|
Troubleshooting ILM (MIIS) Failed: Filter Rejection (rejected-by-filter) error |
|
|
As stated in previous posts on the topic of troubleshooting ILM (a.k.a. MIIS) errors, I’m posting problems, resolutions and reasons on certain errors that I’ve hit in MIIS or, more specifically with this next one, ILM “2”. While the other posts were quick and easy to work out what was happening this one took a lot more time and I couldn’t find much information on the web about it either. Basically, the ILM2 MA wasn’t performing outbound synchronisation. Now the actual MA is pretty irrelevant here, what’s important is that when I was previewing an object in the MAs CS I was getting a “synchronisation successful” status, however when I looked at the Provisioning summary “node” I was seeing a status of “rejected-by-filter”. Expanding that and looking at the Connector Add “node” the MA was my AD MA, the object type was user and the status was Failed: Filter Rejection.
I was only seeing this “error” when I ran a preview. Running a synchronisation didn’t yield the error as the inbound synchronisation was succeeding, it was the outbound synchronisation that wasn’t working and the reason was that the objects I was trying to provision were being rejected by “the filter”. Well, the filter in question was before we got to my IMASynchronization.FilterForDisconnection code block, and was also nothing to do with my declared connector filters. The problem was basically I’d mistyped my domain name in my XML configuration file, meaning that the distinguishedName for the object was for a different domain to the one that the AD MA was connected. I’d accidently written DC=ILMv22,DC=idmgmt,DC=int whereas the actual name was DC=ILMv2,DC=idmgmt,DC=int. Nice huh? That took all day to fix, and I had to publically embarrass myself on one of our internal DLs...
So, in summary, if you’re not seeing outbound synchronisation and you think you should be, check the preview results. If you see either of the errors “Failed: Filter Rejection” or “rejected-by-filter” the reason is most likely an invalid DN...
Happy coding and provisioning!
|
