I have now configured many SharePoint Management Agents, and initially I had severe problems finding out which attributes to populate with what. Here is the lessons I learned during this investigation.
Application ID
During configuration of the Management Agent, you are requested to input Application ID. I have never used it, and i guess it is used when you have multiple User Profile Service Applications.
Anchor
Do not bother with anchors. Instead just provision a connector space object and let it get the default anchor. You will never see the anchor anywhere except in FIM and internally in the SharePoint databases.
Manager attribute populating bug
There is a bug in SharePoint, where the manager attribute won't be populated in the User Profile Service, even though you are flowing it with FIM. The reason is that the timer job "User Profile Service Application - User Profile ActiveDirectory Import Job" is not created if you configure "Enable External Identity Manager" directly. Instead, you have to first choose "Use SharePoint Active Directory Import" on the "Configure Synchronization Settings", and let this job be created (takes 15 minutes), then switch to "Enable External Identity Manager".
Parallellism
It is not supported to run multiple SharePoint MAs simultaneously. Not sure why, but a little bit of code snooping shows this is true.
Pictures
Pictures can be a bit difficult, especially when trying with limited permissions. First of all, if you use fiddler the attribute is actually called "PictureURL". Also, technically it seems as though what actually happens when you use this connector and export a picture, you transfer the binary data (as base64 ofc) out in "PictureURL / Picture" and the API you talk to uploads these data as an original to your mysite, at the location "http://mysitehost.goodworkaround.com/User photos". And then it stores the url of the picture in the User Profile Service.
First of all, the MySite host MUST BE IN THE SAME FARM. It is not possible to have pictures uploaded to a separate SharePoint farm. Second, there is a requirement for permissions on the mysitehost. You can grant these permissions with the following cmdlet:
$w = Get-SPWebApplication -Identity http://mysitehost.goodworkaround.com
$w.GrantAccessToProcessIdentity("gwrnd\managementAgentAccount")
If you do not give this permissions, FIM will not get any error message from SharePoint saying "sorry, we could not store this picture". It will simply be "ok" even though the picture was not saved.
Also, as you can see in this TechNet article you need to run a cmdlet to actually generate the thumbnail photos.
ADFS authentication
To configure ADFS authentication the following attributes needs to be flowed from FIM to SharePoint:
| SharePoint attribute | Value |
| SPS-ClaimProviderID | Name of the trusted identity provider in SP (case sensitive): "SAML Users" |
| SPS-ClaimProviderType | Constant: "Trusted" |
| SPS-ClaimID | Unique identifier - mail, userPrincipalname, employeeID etc. Must be what comes in the nameidentifier claim from ADFS |
| SID | Do not flow anything |
| ProfileIdentifier | someprefix:unique - where "unique" is the same as SPS-ClaimID (not required, but make it unique) |
| UserName | Do not flow anything |
| AccountName | Do not flow anything |
Example user
| SharePoint attribute | Value |
| SPS-ClaimProviderID | SAML Users |
| SPS-ClaimProviderType | Trusted |
| SPS-ClaimID | marius@goodworkaround.com |
| SID | no flow |
| ProfileIdentifier | gwrnd:marius@goodworkaround.com |
| UserName | no flow |
| AccountName | no flow - SharePoint will automatically populate this with something like "i:0\.t|SAML Users|marius@goodworkaround.com" |
Windows authentication
To configure Windows authentication the following attributes needs to be flowed from FIM to SharePoint:
| SharePoint attribute | Value |
| SPS-ClaimProviderID | Constant: "Windows" |
| SPS-ClaimProviderType | Constant: "Windows" |
| SID | ObjectSID from Active Directory |
| ProfileIdentifier | DOMAIN\sAMAccountName from Active Directory |
| UserName | sAMAccountName from Active Directory |
| AccountName | Do not flow anything |
Example user
| SharePoint attribute | Value |
| SPS-ClaimProviderID | Windows |
| SPS-ClaimProviderType | Windows |
| SID | - binary data - |
| ProfileIdentifier | GWRND\marius |
| UserName | marius |
| AccountName | no flow |
That's, hope it saves you some time.