MIM 2016/ FIM2010 Troubleshooting Sync-rule-flow-provisioning-failed: An Object with DN Already Exists in Management Agent

아티클
1/17/2024

The objective of the FIM synchronization service is to manage the distributed identity data in your external systems according to the configuration of your synchronization rules.

Introduction

For a complete overview of how the FIM synchronization service works and how to configure it, see Understanding Data Synchronization with External Systems.

The activities of the FIM synchronization service are initiated by run profile. During the run of a synchronization run profile, the Synchronization Service Manager user interface might report errors codes such as “sync-rule-flow-provisioning-failed”.

The following illustration shows an example for this:

To troubleshoot the error, you need to first gather more details about the nature of the error by reviewing the associated call stack trace information. Clicking the error code opens the Connector Space Object Properties dialog. This dialog has a Stack Trace button to display the call stack information. The objective of this article is to provide more details about common call stack trace details of a synchronization run and troubleshooting steps to resolve them.

Symptoms

The call stack information of a synchronization error might indicate that an object with a specific DN already exists in the connector space of a management agent.

The following illustration shows an example for this:

Cause

When you configure a synchronization rule in the FIM portal, at a minimum, you must configure an attribute flow mapping to set the DN of a newly provisioned object. In FIM, the DN of connector space objects must be unique. If your synchronization rule causes the synchronization engine to provision a new connector that has the same value for the DN attribute as an already existing connector space object, an exception is raised.

Resolution

To fix this issue, you need to determine what the reason for this conflict is.

The most common reasons are:

Incomplete joins
Incorrect DN calculation method

Incomplete joins

the objective of the initialization phase is to join related identity data parts. This is why you should disable provisioning in your initial synchronization runs.

To fix an incomplete join problem in your environment, you should:/p>

Disable provisioning.
Run synchronization on the Fabrikam FIMMA to bring Britta Simon into the metaverse.
Run synchronization on the Fabrikam ADDSMA to join Britta Simon with the related object in the metaverse.
EEnable provisioning.

Incorrect DN calculation method

Your logic to calculate the value of your DN attribute must result in a unique value. In this case, you need to develop a better method to calculate a unique DN attribute value.

다음을 통해 공유