Hi,

I'm investigating an ACTGOV incident (Ivanti Incident 50255) and they have run into issues testing an upgrade to .Net 4.6 on an existing installation in their TEST environment. 

The description from ACTGOV is as follows:

Hi,

We would like to upgrade .net on our Education FIM server to 4.6 but we found that when we do so in our test environment that our Maze MAs stop working.  In the event log we get the error message:

Given the MA refuses to even start the problem appears to be Unify.Framework.ILM2007FP1Adapter.dll.  Are you able to provide an updated version of this DLL that has been compiled with .net 4.6?

The version we currently have is 3.0.1.1 with a time stamp of 9/7/2013.

Cheers,

I was hoping you may be able to assist with a copy of the dll able to run with .Net 4.6 or what the action for remediation on this issue is.

Below are also the software versions the client has:

• FIM 2010 Sync Engine
  
• FIM Service Portal and SSPR
  
• Identity Broker for FIM 4
  
• Identity Broker for CISCO 4
  
• Identity Broker for viewDS
  
• Identity Broker for Sharepoint 4

Let me know if you need any more details.

Thank you,

Hayden Gray

I have installed IdB 5.2.0.1 on a new Dev server and migrated the config from Production, which has IdB 5.0.4. I created the LDAP gateway and got the MA imported - however when I tried to make any changes to the MA I got a warning that it was going to delete the partitions "DC=IdentityBroker" (previously selected) and "cn=schema" (previously un-selected).

After backing up the MA I let it delete the partitions, and so far everything looks fine - I can run a Full Import and data was imported from the adapters.

So this is just a sanity check - was letting MIM delete that partition from the MA the right thing to do?

Running a Delta import and Delta Sync from IdB Sharepoint connector and get the error below. Ran a Full Import and Full Synchronization & the error did not occur.  Ran a Delta import and Delta Sync again and error does not occur.

Not sure if I'll be able to replicate again, but raising regardless.

The extensible extension returned an unsupported error.
 The stack trace is:
 
 "System.ArgumentException: Value bp is not a valid hexadecimal number.
Parameter name: sourceValue
   at Unify.Framework.IO.DNComponentAttributeValueParserAdapter.Transform(String sourceValue)
   at Unify.Framework.IO.DistinguishedNameComponent.CreateDNComponent(String dnComponentString)
   at Unify.Framework.IO.DistinguishedNameConversionFromString.CreateDistinguishedName()
   at Unify.Product.IdentityBroker.ImportProxy.GetContainerName(String dn)
   at Unify.Product.IdentityBroker.ImportProxy.TryGetObjectClass(String dn, String& objectClass)
   at Unify.Product.IdentityBroker.ImportProxy.<EntryToDeltas>d__25.MoveNext()
   at System.Linq.Enumerable.<SelectManyIterator>d__16`2.MoveNext()
   at System.Linq.Enumerable.<SelectManyIterator>d__16`2.MoveNext()
   at Unify.Product.IdentityBroker.ExtensionMethods.Take[TSource](IEnumerator`1 source, Int32 count, IList`1& items)
   at Unify.Product.IdentityBroker.ExtensionMethods.<Page>d__3`1.MoveNext()
   at Unify.Product.IdentityBroker.ImportProxy.Import(GetImportEntriesRunStep importRunStep)
   at Unify.Product.IdentityBroker.UnifyLdapConnectorTypeProxy.GetImportEntries(GetImportEntriesRunStep importRunStep)
   at Unify.Product.IdentityBroker.UnifyLdapConnector.GetImportEntries(GetImportEntriesRunStep importRunStep)
Forefront Identity Manager 4.4.1459.0"

I want to use an attribute created in a PowerShell transformation in the DN, but am getting a "field not required" error.  How can I configure this new attribute as required?

Hi Gents,

I'm configuring my IDB management agents, and I've noticed the following error being thrown when I try to enable TLS:

I have created a self signed cert and configured it within the interface.

For reference, I used the following command to create my cert:

New-SelfSignedCertificate -Type Custom -Provider "Microsoft RSA SChannel Cryptographic Provider" -Subject "CN=Unify.IdentityBroker" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.2") -KeyUsage DigitalSignature -KeyAlgorithm RSA -KeyLength 2048 -CertStoreLocation "Cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears(5)

I have configured IdB to use IIS, but there is nothing in the doco to suggest that it should be restricted. 

http://voice.unifysolutions.net/topics/2943-configuring-identity-broker-for-use-with-iis/

Leaving access open to any authenticated user is potentially a security risk.  

I have configured IIS to only listed on 127.0.0.1, but presumably there is something else in IdB to perform this role. 

How can IdB be restricted when using IIS?

I have a date attribute in my Aurion Adapter called DateCommenced.  

In the IdB UI it appears as 2010-05-24. 

When it imports into MIM, it's a string type and is shown in the connector space as:

2010-05-24T00:00:00:000

When I look at FIM, (which we're replacing) it's also a string type, however it's shown in the connector space as:

2010-05-24

Has something changed in the handling of Dates between 3.x and 5.x? 

The UI is displaying "Specified argument was out of the range of valid values. Parameter name: key"  after configuring a Time Offset Flag Transformation.   Looking at the data, there is nothing currently in the column, I suspect this might be causing the error. 

There are two configured transformations:

<adapter name="TimeOffsetFlag" key="e761c890-313b-4b88-bfcf-272595dcf784">
   <Extended offset="-P15DT10H" sourceColumn="DateCommenced" destinationColumn="EmployeeStarted" LesserValue="True" EqualValue="True" GreaterValue="False" NullValue="False" adjustForLocal="false" xmlns="" />
 </adapter>
 <adapter name="TimeOffsetFlag" key="00eaab5c-89e9-41b4-9728-e7b342d07db8">
   <Extended offset="PT10H" sourceColumn="DateTerminated" destinationColumn="EmployeeTerminated" LesserValue="False" EqualValue="True" GreaterValue="False" NullValue="True" adjustForLocal="false" xmlns="" />
 </adapter>

The first one foes not throw an error. The second one does.

When trying to retrieve schema, MIM throws error below.

Log Name:      Application
Source:        FIMSynchronizationService
Date:          30/05/2017 8:44:54 AM
Event ID:      6801
Task Category: Server
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      dc1devfim01.dev.apra.gov.au
Description:
The extensible extension returned an unsupported error.
 The stack trace is:
 
 "Unify.Product.IdentityBroker.LdapOperationException: Object reference not set to an instance of an object.
   at Unify.Product.IdentityBroker.LdapConnection.SendRequest(ILdapRequest request)
   at Unify.Product.IdentityBroker.LdapConnection.GetSchema(String schemaDn)
   at System.Linq.Enumerable.WhereSelectEnumerableIterator`2.MoveNext()
   at System.Linq.Enumerable.Aggregate[TSource](IEnumerable`1 source, Func`3 func)
   at Unify.Product.IdentityBroker.LdapConnectionProxy.get_LdapSchema()
   at Unify.Product.IdentityBroker.LdapConnectionProxy.get_Schema()
   at Unify.Product.IdentityBroker.UnifyLdapConnectorTypeProxy.GetSchema(KeyedCollection`2 configParameters)
   at Unify.Product.IdentityBroker.UnifyLdapConnector.GetSchema(KeyedCollection`2 configParameters)
Forefront Identity Manager 4.4.1459.0"

20170529,22:44:53,UNIFY Identity Broker,Security engine,Information,"Require an LDAP access level
Request to require LDAP access level Read completed successfully.",Verbose
20170529,22:44:53,UNIFY Identity Broker,LDAP engine,Error,"Handling of LDAP schema request.
Handling of LDAP schema request from user mim on connection 127.0.0.1:65135 for the server schema failed with error ""Ob
ject reference not set to an instance of an object."". Duration: 00:00:00.",Normal
20170529,22:44:53,UNIFY Identity Broker,LDAP Engine,Error,"An error occurred on client from 127.0.0.1:65135. More detail
s:
Internal Server Error #11: System.NullReferenceException: Object reference not set to an instance of an object.
   at Unify.Product.IdentityBroker.SearchRequestHandlerBase.HandleRequest(IRfcLdapMessage message, CancellationToken tok
en, Action`1 postAction)
   at Unify.Product.IdentityBroker.RequestHandlerAuditingDecorator.HandleRequest(IRfcLdapMessage message, CancellationTo
ken token, Action`1 postAction)
   at Unify.Product.IdentityBroker.LDAPRequestHandlerSecurityDecorator.HandleRequest(IRfcLdapMessage message, Cancellati
onToken token, Action`1 postAction)
   at Unify.Product.IdentityBroker.LDAPConnection.<RespondToMessageAsync>d__33.MoveNext()",Normal
20170529,22:44:53,UNIFY Identity Broker,LDAP engine,Information,"Handling of LDAP unbind request.
Handling of LDAP unbind request received on connection mim to connect as user 127.0.0.1:65135 started.",Verbose
20170529,22:44:53,UNIFY Identity Broker,Security engine,Information,"Require an LDAP access level

Trying to retrieve schema in MIM & getting the error below in event logs. MIM UI displays error Unable to retrieve schema. Error: Exception from HRESULT: 0x80231343

Log Name:      Application
Source:        FIMSynchronizationService
Date:          25/05/2017 3:35:21 PM
Event ID:      6801
Task Category: Server
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      dc1devfim01.dev.apra.gov.au
Description:
The extensible extension returned an unsupported error.
 The stack trace is:
 
 "System.InvalidOperationException: Sequence contains no elements
   at System.Linq.Enumerable.Single[TSource](IEnumerable`1 source)
   at RegExExtensions.RegExExtensions.Extract(String text, String pattern)
   at Unify.Product.IdentityBroker.LdapAttributeDefinition..ctor(String definition)
   at Unify.Product.IdentityBroker.LdapSchema.<>c.<.ctor>b__0_0(String attr)
   at System.Linq.Enumerable.WhereSelectListIterator`2.MoveNext()
   at System.Linq.Enumerable.ToDictionary[TSource,TKey,TElement](IEnumerable`1 source, Func`2 keySelector, Func`2 elementSelector, IEqualityComparer`1 comparer)
   at Unify.Product.IdentityBroker.LdapSchema..ctor(SearchResultEntry entry)
   at Unify.Product.IdentityBroker.LdapConnection.GetSchema(String schemaDn)
   at System.Linq.Enumerable.WhereSelectEnumerableIterator`2.MoveNext()
   at System.Linq.Enumerable.Aggregate[TSource](IEnumerable`1 source, Func`3 func)
   at Unify.Product.IdentityBroker.LdapConnectionProxy.get_Schema()
   at Unify.Product.IdentityBroker.UnifyLdapConnectorTypeProxy.GetSchema(KeyedCollection`2 configParameters)
Forefront Identity Manager 4.4.1459.0"