Popupulate end date attribute from DB to the FIM user / AD
Hello!
We are sync users from database to the FIM portal and to the AD. We want to pass end date attribute from database to
FIM portal user and Active directory user. How to accomplish this? Can we do this in codeless way?
Thanks!
September 21st, 2011 9:09am
Start with
this post from Brad Turner - as you can see you're up for a mix of SQL and rules extensions (forget trying to do this in declarative sync rules).Bob Bradley (FIMBob @ http://thefimteam.com/) ... now using Event Broker 3.0 @ http://www.fimeventbroker.com/ for just-in-time delivery of FIM 2010 policy via the sync engine
Free Windows Admin Tool Kit Click here and download it now
September 21st, 2011 9:41am
Thanks, I saw the link but I have some questions:
Do this work with codeless rules if I can get right date format from DB?
How to integrate this code into my FIM? Do I need the Visual studio to realise this?
Can you give a high level steps for newbies to deploy codeless rules?
Thanks!
September 21st, 2011 9:57am
1. That is correct. You would use a direct import flow from the FIM MA into an attribute in the metaverse, and then configure an Advanced export flow in the AD MA and specify the rule extension name.
2. In the past (with ILM) I've always used the full Visual Studio, but on the FIM 2010 machines I've installed in R&D when I go to open the solution, it opens in Microsoft Visual Studio tools for Applications 2.0 which seems fine for the limited
amount of code editing required for FIM. I'm not sure, but I think I got that when I installed SQL Server 2008 R2.
Check out this article if you are installing Visual Studio and SQL Server on the same machine to avoid or resolve conflicts. I've also used the express version of VS before on my test machines without issue. If you don't want Visual Studio on
your FIM server, you can install it elsewhere and open the project that FIM creates there. Just make sure your extension DLL ends up in the Extensions folder where FIM expects it either during or after the build process.
3. My experience with ILM/FIM is that if you have defined rule extensions (for import or export flows, join rules, projection rules, etc.) in your management agent properties before you create the extension project, then the select case statement should
be generated automatically. If you create the project first and then define the rules, you have to put in the select case statement yourself. It isn't the most complicated coding...I wasn't a real programmer before learning ILM but I picked it
up. All of the methods that could be called by the MA are declared, even if there's no code inside them. Then you just need to put in the code that makes it do something. Carol's blog has a good walkthrough of the process of creating the
rule and then the project with screenshots:
http://www.wapshere.com/missmiis/advanced-attribute-flow-rules That should get you started. (Her note about renaming the class I think is applicable if you put all of your rule extensions into the same solution. How you write and manage
your code is up to you. I have a separate solution for each MA and for the metaverse...probably a few inefficiencies there, but it works for me the inexperienced developer.)
Free Windows Admin Tool Kit Click here and download it now
September 21st, 2011 10:30am
I don't think there's any way in codeless rules to convert the string/datetime format used in the portal to the filetime format required by the accountExpires attribute of AD. (I'm assuming that's where you want that data to go.)
In your rule extension, you'd have something like this for your export rule:
If mventry("YourEndDateAttributeFlowedAsAString").IsPresent Then
csentry("accountExpires").IntegerValue = DateTime.Parse(mventry("YourEndDateAttributeFlowedAsAString").value).ToFileTimeUTC()
End If
You might try .ToFileTime() instead. Note that with the way AD displays the account expiration date and a few other quirks, the date that displays in ADUC can be as much as two days off from the date that you intended to set (and may have actually
set). See
http://www.rlmueller.net/AccountExpires.htm for more information.
The high-level for deploying the coded export rule is to define the advanced flow in the AD MA and name the extension rule something sane (I never use the default suggestion). Assuming you don't already have a rule extension for your ADMA, go to the
management agents tab, right-click the ADMA and create the extension project. If you defined the rule first, there should be a select case statement with your rule specified in it. Put in the code you need there. Use the preview feature on
a few connector space objects to ensure it is working the way you intend, and then run a full sync to apply to all objects.
September 21st, 2011 10:34am
I don't think there's any way in codeless rules to convert the string/datetime format used in the portal to the filetime format required by the accountExpires attribute of AD. (I'm assuming that's where you want that data to go.)
In your rule extension, you'd have something like this for your export rule:
If mventry("YourEndDateAttributeFlowedAsAString").IsPresent Then
csentry("accountExpires").IntegerValue = DateTime.Parse(mventry("YourEndDateAttributeFlowedAsAString").value).ToFileTimeUTC()
End If
You might try .ToFileTime() instead. Note that with the way AD displays the account expiration date and a few other quirks, the date that displays in ADUC can be as much as two days off from the date that you intended to set (and may have actually
set). See
http://www.rlmueller.net/AccountExpires.htm for more information.
The high-level for deploying the coded export rule is to define the advanced flow in the AD MA and name the extension rule something sane (I never use the default suggestion). Assuming you don't already have a rule extension for your ADMA, go to the
management agents tab, right-click the ADMA and create the extension project. If you defined the rule first, there should be a select case statement with your rule specified in it. Put in the code you need there. Use the preview feature on
a few connector space objects to ensure it is working the way you intend, and then run a full sync to apply to all objects.
Here are questions:
1. I need to create Emploee end date attribute flow mapping with advanced flow (because rule with code). Is it correct?
2. To create the extension project do I need to installed Visual studio?
3. Do the Select case statemen will be generated automatically?
Thanks!
Free Windows Admin Tool Kit Click here and download it now
September 22nd, 2011 7:29am
Maybe this helps?
http://granfeldt.blogspot.com/2010/03/exporting-employeestartdate-to-fim-2010.htmlRegards, Soren Granfeldt
http://granfeldt.blogspot.com
September 26th, 2011 12:12pm