Identity Broker Forum
Welcome to the community forum for Identity Broker.
Browse the knowledge base, ask questions directly to the product group, or leverage the community to get answers. Leave ideas for new features and vote for the features or bug fixes you want most.
Chris 21 : GTR line type is recognized but not valid [Data]
With this patch (Unify.Framework.Chris21GtrWorker.dll) I am receiving the following error:
20170630,05:28:39,chris21 GTR Communicator,List,Warning,"Logout failed with the following message: GTR line type is recognized but not valid [Data].",Verbose
Is this a known error? If so, does it need to be resolved? or else, any direction on how to fix or what problems this may cause because it does appear to be syncing in both directions even with the error.
If you upgrade to v3.0.6 you should get better feedback on the logout error.
Alternatively, you can set the Skip Logout setting to true to mimic previous behaviour. Otherwise ignore the error as it's just a warning, operation should continue.
Determine which attribute is causing error
I have the error below, but the logs do not say which attribute is at fault for passing onto the Sharepoint team for rectication.
How can I determine which attribute is causing the error?
Change detection engine import all items for connector SharePoint User Profile failed with reason Provided value Avanteos Investments Limited failed validation . Duration: 00:00:05.7520690
Error details:
Unify.Product.IdentityBroker.EntitySchemaValidationException: Provided value Avanteos Investments Limited failed validation ---> System.FormatException: Input string was not in a correct format.
at System.Number.ParseSingle(String value, NumberStyles options, NumberFormatInfo numfmt)
at System.String.System.IConvertible.ToSingle(IFormatProvider provider)
at System.Convert.ChangeType(Object value, Type conversionType, IFormatProvider provider)
at Unify.Product.IdentityBroker.EntityObjectTypeSchemaValidator`2.CreateValue(Object dataValue)
--- End of inner exception stack trace ---
at Unify.Product.IdentityBroker.EntityObjectTypeSchemaValidator`2.CreateValue(Object dataValue)
at Unify.Product.IdentityBroker.EntityMultiValueValidatorFactoryBase`3.<>c__DisplayClass1_0.<GetValidator>b__0(Object value)
at Unify.Product.IdentityBroker.EntityMultiValueObjectTypeSchemaValidator`3.<CreateValue>b__6_0(Object item)
at System.Linq.Enumerable.WhereSelectArrayIterator`2.MoveNext()
at System.Collections.Generic.List`1..ctor(IEnumerable`1 collection)
at System.Linq.Enumerable.ToList[TSource](IEnumerable`1 source)
at Unify.Product.IdentityBroker.EntityMultiValueObjectTypeSchemaValidator`3.CreateValue(Object dataValue)
at Unify.Product.IdentityBroker.SharePoint2010UserProfileConnector.CreateValueTypeFromProfileData(PropertyDataContract data)
at Unify.Product.IdentityBroker.SharePoint2010UserProfileConnector.<ConvertConnectorEntityFromPropertyData>b__22_2(<>f__AnonymousType5`2 <>h__TransparentIdentifier0)
at System.Linq.Enumerable.WhereSelectEnumerableIterator`2.MoveNext()
at System.Linq.Enumerable.WhereSelectEnumerableIterator`2.MoveNext()
at Unify.Framework.Visitor.Visit[T](IEnumerable`1 visitCollection, Action`2 visitor)
at Unify.Product.IdentityBroker.SharePoint2010UserProfileConnector.ConvertConnectorEntityFromPropertyData(PropertyDataContract[] profile)
at Unify.Product.IdentityBroker.SharePoint2010UserProfileConnector.<GetAllEntities>d__26.MoveNext()
at System.Linq.Buffer`1..ctor(IEnumerable`1 source)
at System.Linq.Enumerable.ToArray[TSource](IEnumerable`1 source)
at Unify.Product.IdentityBroker.AuditReadingConnectorDecorator.GetAllEntities(IStoredValueCollection storedValues, CancellationToken cancellationToken)
at Unify.Product.IdentityBroker.EventNotifierReadingConnectorDecoratorBase`1.GetAllEntities(IStoredValueCollection storedValues, CancellationToken cancellationToken)
at Unify.Product.IdentityBroker.ChangeDetectionImportAllJob.ImportAllChangeProcess()
at Unify.Product.IdentityBroker.ChangeDetectionImportAllJob.RunBase()
at Unify.Framework.DefinedScopeJobAuditTrailJobDecorator.Run()
at Unify.Product.IdentityBroker.ConnectorJobExecutor.<>c__DisplayClass30_0.<Run>b__0()
at Unify.Framework.AsynchronousJobExecutor.PerformJobCallback(Object state)",Normal
Hi Matt,
It looks like you are assigning a string "Avanteos Investments Limited" to a Single Schema Field, not a String Schema Field. Is this intended? This field may be mis-configured.
Error enabling TLS from Management Agent
Hi Gents,
I'm configuring my IDB management agents, and I've noticed the following error being thrown when I try to enable TLS:
I have created a self signed cert and configured it within the interface.
For reference, I used the following command to create my cert:
New-SelfSignedCertificate -Type Custom -Provider "Microsoft RSA SChannel Cryptographic Provider" -Subject "CN=Unify.IdentityBroker" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.2") -KeyUsage DigitalSignature -KeyAlgorithm RSA -KeyLength 2048 -CertStoreLocation "Cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears(5)
Please try Unify.IdentityBroker.FIMAdapter.dll and let me know how it goes.
Identity Broker Service Installation/Upgrade Setup Wizard Ended Prematurely
Identity Broker Service Installation/upgrade Setup Wizard Ended Prematurely. Here are the version details:
Current Version • Identity Broker Service v4.1.4 RTM x64
Target Version
• Identity Broker Service v5.1.0.2 RTM x64
Please see the attached screenshots.
Attempting to import binary attribute failing
I'm trying to read a read a binary attribute (Image) from an adapter into a PowerShell script, and am currently getting an exception in IdB - which i suspect is due to an image being too large. I have tried altering the MaxReceivedMessageSize field in the Unify.Service.Connect.exe.config under the <basicHttpBinding> element but the error message doesn't seem to change (i.e. the message size quota value in the error message, doesn't change regardless of the value I put in the MaxReceivedMessageSize field).
Identity Broker Version 4.1.5
Change detection engine import all items failed. Change detection engine import all items for connector Image Resize failed with reason An exception has been thrown when reading the stream.. Duration: 00:01:59.4399428 Error details: System.Management.Automation.CmdletInvocationException: An exception has been thrown when reading the stream. ---> System.IO.IOException: An exception has been thrown when reading the stream. ---> System.ServiceModel.CommunicationException: The maximum message size quota for incoming messages (204003200) has been exceeded. To increase the quota, use the MaxReceivedMessageSize property on the appropriate binding element. ---> System.ServiceModel.QuotaExceededException: The maximum message size quota for incoming messages (204003200) has been exceeded. To increase the quota, use the MaxReceivedMessageSize property on the appropriate binding element. --- End of inner exception stack trace --- |
Thanks guys, increasing the buffer size on the consuming service solved the issue.
SID Mapping errors
This is a pre-existing issue, so could very well be environmental. We're not meant to be fixing pre-existing issues, but if it's something simple it should be addressed.
Any idea what might be causing this?
IdB5.x
System.ServiceModel.FaultException`1[System.ServiceModel.ExceptionDetail]: No mapping between account names and security IDs was done (Fault Detail is equal to An ExceptionDetail, likely created by IncludeExceptionDetailInFaults=true, whose value is: System.ComponentModel.Win32Exception: No mapping between account names and security IDs was done at Microsoft.Office.Server.Utilities.Win32.AdvApi.LookupAccountName(String lpSystemName, String lpAccountName, IntPtr Sid, Int32& cbSid, StringBuilder ReferencedDomainName, Int32& cchReferencedDomainName, SID_NAME_USE& peUse) at Microsoft.Office.Server.UserProfiles.UserProfileGlobal.GetSidFromAccount(String strAccountName, SID_NAME_USE[] IntendedAccountType, SID_NAME_USE& sidUse) at Microsoft.Office.Server.UserProfiles.UserProfileGlobal.GetSidFromAccount(String strAccountName, Int32 nMaxLengh) at Microsoft.Office.Server.UserProfiles.UserProfileGlobal.GetSidFromAccount(UserProfileApplicationProxy proxy, Guid partitionID, String strAccountName, Boolean isWindowsAccount) at Microsoft.Office.Server.UserProfiles.UserProfile..ctor(UserProfileManager objManager, String strAccountName, String strPreferredName) ...).
IdB3.x
System.ServiceModel.FaultException`1[System.ServiceModel.ExceptionDetail]: Invalid Property Value: Could not find SID corresponding to input account name. (Fault Detail is equal to An ExceptionDetail, likely created by IncludeExceptionDetailInFaults=true, whose value is:
Microsoft.Office.Server.UserProfiles.PropertyInvalidValueException: Invalid Property Value: Could not find SID corresponding to input account name.
at Microsoft.Office.Server.UserProfiles.UserProfileGlobal.ValidatedPerson(Object value, UserFormat userFormat, UserProfileApplicationProxy userProfileApplicationProxy, Guid partitionID)
at Microsoft.Office.Server.UserProfiles.UserProfileGlobal.ValidatedSingleValue(Object value, ProfileSubtypeProperty prop, PropertyDataType propDataType, UserFormat userFormat, UserProfileApplicationProxy userProfileApplicationProxy, Guid partitionID, SiteContext si)
at Microsoft.Office.Server.UserProfiles.UserProfileGlobal.ValidatedValue(Object value, ProfileSubtypeProperty prop, PropertyDataType propDataType, UserFormat userFormat, UserProfileApplicationProxy userProfileApplicationProxy, Guid partitionID, SiteContext si)
at Microsoft.Office.Server.UserProfiles.ProfileValueC...).
I'd recommend speaking with the SharePoint and/or sys admin, as this error is pretty low down in the SharePoint stack and is calling into native API's (advapi32.dll
LookupAccountName).
User profile provisioning: System.Collections.Generic.KeyNotFoundException
Provisioning users to SharePoint for the 1st time on IdB 5.1 and encountered the following error.
System.Collections.Generic.KeyNotFoundException: The key 0799C19A00044B368A7D06D9AE23CC07 could not be found in the list of known profile types. The known types are UserProfile_GUID, SID, ADGuid, AccountName, FirstName, SPS-PhoneticFirstName, LastName, SPS-PhoneticLastName, PreferredName, SPS-PhoneticDisplayName, WorkPhone, Department, Title, SPS-JobTitle, Manager, AboutMe, PersonalSpace, PictureURL, UserName, QuickLinks, WebSite, PublicSiteRedirect, SPS-DataSource, SPS-MemberOf, SPS-Dotted-line, SPS-Peers, SPS-Responsibility, SPS-SipAddress, SPS-MySiteUpgrade, SPS-DontSuggestList, SPS-ProxyAddresses, SPS-HireDate, SPS-DisplayOrder, SPS-ClaimID, SPS-ClaimProviderID, SPS-ClaimProviderType, SPS-LastColleagueAdded, SPS-OWAUrl, SPS-SavedAccountName, SPS-SavedSID, SPS-ResourceSID, SPS-ResourceAccountName, SPS-ObjectExists, SPS-MasterAccountName, SPS-DistinguishedName, SPS-SourceObjectDN, SPS-LastKeywordAdded, WorkEmail, CellPhone, Fax, HomePhone, Office, SPS-Location, SPS-TimeZone, Assistant, SPS-PastProjects, SPS-Skills, SPS-School, SPS-Birthday, SPS-StatusNotes, SPS-Interests, SPS-EmailOptin, ResponsibleSupervisorEntities, AnalysisEntities, RoleLevel, CostCentre, Company, DaysAtOffice, StaffType, usrDivision, Team, GroupOrg, Branch, Floor, RoleDescriptionUrl
at Unify.Product.IdentityBroker.SharePoint2010Utilities.ConvertAttributeToValues(KeyValuePair`2 attribute, IDictionary`2 profileTypes, IValueAdapter`2 referenceValueToUserProfileNameAdapter, UserProfileNameToStringAdapter userProfileToNameAdapter)
at Unify.Product.IdentityBroker.SharePoint2010UserProfileConnector.<ConvertConnectorEntityToPropertyData>b__22_1(<>f__AnonymousType3`2 <>h__TransparentIdentifier0)
at System.Linq.Enumerable.WhereSelectEnumerableIterator`2.MoveNext()
at System.Linq.Buffer`1..ctor(IEnumerable`1 source)
at System.Linq.Enumerable.ToArray[TSource](IEnumerable`1 source)
at Unify.Product.IdentityBroker.SharePoint2010UserProfileConnector.ConvertConnectorEntityToPropertyData(IEnumerable`1 entity)
at Unify.Product.IdentityBroker.SharePoint2010UserProfileConnector.AddEntity(IConnectorEntity entity, ISharePoint2010UserProfileService communicatorChannel)
at Unify.Product.IdentityBroker.SharePoint2010UserProfileConnector.<>c__DisplayClass7_1.<AddEntities>b__1(IConnectorEntity entity)
at Unify.Framework.Visitor.Visit[T](IEnumerable`1 visitCollection, Action`2 visitor)
at Unify.Product.IdentityBroker.SharePoint2010UserProfileConnector.<>c__DisplayClass7_0.<AddEntities>b__0(ISharePoint2010UserProfileService channel)
at Unify.Product.IdentityBroker.SharePointWCFAgent.Execute[TService](WcfCommunicatorFactory`1 serviceFactory, Action`1 service, Int32 maxItemsInObjectGraph)
at Unify.Product.IdentityBroker.SharePoint2010UserProfileConnector.AddEntities(IEnumerable`1 entities, ISaveEntityResults`2 results)
at Unify.Product.IdentityBroker.AuditAddingConnectorDecorator.AddEntities(IEnumerable`1 entities, ISaveEntityResults`2 results)
at Unify.Product.IdentityBroker.EventNotifierAddingConnectorDecorator.AddEntities(IEnumerable`1 entities, ISaveEntityResults`2 results)
Add Ability to include query parameters
Currently the default query for Import All is "*"
In TRIM, you can drill this down, such as "login:*" to get all users with a populated login attribute.
Would it be possible to add the ability to fill in a query string on the connector page, which - when filled, would override the "*" sent to the endpoint?
I've tested this with the REST v8 and confirmed it works. Personally I need this for v4.1 but can see it being useful for newer connectors also.
Feature implementation complete and is included in the following releases:
- v4.1.1 RC3
- v5.0.1 RC3
- v5.1.0 RC6
- v5.2.0 RC4
Restrict access to IIS
I have configured IdB to use IIS, but there is nothing in the doco to suggest that it should be restricted.
http://voice.unifysolutions.net/topics/2943-configuring-identity-broker-for-use-with-iis/
Leaving access open to any authenticated user is potentially a security risk.
I have configured IIS to only listed on 127.0.0.1, but presumably there is something else in IdB to perform this role.
How can IdB be restricted when using IIS?
Hi Matt,
We removed the IDB auth settings from 5.0 as it was unmaintanable. From 5.2 onwards, we provide auth settings through Owin (as seen on this page.)
For 5.0 and 5.1, auth settings can be restricted in IIS through groups etc, using examples such as this one or settings found here. Up to the consultant and client how the restrictions look in line with what the requirements are.
Adapter Transformation Trigger Behaviour
Question about what triggers an adapter transformation to recalculate. Say I have a PowerShell adapter transformation that calculates the DN of a manager. Will that transformation only run again if the underlying connector is updated? If not, will an Import All on the connector trigger the adapter transformation to fire even on objects with no change in the connector?
Hi Daniel,
All transformations run when an entity is determined to have changed, see Change Detection for details. PowerShell transformations do not participate in the change detection process. However if you are calculating a manager DN based on another attribute on the adapter entity (e.g. the manager's detnumber or name), then the change to that attribute itself would trigger a change.
If the manager's details are retrieved via a Join Transformation, then any change to the attributes in the Join Criteria of both the entity in the base connector or to any entity in the relational connector which would join to the base entity will trigger a change.
The only issue you should encounter with changes not being automatically triggered for a PowerShell transformation would be if you are actually retrieving information from an external system as part of the transformation. There is currently no way for a PowerShell transformation to monitor external systems for changes.
Please let me know if you need further clarification.
Customer support service by UserEcho