locked
Flow distinguished name (dn) from Portal -> FIM -> AD error RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hello everybody,


    i have a Problem with FIM 2010 R2. Here is a short summary:

    I am flowing Persons from the FIM Portal into an Active Directory. One of the Attributes is the Organisation. The DN is build variable depending on the Organisation. If a Person changes the Organisation it creates a new DN.

    The initial DN flow works fine into the AD.

    But the flow after changing the Organisation does not change the DN in the AD and does not set the user into another OU.

    I have implemented one DN flow initial and another one not initial in the FIM portal.


    now i tried to use a metaverse Extension for that. I am getting the following error now:

    The partition filter criteria for management agent "ADMA" do not include an object with DN "cn=Dani Depression\,ou\=Benutzer\,ou\=ou1\,dc\=domain\,dc\=local" and object classes user. The error is produced at "csentry = connected_ADDS.Connectors.ByIndex(0)".


        Public Sub Provision(ByVal mventry As MVEntry) Implements IMVSynchronization.Provision

        If mventry.ObjectType.Equals("person") Then
            'If mventry("AccountName").IsPresent Then

            If mventry("_dn").IsPresent Then

                Dim csentry As CSEntry
                Dim dn As ReferenceValue
                Dim rdn As String
                Dim connected_ADDS As ConnectedMA
                connected_ADDS = mventry.ConnectedMAs("ADMA")

                rdn = mventry("_dn").Value

                dn = connected_ADDS.EscapeDNComponent(rdn)

                If connected_ADDS.Connectors.Count = 0 Then

                    csentry = connected_ADDS.Connectors.StartNewConnector("user")
                    csentry.DN = dn
                    csentry.CommitNewConnector()

                ElseIf connected_ADDS.Connectors.Count = 1 Then

                    csentry = connected_ADDS.Connectors.ByIndex(0) <-- error is produced by this one
                    csentry.DN = dn 

                Else
                    Throw New UnexpectedDataException("Multiple AD connectors!")
                End If
            End If
        End If

    End Sub

    Does anybody know how to change the DN in the AD via FIM portal / FIM Sync Engine WITHOUT using any Extensions??

    Kind regards,

    Pascal



    Thursday, October 11, 2012 12:48 PM

Answers

  • Question
    Sign in to vote
    1
    Sign in to vote

    Thank you Patrick and Glenn. But now i found the reason why it didn't work.

    I found out, that the DN was not changed in the Metaverse as well.

    The Organisation attribute was not flowed into the Metaverse. I had to change that and now it works fine. And i don't have to use the Extension for it!!

    Thank you for your help anyway!


    Kind regards,

    Pascal


    Monday, October 15, 2012 7:36 AM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    I think the floowing line cause you the problem: dn =connected_ADDS.EscapeDNComponent(rdn)

    You have to separate the CN from the rest of the DN and apply at the following way:

    dn =connected_ADDS.EscapeDNComponent(CN=...).Concat(OU=...,DC=...)

    Patrick.


     

    Patrick Layani

    Sunday, October 14, 2012 2:42 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Pascal,

    Having a second flow for DN without having initial flow only is the correct way to go. I suspect that this is not working because in the scenario, the organization attribute is not being changed before it gets to second flow rule where it would be used to construct the DN. Could you possibly show how you are flowing this?

    Sunday, October 14, 2012 4:38 PM
  • Question
    Sign in to vote
    1
    Sign in to vote

    Thank you Patrick and Glenn. But now i found the reason why it didn't work.

    I found out, that the DN was not changed in the Metaverse as well.

    The Organisation attribute was not flowed into the Metaverse. I had to change that and now it works fine. And i don't have to use the Extension for it!!

    Thank you for your help anyway!


    Kind regards,

    Pascal


    Monday, October 15, 2012 7:36 AM