Problema de Sync nos objetos From FIM 2010 to External System

Após a criação das regras de synchronismo poderá ocorrer os seguintes erros caso você não tenha habilitado as devidas MPR´s.

“Identity Manager Policy prohibits the request from completing.”

“”failed-creation-via-web services”

“failed modification via web services”

Looking at the detailed error trace here’s the output:

There is an error executing a web service object creation request.
Type: Microsoft.ResourceManagement.WebServices.Client.PermissionDeniedException

Message: Fault Reason: Policy prohibits the request from completing.

Fault Details: <RequestFailures xmlns=”http://schemas.microsoft.com/2006/11/ResourceManagement” xmlns:xsi=”http://www.w3.org/2001/XMLSchema-instance” xmlns:xsd=”http://www.w3.org/2001/XMLSchema”></RequestFailures>

Stack Trace:    at Microsoft.ResourceManagement.WebServices.ResourceFactoryClient.Create(Message request)
   at Microsoft.ResourceManagement.WebServices.ResourceFactoryClient.Create(Create createBody)
   at Microsoft.ResourceManagement.WebServices.Client.ResourceTemplate.CreateResource()

Inner Exception: Policy prohibits the request from completing.

image

image

Como verificar quais MPR´s devem ser habilitadas?

Executar o script PowerShell abaixo

Using PowerShell to check your MPR configuration for synchronization

  1. #————————————————————————————————————————-
  2. # Name   : Using PowerShell to check your MPR configuration for synchronization
  3. # Version: 2.0
  4. #————————————————————————————————————————-
  5.   Set-Variable -Name URI -Value “http://localhost:5725/resourcemanagementservice’ ” -Option Constant 
  6.   Set-Variable -Name msgWarning -Value “Caution: Your current MPR configuration requires your attention!” -Option Constant
  7.   Set-Variable -name msgOK -Value “Your current MPR configuration meets all requirements” -Option Constant
  8. #————————————————————————————————————————-
  9.  Function GetObjects 
  10.  {   
  11.     Param($Filter)   
  12.     End
  13.     {
  14.        $ExportObject = Export-Fimconfig -uri $URI `
  15.                              –onlyBaseResources `
  16.                              -customconfig ($Filter) `
  17.                              -ErrorVariable Err `
  18.                                                                                      -ErrorAction SilentlyContinue
  19.        If($Err){Throw $Err}
  20.        Return $ExportObject 
  21.      }
  22.  }
  23. #————————————————————————————————————————-
  24.  Function ShowResults
  25.  { 
  26.     Param([ref]$bActionItem, $lstAttributes, $msgMissing) 
  27.     End 
  28.     {
  29.        if([int]($lstAttributes.length) -eq 0) {return}
  30.        $bActionItem.value = $true   
  31.        Write-Host “`n$msgMissing” -foregroundcolor black -backgroundcolor yellow   
  32.        ForEach($attributeName In $lstAttributes) {Write-Host ” -$attributeName”} 
  33.     }
  34.  }
  35. #————————————————————————————————————————-
  36.  Function GetXmlDoc
  37.  { 
  38.     Param($exportObjects, $attributeName) 
  39.     End
  40.     {   
  41.        $curAttribute = $exportObjects.ResourceManagementObject.ResourceManagementAttributes | `
  42.                                Where-Object {$_.AttributeName -eq “$attributeName”}   
  43.        Return “<root>$($curAttribute.Value)</root>” 
  44.     }
  45.  }
  46. #————————————————————————————————————————-
  47.  Function GetDataFromMpr 
  48.  { 
  49.     Param($mprName, [ref]$lstMissingMpr, [ref]$lstDisabledMpr) 
  50.     End
  51.     {
  52.        $curMprObject = GetObjects -Filter “/ManagementPolicyRule[DisplayName=’$mprName’]”   
  53.        If($curMprObject -eq $null) {$lstMissingMpr.value += $mprName}   
  54.        Else
  55.        {    
  56.           $curAttribute = $curMprObject.ResourceManagementObject.ResourceManagementAttributes | `
  57.                           Where-Object {$_.AttributeName -eq “Disabled”}    
  58.           If($curAttribute.Value -eq “True”) {$lstDisabledMpr.value += $mprName}   
  59.        }  
  60.     }
  61.  }
  62. #————————————————————————————————————————-
  63.  Function GetResAttrsForMpr
  64.  { 
  65.     Param($mprName) 
  66.     End
  67.     {   
  68.        $curMprObject = GetObjects -Filter “/ManagementPolicyRule[DisplayName=’$mprName’]”   
  69.        If($curMprObject -eq $null) {Return @()}   
  70.        $curAttribute = $curMprObject.ResourceManagementObject.ResourceManagementAttributes | `
  71.                Where-Object {$_.AttributeName -eq “ActionParameter”}   
  72.        If($curAttribute -eq $null) {Return @()}   
  73.        return $curAttribute.Values 
  74.     }
  75.  }
  76. #————————————————————————————————————————-
  77.  Function GetEafAttributesForObjectType
  78.  {  
  79.     Param($cdObjectType, $mvObjectType, $xmlDoc)  
  80.     End  
  81.     {   
  82.        $lstAttribute = @()   
  83.        $typeNode = $xmlDoc.selectSingleNode(“//export-flow-set[@cd-object-type=’$cdObjectType’ and @mv-object-type=’$mvObjectType’]”)   
  84.        If($typeNode -eq $null) {Return $lstAttribute}   
  85.        ForEach($curNode in $typeNode.selectNodes(“export-flow[direct-mapping]”))   
  86.        {
  87.           $lstAttribute += $curNode.selectSingleNode(“@cd-attribute”).get_InnerText()   
  88.        }
  89.   
  90.        Return $lstAttribute  
  91.     } 
  92.  }
  93. #————————————————————————————————————————-
  94.  Function GetAttributeDiff
  95.  { 
  96.     Param([array]$lstSource, [array]$lstTarget) 
  97.     End
  98.     {   
  99.        $lstAttributes = @()   
  100.        ForEach($attrName in $lstSource)   
  101.        {  
  102.           If(!($lstTarget -contains $attrName)) {$lstAttributes += $attrName}   
  103.        }
  104.    
  105.        Return $lstAttributes  
  106.     }
  107.  }
  108. #————————————————————————————————————————-
  109.  If(@(Get-PSSnapin | Where-Object {$_.Name -eq “FIMAutomation”} ).count -eq 0) {Add-PSSnapin FIMAutomation}
  110. #————————————————————————————————————————-
  111.  $exportObjects = GetObjects -Filter “/ma-data[SyncConfig-category=’FIM’]”
  112.  If($exportObjects -eq $null) {Throw “There is no FIM MA configured on your system!”}
  113.  [xml]$xmlExportFlow = GetXmlDoc -exportObjects $exportObjects `
  114.                                  -attributeName “SyncConfig-export-attribute-flow”
  115.  [xml]$xmlProjection = GetXmlDoc -exportObjects $exportObjects `
  116.                                  -attributeName “SyncConfig-projection”
  117.  
  118.  [array]$lstEafAttributesPerson = GetEafAttributesForObjectType -cdObjectType “Person” `
  119.                                                                 -mvObjectType “person” `
  120.                                                                 -xmlDoc $xmlExportFlow
  121.                                                                
  122.  [array]$lstEafAttributesGroup = GetEafAttributesForObjectType -cdObjectType “Group” `
  123.                                                                -mvObjectType “group” `
  124.                                                                                                                                                                        -xmlDoc $xmlExportFlow
  125.  
  126.  If($lstEafAttributesGroup -contains “Member”)
  127.  { 
  128.     $lstEafAttributesGroup = @($lstEafAttributesGroup | Where-Object {$_ -ne ‘Member’}) 
  129.     $lstEafAttributesGroup += “ExplicitMember” }
  130.     If($xmlProjection.selectNodes(“//class-mapping[@cd-object-type=’Person’]”).get_count() -eq 0) {Throw “The FIM management agent does not manage person objects”}
  131.    
  132.     $bHasGroups = $xmlProjection.selectNodes(“//class-mapping[@cd-object-type=’Group’]”).get_count() -gt 0
  133. #————————————————————————————————————————-
  134.  $mprNames = @() 
  135.  $mprNames += “General: Users can read schema related resources”
  136.  $mprNames += “General: Users can read non-administrative configuration resources”
  137.  $mprNames += “User management: Users can read attributes of their own”
  138.  $mprNames += “Synchronization: Synchronization account can delete and update expected rule entry resources”
  139.  $mprNames += “Synchronization: Synchronization account can read schema related resources”
  140.  $mprNames += “Synchronization: Synchronization account can read synchronization related resources”
  141.  $mprNames += “Synchronization: Synchronization account can read users it synchronizes”
  142.  $mprNames += “Synchronization: Synchronization account controls detected rule entry resources”
  143.  $mprNames += “Synchronization: Synchronization account controls synchronization configuration resources”
  144.  $mprNames += “Synchronization: Synchronization account controls users it synchronizes”
  145.  
  146.  If($bHasGroups -eq $true)
  147.  {
  148.     $mprNames += “Synchronization: Synchronization account can read group resources it synchronizes” 
  149.     $mprNames += “Synchronization: Synchronization account controls group resources it synchronizes”
  150.  }
  151. #————————————————————————————————————————-
  152.  $bActionItem = $false
  153.  $lstDisabledMpr = @() 
  154.  $lstMissingMpr = @()
  155.  
  156.  ForEach($mprName In $mprNames)
  157.  { 
  158.     GetDataFromMpr -mprName $mprName `
  159.                            -lstMissingMpr ([ref]$lstMissingMpr) `
  160.                                                    -lstDisabledMpr ([ref]$lstDisabledMpr)
  161.  }
  162. #————————————————————————————————————————-
  163.  Clear-Host
  164.  Write-Host “`nFIM MPR Configuration For Synchronization Check”
  165.  Write-Host “===============================================”
  166.  ShowResults -bActionItem ([ref]$bActionItem) `
  167.              -lstAttributes $lstMissingMpr `
  168.              -msgMissing “Missing MPRs:”
  169.             
  170.  ShowResults -bActionItem ([ref]$bActionItem) `
  171.              -lstAttributes $lstDisabledMpr `
  172.              -msgMissing “MPRs that need to be enabled:”
  173.  
  174.  $mprName = “Synchronization: Synchronization account controls users it synchronizes”
  175.  
  176.  [array]$lstResAttributes = GetResAttrsForMpr -mprName $mprName
  177.  [array]$lstMissingAttrs = GetAttributeDiff -lstSource $lstEafAttributesPerson `
  178.                                             -lstTarget $lstResAttributes
  179.  ShowResults -bActionItem ([ref]$bActionItem) `
  180.              -lstAttributes $lstMissingAttrs `
  181.              -msgMissing “Missing attributes of $($mprName):”
  182.             
  183.  If($bHasGroups -eq $true)
  184.  { 
  185.     $mprName = “Synchronization: Synchronization account controls group resources it synchronizes” 
  186.     $lstResAttributes = GetResAttrsForMpr -mprName $mprName   
  187.     $lstMissingAttrs  = GetAttributeDiff -lstSource $lstEafAttributesGroup `
  188.                                          -lstTarget $lstResAttributes 
  189.     ShowResults -bActionItem ([ref]$bActionItem) `
  190.                 -lstAttributes $lstMissingAttrs `
  191.                 -msgMissing “Missing attributes of $($mprName):”
  192.  }
  193. #————————————————————————————————————————-
  194.  If($bActionItem -eq $true) {write-host “`n$msgWarning`n” -foregroundcolor white -backgroundcolor darkblue}
  195.  Else {write-host “`n$msgOK”}
  196. #————————————————————————————————————————-
  197.  Trap
  198.  { 
  199.     Write-Host “`nError: $($_.Exception.Message)`n” -foregroundcolor white -backgroundcolor darkred  
  200.     Write-Host $_.Exception.GetType().FullName -foregroundcolor white -backgroundcolor darkred 
  201.     Exit 1
  202.  }
  203. #————————————————————————————————————————-

Source Script:

 Using PowerShell to check your MPR configuration for synchronization

Executar o script que ira trazer quais as MPR´s deverão ser habilitadas conforme mostra abaixo.

“MPRs that need to be anabled”

image

Basta habilitar as MPRs que os sincronismos irá ocorrer sem problemas.

Anúncios

2 comments

  1. Caramba cara como é difícil encontrar bons artigos assim sobre FIM, com script e tudo, verei fã mesmo do seu blog, nota 10, parabéns. Gostaria de aprender mais sobre FIM, quando teremos aqui no blog usn posts de introdução? 🙂

  2. Ola meu amigo, Muito bom ouvir isso.Estou preparando um material voltado para introdução e uma boa explanação das funcionalidades do FIM, Já temos algumas coisas que serão muito ulteis você, Segue abaixo.http://lucasmarquesit.blogspot.com/search/label/SQL%20Server%202008http://lucasmarquesit.blogspot.com/search/label/WSS%203.0http://lucasmarquesit.blogspot.com/2010/06/instalando-forefront-identity-manager.htmlInicialmente de uma olhada no link abaixo que tem um material muito bom para iniciar o entendimento no FIM 2010.http://technet.microsoft.com/en-us/library/ee621261(WS.10).aspxMuito obrigado, Até breve.

Deixe uma Resposta

Preencha os seus detalhes abaixo ou clique num ícone para iniciar sessão:

Logótipo da WordPress.com

Está a comentar usando a sua conta WordPress.com Terminar Sessão /  Alterar )

Google+ photo

Está a comentar usando a sua conta Google+ Terminar Sessão /  Alterar )

Imagem do Twitter

Está a comentar usando a sua conta Twitter Terminar Sessão /  Alterar )

Facebook photo

Está a comentar usando a sua conta Facebook Terminar Sessão /  Alterar )

Connecting to %s