Config Migration - Situation to watch out for
I ran across an interesting error during config migration today. This was a small incremental change of two set filters. The sets however, have approx 20k users each and when the config change commit was made, the following error occured. The ID referenced is the second changed set and request. Import-FIMConfig : While creating a new object, the web service reported the object is pending authorization. The import cannot continue until the object exists. Please approve the object and then replace all subsequent references to this object with its object id. Once the references are up to date, please resume the import by providing the output from this stream as input. Request ID = urn:uuid:9e3c27b2-6720-46e5-89bf-5ab84375a157 ObjectType = Set SourceObjectID = urn:uuid:dcdb3c31-918f-4693-920d-8f052ccc188b At C:\Users\fdrewes\migrate_fim_policy.ps1:200 char:45 + $undoneImports = $imports | Import-FIMConfig <<<< -uri http://"$DestinationServer":5725/ResourceManagementService + CategoryInfo : InvalidOperation: (:) [Import-FIMConfig], InvalidOperationException + FullyQualifiedErrorId : ImportConfig,Microsoft.ResourceManagement.Automation.ImportConfig I'm assuming the 'pending authorization' error is due to the amount of time it took to process the update. The request was created over an hour ago, and it's still in post-processing since all the child requests haven't completed yet. I looking to the 'authorization' part of the error message but the only authorization workflow is the "General workflow: Filter atrrbiute validation for administrators" which shows completed, but i don't see any indication how long that took to complete. Since the server was very busy processing the first set filter change, that auth workflow might have taken longer than Import-FIMConfig would wait.. Not sure if there is anything that can be done in this situation, but any ideas are welcome. All I can think of is possibly temporarily disabling the transition in/out wf's during the commit phase of the migration..
July 7th, 2011 8:17pm

Indeed the cmdlet does behave in ways I don't sometimes expect. In this case I would do something like this to handle the error: $error.clear() Import-FIMConfig $myImportObject -ErrorAction SilentlyContinue | Out-Null if (-not $?) { if ($error[0] -ilike '*While creating a new object, the web service reported the object is pending authorization*') { ### This did NOT do what I expected. This never happens... ### Better fail silently, shhh! } } CraigMartin – Edgile, Inc. – http://identitytrench.com
Free Windows Admin Tool Kit Click here and download it now
July 8th, 2011 1:21am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics