Configuring Profile Import in SharePoint 2010 – A Way Around the Minefields

Author’s Note – July 17 2012. When I originally wrote this in early 2010 it was based on some (at the time) sketchy Technet documentation and experience. It was meant to be an easy to understand guide to setting up the User Profile Service. I want to point out that there is a much more comprehensive guide out there on the topic, the Rational Guide to the User Profile Service by Spencer Harbar. It’s the reference I use when I get into trouble, and if this article doesn’t do it for you, I recommend going there.

Profile synchronization has changed drastically in SharePoint 2010 compared to 2007. The 2010 profile synchronization uses the Forefront Identity Management services. There are a lot of good things about this, one of which is that it provides for bi-directional synchronization. User changes to their profile store can be synchronized back to their identity store (Active directory, etc). This of course can be tightly controlled, on a field by field basis. There’s a great post on how to do so here.

Of course, all of this added power is not without its cost in complexity. I had a great deal of trouble even getting profile imports to work at all with some of the pre-release builds, and the final release is still a little rough around the edges. There is a Technet document available here that details precisely how to configure profile imports. It’s completely accurate, but doesn’t necessarily answer all of your questions. This post is my attempt to help guide around the worst of the thorns, and get it working with Active Directory.

First, you’ll need to have a Profile application running. If you’ve done a migration, you already do. If you’ve run the setup wizard, and selected user profile application, you also already have one. Synchronization will however not be happening,even if you’ve done a migration. It will need to be configured.

If you don’t already have a Profile Service application,you’ll need to create one. You do that from the Manage Service Applications screen and choose the New button in the upper left. You’ll want to select “User Profile Service Application”.

New User Profile Service

There is a lot of configuration here, make sure that you scroll to the bottom and fill out all of the relevant options. You’ll be choosing databases for social tagging, a database for storing user profiles, a database for storing user tags, and the URL of your MySite Host. If you haven’t already created a MySite site collection, the configuration screen here will allow you to do so. Once you have successfully created the application, you may then proceed to starting the service. This of course is in a completely different are where the services on the server are controlled. Once there, start the User Profile Synchronization Service.

User Profile Synchronization Service

When you start most of the services, they either start immediately, or give you a configuration screen and start quickly thereafter. Clicking this one gives you the configuration screen where you’re prompted to associate the service with your application from above, and the credentials that the two Windows Service accounts will run with. However once completed, you’ll notice that the service is in a “starting state”. This is normally a bad thing with SharePoint, and indicates that something is hung. Not so in this case. It takes a very long time for this service to start. When it does, you should see the following two services started:

New Profile Import Services

DO NOT attempt to start these services manually, and that will confuse the system in a very big way. Just have patience, and all should be well. You should now be ready to go ahead and perform an import. However, there’s a very import step that likely needs to be performed. The service account that was specified above to run the synchronization service (the one that the two forefront services are running as) need to be granted the “replicating directory changes” permission. There is another Technet article on how to do this, so I won’t go into detail on how.

If you do not perform this step, your import will fail, and you’ll have very little idea as to why. The error message is far from clear. Below I’ll talk a little about how you can troubleshoot import issues.

The next step is to set up the import itself. To do this, open up or manage your Profile service application, and select “Configure Synchronization Connections”

Create New Profile Connection

Once here, you either edit your existing connection(s), or create a new one. The options for import source are greatly increased from 2007 and now include Active Directory, Active Directory Resource (ADAM), Active Directory Logon Data,  BDC (they’ve forgotten to rename it to BCS), IBM Tivoli, Novell eDirectory, or Sun Java System Directory Server. Another improvement in this version is that the import can now use Forms authentication credentials, but can also make use of Claims based authentication if available.

Give the connection a name, select an authentication type, and any appropriate credentials. Once you have done this, press the “Populate Containers” button. If everything is OK, you should see your import source appear below:

Profile Import Container Selection

This dialog is NOT particularly responsive, be prepared for long waits between mouse clicks. The beauty of it is that you can now very easily cherry pick which containers, and even users get imported very easily. This is not something that was straightforward in 2007. Once completed, select OK, and your connection should be created. Note – subsequent edits of the connection will not retain the credential information. This is normal.

At this point you are ready to perform your firs import. Return to the Profile Service Application main page, and in the Synchronization section, select “Start Profile Synchronization”. You then have the option to choose full or incremental sync. Once selected, synchronization runs, and you can keep track of its status on the main profile application screen:

Profile Synchronization Manager Client for SharePoint 2010

This screen shows no problems, but if there are, they will be displayed for each step in a great amount of detail. I’ve used it to troubleshoot a few connection issues already.

In conclusion, the new profile synchronization system in 2010 has quite a few more moving parts, is a little rough around the edges (at the moment), and can be a bit of a bear to get going. However, it’s new capabilities make it well worth the effort, and lay the groundwork for what I can see to be some great new features down the road.

11 thoughts on “Configuring Profile Import in SharePoint 2010 – A Way Around the Minefields

  1. Ziad

    Thanks for this John, I””ve actively tried to avoid having to understand profile synchronization, but you””ve given me just what I need to make it work 🙂

  2. Pingback: Unable to access My Site Hosts site « DanOnNet's Blog

  3. Pingback: Configurare i profili utente in SharePoint 2010 - NovaTech Consulting Blog

  4. zgort

    Hello John,

    I am new with Sharepoint and Active Directory, I need to mapped “Member Of” property with the “Member of” in the Active Directory
    the connection i used of type “Active Directory”

    Where I got those attributes:

    (M)accountNameHistory
    (M)altSecurityIdentities
    (M)businessCategory
    (M)carLicense
    (M)departmentNumber
    (M)description
    (M)extensionName
    (M)groupPriority
    (M)groupsToIgnore
    (M)houseIdentifier
    (M)labeledURI
    (M)mhsORAddress
    (M)msDS-AllowedToDelegateTo
    (M)msExchLabeledURI
    (M)msNPCallingStationID
    (M)msNPSavedCallingStationID
    (M)msRADIUS-FramedIpv6Route
    (M)msRADIUSFramedRoute
    (M)msRADIUS-SavedFramedIpv6Route
    (M)msRASSavedFramedRoute
    (M)msTSLSProperty01
    (M)msTSLSProperty02
    (M)msTSProperty01
    (M)msTSProperty02
    (M)networkAddress
    (M)o
    (M)otherFacsimileTelephoneNumber
    (M)otherHomePhone
    (M)otherIpPhone
    (M)otherLoginWorkstations
    (M)otherMailbox
    (M)otherMobile
    (M)otherPager
    (M)otherTelephone
    (M)ou
    (M)postalAddress
    (M)postOfficeBox
    (M)proxyAddresses
    (M)roomNumber
    (M)servicePrincipalName
    (M)uid
    (M)url
    (M)userSharedFolderOther
    (M)wbemPath

    Which one of those attributes should I select?

    and thanks for your post 😉

  5. Antonio

    Hello John, nice post.

    I have set up the the profile importer and the synchronization of users from Active Directory works just fine.
    However I couldn’t find any information on how to setup Sharepoint 2010 to import also InetOrgPerson objects.

    Has someone had already this problem? Have you been able to solve this?

    Thanks

  6. Pingback: SharePoint User Profile Import / Synchronization | @SPSamer

  7. Tsvetelin Pavlov

    Hello, nice post!

    I’ve set up the sync and it is working, but we have two methods of authentication (Windows and SAML based with ADFS). SPS-ClaimID attribute is mapped, but when I run sync it does make two profiles for each user – for every login.

    Is it possible to merge those profiles or setup sync to create only one profile?

    Thanks in advance!

  8. Luis

    Is there any list of sharepoint user profile mapping AD attributes. I cannot find the appropiate attribute in User Profile to map P.O. Box. ?

  9. Anonymous

    Luis, zip is not part of the default SharePoint profile. Create a Custm Propertiy in UPS and map it to AD postalCode.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.