none
"Object doesn't have a parent object in management agent X" - Connector space for new MA needs to be initialized in some way? RRS feed

  • Question

  • Note that this FIM installation does not have the portal available, so everything needs to be handled via code and/or the synchronization manager

    I am in the process of developing and setting up a new MA for provisioning users to an external system. I wish to use a local SQL database for storing the connector space data, and I've set it up so that the schema is determined from the structure of the database tables and their columns. I have defined one column "recordId" to serve as anchor and configured it as such in the MA configuration in the synchronization manager.

    We have set up an extension for handling provisioning etc within the metaverse, and I have added my MA there. However, when I try to do synchronization, I get error messages about:

    System.InvalidOperationException: The DN must be set before calling CSEntry.CommitNewConnector.
       at Microsoft.MetadirectoryServices.Impl.ConnectorImpl.Commit()
       at Mms_Metaverse.MVExtensionObject.Microsoft.MetadirectoryServices.IMVSynchronization.Provision(MVEntry mventry) in c:\FIM\Solutions\MVExtension\MVExtension.cs:line 344

    If I try to set the DN explicitly with CSEntry.DN before calling CSEntry.CommitNewConnector(), I get error messages about:

    "Object <DN-value> doesn't have a parent object in management agent <MA>"

    This makes me wonder if I need to do some kind of initialization of the connector space or something special when I start using this new MA for the first time in this FIM implementation, or perhaps there is something else entirely. And and all advice on how to get this sorted out is welcome!

    Wednesday, June 17, 2015 1:04 PM

All replies

  • You need to run a full import and full sync on that MA, target.

    Nosh Mernacaj, Identity Management Specialist

    Wednesday, June 17, 2015 1:58 PM
  • Thanks for looking at this :-)

    I've done so, but it doesn't seem to have had much effect; the errors are still there.

    Is there any way that I can verify, e.g. in the FIM database, that things are as they should be? If so, what should I look for?

    Thursday, June 18, 2015 7:06 AM
  • Not sure if it helps clarify in any way, but when I run with "Enable Provisioning Rules Extension" selected in the Options, I get the errors, even if the extension DLL is basically empty, without any added functionality. When I run without "Enable Provisioning Rules Extension", no errors, but no other visible effects for my MA.

    I'm plowing unfamiliar fields here, so if these things are documented somewhere, feel free to point me to it. I haven't found much of help, but I might be looking in the wrong places...

    Thursday, June 18, 2015 7:28 AM
  • Hello,

    If i understand right, you use a SQL Management type?

    Have tried to set the "recordId" instead of csentry.DN in your provisioning code?

    Regards,


    Sylvain

    Thursday, June 18, 2015 7:30 AM
  • Hello,

    If i understand right, you use a SQL Management type?

    Have tried to set the "recordId" instead of csentry.DN in your provisioning code?

    Regards,


    Sylvain


    Yes, that's when I get the "System.InvalidOperationException: The DN must be set before calling CSEntry.CommitNewConnector."-errors. Note that the MA is set up as an ECMA 2.0 MA, not an SQL server MA
    Thursday, June 18, 2015 7:53 AM
  • Another observation: when I set up the MA in the Synchronization Manager and look at the "Configure Provisioning Hiearchy"-window, there is no data there, and I'm starting to suspect that I'm missing a crucial step in the set-up here?

    In which cases is the "Configure Provisioning Hierarchy"-window applicable? Where does it get its data from? Any specific ways it should be used?

    Thursday, June 18, 2015 10:35 AM
  • Hey,

    What MA are you using? ECMA 2.0 means that you use a developed MA!

    Can you provide some screen shot?

    Normally, you don't have to use DN format for the anchor in a SQL MA. Have you tried to set the DN like in AD "CN=...,DC=foo"?

    Regards,


    Sylvain

    Friday, June 19, 2015 2:38 PM
  • What MA are you using? ECMA 2.0 means that you use a developed MA!

    Can you provide some screen shot?

    Normally, you don't have to use DN format for the anchor in a SQL MA. Have you tried to set the DN like in AD "CN=...,DC=foo"?

    Hi!

    Yes, it's a developed MA. I've been using a previously developed MA (currently up and running production) as a template both for code and configuration.

    What would you like to see screenshots of?

    Here's the attribute flow that has been set up: http://i.gyazo.com/898210ed11153e7502146e9369ff3156.png


    Here are the database tables:

    Person: http://i.gyazo.com/db1a351f4f9a040c64cbca7e5585e4a4.png

    Position: http://i.gyazo.com/69a88617011428a28e99efa4308dd7d6.png

    (recordID serves as anchor for both tables)

    I'll do another pass at setting the DN's as per your suggestion.

    Friday, June 19, 2015 4:02 PM

  • Normally, you don't have to use DN format for the anchor in a SQL MA. Have you tried to set the DN like in AD "CN=...,DC=foo"?

    For the record: I've tried setting this as

    When I set up the MA, the "Configure Provisioning Hieracrhy"-window is empty, like this:

    http://i.gyazo.com/9a136f35332781a48e8c8314d33cfd95.png

    Seems to me this is something that should not be empty; if so, what is the best way to fix it?
    Monday, June 22, 2015 4:41 AM
  • Hello,

    So did you have implement the interface IMAExtensible2GetHierarchy or IMAExtensible2GetPartitions in your code ?


    Sylvain

    Monday, June 22, 2015 9:42 AM
  • So did you have implement the interface IMAExtensible2GetHierarchy or IMAExtensible2GetPartitions in your code ?

    Neither one:

        public class SiPassMA :
        IMAExtensible2CallExport,
        IMAExtensible2CallImport, 
        // IMAExtensible2FileImport,
        // IMAExtensible2FileExport,
        // IMAExtensible2GetHierarchy,
        IMAExtensible2GetSchema,
        IMAExtensible2GetCapabilities,
        IMAExtensible2GetParameters
        // IMAExtensible2GetPartitions
        {

    Monday, June 22, 2015 1:26 PM
  • OK. So that not here!

    What is your DN format? (In the Capabilities function)


    Sylvain

    Tuesday, June 23, 2015 10:14 AM
  • We hadn't set up any specific DN format, so I expect the default to be used.

    Having wrestled with this problem for quite a while without any progress, we have decided to go back to a previous version of our FIM environment retrieved from backup, which seems to be working properly.

    Many thanks for the help and advice offered, especially to you Sylvain. Though it didn't lead to any solution for us in this case, it did help us understand quite a few things better :-)

    Tuesday, June 23, 2015 9:06 PM