1

We have a requirement to import the user profile from "sun java directory services", the SharePoint farm account is in AD but not present in the LDAP.

By design, SharePoint does not allow up to change the "User profile sync" service account and uses the farm account.

Though the "user profile service application" app pool account is present in both AD and in ED and are able to connect to the LDAP from SharePoint, we are unable to import the profiles as the farm account is not present there.

Is there a way to change the "User profile sync" account or fix this issue?

Improve this question
1
  • how can i import the profiles from ED - sun java directory server? Which is the account to be used to import the profiles and what are all the permission required for that account in AD & in ED?
    – Karthikeyan
    Feb 5, 2012 at 12:34

6 Answers 6

Reset to default
3

I hope this may help you http://blogs.msdn.com/b/tehnoonr/archive/2010/11/21/how-to-setup-user-profile-synchronization-between-sharepoint-2010-and-sun-ldap.aspx

we used this approach for importing the user profile.

Improve this answer
3
+25

Just to add a little more detail here, the SharePoint Farm account should not be the account that is used by FIM to actually perform the sync. The sync account is specified when setting up the sync connection (DOMAIN\spups in Spencer's rational guide), and needs to have the "Replicating Directory Changes" permission in AD.

In contrast, the SharePoint Farm account is the identity of the User Profile Synchronisation Service, hence the reason it requires local administrator privileges whenever the UPS is started/provisioned.

According to the link provided by Kuldeep it looks as though there are a number of other permissions that you need to give the sync account on the SUN LDAP server (DOMAIN\spups):

"The account needs to read certain attributes on the LDAP server including nsslapd-sizelimit attribute in cn=config container and lastchangenumber , nsUniqueId and numSubordinates attributes at the root of the container from which user profiles are being synchronized. The account should be able to read all these attributes in the SUN LDAP Server. "

Improve this answer
1

Did you try to change the service account by going to

  1. Central Admin->Security->Configure Service Account.

  2. Select the Windows Service - User Profile Synchronization service from the drop down and change the service account.

You can also check out the detailed guide from harbar.net for User Profile Synchronization. http://www.harbar.net/articles/sp2010ups.aspx

Improve this answer
4
  • Harbar says that "UPS doesn’t understand managed accounts" does it mean that SharePoint farm account is the only account can be used for the User profile sync? what is the use of configuring the managed account for user profile sync service?
    – Karthikeyan
    Feb 2, 2012 at 10:37
  • also is that mean that the account should exist both in AD & LDAP?
    – Karthikeyan
    Feb 2, 2012 at 13:24
  • Managed accounts are used to configure automatic password changes for security reasons. I believe Spence is just pointing out that the UPS doesn't pick up these changes (meaning that it's not practical to use the Managed Account capability with the SharePoint Farm account).
    – Benjamin J Athawes
    Feb 5, 2012 at 17:30
  • You cannot change the UPSS account. There is a check on startup to validate that the account running the UPSS is the Timer Service account. Do not change this, it will break the UPSS.
    – user6024
    Feb 5, 2012 at 18:04
0

Sorry to ask: But, I am curious as to why you are setting up the UPS; while it provides for a few features essentially it does not do more than what you can provide by building a stored procedure and an adsi link with a custom page that provides user search services etc. I had this built and working with my sharepoint installation however much of the issues where around Forefront identity Manager service not running with correct privelages to provision.

I would check with services and verify that FIM is setup and running with Network Service level or even better with a specialized user.

http://sharepointgeorge.com/2010/configuring-the-user-profile-service-in-sharepoint-2010/

Improve this answer
4
  • Paraphrased from Spencer Harbar's article entitled "User Profile Synchronization Service changes in the June 2011 Cumulative Updates": The fact that the UPA utilises FIM (a metadirectory) means that profiles can be created/managed across farms and over unreliable network connections, from a variety of different directories. If you are just importing profiles from AD within the context of a single farm then I suppose yes, FIM could be considered somewhat overkill.
    – Benjamin J Athawes
    Feb 8, 2012 at 22:33
  • - I'm not sure i'd fancy implementing my own "UPA" though :-)
    – Benjamin J Athawes
    Feb 8, 2012 at 22:33
  • I wrote my own ADSI Link and Profile Connection for user data look-up and have a farm install. My development is easier to manager and definitely easier to support as I know what it is doing rather than the issues that can crop up with using Forefront Identity Manager and User Profile Synchronization services.
    – Joe Garrett
    Feb 13, 2012 at 20:32
  • I use AD directly without imports. I use a Stored Proc query against the AD Data. For our medium business this works great and has little to no issues that I can foresee. We also use this to generate an Organization Chart.
    – Joe Garrett
    Feb 13, 2012 at 20:34
0

The post is wrote in italian but I think it is understandable: http://salvatoredifaziosharepoint.blogspot.com/2011/12/come-configurare-unautenticazione.html

enjoy

Improve this answer
0

In addition to Benjamin's answer:

The Sharepoint Farm account is the identity under which both FIM services run. You can see them using Services.mmc:

  1. Forefront Identity Manager Service
  2. Forefront Identity Manager Synchronization Service

That's why you must provide the password of the farm account when you start the UPS: to be able to setup these services.
To connect to your LDAP, the FIM services then use the account that you specify later in the Synchronization Connections page.
So you cannot change the account used by the UPS (the farm account), but you can change the account used to connect to your LDAP.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.