Identity Broker Forum

Welcome to the community forum for Identity Broker.

Browse the knowledge base, ask questions directly to the product group, or leverage the community to get answers. Leave ideas for new features and vote for the features or bug fixes you want most.

0
Fixed

When editing Rename Transformation I am only shown the first one

Carol Wapshere 9 years ago updated by anonymous 9 years ago 5

IdB 5.0.4 RTM. In my Adapters I have both Rename transformations and Join transformations. There is a long list of attribute renames in each. I see the list in the UI but when I try to edit the list I am only shown the first one. I have had to go through the XML to make my changes.

Answer
anonymous 9 years ago

Hi Carol,


I was able to reproduce only in IE8. I have tested a fix, and it will be available in the next release. Please either update to a more modern browser, wait until then the next release, or let me know if you'd like me to do up a patch.


Thanks.

0
Completed

Identity Broker last run connector statistics are cleared on a service restart

Andrew Silcock 9 years ago updated by anonymous 7 years ago 2

Currently in IDB the Import and Export statistics for the last connector run are lost when the Identity Broker windows service is restarted. After a restart it makes it difficult to tell when the last run was and how long etc it took to run.


It would be a nice to have if this data was stored persistently somewhere so it was visible on the Connector page after a restart.

Answer
anonymous 7 years ago

Hi Andrew.


This is the current intention of the statistics, as they aren't persisted. There is an item on the road map (Improved statistics...) to make improvements in this area, however, we'd love to get some feedback or suggestions if you have any?


Thanks.

0
Answered

The server cannot handle directory requests during installation

Matthew Woolnough 9 years ago updated by anonymous 9 years ago 4

With EB and IdB:

Login details validation failed with the following error: "The server cannot handle directory requests." Please check your login information. There doesn't appear to be any issues with AD.

Answer
anonymous 9 years ago

Found a solution online suggesting to provide the override for System.DirectoryServices.AccountManagement.ContextOptions of Negotiate, which is strange as it has worked everywhere else. The setting has worked and will be available in the next releases.

0
Answered

LDAP timeout in IdB

Eddie Kirkman 9 years ago updated by anonymous 9 years ago 1

Is there anywhere that the LDAP timeout can be configured for the IdB 5 adapters?

FIM import tifailed with stopped-extension-dl;l and event viewer shows

The extensible extension returned an unsupported error.

The stack trace is:

"Unify.Product.IdentityBroker.LdapOperationException: Operation timed out.

at Unify.Product.IdentityBroker.LdapConnection.SendRequest(ILdapRequest request)


Is there a setting for the LDAP timeout somewhere?

0
Answered

CPU pegs at 100% during import all

Eddie Kirkman 9 years ago updated by anonymous 8 years ago 6

Running an Import All of a million users is pegging the CPU at 100%. The environment is not production so the server only has 1 CPU.

Is that expected/normal?

Is there any way to make the service play nice?

0
Answered

Multiple object class support for IdB5

Bob Bradley 9 years ago updated by anonymous 9 years ago 3

I am looking at https://unifysolutions.jira.com/wiki/display/IDB50/Adapter+Overview but I can't find any documentation on how to combine objects from different connectors into the same adapter as I was able to do in IdB4 using a composite adapter. I was always under the impression that the composite adapter idea was being obsoleted but that it was being replaced with another approach which would accommodate this requirement. I now wish to add a "state" object class in my existing "HR Person" adapter. Can I please have a pointer as to how to do this in IdB5?

Answer
anonymous 9 years ago

As Identity Broker is now essentially an LDAP server, it's up to you to decide what objects you want to bring into the IdM platform. For FIM/MIM, have a look at partitions/heirarchies and objects classes here.

0
Not a bug

An unrecognized critical control was supplied

Bob Bradley 9 years ago updated by anonymous 9 years ago 2

The following error was reported from a FIM import:

Handling of LDAP search request from user hrma on connection 127.0.0.1:51554 targeting OU=HR,DC=IdentityBroker with a scope of WholeSubtree failed with error "An unrecognized critical control was supplied.". Duration: 00:00:00.


From the error log:


20160403,23:58:20,UNIFY Identity Broker,LDAP engine,Error,"Handling of LDAP search request.

Handling of LDAP search request from user hrma on connection 127.0.0.1:63713 targeting OU=HR,DC=IdentityBroker with a scope of WholeSubtree failed with error ""An unrecognized critical control was supplied."". Duration: 00:00:00.",Normal
20160403,23:58:50,UNIFY Identity Broker,LDAP Engine,Information,A client has connected to the LDAP endpoint from address: 127.0.0.1:63741.,Normal
20160403,23:58:50,UNIFY Identity Broker,LDAP engine,Error,"Handling of LDAP search request.

Going by the frequency of the error I believe that it is from the Event Broker agent:

Image 3042

Answer
anonymous 9 years ago

Hi Bob,


You're correct, it is being triggered by the FIM Event Broker operation. This is because the mechanism used to check for changes in LDAP/AD has not yet been added as a supported feature in Identity Broker (it's roadmapped). See https://unifysolutions.jira.com/wiki/display/EB32/Identity+Broker+Changes for details on checking for changes in Identity Broker.


Thanks.

0
Not a bug

Identity Broker v5.0.4 reports 2 certificates

Bob Bradley 9 years ago updated by anonymous 9 years ago 1

A vanilla Identity Broker v5.0.4 x64 installation is reporting the following alert on the dashboard after startup (Windows 2012 platform):


Configuration does not uniquely identify a certificate. Found 2 certificates.

Answer
anonymous 9 years ago

Hi Bob,


That's fine, it just means that if you want to add TLS to the LDAP endpoint you need to configure the certificate on the Settings page. If you don't want to use TLS you can ignore the warning.

0
Not a bug

Identity Broker v5.0.4 reports LDAP Engine Error

Bob Bradley 9 years ago updated by anonymous 9 years ago 11

A vanilla IdB 5.0.4 installation is reporting the following exception on the dashboard after service startup:

The LDAP endpoint failed to startup: An attempt was made to access a socket in a way forbidden by its access permissions


Full error message as follows from the log:


20160401,02:16:10,UNIFY Identity Broker,Logging Engine,Information,Log file started.,Minimal

20160401,02:16:10,UNIFY Identity Broker,LDAP Engine,Error,"The LDAP endpoint failed to startup: System.Net.Sockets.SocketException (0x80004005): An attempt was made to access a socket in a way forbidden by its access permissions
at System.Net.Sockets.Socket.DoBind(EndPoint endPointSnapshot, SocketAddress socketAddress)
at System.Net.Sockets.Socket.Bind(EndPoint localEP)
at System.Net.Sockets.TcpListener.Start(Int32 backlog)
at Unify.Product.IdentityBroker.LDAPEngine.UnsafeEnableEndpoint()
at Unify.Product.IdentityBroker.LDAPEngine.EnableEndpoint()",Minimal


Answer
anonymous 9 years ago

Is the port already in use (netstat -ab)? What IP are you binding to, can you try 0.0.0.0?

0
Answered

IDB 5.0.4 Connector import does not reflect in adapter

Eddie Kirkman 9 years ago updated by anonymous 9 years ago 8

At DET I have run import all on 4 connectors, bringing in 993 k users, 963 k users, 13 k users and 150 organisations. Part of the check to see that everything had worked is to check LDAP endpoint. One of my containers is missing - the connector import was successful but in the log I see error messages about failing to reflect:


Request to reflect change entities of the adapter.
Request to reflect change entities of the CAMSGeneric (30914957-d066-4f84-97e7-5c29d652d120) adapter errored with message: Timeout expired. The timeout period elapsed prior to completion of the operation or the server is not responding.. Duration: 00:16:40.1628000
Error details:
System.Data.SqlClient.SqlException (0x80131904): Timeout expired. The timeout period elapsed prior to completion of the operation or the server is not responding. ---> System.ComponentModel.Win32Exception (0x80004005): The wait operation timed out
at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) ...


Any ideas on how to get the connector entities to flow through to the adapter?

I tried clearing the connector to see if an import all might give it the necessary kick, but the clear connector option gives me the warning but does nothing if I select OK - i.e. my connector is unclearable.



Answer
anonymous 9 years ago

Hi Eddie,


Database health in Identity Broker v5.0 is as important as it was in v4.1. Please ensure that indexes are maintained and statistics are kept up to date. This is especially true if there are a large number of changes to the database.


Thanks.