Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

We have a requirement to import the user profile from "sun java directory services", the SharePoint farm account is in AD but not present in the LDAP.

By design, SharePoint does not allow up to change the "User profile sync" service account and uses the farm account.

Though the "user profile service application" app pool account is present in both AD and in ED and are able to connect to the LDAP from SharePoint, we are unable to import the profiles as the farm account is not present there.

Is there a way to change the "User profile sync" account or fix this issue?

share|improve this question
    
how can i import the profiles from ED - sun java directory server? Which is the account to be used to import the profiles and what are all the permission required for that account in AD & in ED? –  Karthikeyan Feb 5 '12 at 12:34
add comment

6 Answers

Just to add a little more detail here, the SharePoint Farm account should not be the account that is used by FIM to actually perform the sync. The sync account is specified when setting up the sync connection (DOMAIN\spups in Spencer's rational guide), and needs to have the "Replicating Directory Changes" permission in AD.

In contrast, the SharePoint Farm account is the identity of the User Profile Synchronisation Service, hence the reason it requires local administrator privileges whenever the UPS is started/provisioned.

According to the link provided by Kuldeep it looks as though there are a number of other permissions that you need to give the sync account on the SUN LDAP server (DOMAIN\spups):

"The account needs to read certain attributes on the LDAP server including nsslapd-sizelimit attribute in cn=config container and lastchangenumber , nsUniqueId and numSubordinates attributes at the root of the container from which user profiles are being synchronized. The account should be able to read all these attributes in the SUN LDAP Server. "

share|improve this answer
add comment

Did you try to change the service account by going to

  1. Central Admin->Security->Configure Service Account.

  2. Select the Windows Service - User Profile Synchronization service from the drop down and change the service account.

You can also check out the detailed guide from harbar.net for User Profile Synchronization. http://www.harbar.net/articles/sp2010ups.aspx

share|improve this answer
    
Harbar says that "UPS doesn’t understand managed accounts" does it mean that SharePoint farm account is the only account can be used for the User profile sync? what is the use of configuring the managed account for user profile sync service? –  Karthikeyan Feb 2 '12 at 10:37
    
also is that mean that the account should exist both in AD & LDAP? –  Karthikeyan Feb 2 '12 at 13:24
    
Managed accounts are used to configure automatic password changes for security reasons. I believe Spence is just pointing out that the UPS doesn't pick up these changes (meaning that it's not practical to use the Managed Account capability with the SharePoint Farm account). –  Benjamin J Athawes Feb 5 '12 at 17:30
    
You cannot change the UPSS account. There is a check on startup to validate that the account running the UPSS is the Timer Service account. Do not change this, it will break the UPSS. –  Trevor Seward Feb 5 '12 at 18:04
add comment

Sorry to ask: But, I am curious as to why you are setting up the UPS; while it provides for a few features essentially it does not do more than what you can provide by building a stored procedure and an adsi link with a custom page that provides user search services etc. I had this built and working with my sharepoint installation however much of the issues where around Forefront identity Manager service not running with correct privelages to provision.

I would check with services and verify that FIM is setup and running with Network Service level or even better with a specialized user.

http://sharepointgeorge.com/2010/configuring-the-user-profile-service-in-sharepoint-2010/

share|improve this answer
    
Paraphrased from Spencer Harbar's article entitled "User Profile Synchronization Service changes in the June 2011 Cumulative Updates": The fact that the UPA utilises FIM (a metadirectory) means that profiles can be created/managed across farms and over unreliable network connections, from a variety of different directories. If you are just importing profiles from AD within the context of a single farm then I suppose yes, FIM could be considered somewhat overkill. –  Benjamin J Athawes Feb 8 '12 at 22:33
    
- I'm not sure i'd fancy implementing my own "UPA" though :-) –  Benjamin J Athawes Feb 8 '12 at 22:33
    
I wrote my own ADSI Link and Profile Connection for user data look-up and have a farm install. My development is easier to manager and definitely easier to support as I know what it is doing rather than the issues that can crop up with using Forefront Identity Manager and User Profile Synchronization services. –  Joe Garrett Feb 13 '12 at 20:32
    
I use AD directly without imports. I use a Stored Proc query against the AD Data. For our medium business this works great and has little to no issues that I can foresee. We also use this to generate an Organization Chart. –  Joe Garrett Feb 13 '12 at 20:34
add comment

The post is wrote in italian but I think it is understandable: http://salvatoredifaziosharepoint.blogspot.com/2011/12/come-configurare-unautenticazione.html

enjoy

share|improve this answer
add comment

In addition to Benjamin's answer:

The Sharepoint Farm account is the identity under which both FIM services run. You can see them using Services.mmc:

  1. Forefront Identity Manager Service
  2. Forefront Identity Manager Synchronization Service

That's why you must provide the password of the farm account when you start the UPS: to be able to setup these services.
To connect to your LDAP, the FIM services then use the account that you specify later in the Synchronization Connections page.
So you cannot change the account used by the UPS (the farm account), but you can change the account used to connect to your LDAP.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.