First published on MSDN on Dec 30, 2014
The FIM MA is just another Management Agent
The FIM Service Management Agent (FIM MA) is a call-based MA used to communicate with the FIM Web service. This management agent extends the functionality of Forefront Identity Manager to leverage codeless provisioning, management policy application, reporting, and self-service by connecting aggregated identity data in the Metaverse with a separate data source, the FIMService database. Think of the FIM MA as just another Management Agent, and the FIMService database as just another data source. From a synchronization perspective that's ALL it is, albeit with some configuration set by design.
Some FIM MA properties are set by design
Identity data managed by the FIM MA has a direct relationship to the Metaverse. This information is important, and helps iron out some of the weirdness in the FIM MA. Technically, this is not the whole story as there are separate schemas for the Metaverse and FIM Service, and there is no requirement to configure additional attribute flows at all (perhaps there should be). In any event it is true for understanding synchronization with the FIM MA and there are 4 effects imposed by this design choice:
|FIM Connector Space||| Metaverse|
* Object Type Mappings must be set for 2. and 3. to be true. Without an Object type Mapping there are no rules for projection or provisioning.
Best Practice: Configure the Connector Filter
Ok, this is not technically a requirement for understanding but is highly suggested as best practice to filter out the Built-in Synchronization Account (ILMSync) and the Install Account. These GUIDs are well known and I would be interested to hear an argument as to why these identities should be synchronized in any scenario.
Configure the filter on the <dn> as shown below:
And that's it! The FIM MA is just another MA with pre-configured (and obscured) rules. Please leave comments or questions below and I will answer them below and update the post.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.