I cannot create criteria-based sets in either of my FIM Environments.  In production I get a permissions error even though I am a member of the Administrators set.

In the development environment we get the following detailed error description

Error processing your request: The operation was rejected because of access control policies.
Reason: The supplied request content violates system rules.
Attributes:
Correlation Id: c949132e-75a0-474c-9534-de4d1154b39b
Request Id: a7c43448-548b-4fec-a950-fb6c9584596d
Details: The Request contains changes that violate system constraints.

I have looked through everything to do with the sets and Attribute Filters and all seem to be in order.  I have seen similar items before, but they were related to SPNs and AppPool permissions, which are not the case here.  Anything that can be done to point me in the correct direction is greatly appreciated.

Thanks,

DW

David,

The criteria you are using for your filter definition........if you are including a custom attribute, did you add it to the administrative filter configuration? This is located under All Resources->Filter Permission->Administrator Filter Permission.

David,

The criteria you are using for your filter definition........if you are including a custom attribute, did you add it to the administrative filter configuration? This is located under All Resources->Filter Permission->Administrator Filter Permission.

• Proposed as answer by Nosh Mernacaj 15 hours 27 minutes ago

David,

The criteria you are using for your filter definition........if you are including a custom attribute, did you add it to the administrative filter configuration? This is located under All Resources->Filter Permission->Administrator Filter Permission.

• Proposed as answer by Nosh Mernacaj Tuesday, June 09, 2015 3:56 PM

In addition to Glenn's question can you provide us with the criteria you are trying to implement ?

/Peter

David,

The criteria you are using for your filter definition........if you are including a custom attribute, did you add it to the administrative filter configuration? This is located under All Resources->Filter Permission->Administrator Filter Permission.

If you have done what my colegues suggested,

You need to update the MPR "Adminsitration: Administrators can real attributes of users" (The name of this MPR may be slightly different, please check the syntax, because I don't have FIM in front of me and I don't remember the exact name.  Basically, this MPR allows administrators to read the attributes of user. Since your attribute is a custom one, most likely is not included in the read access for admins.

In the attribute list, select the 2 attributes you need. Most likely Firstname is in there, customDomain ma

If you have done what my colegues suggested,

You need to update the MPR "Adminsitration: Administrators can real attributes of users" (The name of this MPR may be slightly different, please check the syntax, because I don't have FIM in front of me and I don't remember the exact name.  Basically, this MPR allows administrators to read the attributes of user. Since your attribute is a custom one, most likely is not included in the read access for admins.

In the attribute list, select the 2 attributes you need. Most likely Firstname is in there, customDomain ma

Second, your DEV and PROD are not the same.
CAREFUL: It is not recommended to have DEV and PROD with different configurations. In case you need to migrate from DEV to PROD