6:21 PM
    Moderator

All replies

  • Please check this article, which is discussing the error you are facing: "join-resolution errors during GalSync" at http://support.microsoft.com/kb/948004

    Additionally you can check for more info at : Global Address List Synchronization (GalSync) Resources on TNWiki.

    Kind regards,
    Peter


    Peter Geelen (Microsoft Belgium) - Premier Field Engineer Security & Identity

    [If a post helps to resolve your issue, please click the Answered "Mark as Answer" of that post or click Answered "Vote as helpful" button of that post.
    By marking a post as Answered or Helpful, you help others find the answer faster.

    Tuesday, April 2, 2013 2:19 PM
    Moderator
  • Hi Peter,

    The support link describes about exchange 5.5 and about the similar proxy address.

    In my case user A is having the proxy address are email.address@domain.com and User B is having email_address@domain.com

    Is this the issue where the KB describes. If so what is the solution? Do I need to change the proxy address of the user completely.

    Please advice.


    Ahmed Ali

    Tuesday, April 2, 2013 2:49 PM
  • The Exchange version doesn't really matter in this case, as the GALSync code has been pretty much doing the same in MIIS/ILM/FIM.

    Are you using the out-of-the box GALSync code?
    Check the GALSync solution, in the GALMA.vb, find the ResolveJoinSearch function.

    '
    ' Do not want to join from the authoritative container even if
    ' there is only one MV candidate. 
    '
    If (csentry.ObjectType.Equals(CONTACT) AndAlso IsInContactOUs(csentry)) _
     OrElse csentry.ObjectType.Equals(USER) _
     OrElse csentry.ObjectType.Equals(GROUP)  Then
    '
    ' If the contact is in the authoritative container, then it
    ' should project, not join, so this is an error.
    '
     exceptionString = "An authoritative " _
     & csentry.GetType.ToString & "-object in " _
     & csentry.MA.Name _
     & " with DN " & csentry.ToString _
     & " attempts to join when it should be projected. There " _
     & "is another authoritative object representing the same " _
     & "entity in the metaverse: " _
     & MasterConnector(rgmventry(0)) _
     & ". This object will not be propagated to any other " _
     & "forests until this conflict is resolved by removing " _
     & "or modifying one of the objects so that they no " _
     & "longer collide. Also Microsoft Identity Integration Server will try to maintain these " _
     & "objects if it has the permissions and may rewrite " _
     & "the attributes unless appropriate action is taken."
     
     LogAndThrowUnexpectedDataException(exceptionString)
     End If

    As you can see, the code is not even trying to join, it's checking the CS ObjectType.

    Have you debugged the code and checked the exact values that are passed to the function when the function is called?

    More important, this code is only called if there's only 1 candidate in the MV...

    Check a few lines up:

    '
    ' If more than one candidate is present, it is an error
    '
    If 1 < rgmventry.Length Then
    /../
    End if

    What exactly is contained in the ProxyAddresses attribute? (Including, X500, SMTP, smtp, SIP, ...)


    Peter Geelen (Microsoft Belgium) - Premier Field Engineer Security & Identity

    [If a post helps to resolve your issue, please click the Answered"Mark as Answer" of that post or click Answered"Vote as helpful" button of that post.
    By marking a post as Answered or Helpful, you help others find the answer faster.


    Tuesday, April 2, 2013 6:21 PM
    Moderator