FIM 2010 - XPath : How to check null value on a datetime attribute
Hi there,
I am Syam Pinnaka, Dev in Identity and Access (IAM) team in Microsoft. Today lets see one of my recent learning with Forefront Identity Manager (FIM) Xpath and datetime attribute values.
Forefront Identity Manager (FIM) 2010 can read XPath (XML Path language) queries and return the result set matching the given XPath query. XPath queries can be issued using FIM WCF endpoints and/or FIM PowerShell scripts. That’s a completely different subject and we will touch upon them on a different post(s). Everything with XPath will be good until we reach to a point where we test null value for a dateTime attribute. FIM XPath filter dialect supports checking null values on string attributes using “contains” phrase. For example the following expression defines all persons for which the displayName attribute is not defined.
/Person[not(contains(DisplayName, ‘’))]
However the above construct will fail when tried on a dateTime attribute as FIM didn’t have an option to directly test null value on a datetime attributes. Meaning the following will not work as expected.
/Group[not(contains(ExpiryTime, ‘’))]
The reason for that is that unlike string attributes, FIM only supports querying against invalid values for dateTime and Integer based attributes. In specific scenarios as in this case, null is a perfectly valid value hence it cannot used as an Invalid value to query against. However we can work around this scenario by querying against a positive value and inverting the result set. For example when we wanted to check all objects with a null expiryTime, we can search for all objects with an expiryTime of absolute out of range value, lets say >= ‘1900/01/01’ and then negate the result set to find all objects with a null value. The XPath query will look something like below.
/Group[not(ExpirationTime >= ‘1900-01-01T00:00:000’)]
However, beware that the above query will also return all objects with an expiration time < ‘1900/01/01’ hence you got to choose the lower bound carefully to get only the objects with null expiry time.
I went through this so fully aware of the effort required to find this. Hence thought this post will be useful for someone looking for the same answer.
Happy coding!