How to Use PowerShell to Manually Remove a Resource from the Scope of a Synchronization Rule
FIM ScriptBox Item
Summary
When you manage resources with FIM, it is possible that a resource was accentually brought into the scope of the wrong outbound synchronization rule.
The objective of this article is to explain how to fix this.
To manage your resource in external systems with FIM, you need to bring them into the scope of the related synchronization rules.
This means, you link a resource with an outbound synchronization rule by creating an Expected Rules Entry (ERE).
The following picture outlines the related architecture:
This process is defined by your synchronization policy. A synchronization policy consists of 4 components:
- A Management Policy Rule (MPR)
- A Set
- A Workflow
- An Outbound Synchronization Rule
The following picture outlines the related architecture:
The process of bringing a resource into the scope of a synchronization rule starts with the transition of the resource into a specific set.
After the resource has transitioned into this set, the FIM service invokes the set transition MPR you have defined in your synchronization policy.
The MPR invokes the configured workflow.
In your workflow definition, you must have a synchronization rule and an action defined.
To bring the resource into the scope of a synchronization rule, an Add must be defined as action:
When this process has completed, your resource is in the scope of the synchronization rule:
You can find a more detailed description of this process in “Understanding Data Synchronization with External Systems”.
If you need to remove a resource from the scope of a synchronization rule, you also need to implement a synchronization policy that consists of temporary components.
The main difference is that your temporary workflow is configured to remove the resource form the scope of the synchronization rule:
While it is possible to create the required components manually, it helps you to safe some time by automating this process in form of a script.
The script would first check whether your temporary MPR, workflow and set already exist.
If so, the script deletes them.
After the object information about the resource and the synchronization rule have been retrieved the script creates the required temporary components of the synchronization policy.
When you develop the script, the only little challenge is the definition of the Workflow activity because the related attribute has a complete XML block as attribute value.
You can get the required XML block from an existing workflow definition.
The only part, the script code needs to update, is the ID of the synchronization rule:
Creating the temporary MPR is a straight forward process. In your script code, you set the following attributes:
<><><><><>To trigger a set transition in your temporary set, the script code makes the related resource a static member. As a last step, the script deletes the temporary components again. When the script has completed successfully, you should review the provisioning status of your resource. Your resource should have a pending remove operation for the related synchronization rule.
To actually remove the relationship between the resource and the synchronization rule, a synchronization cycle is required. This means, you need to run the following run profiles on your FIM management agent:
- Delta Import
- Delta Synchronization
- Export
| Attribute | Value | |||
|---|---|---|---|---|
| ActionParameters | * | |||
| ActionType | Transition In | |||
| ActionWorkflowDefinition | <ID of the temporary workflow> | |||
| Disabled | False | |||
| GrantRight | False | |||
| ManagementPolicyRuleType | SetTransition | |||
| ResourceFinalSet | <ID of the temporary set> |
To trigger a set transition in your temporary set, the script code makes the related resource a static member.
As a last step, the script deletes the temporary components again.
When the script has completed successfully, you should review the provisioning status of your resource.
Your resource should have a pending remove operation for the related synchronization rule:
To actually remove the relationship between the resource and the synchronization rule, a synchronization cycle is required.
This means, you need to run the following run profiles on your FIM management agent:
- Delta Import
- Delta Synchronization
- Export
Script Code
| 001 002 003 004 005 006 007 008 009 010 011 012 013 014 015 016 017 018 019 020 021 022 023 024 025 026 027 028 029 030 031 032 033 034 035 036 037 038 039 040 041 042 043 044 045 046 047 048 049 050 051 052 053 054 055 056 057 058 059 060 061 062 063 064 065 066 067 068 069 070 071 072 073 074 075 076 077 078 079 080 081 082 083 084 085 086 087 088 089 090 091 092 093 094 095 096 097 098 099 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 |
#-------------------------------------------------------------------------------------------------------------------- Set-Variable -Name URI -Value "http://localhost:5725/resourcemanagementservice" -Option Constant #-------------------------------------------------------------------------------------------------------------------- Function SubmitResource { Param($Resource) End { $Resource | Import-FIMConfig -uri $URI ` -ErrorVariable Err ` -ErrorAction SilentlyContinue If($Err){Throw $Err} } } #-------------------------------------------------------------------------------------------------------------------- Function ExportResources { Param($Filter) End { $CurObjects = export-fimconfig -uri $URI ` –onlyBaseResources ` -customconfig ($Filter)` -ErrorVariable Err ` -ErrorAction SilentlyContinue If($Err){Throw $Err} Return $CurObjects } } #-------------------------------------------------------------------------------------------------------------------- Function AddMemberToSet { Param($Set, $NewMember) End { $ResourceId = @($Set)[0].ResourceManagementObject.ObjectIdentifier $ObjectType = @($Set)[0].ResourceManagementObject.ObjectType $ImportObject = New-Object Microsoft.ResourceManagement.Automation.ObjectModel.ImportObject $ImportObject.ObjectType = $ObjectType $ImportObject.TargetObjectIdentifier = $ResourceId $ImportObject.SourceObjectIdentifier = $ResourceId $ImportObject.State = 1 AddChangeToResource -Resource $ImportObject ` -AttributeName "ExplicitMember" ` -AttributeValue $NewMember ` -Operation 0 SubmitResource -Resource $ImportObject } } #-------------------------------------------------------------------------------------------------------------------- Function AddChangeToResource { Param($Resource, $AttributeName, $AttributeValue, $Operation) End { $ImportChange = New-Object Microsoft.ResourceManagement.Automation.ObjectModel.ImportChange $ImportChange.Operation = $Operation $ImportChange.AttributeName = $AttributeName $ImportChange.AttributeValue = $AttributeValue $ImportChange.FullyResolved = 1 $ImportChange.Locale = "Invariant" If($Resource.Changes -eq $null) {$Resource.Changes = (,$ImportChange)} Else {$Resource.Changes += $ImportChange} } } #-------------------------------------------------------------------------------------------------------------------- Function CreateResource { Param($ObjectType, $DisplayName) End { $NewResource = New-Object Microsoft.ResourceManagement.Automation.ObjectModel.ImportObject $NewResource.ObjectType = $ObjectType $NewResource.SourceObjectIdentifier = [System.Guid]::NewGuid().ToString() AddChangeToResource -Resource $newResource ` -AttributeName "DisplayName" ` -AttributeValue $DisplayName ` -Operation "1" Return $NewResource } } #-------------------------------------------------------------------------------------------------------------------- Function DeleteResource { PARAM($Resource) END { $ObjectId = (($Resource.ResourceManagementObject.ObjectIdentifier).split(":"))[2] $ObjectType = $Resource.ResourceManagementObject.ObjectType $ImportObject = New-Object Microsoft.ResourceManagement.Automation.ObjectModel.ImportObject $ImportObject.ObjectType = $ObjectType $ImportObject.TargetObjectIdentifier = $ObjectId $ImportObject.SourceObjectIdentifier = $ObjectId $ImportObject.State = 2 SubmitResource $ImportObject } } #-------------------------------------------------------------------------------------------------------------------- Function ExportSingleResource { Param($Filter) End { $CurObject = ExportResources -Filter $Filter If($CurObject -eq $null) {Throw "Resource not found: $Filter"} If(@($CurObject).Count -ne 1) {Throw "Multiple objects found: $Filter"} Return $CurObject } } #---------------------------------------------------------------------------------------------------------- Function MustNotExist { Param($Filter) End { $CurObjects = ExportResources -Filter $Filter If($CurObjects -eq $null) {Return} $CurObjects | ForEach { DeleteResource -Resource $_ } } } #---------------------------------------------------------------------------------------------------------- If($args.count -eq 0) { Write-Host "To run this script, you need to provide two parameters:" Write-Host "1) The name of the affected resource" Write-Host "2) The name of the affected synchronization rule" Exit } If($args.count -ne 2) {Throw "A required parameter is missing!"} $ResourceName = $args[0] $SyncRuleName = $args[1] If(@(Get-PSSnapin | Where-Object {$_.Name -eq "FIMAutomation"} ).count -eq 0) {Add-PSSnapin FIMAutomation} Clear-Host $iStep = 0 $iMax = 12 $iStep++ $ProgressPreference ="Continue" Write-Progress -activity "Removing MPR: 1MPR" ` -status "Please wait" -percentcomplete ([int]($iStep/$iMax * 100)) ` -currentoperation "Processing step $iStep of $iMax" $ProgressPreference ="SilentlyContinue" MustNotExist -Filter "/ManagementPolicyRule[DisplayName='1MPR']" $iStep++ $ProgressPreference ="Continue" Write-Progress -activity "Removing workflow: 1WorkFlow" ` -status "Please wait" -percentcomplete ([int]($iStep/$iMax * 100)) ` -currentoperation "Processing step $iStep of $iMax" $ProgressPreference ="SilentlyContinue" MustNotExist -Filter "/WorkflowDefinition[DisplayName='1WorkFlow']" $iStep++ $ProgressPreference ="Continue" Write-Progress -activity "Removing set: 1Set" ` -status "Please wait" -percentcomplete ([int]($iStep/$iMax * 100)) ` -currentoperation "Processing step $iStep of $iMax" $ProgressPreference ="SilentlyContinue" MustNotExist -Filter "/Set[DisplayName='1Set']" $iStep++ $ProgressPreference ="Continue" Write-Progress -activity "Retrieving resource: $ResourceName" ` -status "Please wait" -percentcomplete ([int]($iStep/$iMax * 100)) ` -currentoperation "Processing step $iStep of $iMax" $ProgressPreference ="SilentlyContinue" $Resource = ExportSingleResource -Filter "/Person[DisplayName='$ResourceName']" $iStep++ $ProgressPreference ="Continue" Write-Progress -activity "Retrieving resource: $SyncRuleName" ` -status "Please wait" -percentcomplete ([int]($iStep/$iMax * 100)) ` -currentoperation "Processing step $iStep of $iMax" $ProgressPreference ="SilentlyContinue" $SyncRule = ExportSingleResource -Filter "/SynchronizationRule[DisplayName='$SyncRuleName']" $iStep++ $ProgressPreference ="Continue" Write-Progress -activity "Creating Set: 1Set" ` -status "Please wait" -percentcomplete ([int]($iStep/$iMax * 100)) ` -currentoperation "Processing step $iStep of $iMax" $ProgressPreference ="SilentlyContinue" $Set = CreateResource -Objecttype "Set" -DisplayName "1Set" SubmitResource -Resource $Set $Set = ExportSingleResource -Filter "/Set[DisplayName='1Set']" $iStep++ $ProgressPreference ="Continue" Write-Progress -activity "Creating Workflow: 1WorkFlow" ` -status "Please wait" -percentcomplete ([int]($iStep/$iMax * 100)) ` -currentoperation "Processing step $iStep of $iMax" $ProgressPreference ="SilentlyContinue" $Workflow = CreateResource -Objecttype "WorkflowDefinition" -DisplayName "1Workflow" $SetId = ((@($Set)[0].ResourceManagementObject.ObjectIdentifier).split(":"))[2] $SyncRuleId = ((@($SyncRule)[0].ResourceManagementObject.ObjectIdentifier).split(":"))[2] $XOML = "<ns0:SequentialWorkflow x:Name=""SequentialWorkflow"" ActorId=""00000000-0000-0000-0000-000000000000"" " + ` "WorkflowDefinitionId=""00000000-0000-0000-0000-000000000000"" RequestId=""00000000-0000-0000-0000-000000000000"" " + ` "TargetId=""00000000-0000-0000-0000-000000000000"" xmlns:x=""http://schemas.microsoft.com/winfx/2006/xaml"" " + ` "xmlns:ns0=""clr-namespace:Microsoft.ResourceManagement.Workflow.Activities;Assembly=Microsoft.ResourceManagement, " + ` "Version=4.0.3531.2, Culture=neutral, PublicKeyToken=31bf3856ad364e35""> " + ` "<ns0:SynchronizationRuleActivity RemoveValue=""{x:Null}"" AttributeId=""00000000-0000-0000-0000-000000000000"" " + ` "AddValue=""{x:Null}"" x:Name=""authenticationGateActivity1"" SynchronizationRuleId=""" + ` $($SyncRuleId) + ` """ Action=""Remove""> " + ` "<ns0:SynchronizationRuleActivity.Parameters> <x:Array Type=""{x:Type ns0:SynchronizationRuleParameter}"" /> " + ` "</ns0:SynchronizationRuleActivity.Parameters> </ns0:SynchronizationRuleActivity> </ns0:SequentialWorkflow>" AddChangeToResource -Resource $Workflow ` -AttributeName "XOML" ` -AttributeValue $XOML ` -Operation "1" AddChangeToResource -Resource $Workflow ` -AttributeName "RequestPhase" ` -AttributeValue "Action" ` -Operation "1" AddChangeToResource -Resource $Workflow ` -AttributeName "RunOnPolicyUpdate" ` -AttributeValue "False" ` -Operation "1" SubmitResource -Resource $Workflow $Workflow = ExportSingleResource -Filter "/WorkflowDefinition[DisplayName='1Workflow']" $WorkflowId =((@($Workflow)[0].ResourceManagementObject.ObjectIdentifier).split(":"))[2] $iStep++ $ProgressPreference ="Continue" Write-Progress -activity "Creating MPR: 1MPR" ` -status "Please wait" -percentcomplete ([int]($iStep/$iMax * 100)) ` -currentoperation "Processing step $iStep of $iMax" $ProgressPreference ="SilentlyContinue" $MPR = CreateResource -Objecttype "ManagementPolicyRule" -DisplayName "1MPR" AddChangeToResource -Resource $MPR ` -AttributeName "ActionParameter" ` -AttributeValue "*" ` -Operation "0" AddChangeToResource -Resource $MPR ` -AttributeName "ActionType" ` -AttributeValue "TransitionIn" ` -Operation "0" AddChangeToResource -Resource $MPR ` -AttributeName "ActionWorkflowDefinition" ` -AttributeValue $WorkflowId ` -Operation "0" AddChangeToResource -Resource $MPR ` -AttributeName "Disabled" ` -AttributeValue "False" ` -Operation "1" AddChangeToResource -Resource $MPR ` -AttributeName "GrantRight" ` -AttributeValue "False" ` -Operation "1" AddChangeToResource -Resource $MPR ` -AttributeName "ManagementPolicyRuleType" ` -AttributeValue "SetTransition" ` -Operation "1" AddChangeToResource -Resource $MPR ` -AttributeName "ResourceFinalSet" ` -AttributeValue $SetId ` -Operation "0" SubmitResource -Resource $MPR $iStep++ $ProgressPreference ="Continue" Write-Progress -activity "Updating Set membership" ` -status "Please wait" -percentcomplete ([int]($iStep/$iMax * 100)) ` -currentoperation "Processing step $iStep of $iMax" $ProgressPreference ="SilentlyContinue" $ResourceId = ((@($Resource)[0].ResourceManagementObject.ObjectIdentifier).split(":"))[2] AddMemberToSet -Set $Set -NewMember $ResourceId $iStep++ $ProgressPreference ="Continue" Write-Progress -activity "Deleting MPR: 1MPR" ` -status "Please wait" -percentcomplete ([int]($iStep/$iMax * 100)) ` -currentoperation "Processing step $iStep of $iMax" $ProgressPreference ="SilentlyContinue" MustNotExist -Filter "/ManagementPolicyRule[DisplayName='1MPR']" $iStep++ $ProgressPreference ="Continue" Write-Progress -activity "Deleting Workflow: 1Workflow" ` -status "Please wait" -percentcomplete ([int]($iStep/$iMax * 100)) ` -currentoperation "Processing step $iStep of $iMax" $ProgressPreference ="SilentlyContinue" MustNotExist -Filter "/WorkflowDefinition[DisplayName='1WorkFlow']" $iStep++ $ProgressPreference ="Continue" Write-Progress -activity "Deleting Set: 1Set" ` -status "Please wait" -percentcomplete ([int]($iStep/$iMax * 100)) ` -currentoperation "Processing step $iStep of $iMax" $ProgressPreference ="SilentlyContinue" MustNotExist -Filter "/Set[DisplayName='1Set']" #---------------------------------------------------------------------------------------------------------- Trap { Write-Host "`nError: $($_.Exception.Message)`n" -foregroundcolor white -backgroundcolor darkred Exit 1 } #---------------------------------------------------------------------------------------------------------- |
Note
To provide feedback about this script, create a post on the FIM TechNet Forum.
For more FIM related Windows PowerShell scripts, see the FIM ScriptBox.