User Profile Service: Can add my user to Administrators, but not Permissions

Question

I'm trying to run a Powershell script that updates the "PictureURL" for a specific FBA user on my SharePoint 2010 site. However, the script returns an error saying:

New-Object : Exception calling ".ctor" with "1" argument(s): "Object reference not set to an instance of an object."

Having read around, I found that 50% of people say to add my user to the Administrators list for the User Profile Service, and the other 50% say to add my user to the Permissions list for the User Profile Service.

So, I go to CA and select the User Profile Service. Clicking Administrators I can add 'Kevin' to the list and the people picker find me (domain\kevin).

However, when I go the Permissions for the same service, the people picker cannot find me at all, or ANY other user in the system, AD or FBA.

I cannot understand why the people picker works for one list but not another, so I find myself here.

Any clues?

Kevin

Answer 1

While this doesn't directly answer the question of why the people picker wasn't working for the User Profile Service permissions list, I was directed to an article that explains how to add people to that list using powershell. I thought I'd answer this with a workaround, for future readers.

Set-UpsConnectionPermission.ps1

param (
$accountName
)

$claimType = "http://schemas.microsoft.com/sharepoint/2009/08/claims/userlogonname"
$claimValue = $accountName
$claim = New-Object Microsoft.SharePoint.Administration.Claims.SPClaim($claimType, $claimValue, "http://www.w3.org/2001/XMLSchema#string", [Microsoft.SharePoint.Administration.Claims.SPOriginalIssuers]::Format("Windows"))
$claim.ToEncodedString()

$permission = [Microsoft.SharePoint.Administration.AccessControl.SPIisWebServiceApplicationRights]"FullControl"

$SPAclAccessRule = [Type]"Microsoft.SharePoint.Administration.AccessControl.SPAclAccessRule``1"
$specificSPAclAccessRule = $SPAclAccessRule.MakeGenericType([Type]"Microsoft.SharePoint.Administration.AccessControl.SPIisWebServiceApplicationRights")
$ctor = $SpecificSPAclAccessRule.GetConstructor(@([Type]"Microsoft.SharePoint.Administration.Claims.SPClaim",[Type]"Microsoft.SharePoint.Administration.AccessControl.SPIisWebServiceApplicationRights"))
$accessRule = $ctor.Invoke(@([Microsoft.SharePoint.Administration.Claims.SPClaim]$claim, $permission))

$ups = Get-SPServiceApplication | ? { $_.TypeName -eq 'User Profile Service Application' }
$accessControl = $ups.GetAccessControl()
$accessControl.AddAccessRule($accessRule)
$ups.SetAccessControl($accessControl)
$ups.Update()

and then call that script using:

.\Set-UpsConnectionPermission.ps1 "win2008\administrator"