Forefront Identity Manager 2010 R2 build 4.1.3508.0 released

Today, Wednesday February 5th Tuesday February 11th, saw Microsoft release a new hotfix rollup package (build 4.1.3508.0) for Forefront Identity Manager 2010 R2.  The official documentation for this build can be found on the Microsoft support website under knowledgebase (KB) article 2913228.  Download link is here.  This build supersedes 4.1.3496.0.

The hotfix contains three (3) FIM Service and Portal updates and two (2) FIM Synchronization Service updates.

Full details of each update, duplicated from the KB for posterity, follow.  Hit the KB for the known issues and other details.

FIM Service and Portal

Issue 1

If a FIMService instance loses connection to the FIMService database, the FIMService instance may stop processing FIM Service MA export requests. This results in failed FIM Service MA exports that have a run status of stopped-server. Additionally, the following exception is logged in the Forefront Identity Manager event log:

System.Data: System.InvalidOperationException: The requested operation cannot be completed because the connection has been broken.

Issue 2

Consider the following scenario:

  • A Transition Out management policy rule is using a dynamic set together with a multivalued attribute.
  • Two or more elements are removed from the attribute in a single request.
  • One of the removed elements triggers the Transition-Out ManagementPolicyRule (MPR) resource.

In this scenario, the request fails. Additionally, you receive the following exception:

Microsoft.ResourceManagement.WebServices.Exceptions.UnwillingToPerformException: Other —> System.Data.SqlClient.SqlException: Reraised Error 2627, Level 14, State 1, Procedure DoEvaluateRequestInner, Line 1073, Message: Violation of PRIMARY KEY constraint ‘PK__#1B54B73__5330D0771D3CFFB1’. Cannot insert duplicate key in object ‘dbo.@transitionOutApplicableRuleBuffer’.

Issue 3

When an export that is run in the FIM Service MA includes updates to the Filter attribute of multiple dynamic groups, a failed-modification-via-web-services exception may be returned. When you review the details of the exception, you find that an SQL deadlock occurred.

FIM Synchronization Service

Issue 1

If a multivalued attribute is exported and then changed directly in the target system, the change is not evaluated during delta synchronization. For example, this issue occurs in the following scenario when the Active Directory Management Agent is used:

  • A change to proxyAddresses is exported to the Active Directory for User1.
  • A second change is made to proxyAddresses directly in Active Directory outside the synchronization service.
  • A Delta Import run profile is run to confirm the exported changes.

In this scenario, the next delta sync will not process the change.

Issue 2

If an exception is thrown by the Connector’s password extension during password synchronization, the Connector will be unloaded from memory. This behavior may cause high processor usage on the computer that is hosting the FIM Synchronization Service when that computer processes password synchronization if it is under load or is synchronizing passwords to multiple Connectors.

After this update is installed, exceptions of type PasswordPolicyException and PasswordIllFormedException no longer discard the password interface and unload the Connector. This lets the interface to be reused for another password operation to the connected data source. The password operation will not be retried and is removed from the queue. Any other exception will still unload the Connector and reload it at the next password operation.


About Paul Williams

IT consultant working for Microsoft specialising in Identity Management and Directory Services.
This entry was posted in FIM 2010 R2, Hotfix, News and tagged , , , , . Bookmark the permalink.

3 Responses to Forefront Identity Manager 2010 R2 build 4.1.3508.0 released

  1. Mark says:

    HI Paul,
    We have been awaiting this patch for some time now due to the DB timeouts. I can download the file, but KB2913228 does not seem to exist…

    • Hi Mark,

      I made a mistake and posted too early! 🙂

      I pulled the post for a few days to wait for the KB to go live. The post is back and the KB is now live.

      Apologies. I posted both FIM and FIM R2 on the same day when in actuality there is a 7 day window between releases.

      All good now.

  2. Pingback: Forefront Identity Manager 2010 R2 build 4.1.3510.0 released | Yet another identity management blog

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s