Identity Broker Forum

Welcome to the community forum for Identity Broker.

Browse the knowledge base, ask questions directly to the product group, or leverage the community to get answers. Leave ideas for new features and vote for the features or bug fixes you want most.

0
Answered

Force connector delta import to run after export

Carol Wapshere 9 years ago in PowerShell connector updated by anonymous 9 years ago 4

I want the delta import to run immediately after the export without having to schedule it to run on its own. Is there a way I can trigger the delta import from the end of the Export script?


I did see something on the Google Apps Connector topic about import-after-export but can't see any such setting in the IdB 5 UI.

Answer
anonymous 9 years ago

This is possible using the REST endpoint. Use the same operation that EB uses to trigger an import. Unfortunately Confluence is down at the moment so I can't link it.


This feature is on the Google Apps connector for quite a specific reason - as the v4.1 connector can export without waiting for the result, the import needs to run afterwards. It's not in v5.0 as batched exports make it unnecessary.


Let me know your use case if you would like a more generic feature to be added to Identity Broker.

0
Answered

How is $components.InputEntities populated?

Carol Wapshere 9 years ago in PowerShell connector updated by anonymous 9 years ago 3

I have an IdB Powershell connector talking to Office 365. One of the IdB schema attributes is “Alumni” (Boolean flag). I populate this on import from O365, so it’s not something that is flowing from FIM. (There are reasons why it has to be like this to do with AADSync delay.)


Question is: if entity[‘Alumni’] has been changed on Import, will this cause the entity to be part of the $components.InputEntities when the Update script runs on export?


I know if the change comes from FIM via the Adapter it will be in that collection – just want to understand what happens if the change came from the Connector instead.

Answer
anonymous 9 years ago

I'm going to get around it by setting a Boolean value to 'true' on connector import if certain conditions are met. FIM has a constant export flow which sets the flag back to 'false' - so this should ensure the object is included in $components.InputEntries to the Update script.

0
Thanks

MIM2016 and IdB5 using the Microsoft Generic LDAP Management Agent

Bob Bradley 9 years ago in PowerShell connector updated by anonymous 9 years ago 1

Congratulations to the UNIFY PG for an outstanding job with IdB5. I haven't had a chance to use it in anger until this weekend just gone, and it was everything I hoped it would be. My goal was to set up a dummy HR connector to create a suitable platform to run my MIMTeam demo on 14th of April, and I was able to reuse some libraries from another project to rapidly build a PowerShell connector to a Mockaroo.com JSON webservice for 1000 random users (with controllable set of reference data).


I am almost finished the demo build and just wanted to say thanks - it's awesome how well this looks and works - particularly given I didn't really know what I was doing when I created the LDAP MA instance and pointed it to IdB5's LDAP service for the first time. Schema discovery meant that I could do refresh/rediscover multiple times as I built up the concepts. Performance is great, and flexibility is outstanding - looking forward to showing this off (just quietly).

Answer
anonymous 9 years ago

Thanks Bob, really appreciate the kind words!

0
Answered

Multiple object class support for IdB5

Bob Bradley 9 years ago updated by anonymous 9 years ago 3

I am looking at https://unifysolutions.jira.com/wiki/display/IDB50/Adapter+Overview but I can't find any documentation on how to combine objects from different connectors into the same adapter as I was able to do in IdB4 using a composite adapter. I was always under the impression that the composite adapter idea was being obsoleted but that it was being replaced with another approach which would accommodate this requirement. I now wish to add a "state" object class in my existing "HR Person" adapter. Can I please have a pointer as to how to do this in IdB5?

Answer
anonymous 9 years ago

As Identity Broker is now essentially an LDAP server, it's up to you to decide what objects you want to bring into the IdM platform. For FIM/MIM, have a look at partitions/heirarchies and objects classes here.

0
Not a bug

An unrecognized critical control was supplied

Bob Bradley 9 years ago updated by anonymous 9 years ago 2

The following error was reported from a FIM import:

Handling of LDAP search request from user hrma on connection 127.0.0.1:51554 targeting OU=HR,DC=IdentityBroker with a scope of WholeSubtree failed with error "An unrecognized critical control was supplied.". Duration: 00:00:00.


From the error log:


20160403,23:58:20,UNIFY Identity Broker,LDAP engine,Error,"Handling of LDAP search request.

Handling of LDAP search request from user hrma on connection 127.0.0.1:63713 targeting OU=HR,DC=IdentityBroker with a scope of WholeSubtree failed with error ""An unrecognized critical control was supplied."". Duration: 00:00:00.",Normal
20160403,23:58:50,UNIFY Identity Broker,LDAP Engine,Information,A client has connected to the LDAP endpoint from address: 127.0.0.1:63741.,Normal
20160403,23:58:50,UNIFY Identity Broker,LDAP engine,Error,"Handling of LDAP search request.

Going by the frequency of the error I believe that it is from the Event Broker agent:

Image 3042

Answer
anonymous 9 years ago

Hi Bob,


You're correct, it is being triggered by the FIM Event Broker operation. This is because the mechanism used to check for changes in LDAP/AD has not yet been added as a supported feature in Identity Broker (it's roadmapped). See https://unifysolutions.jira.com/wiki/display/EB32/Identity+Broker+Changes for details on checking for changes in Identity Broker.


Thanks.

0
Not a bug

Identity Broker v5.0.4 reports 2 certificates

Bob Bradley 9 years ago updated by anonymous 9 years ago 1

A vanilla Identity Broker v5.0.4 x64 installation is reporting the following alert on the dashboard after startup (Windows 2012 platform):


Configuration does not uniquely identify a certificate. Found 2 certificates.

Answer
anonymous 9 years ago

Hi Bob,


That's fine, it just means that if you want to add TLS to the LDAP endpoint you need to configure the certificate on the Settings page. If you don't want to use TLS you can ignore the warning.

0
Not a bug

Identity Broker v5.0.4 reports LDAP Engine Error

Bob Bradley 9 years ago updated by anonymous 9 years ago 11

A vanilla IdB 5.0.4 installation is reporting the following exception on the dashboard after service startup:

The LDAP endpoint failed to startup: An attempt was made to access a socket in a way forbidden by its access permissions


Full error message as follows from the log:


20160401,02:16:10,UNIFY Identity Broker,Logging Engine,Information,Log file started.,Minimal

20160401,02:16:10,UNIFY Identity Broker,LDAP Engine,Error,"The LDAP endpoint failed to startup: System.Net.Sockets.SocketException (0x80004005): An attempt was made to access a socket in a way forbidden by its access permissions
at System.Net.Sockets.Socket.DoBind(EndPoint endPointSnapshot, SocketAddress socketAddress)
at System.Net.Sockets.Socket.Bind(EndPoint localEP)
at System.Net.Sockets.TcpListener.Start(Int32 backlog)
at Unify.Product.IdentityBroker.LDAPEngine.UnsafeEnableEndpoint()
at Unify.Product.IdentityBroker.LDAPEngine.EnableEndpoint()",Minimal


Answer
anonymous 9 years ago

Is the port already in use (netstat -ab)? What IP are you binding to, can you try 0.0.0.0?

0
Answered

IDB 5.0.4 Connector import does not reflect in adapter

Eddie Kirkman 9 years ago updated by anonymous 9 years ago 8

At DET I have run import all on 4 connectors, bringing in 993 k users, 963 k users, 13 k users and 150 organisations. Part of the check to see that everything had worked is to check LDAP endpoint. One of my containers is missing - the connector import was successful but in the log I see error messages about failing to reflect:


Request to reflect change entities of the adapter.
Request to reflect change entities of the CAMSGeneric (30914957-d066-4f84-97e7-5c29d652d120) adapter errored with message: Timeout expired. The timeout period elapsed prior to completion of the operation or the server is not responding.. Duration: 00:16:40.1628000
Error details:
System.Data.SqlClient.SqlException (0x80131904): Timeout expired. The timeout period elapsed prior to completion of the operation or the server is not responding. ---> System.ComponentModel.Win32Exception (0x80004005): The wait operation timed out
at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) ...


Any ideas on how to get the connector entities to flow through to the adapter?

I tried clearing the connector to see if an import all might give it the necessary kick, but the clear connector option gives me the warning but does nothing if I select OK - i.e. my connector is unclearable.



Answer
anonymous 9 years ago

Hi Eddie,


Database health in Identity Broker v5.0 is as important as it was in v4.1. Please ensure that indexes are maintained and statistics are kept up to date. This is especially true if there are a large number of changes to the database.


Thanks.

0
Fixed

Identity Broker 5.0.4 breaks custom connector

Eddie Kirkman 9 years ago updated by anonymous 7 years ago 2


Working solution with IDB 5.0.3. Installed 5.0.4 and the custom connector for CAMS failed with:

Change detection engine import all items for connector CAMS User failed with reason Method not found: 'Void Unify.Product.IdentityBroker.DirectEntityFieldsToFieldListConverter..ctor()'..

Richard Green has modified his connector

Answer
anonymous 7 years ago

Fixed in 5.0.5

0
Fixed

Identity Broker Version displayed incorrectly on About page

Eddie Kirkman 9 years ago updated by anonymous 7 years ago 2

From Identity Broker 5 web console, the about link presents incomplete version information (missing the major version)Image 3041

Answer
anonymous 7 years ago

Fixed in 5.1