none
sync-rule-validation-parsing-error; referenced MA has been deleted RRS feed

  • Question

  • Hi,

    We had a FIM Portal with 6 Sync Rules working. The Sync Rules were using existing MAs.

    We wanted to test a DR process, so we exported all the MAs, and deleted them.

    We then reimported exactly the same MAs, and most of the Run Profiles were fine, except the FIM Portal ones which failed with: sync-rule-validation-parsing-error (6 errors, 1 per Sync Rule).

    On closer inspection of the Sync Rules this is the error message we found in the Portal (next to the Sync Rule entry):

    The referenced Management Agent has been deleted. Please delete this Synchronization Rule, update the external system field or re-import the deleted Management Agent.

    Well, we did the last recommendation - we re-imported the deleted Management Agent - but the FIM Portal doesnt seem to be aware of this...how come?

    Thank you,

    SK

    PS. If this process doesnt work, how is one meant to migrate the FIM Portal and MAs from a lab environment to production?




    • Edited by D Wind Friday, May 25, 2012 8:19 AM
    Friday, May 25, 2012 8:07 AM

Answers

  • If I recall correctly it is a difference when exporting individual MA and when exporting server configuration.

    Importing an individual MA will create a new GUID for it and the Sync Rule needs to be re-mapped.

    Importing Server configuration the MA keep the original GUID, making the Sync Rule mapping continue to work.

    I once did a PS script to re-map the sync rules but seems to have it in a very secure location ;-)

    • Proposed as answer by Steve Kradel Friday, May 25, 2012 10:10 PM
    • Marked as answer by D Wind Wednesday, September 26, 2012 12:08 PM
    Friday, May 25, 2012 8:25 PM

All replies

  • Hi,

    The 'normal' scenario is that you first create (or import) the management agent in the sync engine. After that, you should import the synchronization rules in the FIM portal. As to my knowledge, there is no scenario for re-enabling the sync rule when it is in this state.

    The scenario for migration from lab to production would be just that: create a back-up of your fim sync-engine configuration and create a backup of the policy rules. In production you should import the sync engine configuration first and then import the policy rules in the portal.

    Does this answer your question?

    Best regards,
    Pieter.


    Pieter de Loos - Consultant at Traxion (http://www.traxion.com) http://fimfacts.wordpress.com/

    Friday, May 25, 2012 10:38 AM
  • You can also update the sync rule manually within the portal if i am not mistaken if the management agents is lost somewhere, not sure what went wrong in your scenario but the management agents are all linked to GUID's so somehow the GUID is different i think.

    Need realtime FIM synchronization and advanced reporting? check out the new http://www.imsequencer.com that supports FIM 2010, Omada Identity Manager, SQL, File, AD or Powershell real time synchronization!

    Friday, May 25, 2012 3:02 PM
  • Try re-entering the credentials of your FIM MA - this will recreate the ma-data and mv-data in your FIM portal to match the latest definitions, and if there's an inconsistency then your sync rule page should show this up clearly afterwards.

    Bob Bradley (FIMBob @ http://thefimteam.com/) ... now using Event Broker 3.0 @ http://www.fimeventbroker.com/ for just-in-time delivery of FIM 2010 policy via the sync engine

    Friday, May 25, 2012 3:45 PM
  • If I recall correctly it is a difference when exporting individual MA and when exporting server configuration.

    Importing an individual MA will create a new GUID for it and the Sync Rule needs to be re-mapped.

    Importing Server configuration the MA keep the original GUID, making the Sync Rule mapping continue to work.

    I once did a PS script to re-map the sync rules but seems to have it in a very secure location ;-)

    • Proposed as answer by Steve Kradel Friday, May 25, 2012 10:10 PM
    • Marked as answer by D Wind Wednesday, September 26, 2012 12:08 PM
    Friday, May 25, 2012 8:25 PM
  • You might also see if those ma config items are in the FIM portal. I had a situation where no matter what we did, the sync config wouldn't come over. All the usual tricks failed and PSS had to go in and do some magic. It was a config migration from dev to a clean prod install. Never had the problem on any other system, just this once - and I move lots of configs around.


    Frank C. Drewes III - Architect - Oxford Computer Group

    Friday, May 25, 2012 8:55 PM
  • Agreed, it is possible to import and re-import the same individual MA from its XML version again and again, and it will receive a new GUID every time, including the first time.  I would absolutely expect this to break stuff in the FIM Service + Portal.

    The official disaster recovery plan for FIM is to recover the FIMSynchronizationService and FIMService databases at a consistent point in time--mucking about with individual MAs is not going to get the right effect.

    Friday, May 25, 2012 10:12 PM
  • Thank you everyone.

    The error message in the Portal next to the Sync Rule is:

    (The referenced Management Agent has been deleted. Please delete this Synchronization Rule, update the external system field or re-import the deleted Management Agent)

    Its just a little bit deceptive that's all. If you import one MA at a time, you get a new GUID, which leads to the problems above. Looks like we will need to 'Import Server Configuration' to resolve this issue.

    Thanks

    • Edited by D Wind Monday, May 28, 2012 3:32 AM
    Sunday, May 27, 2012 11:40 PM
  • I've run into this issue once in a while when moving config between servers. I have created a powershell script that will update the invalid MA references on the sync rules, which seem to work. I have uploaded it to the FIM scriptbox, feel free to try it out. 

    FIM architect - Crayon AS - www.crayon.com

    Friday, September 7, 2012 12:38 PM
  • Thank you everyone.
    Wednesday, September 26, 2012 12:08 PM