Wednesday 21 November 2012

FIM 2010 R2 Portal: Microsoft.ResourceManagement.Service: Microsoft.ResourceManagement.WebServices.Exceptions.PermissionDeniedException: ResourceIsMissing

I received a very strange errors at one of my clients when a approver view/refresh his "Approve Requests"


There is no errors within the FIM portal requests, but in the FIM Event get the following error:
Source: Microsoft.ResourceManagemt
Event ID: 3
Requestor: urn:uuid:10c491fb-a0fa-4dd5-9a27-66f5a4465963
Correlation Identifier: 42f74d59-bb91-480a-9582-d9c588436ebb
Microsoft.ResourceManagement.Service: Microsoft.ResourceManagement.WebServices.Exceptions.PermissionDeniedException: ResourceIsMissing
at Microsoft.ResourceManagement.WebServices.RequestDispatcher.ExecuteGetAction(RequestType request)
at Microsoft.ResourceManagement.WebServices.RequestDispatcher.ExecuteAction(RequestType request)
at Microsoft.ResourceManagement.WebServices.RequestDispatcher.ExecuteAction[ResponseBodyType](RequestType request)
at Microsoft.ResourceManagement.WebServices.RequestDispatcher.DispatchRequest[ResponseBodyType](RequestType request, Guid requestIdentifier, Object redispatchSingleInstanceKey, Boolean isRedispatch)
at Microsoft.ResourceManagement.WebServices.RequestDispatcher.DispatchRequest[ResponseBodyType](RequestType request)
at Microsoft.ResourceManagement.WebServices.ResourceManagementService.Get(Message request)

After quite a bit of research and setting the event logging to Verbose logging I have discover teh following:

The error only appear in the event viewer when we do a search on approvals when the originator is the service account which update users. The approvers which have this error does not have the correct rights, due to that we used a web service call from another domain which uses a service account to make the changes in the FIM Portal and the account is part of the FIM Administrators. Grant the users the correct permissions and the error is resolved.

1 comment:

  1. After having the same problem I found I needed to let 'All People' read the ObjectID and ObjectType of 'All People'. Previously I had restricted All People to a set of "Portal Users" which excluded admin and service accounts.

    ReplyDelete