FIM sync model
Hello colleagues!
I recently setup FIM in virtual lab and configure basic attributes flow like described below:
Data Source :Attribute
Direction
Destination
AD:sAMAccountName
>
AccountName
AD:Word(Word(userPrinciapName,2,"@"),1,".")
>
Domain
AD:objectSid
>
ObjectSid
HR DB: EmployeeID
>
EmployeeID
HR DB: EmployeeType
>
EmployeeType
HR DB: FirstName
>
FirstName
HR DB:FirstName + " " + lastName
>
displayName
HR DB:lastName
>
LastName
So all data is aggregated in FIM Portal (DB)...
I have 2 questions:
How to flow some atrributes back to DataSource per Each FIM Management Agent Synchronization?
What is best way to change (once) attribute in all active accounts (for example All Contractors set).
For example change EmployeeID to "aa0-"+EmployeeID
April 14th, 2010 10:24am
In FIM, you have inbound and outbound attribute flow mappings.To flow something back to a connected data source, you need an outbound attribute flow mapping.For more details about the synchronization model, see Understanding Data Synchronization with External Systems. In this context, it is also a good idea to take a look at About Attribute Flow Precedence.
To bulk update attribute values in case of a set transition, use a workflow and include it into a TMPR.For more details on MPRs, see Designing Business Policy Rules.
Cheers,MarkusMarkus Vilcinskas, Knowledge Engineer, Microsoft Corporation
Free Windows Admin Tool Kit Click here and download it now
April 14th, 2010 12:44pm
Ok , I understand basics and first question is answered, this topic "Bulk Modify Users in FIM portal" is answer for second.
p.s.
Talking about second question - I try both solutions, and select this one:
You would actually achieve far better performance by using Run On Policy Update (ROPU) - I'll be talking about this in one of my TEC presentations:
Create a Set (calculated or manual) of the objects you wish to affect
Create an Action Workflow that makes the changes you wish to execute, enable "Run On Policy Update" a.k.a "Run Mapping" by the PG
Create a Transition-In policy using your Set and executing your new WF
As soon as you click Submit on the policy, it will trigger the WF to execute against all members of the set and it will use all of the system resources to do it. ROPU is massively multi-threaded and will span all of your FIM Service instances.
For 5 users this may not be worth it, but when updating thousands of objects it is your best bet to scale the operation.
Brad Turner, ILM MVP - Ensynch, Inc - www.identitychaos.com
April 14th, 2010 12:51pm