Management Agent Run Error Codes

failed-connection

Connection to the connected directory has failed for a reason other than authentication. For example, the network is unavailable, or the target server is offline.

failed-authentication

Authentication is not possible using the supplied credentials.

failed-search

A container or table search failed with an unexpected error.

no-start-partition-delete

The LDAP partition originally configured for this management agent no longer exists. This error is returned when the partition was deleted, or the partition was deleted and re-created with the same name. In the latter case, even though the name is the same, the error partition GUID will have changed.

missing-change-type

This error is returned during a delta import run by file-based and database management agents, as well as the management agent for Sun and Netscape directory servers, when the change type column value (add, modify, delete) is not present.

multi-valued-change-type

This error is returned during a delta import run by file-based and Sun and Netscape directory servers management agents when more than one value for the change type is present.

missing-dn

This error is returned for file-based management agents (that is, management agents for LDIF, DSML, or flat files with configured domain name attributes) when there is no domain name value. This is also returned in the case of a corrupted Sun ONE Directory Server change log where the domain name attribute is missing. It indicates that the management agent could read the element and parse it, but there was no domain name value for the object.

invalid-dn

This error is returned when a management agent reports that a domain name does not meet an FIM constraint, which includes:

• One or more characters that are not allowed by FIM
  
  
• An empty relative distinguished name (also known as RDN)
  
  
• A relative distinguished name that exceeds the maximum for FIM
  
  
• The number of hierarchy levels of the domain name exceeds the maximum for FIM
  
  

multi-valued-anchor-component

This error is returned by the management agent for Sun and Netscape directory servers if they cannot construct the anchor because an anchor construction rule attribute has more than one value.

duplicate-object

This error is returned on full imports by file-based and database management agents when an object with the same anchor has already been reported to the synchronization engine during this run.

missing-object-type

This error is returned when performing a resume of import from a corrupted drop file. This error should not be encountered during normal operation.

parse-error

This error is returned by the management agent for Sun and Netscape directory servers in delta mode and by file-based management agents when they cannot parse an entry. The <entry-number> element (and in most cases <line-number> and <column-number>) will be present to help locate the error. The <attribute-name> element might be present. The management agent for Sun and Netscape directory servers terminates the run when this is encountered. The file-based management agents log the discovery error and continue.

staging-error

This error is returned by most management agents. It indicates that the synchronization engine could not stage the delta in the connector space. The server creates an event log that provides information about the problem and that can be used for troubleshooting. Most management agents continue the import run when the error is logged, but the management agent for Sun and Netscape delta runs stops because gaps in the change log processing could be cause an inconsistent state in the connector space. This error should not be encountered during normal operation.

conflicting-modification-types

This error is returned by the LDIF management agent indicating differing attribute level modification types were encountered in the same record (in this case the attribute name which produced the conflicting types is reported) or multiple replace LDIF deltas are seen in the same file, such as:

replace: objectclass
objectclass: group
replace: objectclass
objectclass: user 

invalid-attribute-value

This error is returned by a call-based management agent when an attribute value is read that does not conform to the attribute type declared in the schema. Includes an <attribute-name> element to give the context of the error.

invalid-numeric-value

This error is returned by file-based management agents and the management agent for LDAP when they are unable to parse a numeric value. Includes an <attribute-name> element to give the context of the error.

reference-value-not-ldap-conformant

This error is returned by management agents for LDAP, LDIF, and DSML or flat files (with configured domain name attribute) when a domain name value does not conform to the LDAP specification. This error message includes an <attribute-name> element to give the context of the error.

unsupported-value-type

This error is returned by the DSML or LDIF management agent when the type of value given in the file is incompatible with the type of attribute, including:

A URI or URL value is given for a non-string attribute or for any reserved keyword such as dn, objectclass, or changetype.

A base64 value is given for the changetype attribute.

A string value containing non-ASCII characters is given for a binary attribute.

extension-dll-exception

This error occurs if a rules extension causes an exception. If you encounter this error, look at the <exception-error-info> element to examine the call stack of the exception. In some cases, the <rule-error-info> is present and provides additional information about what rule was being processed when the error occurred.

extension-dll-timeout

This error occurs if the customer has configured an extension timeout and the call on a single customer extension code entry point exceeds the configured timeout. The <exception-error-info> will give contextual information about what entry point was being called when it timed out. In some cases the <rule-error-info> will be present and will provide additional information about which rule was being processed when the error occurred. Note that when you are debugging the process that is executing the extension, timeouts are not enforced.

extension-projection-invalid-object-type

This error occurs when the implementation of the IMASynchronization.ShouldProjectToMV method in the rules extension sets the value of the outbound metaverse object type to a value that is not listed in Metaverse Designer of Synchronization Service Manager. Check that the method uses one of the specified object type values.

extension-join-resolution-index-out-of-bounds

This error occurs when an implementation of the IMASynchronization.ResolveJoinSearch method in the rules extension set an index value that is either negative or greater than equal to the number of metaverse objects.

extension-deprovisioning-invalid-result

This error occurs when an implementation of the IMASynchronization.Deprovision method returns an invalid DeprovisionAction enumeration value. Verify that the method returns a valid value.

extension-unexpected-attribute-value

This error occurs when a rules extension throws an UnexpectedDataException exception.

cs-attribute-type-mismatch

This error occurs when the type of the imported attribute does not match the attribute type specified in the management agent schema. One cause of this error could be that the stored connected data source schema has become out of date with the actual schema of the connected data source. To bring the stored connected data source schema up-to-date, refresh the schema using Synchronization Service Manager.

dn-index-out-of-bounds

This error occurs when the distinguished name component index value used in an import attribute flow configured in the properties of a management agent in Synchronization Service Manager is larger than the number of components in the distinguished name of the source object.

unsupported-container-delete

The management agent is attempting to delete a container object during deprovisioning. FIM management agents cannot delete container objects with child objects.

ambiguous-export-flow-to-single-valued-attribute

This error occurs when the export flow rule, configured in the properties for a management agent in Synchronization Service Manager, attempts to flow multiple values from a metaverse object to a single-value attribute.

unexported-container-rename

The implementation of the IMVSynchronization.Provision or IMASynchronization.Deprovision method is attempting to rename a container object with one or more unexported child objects.

locking-error-needs-retry

Multiple management agents are attempting to synchronize the same connector space object. Run the management agent again.

encryption-key-lost

The encryption key sets are missing from the server that is running FIM.

exported-change-not-reimported

This error occurs when changes that are exported to a management agent are not reconfirmed during this import management agent run. A user or a system process operating outside of FIM has changed the data in the connected data source in a way that indicates a configuration problem where the export attribute flow rule is trying to flow a value to a connected data source object, but the connected data source automatically resets the value to something different without reporting an error to the management agent. The <change-not-reimported> element indicates which changes were not reconfirmed.

missing-partition-for-run-step

This error indicates that the partition specified in the run profile cannot be found. Verify that the partition has not been deleted or renamed.

cd-missing-object

This error is returned when a modify of an object is exported to the connected data source, but the object cannot be found in the connected data source. It is returned only for call-based management agents. The cause of this error is that a person or external process has deleted an object from the connected data source outside of FIM.

duplicate-anchor

This error is returned if the anchor on a newly provisioned object is not unique. It is returned only for call-based and database management agents, as well as the management agent for Sun and Netscape directory servers. If this error is encountered, check the anchor construction rules to ensure that a unique anchor value for each object has been defined.

password-policy-violation

This error is returned by the management agents for Active Directory and Active Directory global address list (GAL) when the password attribute is set or changed to a value that does not meet the administrator-defined password policy of the connected data source.

kerberos-time-skew

This error is returned by the management agents for Active Directory and Active Directory global address list (GAL) when the password attribute is being set or changed and the FIM server machine time is more than five minutes different from the time on the domain controller.

encryption-not-enabled

This error is returned by the management agent for Active Directory Application Mode (ADAM) when the password attribute is set or being changed and the connection that the management agent uses to communicate to the connected data source has not been configured with an appropriate encryption mechanism (128 bit SSL or TLS). ADAM requires either 128 bit SSL or TLS configuration for setting passwords.

schema-violation

This error is returned by the management agent for LDAP when exporting an object modification and adding a attribute that is not in the connected data source schema or when removing an attribute from an object that is required by the schema. FIM does not allow these operations to occur because its rules check the stored copy of the connected data source schema. However, this problem might occur if the FIM schema is out of date with the connected data source schema. If you encounter this problem, refresh the management agent schema by using the user interface.

syntax-violation

This error is returned by the management agents for LDAP and Windows NT 4.0 when the value for an attribute violates certain value constraints. For example, when the value being exported contains an invalid character.

insufficient-field-width

This error is returned by the management agent for fixed-width text files when exporting an add or modify to an object and when the value of an attribute exceeds the width of the column.

permission-issue

This error is returned by the management agents for LDAP and Windows NT 4.0 when the export of an add, modify, or delete fails because the management agent has insufficient permissions to perform the operation against the connected data source.

non-existent-parent

This error is returned by the management agent for LDAP when either the export of an add or a rename fails because the parent object does not exist in the connected data source.

no-export-to-this-object-type

This error is returned by the management agent for Windows NT 4.0 when you try to perform provisioning operations or export attribute flow on computer objects. Export operations are not allowed on this type of object but you can perform an import on objects of this type.

invalid-provisioning-attribute-value

This error is returned when you are exporting a newly provisioned object and when certain attributes for provisioning set by the rules extension are invalid, for example, when they are not in a certain value range.

missing-anchor-component

This error is returned when you are exporting a newly provisioned object and an anchor cannot be generated because a value required for constructing the anchor is not available. Possible causes are when an attribute is not set during provisioning (that is, in management agents for Sun or Netscape directory servers, database, and file-based management agents), or it cannot be read from the connected data source (that is, in management agents for Active Directory, Sun and Netscape directory servers, and database management agents) when the anchor is constructed from an auto-increment column.

anchor-too-long

This error is returned by file-based and database management agents, as well as the management agent for Sun and Netscape directory servers, when the anchor construction produces an anchor that exceeds the maximum size limit for FIM. The maximum length of anchor values for a single attribute in the connector space is 398 characters. If the anchor is constructed from multiple attributes, subtract 2 characters for each additional attribute. For example, an anchor constructed of 3 attributes (sn+location+telephoneNumber) would have a limit of 392 characters.

encryption-key-lost

This error should not be encountered as part of normal operation. It indicates that FIM is unable to decrypt the value of an encrypted attribute that is stored in the connector space when it loads the object. It might indicate that the encryption key sets used by FIM are missing from the computer. This error can be generated by any management agent that contains a password attribute such as Active Directory, Active Directory global address list (GAL), Sun and Netscape directory servers, Lotus Notes, and Windows NT 4.0.

cd-error

This error is returned when the connected data source has a specialized error type. This error is accompanied by the <cd-error> element, and the information contained there should aid in troubleshooting.

no-export-to-this-object-type

This error is returned by the management agent for Windows NT 4.0 when you try to perform provisioning operations or when you export attribute flow on computer objects. The management agent for Windows NT 4.0 does not support export operations on this type of object.

temporary-certifier-file-creation-failure

This error is returned by the management agent for Lotus Notes when a new user or container is provisioned and the process of creating the certifier file fails for any reason (for example, out of disk space, permissions, and so on). The FIM process for creating the certifier file is to fetch the certifier information for the certifier container, specified by the _MMS_Certifier attribute, and temporarily create a certifier file in the MAData folder of the management agent for Lotus Notes for use by the Notes API.