Join and Project Rules & Sync Rules?

hi,
We are using declarative provisioning to provision data to various target systems. Data is imported from the HR source database. However, on the HR MA, we don't have any Join or Projection Rules. If we are using declarative provisioning, do we still need
Join and Projection Rules on the MA itself?
The reason I ask is that we are getting the following errors on a Full Sync of the HR MA...and I wonder if this error would disappear if we had a Join rule in the MA:
sync-rule-flow-provisioning-failed
Microsoft.MetadirectoryServices.ProvisioningBySyncRuleException: An object with DN "kbob001" already exists in management agent "XYZ MA".
thank,
sk

When you project the object into the metaverse (from HR MA), your object match the declarative rule in of your synchronization rule and FIM try to provision the object in "XYZ MA" and it's failed because you have already an object with the same anchor "DN=kbob001".
One way to resolve this is to do a two step synchronization, the first for the projection and the second for the provisioning. You can achieve that by change your declarative rule. Once the object is projected, you can try to join it from "XYZ MA" before applying
the declarative rule.
For example, the declarative rule could be an attribute calculated in FIM Portal, like "IsPresentInFIM=True"
Regards,
Sylvain

Similar Messages

How used join and projection in TC3.

Hi to all experts,
my quarry is that why Time Constraint 3 infotypes(pa0021) are not used in join and projection. i hope we may used with where clause subty and objps. in this way we may be used. if we should not be used explain me. then next how can we process these type of records. Please explain me in detail.
Best Regards:
Mahesh

Hi LightwaV - the best place to get support for the Adobe Education Exchange is to go through the Help Center on the AEE - http://edex.adobe.com/help-center/. Once there you can navigate through the help items to find answers to common questions and if you're problem isn't solved, you can email the AEE support team. They will be in a better position to help you and troubleshoot your account.
Hope this helps!

Sync-rule-flow-provisioning-failed

Hi,
I added a user in FIM portal and then synchronize it . After 2 days I deleted that user in FIM portal. Again when I added the same user in FIM Portal and synchronizing it in a synchronization service, it gives me an error and that is sync-rule-flow-provisioning-failed
. Microsoft.MetadirectoryServices.ProvisioningBySyncRuleException: An object with DN "CN=109176,OU=FIM,DC=PSPCL,DC=IN" already exists in management agent "PSPCL AD MA".
Now how can I able to synchronize that user?

On Fri, 12 Dec 2014 05:30:54 +0000, HONEY MITTAL SIFY wrote:
I added a user in FIM portal and then synchronize it . After 2 days I deleted that user in FIM portal. Again when I added the same user in FIM Portal and synchronizing it in a synchronization service, it gives me an error and that is sync-rule-flow-provisioning-failed
. Microsoft.MetadirectoryServices.ProvisioningBySyncRuleException: An object with DN "CN=109176,OU=FIM,DC=PSPCL,DC=IN" already exists in management agent "PSPCL AD MA".
Now how can I able to synchronize that user?
You asked this exact same question on November 19th and marked it as
answered on November 20th.
https://social.technet.microsoft.com/Forums/en-US/ad06cc7a-958f-4807-9c75-3cf74258592a/syncruleflowprovisioningfailed?forum=ilm2#ae0171c5-f9f3-4c5c-a8ab-b03e2391b553
Paul Adare - FIM CM MVP
"Lotus Notes for Dummies" is surely a single page pull out with
"don't" printed on it. -- Unknown

How to configure sync rules involving a CSV file and portal self service

Hello,
I need to configure some FIM sync rules for the following scenario:
User account details are entered from a HR CSV file and exported to AD Users have the ability to modify their own AD attributes in the
FIM portal (there is not a requirement for them to view their HR CSV data in the portal). The FIM portal modifications will be exported to AD as expected.
My setup is as follows:
CSV file - name, last name, employee ID, address.
CSV MA - has direct attribute flows configured in the MA between the data source and MV Portal self service attributes –
users can edit mobile, display name and photo
I've also set the CSV MA as precedent for the attributes
FIM MA – attribute flows defined for MV to Data Source as usual (i.e. firstname to firstname, accountname to accountname, etc).
AD MA – no attribute flows defined as inbound and outbound sync rules have been configured in the portal using the Set\MPR\Triple.
I’m thinking of using the following run profiles:
CSV MA – full import and delta sync (imports HR data)
FIM MA – export and delta import (imports portal changes)
FIM MA – delta sync (syncs any portal changes)
AD MA – export and delta import
If my understanding is correct this should sync HR data from CSV to AD, as well as user attribute self service updates from the portal to AD.
If I wanted to just do a HR CSV sync could I get away with just steps 1 & 4 ? (presumably not as my rules are in the FIM portal?)
If I wanted to do just a portal sync, could I get away steps 2-4?
Any advice on how to improve my setup is much appreciated - cheers
IT Support/Everything

The truth is that your design should be done in the way that it doesn't matter which profiles in which order you will execute. At the end, if you will run all import, synch and export profiles on each data source you should get same result. This is beauty
of synch engine here.
Your steps from 1-4 will synch data to your data sources and at the end will give you expected result. But not because of the order you are executing them but because of correct attribute flows. If flows from CSV file and from FIM portal might be done for
the same attributes you need to think also about attribute precedence.
Tomek Onyszko, memberOf Predica FIM Team (http://www.predica.pl), IdAM knowledge provider @ http://blog.predica.pl

FIM RCDC drop down and function evaluator vs functions within sync rules

Hi,
I have several hundred buildings in my organisation and I would like to to give users the ability to select their building name from a custom RCDC - straight forward enough, however I'd also like the following to be automatically selected within FIM:
Address, City, Post Code, Country
I believe this can be done in 2 ways:
An outbound sync rule using a function (.e.g IF(Eq(Address),"Beverly Hills"),"90210",""))
A function evaluator using a similar expression.
Whilst I'm comfortable with sync rules I don't know much about function evaluators in workflows and would like some advice on the best approach to take and how to go about it?
In addition, given there'll be a lot of sites, is there a way to input the RCDC drop down list of sites from a CSV or XML file, rather than having to manually edit the FIM pages and functions?
Thanks
IT Support/Everything

Hi Aetius,
Yeah, they're the two methods I'm familiar with in the portal to do something like what you're saying automatically: either do it in the sync from source to MV or apply a workflow in the Portal.
The general idea with the workflow method would be to have a set called something like "Users With Address" and scope it to only users with the address attribute. Have a transition-in MPR that looks at that set and fires off a workflow when a user enters
that set. There are a lot of options when it comes to how to implement the workflow. You can write your own custom workflow/s. There are some good tutorials by Ross Currie around that http://www.fimspecialist.com/fim-portal/custom-workflow-examples/ and
there are some that have already been built by Soren Grandfeldt http://fimactivitylibrary.codeplex.com/.
So if you leave the workflows for a sec, all the associated data about what will be populated if the address is x can be loaded into the portal by creating a custom object type and then adding them all in one by one. You can probably script the part of actually
adding the data. Or even the custom object type creation if you want. So then you have a central place where that information is all together.
With the workflow when it's triggered, using the workflows that are floating around the internet you should be able to read the attribute off the user and then lookup the value in the list of custom objects and then update the other attributes of the user,
City, Post Code, Country using the lookup value. You kind of chain the custom workflows together and pass data from one to other.
You do need to be careful when you do this sort of thing though. The FIM event queue can get pretty clogged up if you have a huge amount of users in the set and it's trying to process all of these users at once. When you're testing probably better to apply
the MPR to a manual set and add users one or a few at a time and see how it handles it.

Distribution rules and projects - automatic checks

Hello,
I haveve three issues/questions regarding distribution rules and projects:
- Are we able to implement an automatic control which does not allow bookings without distribution rules? The
control already exists for booking which we'll be entered manually. But for automatically generated postings
is not always in place. For example by closing a production order when the appropriate distribution rule is
missing in the BOM.
- Additional for projects: Either the distribution rule which is defined in the project master data should be
proposed automatically and/or only the defined distribution rule is allowed for any bookings. This is mainly
necessary for invoices which are registered only in SAP and not in PM (for example sales commission invoices,
transport costs etc.). There people often use distribution rules which are not suitable.
Our understanding is that once a project is set-up with a distribution rule and an entry is posted against
that item, the distribution rule can not be changed. Is this correct?
With kind regards,
Amine Z.

Closed so I can open a new thread

Best Practice Question: Portal Sync Rules

Hi,
Is there any benefit in combining Inbound and Outbound Flows in a single Sync Rule?
Or does it not matter if Inbound flows have their own Sync Rule and Outbound flows have their own Sync Rules?
Does either option generate more/less EREs/DREs?
Is either option better for performance reasons?
look forward to your comments, thank you
sk

1:
Only the OSR's create EREs, so if you have 4 outbound 3 inbound (assuming a user gets all 4 outbound SR's) the user should have 4 EREs. If the rules were combined into 3 outbound/inbound and 1 outbound, the user still gets 4 EREs.
2:
If my source was AD, I would create a new MV attribute called inAD. Then import a constant "true" from the target, AD for example. Then from my source, HR for example, ill flow in a constant "false". Lastly update the MV attribute precedence for the
inAD attribute to be AD then HR. From there i'd create a custom attribute in the portal so I can use the flag for set criteria.
This might be a long winded way of getting it done, but say you have 10k users in AD and used DRE's. It means 10k more objects in the MV and in the portal.
Disclaimer: Not saying this is best practice, it's just what I do :)

Mobile account managed preferences sync rules not applied

Hello everyone!
I am testing out mobile accounts and home sync on a few of the machines I have. My goal is too use mobile accounts as a way to backup small documents. I have many preference and Home sync rules applied to a group. All the machines I have added to this group seem to recognize these rules, but one machine does not. It is syncing folders and file types that I have excluded. I have checked the users managed preferences file and it appears to be correct, yet when I start a sync it does not appear to follow it's own managed preferences.
One thing I should add is that these machines have been using plain old local accounts and I have been migrating them to mobile accounts using this method:
http://www.macenterprise.org/articles/migratingalocalusertoanetworkuser
This method seems to work great except for the fact that the users preferences like the dock don't appear to be carried over.

Did you ever solve this? I have just started testing this in our office as well. It appears I have a machine that does not appear to obey the rules ether. I am also migrating local accounts to mobile accounts.

10.5 portable home sync rules not being respected on the client...

Portable home syncing is working great for me on my Tiger server and clients, and I'm an old hat at Apple server and OD.... However in my test environment for 10.5, my client machines reuse to respect the rules that I've set in 10.5 Server Workgroup Manager for portable home syncing. I was hoping 10.5.2 would fix this for me, but no luck....
I can tell that the clients are bound to the OD and are reading the MCX settings from the server, because I can change the sync time interval, and that is being reflected on the client. WGM is set to NOT allow settings to be merged with user's settings, so I can eliminate the client settings as a variable.
Both Login/Logout and background sync are effected by this problem.
Is anyone else having this issue?

Bruce's solution above does indeed work. However, I must have stared at his answer for 20 minutes trying to figure out what he was talking about. Undoubtedly, my inability to initially parse his solution comes from my more basic understanding of OS X Server. Since there are likely others out there with this same Home Sync problem and my same level of experience with OS X Server I wanted to give Bruce's answer again but with more detail.
The problem, as explained by the original post, is that Home Sync settings for a user or group aren't necessarily respected. For example, if I were to open Workgroup Manager (WGM), select myself as a user (Berylium), click Preferences, select Mobility from the Overview tab, and select the Rules tab I would be in the Home Sync preferences. If I tell the Login & Logout Sync tab to Always do what I select and then I uncheck the Sync at login and logout checkbox one would expect that when I log in or log out I would not see a Home Sync dialog popup and perform a sync operation - but I did.
The issue as Bruce explains occurs because of another setting I have enabled, Background Sync, and a quirk (bug?) in Leopard Server. I have Background Sync enabled, set to Always, and told to sync in the background my ~/Documents and ~/Desktop folders. Leopard Server, it seems, performs the following operation when I login or logout:
1. Is Login & Logout Sync enabled? No, ok skip this part.
2. Is Background Sync enabled? Yes! Ok, sync the background sync items now even though this is a login or log out.
Clever, Apple. Ok, now that the problem has been explained let's get to the solution.
1. Open WGM, select your problem user or group, click Preferences, and select the Details tab
2. Click the +, navigate to /System/Library/CoreServices/, select ManagedClient, and click Add
- At this point, at least in my installation, several more items appeared in the preference editor list.
3. Select Home Sync in the preference editor list then click the Edit button (looks like a pencil)
4. Expand the Always list item
- Obviously, this is where some people's solution could begin to differ from mine. You may want to edit items in the Once or Often list items.
5. Click the New Key button, a New Item will be created and selected, click New Item and select Sync Background Set During Login from the list.
6. Change the Value item for Sync Background Set During Login from automatic to dontSync
7. Repeat steps 5 and 6 but select Sync Background Set During Logout
8. Click Apply Now followed by Done
Now you should be all set. Thank you Bruce for the solution to this problem and I hope someone else finds my more detailed explanation helpful.
-Berylium

Sync ftl (Computer's rejecting sync rules)

Hello,
I have a small network of macs, about 10 computers, and an xserve. I set up an OD on the xserve, and set up users and a group for all the users. I applied mobile sync options for the group that states:
To not do login/logout sync, to sync in background every two hours.
Yet a few computers dont follow the rules, and do login sync, but not only that, they do login sync and won't finish. Sometimes if you wait for 15+ minutes it will finish, but I can't have my users waiting 15 minutes to login. I would like to know if I can do anything. Otherwise I'm just going to turn off sync cause it's becoming a pain. Oh Btw about 3 computers aren't following the rules, and try to sync at login.

Start by looking at logs, specifically this one in the user's home folder on the client:
~/Library/Logs/FileSyncAgent/FileSyncAgent-verbose.log
Post some excerpts if you don't understand anything.

Mail Rules Sync

Currently I have iPhones, Macbook, Mini Mac, etc. On each of these my mail comes in without problem and are sync'd properly. I have quite a few rules set up on my Macbook Pro and would like these rules to be applied throughout all of my devices. Can I set these rules to be set up on all my iOS devices without having the manually do it on every device? I am aware that I can set these rules in iCloud, but there must be a better way to manage these rules without having the log onto iCloud overtime to make changes/improve my rules. Thank you.
Matt .D

It's not pretty and it's not sexy, but as an interim solution, you could manually copy /Users/Landis/Library/Mail/MessageRules.plist from one machine to the same location on the other machine.

Can FIM delete user in AD/ADLDS without Sync Rules or Code?

Hi,
We have a simple setup, flow in data from a SQL HR system and use the "Outbound System Scoping Filter" to provision users in AD and ADLDS.
Question: Will FIM be able to delete the object in AD/ADLDS without Rules Extensions or Sync Rules?
We were thinking of just using the following:
Delete metaverse object when connector from any of the following MA's is disconnected: SQL HR System
Then on the AD & ADLDS MAs select: Stage a delete on the object for the next export run
So is the above sufficient to delete the objects in AD & ADLDS?
Thanks
SK

Hello,
yes this should work, I've done this some times in my Lab environments.
For simple scenarios thats a possible solution.
-Peter
Peter Stapf - ExpertCircle GmbH - My blog:
JustIDM.wordpress.com

Sync Rules driving me crazy.

I am some trouble with sync rules.
Login and logout rules are
Inculde
~/Desktop
~/Documents
~/Library
Exclude
Starts With Exchange-
Starts With Exchange IMAP-
Starts With Mail/IMAP-
Starts With Mac-
Starts With POP-
Starts With VW Backup
Full Path ~/Music
Full Path ~/Pictures
Full Path ~/Downloads
Full Path ~/Movies
Full Path ~/Library/Mail Downloads
Full Path ~/Library/Mail/Mailboxes
Full Path ~/Documents/Microsoft User Data
Full Path ~/.SymAVQSFile
Full Path ~/.Trash
Full Path ~/.Trashes
Full Path ~/Library/Application Support/SyncServices
Full Path ~/Library/Caches
Full Path ~/Library/Logs
Full Path ~/Library/Printers
Name Is .rnd
Background Sync Rules are:
Inculde
~/Desktop
~/Documents
Exclude
Starts With Exchange-
Starts With Exchange IMAP-
Starts With Mail/IMAP-
Starts With Mac-
Starts With POP-
Starts With VW Backup
Full Path ~/Music
Full Path ~/Pictures
Full Path ~/Downloads
Full Path ~/Movies
Full Path ~/Library/Mail Downloads
Full Path ~/Library/Mail/Mailboxes
Full Path ~/Documents/Microsoft User Data
Full Path ~/.SymAVQSFile
Full Path ~/.Trash
Full Path ~/.Trashes
Full Path ~/Library/Application Support/SyncServices
Full Path ~/Library/Caches
Full Path ~/Library/Logs
Full Path ~/Library/Printers
Name Is .rnd
From what I can figure out if the back gournd rules are not set the system will sync everything in the user folder.
This was all working correctly, but now I have some users that I am moving form local users to portable users.
On the login and logout the sync is scanning the ~/Documents/Microsoft User Data folder and finding Entourage databases that are still in use but being moved away from. It sits there going through a copy type process where it will take 10min or so to copy up an entourage database, but in the end does not actually copy it and carries on syncing the rest of the data it needs to.
So it is working correctly, although my login logout process is being extended by about 10 15 minutes because it is having to look at this entourage database file.
Does any one know why it would be doing this and how to stop it.
Server is on 10.5.8

Hi,
YOu could check the log file whether the ~/Documents/Microsoft Data folder is still excluded.
If it is snot in the log (as excluded) you need to reset the sync list on the local computer.
I find it the easiest way to just delete the ~/.FileSync folder from both client and server. (be sure to do this when the user is 'not' logged on)
If it is excluded, well, then I have similar problems. I recently made a change to the exclusion list and now it seems that almost everything is synced even though files are excluded..

Syncing rules in Mail (OSX) don't work...

I can't sync rules with iCloud. When I activate Documents and Data in iCloud, the rules configured in Mail are deleted. If I create a new rule, when re-start Mail, the rule dissapear.
If turn off Documents and Data, all work perfect. I have a backup of SyncedRules.plist (Library->Mail->V2->MailData) to restore.
I had tried a lot of "fixes", but nothing work.
I have another issues with Documents and Data betwen iOS and Mac. Syncing of data with apps like Tweetbot, IAwriter, iWork... don't work. I'm sure something in my iCloud account is wrong, but I don't know how fix it.
Are there anyone from Apple that can help me?.
Thanks.
Regards.

Not as part of my immediate issue, but (as I did explain above) 1) this thread deals with rules/sigs vanishing, and 2) that seems to happen a lot, to people who sync AND people who don't, 3) it seems that this problem is sometimes attributed to iCloud syncing when that is not the problem and 4) I was hoping there might be some related Mail issue (besides just iCloud) that *might* help explain things. I aslo said I thought it was a long shot, but....any port in a storm. No offense intended, but it seems that my long shot didn't turn up any useful info.
That said, since i DO have a heckuva lot of rules set up, and having them reside eslewhere might be useful. Is there a way to move rules already in existence to iCloud? If I make changes locally, will they get picked up by iCloud or overwriten? If not, then iCloud won't help me at present.....

Work around for the loss of mail rule syncing?

Since MobileMe has been axed, mail rule syncing does not work anymore.
Is there an alternative to get mail rules to sync with iCloud or other tools? It is STUPID to have different clients using the same (IMAP) account(s) but different rule sets.

Thanks for the tip, but this does not work for me.
My impression is that Matt Parkinsons blog is (unfortunatly) wrong.
I am in front of my office iMac (10.8.2). I did change a rule, waited a while, and quit mail on the iMac.
Booted my MBP (10.8.2), opened Mail.app, and checked the rules list. The modification in the rule changed on the iMac was NOT there.
I created a new Smart mailbox, waited a while, and quit Mail on the MPB.
Checked on the iMac after opening Mail. The new Smart mailbox does not show up.
Since I am doing the "propagation of my rules" since quite some time via dropbox, I am also sure that the change dates of the three files MessageRules.plist, RulesActiveState.plist and UnsyncedRules.plist stays as is on one Mac even if rules are edited on another. The same conclusion results from searching (a copy of) the file MessageRules.plist using TextEdit to compensate for the lack of a find/search/locate function in rules with Mail.app.

Join and Project Rules & Sync Rules?

Similar Messages

Maybe you are looking for