Identity Broker Forum
Welcome to the community forum for Identity Broker.
Browse the knowledge base, ask questions directly to the product group, or leverage the community to get answers. Leave ideas for new features and vote for the features or bug fixes you want most.

IDB 5.0.4 Connector import does not reflect in adapter
At DET I have run import all on 4 connectors, bringing in 993 k users, 963 k users, 13 k users and 150 organisations. Part of the check to see that everything had worked is to check LDAP endpoint. One of my containers is missing - the connector import was successful but in the log I see error messages about failing to reflect:
Request to reflect change entities of the adapter.
Request to reflect change entities of the CAMSGeneric (30914957-d066-4f84-97e7-5c29d652d120) adapter errored with message: Timeout expired. The timeout period elapsed prior to completion of the operation or the server is not responding.. Duration: 00:16:40.1628000
Error details:
System.Data.SqlClient.SqlException (0x80131904): Timeout expired. The timeout period elapsed prior to completion of the operation or the server is not responding. ---> System.ComponentModel.Win32Exception (0x80004005): The wait operation timed out
at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) ...
Any ideas on how to get the connector entities to flow through to the adapter?
I tried clearing the connector to see if an import all might give it the necessary kick, but the clear connector option gives me the warning but does nothing if I select OK - i.e. my connector is unclearable.

Hi Eddie,
Database health in Identity Broker v5.0 is as important as it was in v4.1. Please ensure that indexes are maintained and statistics are kept up to date. This is especially true if there are a large number of changes to the database.
Thanks.

Identity Broker 5.0.4 breaks custom connector
Working solution with IDB 5.0.3. Installed 5.0.4 and the custom connector for CAMS failed with:
Change detection engine import all items for connector CAMS User failed with reason Method not found: 'Void Unify.Product.IdentityBroker.DirectEntityFieldsToFieldListConverter..ctor()'..
Richard Green has modified his connector

Identity Broker Version displayed incorrectly on About page
From Identity Broker 5 web console, the about link presents incomplete version information (missing the major version)

IDB5 MA throws cd-existing-object error after a failed export
Using IDB5 (5.0.3 - not yet confirmed if this is still an issue with 5.0.4, but looking at the list of fixes, I suspect so).
Exporting a user to DET's CAMS system, for which a connector has been written. In Dev the system uses a dummy web service front end to allow users to be exported. If an export occurs when the service is unavailable, then an error is returned to the MA (in this case a missing end point error). That is as expected.
At this point, an entity search in the adapter does not show the user as being there.
Starting the web service and repeating the export from FIM, gives a cd-existing-object error.
To enable the export to complete successfully, it was necessary to run an import all on the the IDB5 connector - even though this reported no pending changes and no change to the number of adapter entities.
Any idea what might be going on?

Entity search on a GUID - wildcard breaks the UI
When searching adapter space and trying to filter on a GUID based attribute, if the value put in the filter is not a GUID, then a System.FormatException is thrown (no surprise there). The problem is (and I am not sure if this is a bug or simply how it should behave) that I cannot find any way to clear that error or clear the filter. The only way to get a valid entity search screen back is to restart the service or restart the browser. It would be nice if refreshing the adapter view or re-selecting the entity count would present the normal entity list

Limited export run profiles not working
With IDB5.0.3 configured for the Extensible Connectivity 2 Management Agent using the dll from the Unify Identity Broker for Microsoft FIM 5.0.3 installer.
Create an export run profile with an object limit.
Run the export run profile
All pending export objects are exported and when the run completes, the status message indicates that object limit was reached. See screenshots.

Hi Eddie,
I've looked into this and it seems that the Generic LDAP MA (provided by Microsoft) has the same problem as well. The problem is that FIM gives the full collection of changes to the MA rather than only the number requested, and the number itself doesn't appear to be given on any parameters or configuration options either, so there is simply know way for the MA to know what the limit is.
I would suggest raising a bug with Microsoft about this (I can help with some of the technicalities if required). As a workaround, you can set the "Batch size (objects)" parameter to be the same as the "Number of Objects" parameter, in which case a single batch of the correct amount would be exported and then the agent would stop with "stopped-object-limit".

Update to the IDB connector for WorkDay adding flatterned addresses and phone numbers
Please look at adding the following fields to the WorkDay Connector:
- Primary Business Address (Formatted_Address based of the primary="true" type="WORK"
- Priimary Business Office Phone (Formatted_Phone based of the primary="true" type="WORK" usage descriptor="Telephone")
- Primary Business Mobile Phone (Formatted_Phone based of the primary="true" type="WORK" usage descriptor="Mobile")
- Primary Private Mobile Phone (Formatted_Phone based of the primary="true" type="HOME" usage descriptor="Mobile")

Signing of IDB 5.1 logs
Adding of the signing of log files whould ensure that we can show they were not modified, which would in turn provide a chain of evidence for auditors...

Are you referring to signing the CSV logs? Where would the signature appear?
Are there other requirements? If it's just that no local user can modify the logs, then a different log store such as Splunk would meet that by shipping the logs off. Something more bespoke is now possible in v5.1 thanks to the PowerShell log writer.

Strange behaviour of CSV connector export
The CSV connector is exhibiting some strange behaviour when exporting. See below a file that was written to. Telephone is a multivalue string field in the connector schema - the rest are strings.
Key,Name,EmployeeID,Telephone,Email
13,Matthew Clark,1337,another@address.com,Unify.Framework.StringValue[]
19,Anthony Sheehy,1339,tony.sheehy@unifysolutions.net,Unify.Framework.StringValue[]
100001,Josef,100001,mail@maily.com,System.Collections.Generic.List`1Unify.Framework.StringValue
Telephone and email have seemingly switched value types. I am assuming this is why the string value array writing has appeared.
CSV Export User.png

Identity Broker Service does not start - event viewer error indicates that connection string attribute is missing even though attribute exists in extensible configuration
Task:
Installation of Identity Broker for SAP HCM
Task List:
1. Install Identity Broker service
2. Configure Identity Broker service
3. Install and configure connector and adapter components.
After the successfull installation of Identity Broker service the Identity Broker database was created and the Identity Broker script ran sucessfully. The next step was to configure the service with the datbase connection details as given below. Upon starting the Identity Broker service the following error was captured as given below.
The error indicates that the connection string is missing in the configuration file however the string is present in the DataEngine.extensibility.config.xml configuration.
DataEngine Configuration:
<DataEngine>
<dataRepository>
<dataConnection name="sql" repository="FIM_DEV_Unify_IdentityBroker" connectionString="Data Source=amausgcdbad05;Initial Catalog=FIM_DEV_Unify_IdentityBroker;Integrated Security=True" />
</dataRepository>
</DataEngine>
DataEngine Configuration Values:
Database type = SQL
Database server = amausgcdbad05
Database Name = FIM_DEV_Unify_IdentityBroker
Event Viewer:
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="UNIFY Identity Broker v3.0 service" />
<EventID Qualifiers="0">0</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2011-01-11T23:07:57.000000000Z" />
<EventRecordID>1264</EventRecordID>
<Channel>Application</Channel>
<Computer>AMSGCQAP01.int.alliedmills.com.au</Computer>
<Security />
</System> - <EventData>
<Data>Service cannot be started. Unify.Framework.AdoNetDataControlConfigurationException: Missing connectionString attribute from <dataConnection name="sql" repository="FIM_DEV_Unify_IdentityBroker" /> at Unify.Framework.AdoNetDataControlFactoryBase.SetConfiguration(XElement configurationElement) at Unify.Framework.SqlServerDataControlFactory..ctor(XElement element) at Unify.Framework.SqlServer.SqlServerDataControlGenerator.CreateComponent(XElement element) at Unify.Framework.PlugInGeneratorBase`4.CreateComponent(TFactoryInfo factoryInformation) at Unify.Framework.StoredValuesEngine..ctor(IAdoNetDataControlGenerator dataControlGenerator, DirectoryInfo executingAssemblyDirectory) at Unify.Framework.StoredValuesEnginePlugInFactory.CreateComponent(IUnifyEnginePlugInFactoryInformation factoryInformation) at Unify.Framework.DependencyPlugInGenerator`4..ctor(ICollection`1 plugInGenerator, IPlugInFactory`2 factoryInformationFactory) at Unify.Framework.UnifyEngine..ctor(IEnumerable`1 additionalPlugInFactories, Di...</Data>
</EventData>
</Event>
Customer support service by UserEcho