From Caspi at seznam.cz  Mon Jan  1 20:20:59 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Mon, 01 Jan 2018 20:20:59 +0100 (CET)
Subject: [midPoint] ValidFrom and ValidTo
Message-ID: <4nl.vHb.5tJBw5nKOCX.1QIeeR@seznam.cz>

Hi All,



need help with importing date times in MidPoint from CSV.




In CSV there is date time in format:  "12/31/2000 11:00:00 AM" 




In resource i have enabled activation capability and I tryed to map value as
showwn in config bellow:






         <attribute id="12">

            <c:ref>ri:StartDate</c:ref>

            <tolerant>true</tolerant>

            <exclusiveStrong>false</exclusiveStrong>

            <inbound id="17">

               <authoritative>true</authoritative>

               <exclusive>false</exclusive>

               <strength>normal</strength>

               <expression>

                  <script xmlns:xsi="http://www.w3.org/2001/XMLSchema-
instance"

                          xsi:type="c:ScriptExpressionEvaluatorType">

                     <code>

       import java.text.SimpleDateFormat;

       import java.text.DateFormat;




       DateFormat df = new SimpleDateFormat("MM/dd/yyyy HH:mm:ss a");




       if (input!=null) {

           Date convertedValidFrom = df.parse(input);

     log.info ("convertedValidFrom = " +

     convertedValidFrom);




           return

     com.evolveum.midpoint.util.MiscUtil.asXMLGregorianCalendar
(convertedValidFrom);

       }

       else {

           return null;

       }




                                 </code>

                  </script>

               </expression>

               <target>

                  <c:path>$focus/activation/validFrom</c:path>

               </target>

            </inbound>

         </attribute>





But it doesnt work to me. I am getting error messages like here:








 1001: java.text.ParseException: Unparseable date: "12/31/2000 11:00:00 AM" 
 in expression in mapping in inbound expression for {http://midpoint.
 evolveum.com/xml/ns/public/resource/instance-3}StartDate in resource:900dd
 939-02da-48f2-a7b9-683de6b8d486(HR Feed)({.../common/common-3}input=12/31/
 2000 11:00:00 AM; ) in expression in mapping in inbound expression for 
 {http://midpoint.evolveum.com/xml/ns/public/resource/instance-3}StartDate 
 in resource:900dd939-02da-48f2-a7b9-683de6b8d486(HR Feed)
 
 	

Operation
Save (GUI)
Message
java.text.ParseException: Unparseable date: "12/31/2000 11:00:00 AM" in 
expression in mapping in inbound expression for {http://midpoint.evolveum.
com/xml/ns/public/resource/instance-3}StartDate in resource:900dd939-02da-48
f2-a7b9-683de6b8d486(HR Feed)({.../common/common-3}input=12/31/2000 11:00:00
AM; ) in expression in mapping in inbound expression for {http://midpoint.
evolveum.com/xml/ns/public/resource/instance-3}StartDate in resource:900dd
939-02da-48f2-a7b9-683de6b8d486(HR Feed)






Error
java.text.ParseException: Unparseable date: "12/31/2000 11:00:00 AM" in 
expression in mapping in inbound expression for {http://midpoint.evolveum.
com/xml/ns/public/resource/instance-3}StartDate in resource:900dd939-02da-48
f2-a7b9-683de6b8d486(HR Feed)({.../common/common-3}input=12/31/2000 11:00:00
AM; ) in expression in mapping in inbound expression for {http://midpoint.
evolveum.com/xml/ns/public/resource/instance-3}StartDate in resource:900dd
939-02da-48f2-a7b9-683de6b8d486(HR Feed)
show
com.evolveum.midpoint.util.exception.ExpressionEvaluationException: java.
text.ParseException: Unparseable date: "12/31/2000 11:00:00 AM" in 
expression in mapping in inbound expression for {http://midpoint.evolveum.
com/xml/ns/public/resource/instance-3}StartDate in resource:900dd939-02da-48
f2-a7b9-683de6b8d486(HR Feed)({.../common/common-3}input=12/31/2000 11:00:00
AM; ) in expression in mapping in inbound expression for {http://midpoint.
evolveum.com/xml/ns/public/resource/instance-3}StartDate in resource:900dd
939-02da-48f2-a7b9-683de6b8d486(HR Feed) at com.evolveum.midpoint.model.
common.expression.evaluator.AbstractValueTransformationExpressionEvaluator.
lambda$evaluateRelativeExpression$0
(AbstractValueTransformationExpressionEvaluator.java:433) at com.evolveum.
midpoint.util.MiscUtil.carthesian(MiscUtil.java:370) at com.evolveum.
midpoint.util.MiscUtil.carthesian(MiscUtil.java:360) at com.evolveum.
midpoint.model.common.expression.evaluator.
AbstractValueTransformationExpressionEvaluator.evaluateRelativeExpression
(AbstractValueTransformationExpressionEvaluator.java:457) at com.evolveum.
midpoint.model.common.expression.evaluator.
AbstractValueTransformationExpressionEvaluator.evaluate
(AbstractValueTransformationExpressionEvaluator.java:118) at com.evolveum.
midpoint.repo.common.expression.Expression.evaluateExpressionEvaluators
(Expression.java:213) at com.evolveum.midpoint.repo.common.expression.
Expression.evaluate(Expression.java:149) at com.evolveum.midpoint.model.
common.mapping.Mapping.evaluateExpression(Mapping.java:1055) at com.
evolveum.midpoint.model.common.mapping.Mapping.evaluateBody(Mapping.java:
446) at com.evolveum.midpoint.model.common.mapping.Mapping.evaluate(Mapping.
java:372) at com.evolveum.midpoint.model.impl.lens.projector.
MappingEvaluator.evaluateMapping(MappingEvaluator.java:140) at com.evolveum.
midpoint.model.impl.lens.projector.focus.InboundProcessor.
evaluateInboundMapping(InboundProcessor.java:836) at com.evolveum.midpoint.
model.impl.lens.projector.focus.InboundProcessor.
processInboundMappingsForProjection(InboundProcessor.java:293) at com.
evolveum.midpoint.model.impl.lens.projector.focus.InboundProcessor.
processInboundFocal(InboundProcessor.java:223) at com.evolveum.midpoint.
model.impl.lens.projector.focus.InboundProcessor.processInbound
(InboundProcessor.java:165) at com.evolveum.midpoint.model.impl.lens.
projector.focus.FocusProcessor.lambda$processFocusFocus$0(FocusProcessor.
java:210) at com.evolveum.midpoint.model.impl.lens.LensUtil.partialExecute
(LensUtil.java:947) at com.evolveum.midpoint.model.impl.lens.LensUtil.
partialExecute(LensUtil.java:934) at com.evolveum.midpoint.model.impl.lens.
projector.focus.FocusProcessor.processFocusFocus(FocusProcessor.java:207) at
com.evolveum.midpoint.model.impl.lens.projector.focus.FocusProcessor.
processFocus(FocusProcessor.java:140) at com.evolveum.midpoint.model.impl.
lens.projector.Projector.lambda$projectInternal$1(Projector.java:229) at 
com.evolveum.midpoint.model.impl.lens.LensUtil.partialExecute(LensUtil.java:
947) at com.evolveum.midpoint.model.impl.lens.projector.Projector.
projectInternal(Projector.java:227) at com.evolveum.midpoint.model.impl.
lens.projector.Projector.project(Projector.java:116) at com.evolveum.
midpoint.model.impl.lens.Clockwork.click(Clockwork.java:445) at com.
evolveum.midpoint.model.impl.lens.Clockwork.run(Clockwork.java:202) at com.
evolveum.midpoint.model.impl.controller.ModelController.executeChanges
(ModelController.java:538) at com.evolveum.midpoint.web.component.progress.
ProgressPanel$14.callWithContextPrepared(ProgressPanel.java:605) at com.
evolveum.midpoint.web.component.progress.ProgressPanel$14.
callWithContextPrepared(ProgressPanel.java:591) at com.evolveum.midpoint.
web.component.SecurityContextAwareCallable.call
(SecurityContextAwareCallable.java:59) at java.util.concurrent.FutureTask.
run(Unknown Source) at java.util.concurrent.ThreadPoolExecutor.runWorker
(Unknown Source) at java.util.concurrent.ThreadPoolExecutor$Worker.run
(Unknown Source) at java.lang.Thread.run(Unknown Source) Caused by: com.
evolveum.midpoint.util.exception.ExpressionEvaluationException: java.text.
ParseException: Unparseable date: "12/31/2000 11:00:00 AM" in expression in 
mapping in inbound expression for {http://midpoint.evolveum.com/xml/ns/
public/resource/instance-3}StartDate in resource:900dd939-02da-48f2-a7b9-683
de6b8d486(HR Feed) at com.evolveum.midpoint.model.common.expression.script.
jsr223.Jsr223ScriptEvaluator.evaluate(Jsr223ScriptEvaluator.java:120) at 
com.evolveum.midpoint.model.common.expression.script.ScriptExpression.
evaluate(ScriptExpression.java:107) at com.evolveum.midpoint.model.common.
expression.script.ScriptExpressionEvaluator.transformSingleValue
(ScriptExpressionEvaluator.java:63) at com.evolveum.midpoint.model.common.
expression.evaluator.AbstractValueTransformationExpressionEvaluator.lambda$
evaluateRelativeExpression$0(AbstractValueTransformationExpressionEvaluator.
java:425) ... 33 more Caused by: javax.script.ScriptException: java.text.
ParseException: Unparseable date: "12/31/2000 11:00:00 AM" at org.codehaus.
groovy.jsr223.GroovyScriptEngineImpl.eval(GroovyScriptEngineImpl.java:347) 
at org.codehaus.groovy.jsr223.GroovyCompiledScript.eval
(GroovyCompiledScript.java:41) at javax.script.CompiledScript.eval(Unknown 
Source) at com.evolveum.midpoint.model.common.expression.script.jsr223.Jsr
223ScriptEvaluator.evaluate(Jsr223ScriptEvaluator.java:116) ... 36 more 
Caused by: java.text.ParseException: Unparseable date: "12/31/2000 11:00:00 
AM" at java.text.DateFormat.parse(Unknown Source) at java_text_DateFormat$
parse.call(Unknown Source) at Script41.run(Script41.groovy:8) at org.
codehaus.groovy.jsr223.GroovyScriptEngineImpl.eval(GroovyScriptEngineImpl.
java:344) ... 39 more





Can someone help me with that?




Thanks Jan



(http://192.168.2.102:8080/admin/task2/03b67e2f-4b00-420e-a13e-fa897e93586d?635-1.ILinkListener-mainPanel-mainForm-tabPanel-panel-showResult)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180101/6f0d3a2a/attachment.htm>

From valtri at civ.zcu.cz  Mon Jan  1 22:38:59 2018
From: valtri at civ.zcu.cz (=?UTF-8?Q?Franti=C5=A1ek_Dvo=C5=99=C3=A1k?=)
Date: Mon, 01 Jan 2018 22:38:59 +0100
Subject: [midPoint] ValidFrom and ValidTo
In-Reply-To: <4nl.vHb.5tJBw5nKOCX.1QIeeR@seznam.cz>
References: <4nl.vHb.5tJBw5nKOCX.1QIeeR@seznam.cz>
Message-ID: <1514842739.13683.1.camel@civ.zcu.cz>

Hello,

just a hint - the problem here is with the locale-dependent
SimpleDateFormat in the groovy script - the "AM" string.

  František

Jan Kaspar píše v Po 01. 01. 2018 v 20:20 +0100:
> Hi All,
> 
> need help with importing date times in MidPoint from CSV.
> 
> In CSV there is date time in format:  "12/31/2000 11:00:00 AM" 
> 
> In resource i have enabled activation capability and I tryed to map
> value as showwn in config bellow:
> 
>          <attribute id="12">
>             <c:ref>ri:StartDate</c:ref>
>             <tolerant>true</tolerant>
>             <exclusiveStrong>false</exclusiveStrong>
>             <inbound id="17">
>                <authoritative>true</authoritative>
>                <exclusive>false</exclusive>
>                <strength>normal</strength>
>                <expression>
>                   <script xmlns:xsi="http://www.w3.org/2001/XMLSchema
> -instance"
>                           xsi:type="c:ScriptExpressionEvaluatorType">
>                      <code>
>        import java.text.SimpleDateFormat;
>        import java.text.DateFormat;
> 
>        DateFormat df = new SimpleDateFormat("MM/dd/yyyy HH:mm:ss a");
> 
>        if (input!=null) {
>            Date convertedValidFrom = df.parse(input);
>      log.info ("convertedValidFrom = " +
>      convertedValidFrom);
> 
>            return
>    
>  com.evolveum.midpoint.util.MiscUtil.asXMLGregorianCalendar(converted
> ValidFrom);
>        }
>        else {
>            return null;
>        }
> 
>                                  </code>
>                   </script>
>                </expression>
>                <target>
>                   <c:path>$focus/activation/validFrom</c:path>
>                </target>
>             </inbound>
>          </attribute>
> 
> But it doesnt work to me. I am getting error messages like here:
> 
> 1001: java.text.ParseException: Unparseable date: "12/31/2000
> 11:00:00 AM" in expression in mapping in inbound expression for {http
> ://midpoint.evolveum.com/xml/ns/public/resource/instance-3}StartDate
> in resource:900dd939-02da-48f2-a7b9-683de6b8d486(HR
> Feed)({.../common/common-3}input=12/31/2000 11:00:00 AM; ) in
> expression in mapping in inbound expression for
> {http://midpoint.evolveum.com/xml/ns/public/resource/instance-
> 3}StartDate in resource:900dd939-02da-48f2-a7b9-683de6b8d486(HR Feed)
> Operation
> Save (GUI)
> Message
> java.text.ParseException: Unparseable date: "12/31/2000 11:00:00 AM"
> in expression in mapping in inbound expression for {http://midpoint.e
> volveum.com/xml/ns/public/resource/instance-3}StartDate in
> resource:900dd939-02da-48f2-a7b9-683de6b8d486(HR
> Feed)({.../common/common-3}input=12/31/2000 11:00:00 AM; ) in
> expression in mapping in inbound expression for
> {http://midpoint.evolveum.com/xml/ns/public/resource/instance-
> 3}StartDate in resource:900dd939-02da-48f2-a7b9-683de6b8d486(HR Feed)
> Error
> java.text.ParseException: Unparseable date: "12/31/2000 11:00:00 AM"
> in expression in mapping in inbound expression for {http://midpoint.e
> volveum.com/xml/ns/public/resource/instance-3}StartDate in
> resource:900dd939-02da-48f2-a7b9-683de6b8d486(HR
> Feed)({.../common/common-3}input=12/31/2000 11:00:00 AM; ) in
> expression in mapping in inbound expression for
> {http://midpoint.evolveum.com/xml/ns/public/resource/instance-
> 3}StartDate in resource:900dd939-02da-48f2-a7b9-683de6b8d486(HR Feed)
> show
> com.evolveum.midpoint.util.exception.ExpressionEvaluationException:
> java.text.ParseException: Unparseable date: "12/31/2000 11:00:00 AM"
> in expression in mapping in inbound expression for {http://midpoint.e
> volveum.com/xml/ns/public/resource/instance-3}StartDate in
> resource:900dd939-02da-48f2-a7b9-683de6b8d486(HR
> Feed)({.../common/common-3}input=12/31/2000 11:00:00 AM; ) in
> expression in mapping in inbound expression for
> {http://midpoint.evolveum.com/xml/ns/public/resource/instance-
> 3}StartDate in resource:900dd939-02da-48f2-a7b9-683de6b8d486(HR Feed)
> 	at
> com.evolveum.midpoint.model.common.expression.evaluator.AbstractValue
> TransformationExpressionEvaluator.lambda$evaluateRelativeExpression$0
> (AbstractValueTransformationExpressionEvaluator.java:433)
> 	at
> com.evolveum.midpoint.util.MiscUtil.carthesian(MiscUtil.java:370)
> 	at
> com.evolveum.midpoint.util.MiscUtil.carthesian(MiscUtil.java:360)
> 	at
> com.evolveum.midpoint.model.common.expression.evaluator.AbstractValue
> TransformationExpressionEvaluator.evaluateRelativeExpression(Abstract
> ValueTransformationExpressionEvaluator.java:457)
> 	at
> com.evolveum.midpoint.model.common.expression.evaluator.AbstractValue
> TransformationExpressionEvaluator.evaluate(AbstractValueTransformatio
> nExpressionEvaluator.java:118)
> 	at
> com.evolveum.midpoint.repo.common.expression.Expression.evaluateExpre
> ssionEvaluators(Expression.java:213)
> 	at
> com.evolveum.midpoint.repo.common.expression.Expression.evaluate(Expr
> ession.java:149)
> 	at
> com.evolveum.midpoint.model.common.mapping.Mapping.evaluateExpression
> (Mapping.java:1055)
> 	at
> com.evolveum.midpoint.model.common.mapping.Mapping.evaluateBody(Mappi
> ng.java:446)
> 	at
> com.evolveum.midpoint.model.common.mapping.Mapping.evaluate(Mapping.j
> ava:372)
> 	at
> com.evolveum.midpoint.model.impl.lens.projector.MappingEvaluator.eval
> uateMapping(MappingEvaluator.java:140)
> 	at
> com.evolveum.midpoint.model.impl.lens.projector.focus.InboundProcesso
> r.evaluateInboundMapping(InboundProcessor.java:836)
> 	at
> com.evolveum.midpoint.model.impl.lens.projector.focus.InboundProcesso
> r.processInboundMappingsForProjection(InboundProcessor.java:293)
> 	at
> com.evolveum.midpoint.model.impl.lens.projector.focus.InboundProcesso
> r.processInboundFocal(InboundProcessor.java:223)
> 	at
> com.evolveum.midpoint.model.impl.lens.projector.focus.InboundProcesso
> r.processInbound(InboundProcessor.java:165)
> 	at
> com.evolveum.midpoint.model.impl.lens.projector.focus.FocusProcessor.
> lambda$processFocusFocus$0(FocusProcessor.java:210)
> 	at
> com.evolveum.midpoint.model.impl.lens.LensUtil.partialExecute(LensUti
> l.java:947)
> 	at
> com.evolveum.midpoint.model.impl.lens.LensUtil.partialExecute(LensUti
> l.java:934)
> 	at
> com.evolveum.midpoint.model.impl.lens.projector.focus.FocusProcessor.
> processFocusFocus(FocusProcessor.java:207)
> 	at
> com.evolveum.midpoint.model.impl.lens.projector.focus.FocusProcessor.
> processFocus(FocusProcessor.java:140)
> 	at
> com.evolveum.midpoint.model.impl.lens.projector.Projector.lambda$proj
> ectInternal$1(Projector.java:229)
> 	at
> com.evolveum.midpoint.model.impl.lens.LensUtil.partialExecute(LensUti
> l.java:947)
> 	at
> com.evolveum.midpoint.model.impl.lens.projector.Projector.projectInte
> rnal(Projector.java:227)
> 	at
> com.evolveum.midpoint.model.impl.lens.projector.Projector.project(Pro
> jector.java:116)
> 	at
> com.evolveum.midpoint.model.impl.lens.Clockwork.click(Clockwork.java:
> 445)
> 	at
> com.evolveum.midpoint.model.impl.lens.Clockwork.run(Clockwork.java:20
> 2)
> 	at
> com.evolveum.midpoint.model.impl.controller.ModelController.executeCh
> anges(ModelController.java:538)
> 	at
> com.evolveum.midpoint.web.component.progress.ProgressPanel$14.callWit
> hContextPrepared(ProgressPanel.java:605)
> 	at
> com.evolveum.midpoint.web.component.progress.ProgressPanel$14.callWit
> hContextPrepared(ProgressPanel.java:591)
> 	at
> com.evolveum.midpoint.web.component.SecurityContextAwareCallable.call
> (SecurityContextAwareCallable.java:59)
> 	at java.util.concurrent.FutureTask.run(Unknown Source)
> 	at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown
> Source)
> 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown
> Source)
> 	at java.lang.Thread.run(Unknown Source)
> Caused by:
> com.evolveum.midpoint.util.exception.ExpressionEvaluationException:
> java.text.ParseException: Unparseable date: "12/31/2000 11:00:00 AM"
> in expression in mapping in inbound expression for {http://midpoint.e
> volveum.com/xml/ns/public/resource/instance-3}StartDate in
> resource:900dd939-02da-48f2-a7b9-683de6b8d486(HR Feed)
> 	at
> com.evolveum.midpoint.model.common.expression.script.jsr223.Jsr223Scr
> iptEvaluator.evaluate(Jsr223ScriptEvaluator.java:120)
> 	at
> com.evolveum.midpoint.model.common.expression.script.ScriptExpression
> .evaluate(ScriptExpression.java:107)
> 	at
> com.evolveum.midpoint.model.common.expression.script.ScriptExpression
> Evaluator.transformSingleValue(ScriptExpressionEvaluator.java:63)
> 	at
> com.evolveum.midpoint.model.common.expression.evaluator.AbstractValue
> TransformationExpressionEvaluator.lambda$evaluateRelativeExpression$0
> (AbstractValueTransformationExpressionEvaluator.java:425)
> 	... 33 more
> Caused by: javax.script.ScriptException: java.text.ParseException:
> Unparseable date: "12/31/2000 11:00:00 AM"
> 	at
> org.codehaus.groovy.jsr223.GroovyScriptEngineImpl.eval(GroovyScriptEn
> gineImpl.java:347)
> 	at
> org.codehaus.groovy.jsr223.GroovyCompiledScript.eval(GroovyCompiledSc
> ript.java:41)
> 	at javax.script.CompiledScript.eval(Unknown Source)
> 	at
> com.evolveum.midpoint.model.common.expression.script.jsr223.Jsr223Scr
> iptEvaluator.evaluate(Jsr223ScriptEvaluator.java:116)
> 	... 36 more
> Caused by: java.text.ParseException: Unparseable date: "12/31/2000
> 11:00:00 AM"
> 	at java.text.DateFormat.parse(Unknown Source)
> 	at java_text_DateFormat$parse.call(Unknown Source)
> 	at Script41.run(Script41.groovy:8)
> 	at
> org.codehaus.groovy.jsr223.GroovyScriptEngineImpl.eval(GroovyScriptEn
> gineImpl.java:344)
> 	... 39 more
> 
> Can someone help me with that?
> 
> Thanks Jan
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint


From o.nekriach at dynatech.lv  Tue Jan  2 08:16:35 2018
From: o.nekriach at dynatech.lv (Oleksandr Nekriach)
Date: Tue, 2 Jan 2018 09:16:35 +0200
Subject: [midPoint] How to set AD password from Midpoint?
In-Reply-To: <CAMLLNmksQFzzJNxBhAmZzi+6UNcvCXUzt7QVWg=MLN2V4wQ6XQ@mail.gmail.com>
References: <CAMLLNmksQFzzJNxBhAmZzi+6UNcvCXUzt7QVWg=MLN2V4wQ6XQ@mail.gmail.com>
Message-ID: <CANb693QrokdHFwFOJwUAcnu0smw2FxuPErvOPBtF5B4YXvY3Ng@mail.gmail.com>

Happy new year!
Hi Alcides,
Do you use secure communication for AD connection (ldaps) or not?
Some AD settings does not allow to manage password via open communications.
I had similar issue few years ago with Oracle connector ;)

Regards, Oleksandr


On 28 December 2017 at 21:30, Alcides Carlos de Moraes Neto
<alcides.neto at gmail.com> wrote:
> Hello list,
>
> I'm trying to create AD users from Midpoint. I'm getting the 53
> WILL_NOT_PERFORM error, which it seems to be related to the password policy.
> The AD I'm using does have a password policy.
>
> So I'm trying to set some literal, strong password as a placeholder, but I
> don't think my mapping is working. How should I configure it? I cannot find
> any examples. Below are the error I get and the password outbound mapping.
>
> com.evolveum.midpoint.util.exception.SystemException: Got unexpected
> exception:
> org.identityconnectors.framework.common.exceptions.PermissionDeniedException:
> Error adding LDAP entry CN=JOHN DOE,OU=Users,DC=midpoint,DC=local:
> unwillingToPerform: 0000052D: SvcErr: DSID-031A12D2, problem 5003
> (WILL_NOT_PERFORM), data 0?? (53)
>
> <attribute>
>             <c:ref>ri:userPassword</c:ref>
>             <tolerant>true</tolerant>
>             <exclusiveStrong>false</exclusiveStrong>
>             <fetchStrategy>explicit</fetchStrategy>
>             <outbound>
>                <authoritative>true</authoritative>
>                <exclusive>false</exclusive>
>                <strength>normal</strength>
>                <expression>
>                   <value>Midpoint2018*</value>
>                </expression>
>             </outbound>
> </attribute>
>
>
> Thanks and happy new year to all =)
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>



-- 
Best regards,

Oleksandr Nekriach | Identity and access management engineer

Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia

+37125314685
,
o.nekriach at dynatech.lv
|
www.dynatech.lv




Stay connected:


Confidentiality Notice: This message contains confidential information
and is intended only for the named recipient(s). If you are not the
addressee you may not copy, distribute or perform any other activities
with this information. If you have received this transmission in
error, please notify us by e-mail immediately. E-mail transmission
cannot be guaranteed to be secure or error-free as information could
be intercepted, corrupted, lost, destroyed, arrive late or incomplete,
or contain viruses.


From wojciech.staszewski at diagnostyka.pl  Tue Jan  2 12:07:11 2018
From: wojciech.staszewski at diagnostyka.pl (Wojciech Staszewski)
Date: Tue, 2 Jan 2018 12:07:11 +0100
Subject: [midPoint] Importing entitlements to roles for multiple account
 intents
In-Reply-To: <5f856eb7-eaa3-8b0d-12b7-b7d76edb9d75@diagnostyka.pl>
References: <a6196adf-a380-e35e-7f78-aec4b54e2339@diagnostyka.pl>
 <CAMLLNmmXVenFEXW4+MJ035zbmx7+0tE5tH_e3iMjOO0edT+W8Q@mail.gmail.com>
 <ccf45506-d503-e308-ba5b-78a8f9ca0d4a@diagnostyka.pl>
 <CAMLLNmnAke3EOLNZZ0CP9e1zrfa+QQcf400OajZT2_KW4RF4Bw@mail.gmail.com>
 <5f856eb7-eaa3-8b0d-12b7-b7d76edb9d75@diagnostyka.pl>
Message-ID: <6421a397-5bb4-f060-8cfe-bc320c9320b0@diagnostyka.pl>

Hello!

First: Of course the account intent is specified in the association from link inducement, order 2, not in the first order inducement as I wrote before.
Sorry for the mistake.

Second: After few days of testing, the workaround with multiple ObjectClasses for entitlements is working correctly.
I suppose this is not a right way how it should be done according to the midPoint philosophy,
but at the moment I have no other idea how to achieve the goal, which is independently given entitlements for each account intent when user has two or more accounts in one resource
and use the synchronization flavors of the entitlements for avoiding manual roles editing.
Of course I keep my mind open for other soultions.

Best regards!
WS

W dniu 30.12.2017 o 13:36, Wojciech Staszewski pisze:
> Hi!
> 
> Yes, but if the user have 2 or more accounts on this resource, all accounts will receive the entitlement. I have to avoid this.
> The entitlements must be given indepedently for each account.
> 
> I see some workarounds:
> 
> 1) Manually create the roles for account intents other than default and update them when needed.
> -disadvantages: A lot of roles and a lot of changes. There is 100 resources of this kind, some of them contains more than 1 account intent (1,5 average) and 3 entitlement types, every type contains 20 entitlements average. This makes 100 x 1,5 x 3 x 20 =  9000 roles for manual handling. Terrifying...
> 
> That's why I want to use synchronization tasks for importing and updating the roles automatically.
> 
> 2) Create another resource pointing to the same database for another intent, so each account intent is handled by separate (fake) resource.
> In this case I can set synchronization tasks for importing and updating the same entitlements for every account intent.
> - disadvantages: User changes laboratory, so the account changes intent. It happens. On the resource side this is a simple task: edit user, pick lab from drop-down list, save. How midPoint will see this? The user disappears from one resource and appears on another. With full enforcement policy midPoint will try to fix this situation and create an account for him in old intent. On the second resource new account will be deleted.
> Ok, so let's do it on midPoint side: Assign account and entitlements on the second resource and unassign the first one. MidPoint will delete an account on the first and create new one on the second, as for midPoint there are 2 independent resources. This is wrong way.
> 
> 3) This is ScriptedSQL resource. So in the Groovy scripts I can make multiple ObjectClasses for the entitlements pointing to the same database objects. In midPoint I will see the same entitlements multiple times, each with different ObjectClass. So I can use it to import and synchronize roles for different account intents. When the entitlement in resource database is changed, synchronization wil work for every objectClass.
> - disadvantages: I have to think a little bit, as I invented it just a moment ago.
> 
> Best regards!
> Wojciech Staszewski
> 
> W dniu 29.12.2017 o 19:36, Alcides Carlos de Moraes Neto pisze:
>> If you assign a Role that gives Entitlement X to User Y with weak strength, only the existing account(s) for User Y will receive the entitlement.
>> Having multiple weak inducements will work I think.
>>
>> I have a similar setup, but it's the other way around - multiple intents for entitlements induced from Org, only one for account intent associated to User.
>> I have multiple inducements in a Meta-role that I assign to Orgs.
>>
>> You can also using Condition expression to further filter them.
>>
>> 2017-12-29 13:40 GMT-02:00 Wojciech Staszewski <wojciech.staszewski at diagnostyka.pl <mailto:wojciech.staszewski at diagnostyka.pl>>:
>>
>>     Hi!
>>
>>     I thought about adding multiple first order inducements for each account intent with weak strength to the "associationFromLink" metarole,
>>     but what if the accounts (of one user in multiple intents) must have different privileges (entilements)?
>>     When I assign a role that gives entitlement X, it will be applied to every user account on this resource, i think.
>>
>>     Another way I tried is to assign the "associationFromLink" metarole to the role that provisions account creation,
>>     and the role with linkRef pointing to the entitlement shadow as separate user assignment, but it don't work.
>>     I think (but I don't know exactly) that "associationFromLink" is limited to one assignment chain so the linkRef and associationFromLink
>>     must be in the same chain. But maybe I'm wrong...?
>>
>>     I'm stuck here and see no good solution for now.
>>
>>     Best regards!
>>     WS
>>
>>
>>     W dniu 29.12.2017 o 15:08, Alcides Carlos de Moraes Neto pisze:
>>>     Hi WS,
>>>
>>>     In your role template, have you tried adding multiple inducements with an association for each entitlement? I don't see why that wouldn't work.
>>>
>>>     2017-12-28 13:54 GMT-02:00 Wojciech Staszewski <wojciech.staszewski at diagnostyka.pl <mailto:wojciech.staszewski at diagnostyka.pl>>:
>>>
>>>         Hello!
>>>
>>>         I'm looking for correct way how to correctly import resource entitlements into midPoint roles.
>>>
>>>         For now I'm doing this as follows:
>>>         1) create schema handling for entitlement.
>>>         2) create synchronization.
>>>         3) At the "unmatched->addFocus" synchronization step I connect a role template. The template assigns metaroles to the imported roles for:
>>>           a) association from link (as the imported roles are just linkRef only),
>>>           b) approval schema,
>>>           c) and assigns correct OrgUnit in the role catalog, based on resource, role type and other "things".
>>>
>>>         That works just perfect, but for one account intent only. The account intent is statically specified in "association from link" metarole in the first order inducement.
>>>         If is not, the metarole works for "default" account intent.
>>>         But I have 8 account intents in this resource, and every account must be associated with the entitlements regardless of the intent.
>>>
>>>         I tried to make more than one "unmatched->addFocus" synchronization reaction with different role templates
>>>         with hope for importing 8 roles from one entitlement for different account intents but midPoint warns me: "Duplicated reactions [...]".
>>>         I cannot just add multiple "actions" to one reaction because I can apply only one template to one reaction.
>>>
>>>         And I don't know how to do it.
>>>         Any ideas?
>>>         Beer is on me for the help!
>>>
>>>         Happy NY!
>>>         WS
>>>         _______________________________________________
>>>         midPoint mailing list
>>>         midPoint at lists.evolveum.com <mailto:midPoint at lists.evolveum.com>
>>>         http://lists.evolveum.com/mailman/listinfo/midpoint <http://lists.evolveum.com/mailman/listinfo/midpoint>
>>>
>>>
>>>
>>>
>>>     _______________________________________________
>>>     midPoint mailing list
>>>     midPoint at lists.evolveum.com <mailto:midPoint at lists.evolveum.com>
>>>     http://lists.evolveum.com/mailman/listinfo/midpoint <http://lists.evolveum.com/mailman/listinfo/midpoint>
>>
>>     -- 
>>     Wojciech Staszewski
>>     Administrator Systemów Sieciowych
>>     tel. kom: 663 680 236
>>     www.diagnostyka.pl <http://www.diagnostyka.pl>
>>     Diagnostyka Sp. z o. o.
>>     ul. Prof. M. Życzkowskiego 16, 31-864 Kraków
>>     Numer KRS: 0000381559 (Sąd Rejonowy dla Krakowa-Śródmieścia w Krakowie, XI Wydział Gospodarczy KRS)
>>     NIP: 675-12-65-009; REGON: 356366975
>>     Kapitał zakładowy: 33 756 500 zł.
>>
>>     Pomyśl o środowisku zanim wydrukujesz ten e-mail.
>>
>>
>>     _______________________________________________
>>     midPoint mailing list
>>     midPoint at lists.evolveum.com <mailto:midPoint at lists.evolveum.com>
>>     http://lists.evolveum.com/mailman/listinfo/midpoint <http://lists.evolveum.com/mailman/listinfo/midpoint>
>>
>>
>>
>>
>> _______________________________________________
>> midPoint mailing list
>> midPoint at lists.evolveum.com
>> http://lists.evolveum.com/mailman/listinfo/midpoint
> 
> 
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
> 

-- 
Wojciech Staszewski
Administrator Systemów Sieciowych
tel. kom: 663 680 236
www.diagnostyka.pl
Diagnostyka Sp. z o. o.
ul. Prof. M. Życzkowskiego 16, 31-864 Kraków
Numer KRS: 0000381559 (Sąd Rejonowy dla Krakowa-Śródmieścia w Krakowie, XI Wydział Gospodarczy KRS)
NIP: 675-12-65-009; REGON: 356366975
Kapitał zakładowy: 33 756 500 zł.

Pomyśl o środowisku zanim wydrukujesz ten e-mail.


From Caspi at seznam.cz  Tue Jan  2 14:37:17 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Tue, 02 Jan 2018 14:37:17 +0100 (CET)
Subject: [midPoint] ValidFrom and ValidTo
Message-ID: <POh.vHy.2jrTTbjaXyB.1QIuiD@seznam.cz>

Hi again,
So now conversion is not giving me an error anymore. But I am still not able
to populate validFrom and validTo in midpoint.

Used CSV is in attachment. So for me important attributes are validFrom 
(StartDate), validTo (EndDate), and AdministartiveStatus (Status).




In resource configuration i tryed to add following definition in schema 
handling: 






         <attribute id="12">

            <c:ref>ri:StartDate</c:ref>

            <tolerant>true</tolerant>

            <exclusiveStrong>false</exclusiveStrong>

            <inbound id="17">

               <authoritative>true</authoritative>

               <exclusive>false</exclusive>

               <strength>normal</strength>

               <expression>

                  <script xmlns:xsi="http://www.w3.org/2001/XMLSchema-
instance"

                          xsi:type="c:ScriptExpressionEvaluatorType">

                          <code>

                            import java.text.SimpleDateFormat;

                            import java.text.DateFormat;

                            import java.util.Locale; 

                            DateFormat df = new SimpleDateFormat("mm/dd/yyyy
HH:mm:ss a", , Locale.ENGLISH); 

                            if (input!=null) {

                              Date convertedValidFrom = df.parse(input);

                              log.info ("convertedValidFrom = " + 
convertedValidFrom);

                              return  com.evolveum.midpoint.util.MiscUtil.
asXMLGregorianCalendar (convertedValidFrom);

                            }

                            else {

                              return null;

                            }

                          </code>

                  </script>

               </expression>

               <target>

                  <c:path>$focus/activation/validFrom</c:path>

               </target>

            </inbound>

         </attribute>




Bud it doesnt work, How it shoudl be defined? Can some help me?




Regards




Jan




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180102/65ca6a45/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: users1.csv
Type: application/vnd.ms-excel
Size: 495 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180102/65ca6a45/attachment.xlb>

From martin.lizner at ami.cz  Tue Jan  2 15:47:24 2018
From: martin.lizner at ami.cz (=?UTF-8?Q?Martin_L=C3=ADzner_=2D_AMI_Praha_a=2Es=2E?=)
Date: Tue, 2 Jan 2018 15:47:24 +0100
Subject: [midPoint] memory leak issue
In-Reply-To: <CAFzDqZcyD4+PTjEws_r=2VWotrFfGO9vWsE7=aimVjixsYU6ig@mail.gmail.com>
References: <CAFzDqZcyD4+PTjEws_r=2VWotrFfGO9vWsE7=aimVjixsYU6ig@mail.gmail.com>
Message-ID: <CALOh8eMq6ne9HeCVVTk-GjJ-1j2ZuTU6_HM9qLj84NA0MT44Sg@mail.gmail.com>

Hi, Im having OOM problems on 3.7. Which version are you on? There is Jira
for it already and I think it has high priority:
https://jira.evolveum.com/browse/MID-4349

M.

Martin Lízner
solution architect

gsm: [+420] 737 745 571
e-mail: martin.lizner at ami.cz


AMI Praha a.s.
Pláničkova 11
162 00 Praha 6
tel.: [+420] 274 783 239
web: www.ami.cz



[image: AMI Praha a.s.] <http://www.skyidentity.com/>

Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za
společnost AMI Praha a.s.
jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně
písemnou formu.


2017-12-28 21:26 GMT+01:00 Juan Manuel Catá <juan.cata at despegar.com>:

> Greetings
>
> Im writing in reference to a memory leak issue with my instance of
> MidPoint.
>
> When I try to run MidPoint on my VM (4 cpus, 8gb RAM, 40gb HD) I got
> alerts in relation to "critical memory usage". In relation to this, I found
> that memory is not managed correctly, and is never released until the
> kernel kill the MidPoint process; another problem that i found is that I'm
> running out of availables Inodes. ¿Could this be related to some
> missconfiguration on my MidPoint instance? Have you noticed these kind of
> issues before?
>
> Any kind of help will be appreciated
>
> Regards
>
> --
> *Juan Manuel Catá*
> Application Security
> Juana Manso 999 - piso 2° - C.A.B.A.
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180102/4c86a29c/attachment.htm>

From wojciech.staszewski at diagnostyka.pl  Tue Jan  2 16:27:37 2018
From: wojciech.staszewski at diagnostyka.pl (Wojciech Staszewski)
Date: Tue, 2 Jan 2018 16:27:37 +0100
Subject: [midPoint] Entitlements reconciliation errors (v3.7)
In-Reply-To: <78f8a50a-60b4-746a-2b20-b699383e46f8@diagnostyka.pl>
References: <78f8a50a-60b4-746a-2b20-b699383e46f8@diagnostyka.pl>
Message-ID: <91f844f4-08b3-633b-7739-065d73be2e2f@diagnostyka.pl>

Hello!

The issue update:

This error appears not only in the reconciliation tasks.
If I enter the resource and browse entitlements (on Resource), midPoint also gives me Null Pointer Exception on non-default-intent entitlements.
If I go to the SchemaHandling config and switch default button on the entitlement that previously was causing error, the list is showing correctly and the other ones show error.
Most funny thing is that sometimes it works OK without touching anything. But next day, or after tomcat restart, the NPE errors return.

Can it be a bug? I don't know if I should make a Jira ticket or not...

Regards,
WS

W dniu 21.12.2017 o 23:18, Wojciech Staszewski pisze:
> Hello All!
> 
> I have a problem and I don't know what is causing it:
> 
> I have 3 different types of entitlements in my resource (ScriptedSQL).
> 
> So I configured 3 different objectClasses in the connector scripts:
> - CustomRolesObjectClass,
> - CustomWorkplacesObjectClass,
> - CustomRoomsObjectClass
> 
> and 3 intents in midPoint schema handling:
> - role,
> - workplace,
> - room
> 
> I can mark "default" intent of only one entitlement in schema handling
> Wizard step,  though the entitlements have different objectClasses.
> 
> and 3 reconciliation tasks.
> 
> And only one task is running good - the task that referencing the intent
> marked as default.
> So if I check "role" intent as default, reconciliation of roles goes ok
> and the other two end with error,
> when I check "workplace" intent as default  - the reconciliation of
> workplaces goes ok, and the other two end with error and so on.
> 
> The error log is attached.
> 
> What am I doing wrong?
> Thanks for any help.
> 
> WS
> 
> 
> 
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
> 


From Caspi at seznam.cz  Tue Jan  2 20:37:00 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Tue, 02 Jan 2018 20:37:00 +0100 (CET)
Subject: [midPoint] ValidFrom and ValidTo
Message-ID: <6ZM.vGH.tOnDyoPWKR.1QIzzS@seznam.cz>

Hi all,



solved by editation of schema. I missed that.




Jan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180102/98d7efd7/attachment.htm>

From christopher.hoskin at gmail.com  Wed Jan  3 00:02:55 2018
From: christopher.hoskin at gmail.com (Christopher Hoskin)
Date: Tue, 2 Jan 2018 23:02:55 +0000
Subject: [midPoint] connector-ldap and SASL-GSSAPI
Message-ID: <CAEjvcd9h_78jU7TG8FJHDEw4z0UHNFLbG7Mq0HeTNGDOkUCtbw@mail.gmail.com>

According to the documentation [1], the LDAP Connector should support
SASL-GSSAPI as an authentication type.

I was wondering if this has actually been implemented? Looking at the code
[2],[3], it's not obvious to me that setting authenticationType to
SASL-GSSAPI actually has any affect. From a quick scan of [4], I was
expecting to find a call to bindSaslGssApi or bindSasl.

Is the use of this authenticationType documented anywhere?

Thanks.

[1] https://wiki.evolveum.com/display/midPoint/LDAP+Connector+Migration
[2] https://github.com/Evolveum/connector-ldap/search?l=Java&q=sasl
[3]
https://github.com/Evolveum/connector-ldap/search?l=Java&q=authenticationType
[4] http://directory.apache.org/api/user-guide/5.3-sasl-bind.html

Christopher Hoskin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180102/ca6d68ec/attachment.htm>

From Caspi at seznam.cz  Wed Jan  3 08:43:11 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Wed, 03 Jan 2018 08:43:11 +0100 (CET)
Subject: [midPoint] Database maintenance
Message-ID: <QXY.vGU.7lAxuOmUgaP.1QJ8cF@seznam.cz>

Hello,



i have a questino about database maintenance. I am using MP 3.7 on windows 
right now.




There is a DB file midpoint.mv.db and curently after one week of tests it 
has 37GB.




How is performed maintenance? Testing was made with few groups and ten users
and only two resources.




Jan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180103/6cd98e98/attachment.htm>

From radovan.semancik at evolveum.com  Wed Jan  3 12:37:37 2018
From: radovan.semancik at evolveum.com (Radovan Semancik)
Date: Wed, 3 Jan 2018 12:37:37 +0100
Subject: [midPoint] connector-ldap and SASL-GSSAPI
In-Reply-To: <CAEjvcd9h_78jU7TG8FJHDEw4z0UHNFLbG7Mq0HeTNGDOkUCtbw@mail.gmail.com>
References: <CAEjvcd9h_78jU7TG8FJHDEw4z0UHNFLbG7Mq0HeTNGDOkUCtbw@mail.gmail.com>
Message-ID: <8113d8ca-3f59-0109-304c-926858c919d4@evolveum.com>

Hi,

SASL-GSSAPI support is mostly a matter of Apache Directory API. That is 
the LDAP API that the connector is using. I'm not entirely sure whether 
the API supports SASL-GSSAPI. What I can tell for sure is that I'm not 
aware of any midPoint deployment that is using that. Anyway, even if it 
is supported by the directory API it was never tested with midPoint LDAP 
connector. Therefore it is likely that some connector code changes will 
be needed. And from my experience there is a slight chance that even 
Apache Directory API changes might be needed to fully support your 
use-case. We will gladly accept pull request in case you have the 
capacity to make the code changes. Otherwise I can recommend to purchase 
midPoint platform subscription which is designed to address such issues.

-- 
Radovan Semancik
Software Architect
evolveum.com



On 01/03/2018 12:02 AM, Christopher Hoskin wrote:
> According to the documentation [1], the LDAP Connector should support 
> SASL-GSSAPI as an authentication type.
>
> I was wondering if this has actually been implemented? Looking at the 
> code [2],[3], it's not obvious to me that setting authenticationType 
> to SASL-GSSAPI actually has any affect. From a quick scan of [4], I 
> was expecting to find a call to bindSaslGssApi or bindSasl.
>
> Is the use of this authenticationType documented anywhere?
>
> Thanks.
>
> [1] https://wiki.evolveum.com/display/midPoint/LDAP+Connector+Migration
> [2] https://github.com/Evolveum/connector-ldap/search?l=Java&q=sasl
> [3] 
> https://github.com/Evolveum/connector-ldap/search?l=Java&q=authenticationType
> [4] http://directory.apache.org/api/user-guide/5.3-sasl-bind.html
>
> Christopher Hoskin
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180103/7fa6f494/attachment.htm>

From radovan.semancik at evolveum.com  Wed Jan  3 12:42:25 2018
From: radovan.semancik at evolveum.com (Radovan Semancik)
Date: Wed, 3 Jan 2018 12:42:25 +0100
Subject: [midPoint] Database maintenance
In-Reply-To: <QXY.vGU.7lAxuOmUgaP.1QJ8cF@seznam.cz>
References: <QXY.vGU.7lAxuOmUgaP.1QJ8cF@seznam.cz>
Message-ID: <efed16fa-0bdd-74e1-b1bf-7048f1702c6f@evolveum.com>

Hi,

MidPoint deployment with embedded H2 database is not supported for 
production use. It is intended only for learning, laboratory use, 
demonstrations and similar non-production use. Therefore there are no 
mechanism to ensure that it is sustainable for a long-term usage. The 
best thing you can do is to migrate your deployment to a real database.

-- 
Radovan Semancik
Software Architect
evolveum.com



On 01/03/2018 08:43 AM, Jan Kaspar wrote:
> Hello,
>
> i have a questino about database maintenance. I am using MP 3.7 on 
> windows right now.
>
> There is a DB file midpoint.mv.db and curently after one week of tests 
> it has 37GB.
>
> How is performed maintenance? Testing was made with few groups and ten 
> users and only two resources.
>
> Jan
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180103/76e928a4/attachment.htm>

From srpenn at us.ibm.com  Wed Jan  3 22:54:32 2018
From: srpenn at us.ibm.com (Sean R Penndorf)
Date: Wed, 3 Jan 2018 16:54:32 -0500
Subject: [midPoint] How to Filter HR Input
Message-ID: <OF6353312B.8FB8AC60-ON8525820A.007547D1-8525820A.0078567B@notes.na.collabserv.com>

Hi,

I'm working on a Midpoint proof of concept for my company.
One requirement we have is that a Midpoint user must exist in our HR 
directory. Employees deleted from HR must disable or delete the Midpoint 
user within 24 hours.
On the surface, sounds easy enough.  Here is where I'm having 
difficulties.

The HR directory contains approximately 380,000 employees and other 
accounts.
Our estimated use case for Midpoint for production is currently 5000 
users.
We have absolutely no authority to update any record in the HR directory.
The HR directory has enforced limitations on query sizes (in other words 
we can't just do a (uid=*)). I need to double-check, but I believe the 
maximum object query return is 10,000. Because there are thousands of apps 
that query our HR directory, the limit is there to keep the directory 
servers from getting bogged down.

Currently, when I run a Reconcile task, Midpoint processes about 1000-1200 
users or so and then it just hangs. No errors are recorded and the GUI 
appears as though the task is still running, but it is not updating.
Also, it seems rather pointless to have 380,000 shadow objects if we will 
only have 5000 Midpoint users.

Is there a way to filter, limit, or change the logic, so that we only pull 
(or create shadow objects) from the HR directory for those employees who 
already have a Midpoint user? (Hope I'm making sense here).
If so, how?
Let me know if you need more info from me.

Thanks!

------------------
Sean Penndorf
SaaS Operational Services (SOS) - ID Management
IBM Cloud
srpenn at us.ibm.com
Office: 248-552-4791   TL  623-9966



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180103/e4cd8279/attachment.htm>

From alcides.neto at gmail.com  Thu Jan  4 01:00:02 2018
From: alcides.neto at gmail.com (Alcides Carlos de Moraes Neto)
Date: Wed, 3 Jan 2018 22:00:02 -0200
Subject: [midPoint] How to set AD password from Midpoint?
In-Reply-To: <CANb693QrokdHFwFOJwUAcnu0smw2FxuPErvOPBtF5B4YXvY3Ng@mail.gmail.com>
References: <CAMLLNmksQFzzJNxBhAmZzi+6UNcvCXUzt7QVWg=MLN2V4wQ6XQ@mail.gmail.com>
 <CANb693QrokdHFwFOJwUAcnu0smw2FxuPErvOPBtF5B4YXvY3Ng@mail.gmail.com>
Message-ID: <CAMLLNmmxwej3sAvTusiJSNjxVeF3wL5AvoS9YXs7amY8_=q=yA@mail.gmail.com>

Hello,

Yes, I'm using ldaps.

2018-01-02 5:16 GMT-02:00 Oleksandr Nekriach <o.nekriach at dynatech.lv>:

> Happy new year!
> Hi Alcides,
> Do you use secure communication for AD connection (ldaps) or not?
> Some AD settings does not allow to manage password via open communications.
> I had similar issue few years ago with Oracle connector ;)
>
> Regards, Oleksandr
>
>
> On 28 December 2017 at 21:30, Alcides Carlos de Moraes Neto
> <alcides.neto at gmail.com> wrote:
> > Hello list,
> >
> > I'm trying to create AD users from Midpoint. I'm getting the 53
> > WILL_NOT_PERFORM error, which it seems to be related to the password
> policy.
> > The AD I'm using does have a password policy.
> >
> > So I'm trying to set some literal, strong password as a placeholder, but
> I
> > don't think my mapping is working. How should I configure it? I cannot
> find
> > any examples. Below are the error I get and the password outbound
> mapping.
> >
> > com.evolveum.midpoint.util.exception.SystemException: Got unexpected
> > exception:
> > org.identityconnectors.framework.common.exceptions.
> PermissionDeniedException:
> > Error adding LDAP entry CN=JOHN DOE,OU=Users,DC=midpoint,DC=local:
> > unwillingToPerform: 0000052D: SvcErr: DSID-031A12D2, problem 5003
> > (WILL_NOT_PERFORM), data 0?? (53)
> >
> > <attribute>
> >             <c:ref>ri:userPassword</c:ref>
> >             <tolerant>true</tolerant>
> >             <exclusiveStrong>false</exclusiveStrong>
> >             <fetchStrategy>explicit</fetchStrategy>
> >             <outbound>
> >                <authoritative>true</authoritative>
> >                <exclusive>false</exclusive>
> >                <strength>normal</strength>
> >                <expression>
> >                   <value>Midpoint2018*</value>
> >                </expression>
> >             </outbound>
> > </attribute>
> >
> >
> > Thanks and happy new year to all =)
> >
> > _______________________________________________
> > midPoint mailing list
> > midPoint at lists.evolveum.com
> > http://lists.evolveum.com/mailman/listinfo/midpoint
> >
>
>
>
> --
> Best regards,
>
> Oleksandr Nekriach | Identity and access management engineer
>
> Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia
>
> +37125314685
> ,
> o.nekriach at dynatech.lv
> |
> www.dynatech.lv
>
>
>
>
> Stay connected:
>
>
> Confidentiality Notice: This message contains confidential information
> and is intended only for the named recipient(s). If you are not the
> addressee you may not copy, distribute or perform any other activities
> with this information. If you have received this transmission in
> error, please notify us by e-mail immediately. E-mail transmission
> cannot be guaranteed to be secure or error-free as information could
> be intercepted, corrupted, lost, destroyed, arrive late or incomplete,
> or contain viruses.
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180103/96a62760/attachment.htm>

From o.nekriach at dynatech.lv  Thu Jan  4 08:39:42 2018
From: o.nekriach at dynatech.lv (Oleksandr Nekriach)
Date: Thu, 4 Jan 2018 09:39:42 +0200
Subject: [midPoint] How to set AD password from Midpoint?
In-Reply-To: <CAMLLNmmxwej3sAvTusiJSNjxVeF3wL5AvoS9YXs7amY8_=q=yA@mail.gmail.com>
References: <CAMLLNmksQFzzJNxBhAmZzi+6UNcvCXUzt7QVWg=MLN2V4wQ6XQ@mail.gmail.com>
 <CANb693QrokdHFwFOJwUAcnu0smw2FxuPErvOPBtF5B4YXvY3Ng@mail.gmail.com>
 <CAMLLNmmxwej3sAvTusiJSNjxVeF3wL5AvoS9YXs7amY8_=q=yA@mail.gmail.com>
Message-ID: <CANb693RtZCjUi-0LUJPEWABoqXmuy5ooKVeecP1sWFVYa8hxKA@mail.gmail.com>

Hello,
It is strange I was sure that problem is in SSL.
See
Known Causes
- This is caused when you don't use SSL in your LDAP connection and AD
enforces SSL connection.
- There are password policies in the AD environment

In my Midpoint instance I don't use "direct" outbound  mapping for userPassword.
Instead, I use

       <credentials>
            <password>
               <outbound>
                  <expression>
                     <asIs xsi:type="c:AsIsExpressionEvaluatorType"/>
                  </expression>
               </outbound>
            </password>
         </credentials>

On 4 January 2018 at 02:00, Alcides Carlos de Moraes Neto
<alcides.neto at gmail.com> wrote:
> Hello,
>
> Yes, I'm using ldaps.
>
> 2018-01-02 5:16 GMT-02:00 Oleksandr Nekriach <o.nekriach at dynatech.lv>:
>>
>> Happy new year!
>> Hi Alcides,
>> Do you use secure communication for AD connection (ldaps) or not?
>> Some AD settings does not allow to manage password via open
>> communications.
>> I had similar issue few years ago with Oracle connector ;)
>>
>> Regards, Oleksandr
>>
>>
>> On 28 December 2017 at 21:30, Alcides Carlos de Moraes Neto
>> <alcides.neto at gmail.com> wrote:
>> > Hello list,
>> >
>> > I'm trying to create AD users from Midpoint. I'm getting the 53
>> > WILL_NOT_PERFORM error, which it seems to be related to the password
>> > policy.
>> > The AD I'm using does have a password policy.
>> >
>> > So I'm trying to set some literal, strong password as a placeholder, but
>> > I
>> > don't think my mapping is working. How should I configure it? I cannot
>> > find
>> > any examples. Below are the error I get and the password outbound
>> > mapping.
>> >
>> > com.evolveum.midpoint.util.exception.SystemException: Got unexpected
>> > exception:
>> >
>> > org.identityconnectors.framework.common.exceptions.PermissionDeniedException:
>> > Error adding LDAP entry CN=JOHN DOE,OU=Users,DC=midpoint,DC=local:
>> > unwillingToPerform: 0000052D: SvcErr: DSID-031A12D2, problem 5003
>> > (WILL_NOT_PERFORM), data 0?? (53)
>> >
>> > <attribute>
>> >             <c:ref>ri:userPassword</c:ref>
>> >             <tolerant>true</tolerant>
>> >             <exclusiveStrong>false</exclusiveStrong>
>> >             <fetchStrategy>explicit</fetchStrategy>
>> >             <outbound>
>> >                <authoritative>true</authoritative>
>> >                <exclusive>false</exclusive>
>> >                <strength>normal</strength>
>> >                <expression>
>> >                   <value>Midpoint2018*</value>
>> >                </expression>
>> >             </outbound>
>> > </attribute>
>> >
>> >
>> > Thanks and happy new year to all =)
>> >
>> > _______________________________________________
>> > midPoint mailing list
>> > midPoint at lists.evolveum.com
>> > http://lists.evolveum.com/mailman/listinfo/midpoint
>> >
>>
>>
>>
>> --
>> Best regards,
>>
>> Oleksandr Nekriach | Identity and access management engineer
>>
>> Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia
>>
>> +37125314685
>> ,
>> o.nekriach at dynatech.lv
>> |
>> www.dynatech.lv
>>
>>
>>
>>
>> Stay connected:
>>
>>
>> Confidentiality Notice: This message contains confidential information
>> and is intended only for the named recipient(s). If you are not the
>> addressee you may not copy, distribute or perform any other activities
>> with this information. If you have received this transmission in
>> error, please notify us by e-mail immediately. E-mail transmission
>> cannot be guaranteed to be secure or error-free as information could
>> be intercepted, corrupted, lost, destroyed, arrive late or incomplete,
>> or contain viruses.
>> _______________________________________________
>> midPoint mailing list
>> midPoint at lists.evolveum.com
>> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>



-- 
Best regards,

Oleksandr Nekriach | Identity and access management engineer

Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia

+37125314685
,
o.nekriach at dynatech.lv
|
www.dynatech.lv




Stay connected:


Confidentiality Notice: This message contains confidential information
and is intended only for the named recipient(s). If you are not the
addressee you may not copy, distribute or perform any other activities
with this information. If you have received this transmission in
error, please notify us by e-mail immediately. E-mail transmission
cannot be guaranteed to be secure or error-free as information could
be intercepted, corrupted, lost, destroyed, arrive late or incomplete,
or contain viruses.


From petr.gasparik at ami.cz  Thu Jan  4 09:11:44 2018
From: petr.gasparik at ami.cz (=?UTF-8?B?UGV0ciBHYcWhcGFyw61rIC0gQU1JIFByYWhhIGEucy4=?=)
Date: Thu, 4 Jan 2018 09:11:44 +0100
Subject: [midPoint] How to set AD password from Midpoint?
In-Reply-To: <CANb693RtZCjUi-0LUJPEWABoqXmuy5ooKVeecP1sWFVYa8hxKA@mail.gmail.com>
References: <CAMLLNmksQFzzJNxBhAmZzi+6UNcvCXUzt7QVWg=MLN2V4wQ6XQ@mail.gmail.com>
 <CANb693QrokdHFwFOJwUAcnu0smw2FxuPErvOPBtF5B4YXvY3Ng@mail.gmail.com>
 <CAMLLNmmxwej3sAvTusiJSNjxVeF3wL5AvoS9YXs7amY8_=q=yA@mail.gmail.com>
 <CANb693RtZCjUi-0LUJPEWABoqXmuy5ooKVeecP1sWFVYa8hxKA@mail.gmail.com>
Message-ID: <CABAspd0_BMHpoccmHce6cc3gFO9AH7CfEr4sdsi=UEpFQH+jow@mail.gmail.com>

Hi, as Oleksandr says, AD disallows manipulating with userPassword
directly. Instead, credential tag is used.
Also, SSL is a must.

in general. WILL_NOT_PERFORM is almost always wrongly set password - in our
cases mostly policy violation (weak or no/bad set password)

Petr

--

s pozdravem

Petr Gašparík
solution architect

gsm: [+420] 603 523 860
e-mail: petr.gasparik at ami.cz


AMI Praha a.s.
Pláničkova 11
162 00 Praha 6
tel.: [+420] 274 783 239
web: www.ami.cz


[image: AMI Praha a.s.]

Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za
společnost AMI Praha a.s.
jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně
písemnou formu.


2018-01-04 8:39 GMT+01:00 Oleksandr Nekriach <o.nekriach at dynatech.lv>:

> Hello,
> It is strange I was sure that problem is in SSL.
> See
> Known Causes
> - This is caused when you don't use SSL in your LDAP connection and AD
> enforces SSL connection.
> - There are password policies in the AD environment
>
> In my Midpoint instance I don't use "direct" outbound  mapping for
> userPassword.
> Instead, I use
>
>        <credentials>
>             <password>
>                <outbound>
>                   <expression>
>                      <asIs xsi:type="c:AsIsExpressionEvaluatorType"/>
>                   </expression>
>                </outbound>
>             </password>
>          </credentials>
>
> On 4 January 2018 at 02:00, Alcides Carlos de Moraes Neto
> <alcides.neto at gmail.com> wrote:
> > Hello,
> >
> > Yes, I'm using ldaps.
> >
> > 2018-01-02 5:16 GMT-02:00 Oleksandr Nekriach <o.nekriach at dynatech.lv>:
> >>
> >> Happy new year!
> >> Hi Alcides,
> >> Do you use secure communication for AD connection (ldaps) or not?
> >> Some AD settings does not allow to manage password via open
> >> communications.
> >> I had similar issue few years ago with Oracle connector ;)
> >>
> >> Regards, Oleksandr
> >>
> >>
> >> On 28 December 2017 at 21:30, Alcides Carlos de Moraes Neto
> >> <alcides.neto at gmail.com> wrote:
> >> > Hello list,
> >> >
> >> > I'm trying to create AD users from Midpoint. I'm getting the 53
> >> > WILL_NOT_PERFORM error, which it seems to be related to the password
> >> > policy.
> >> > The AD I'm using does have a password policy.
> >> >
> >> > So I'm trying to set some literal, strong password as a placeholder,
> but
> >> > I
> >> > don't think my mapping is working. How should I configure it? I cannot
> >> > find
> >> > any examples. Below are the error I get and the password outbound
> >> > mapping.
> >> >
> >> > com.evolveum.midpoint.util.exception.SystemException: Got unexpected
> >> > exception:
> >> >
> >> > org.identityconnectors.framework.common.exceptions.
> PermissionDeniedException:
> >> > Error adding LDAP entry CN=JOHN DOE,OU=Users,DC=midpoint,DC=local:
> >> > unwillingToPerform: 0000052D: SvcErr: DSID-031A12D2, problem 5003
> >> > (WILL_NOT_PERFORM), data 0?? (53)
> >> >
> >> > <attribute>
> >> >             <c:ref>ri:userPassword</c:ref>
> >> >             <tolerant>true</tolerant>
> >> >             <exclusiveStrong>false</exclusiveStrong>
> >> >             <fetchStrategy>explicit</fetchStrategy>
> >> >             <outbound>
> >> >                <authoritative>true</authoritative>
> >> >                <exclusive>false</exclusive>
> >> >                <strength>normal</strength>
> >> >                <expression>
> >> >                   <value>Midpoint2018*</value>
> >> >                </expression>
> >> >             </outbound>
> >> > </attribute>
> >> >
> >> >
> >> > Thanks and happy new year to all =)
> >> >
> >> > _______________________________________________
> >> > midPoint mailing list
> >> > midPoint at lists.evolveum.com
> >> > http://lists.evolveum.com/mailman/listinfo/midpoint
> >> >
> >>
> >>
> >>
> >> --
> >> Best regards,
> >>
> >> Oleksandr Nekriach | Identity and access management engineer
> >>
> >> Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia
> >>
> >> +37125314685
> >> ,
> >> o.nekriach at dynatech.lv
> >> |
> >> www.dynatech.lv
> >>
> >>
> >>
> >>
> >> Stay connected:
> >>
> >>
> >> Confidentiality Notice: This message contains confidential information
> >> and is intended only for the named recipient(s). If you are not the
> >> addressee you may not copy, distribute or perform any other activities
> >> with this information. If you have received this transmission in
> >> error, please notify us by e-mail immediately. E-mail transmission
> >> cannot be guaranteed to be secure or error-free as information could
> >> be intercepted, corrupted, lost, destroyed, arrive late or incomplete,
> >> or contain viruses.
> >> _______________________________________________
> >> midPoint mailing list
> >> midPoint at lists.evolveum.com
> >> http://lists.evolveum.com/mailman/listinfo/midpoint
> >
> >
> >
> > _______________________________________________
> > midPoint mailing list
> > midPoint at lists.evolveum.com
> > http://lists.evolveum.com/mailman/listinfo/midpoint
> >
>
>
>
> --
> Best regards,
>
> Oleksandr Nekriach | Identity and access management engineer
>
> Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia
>
> +37125314685
> ,
> o.nekriach at dynatech.lv
> |
> www.dynatech.lv
>
>
>
>
> Stay connected:
>
>
> Confidentiality Notice: This message contains confidential information
> and is intended only for the named recipient(s). If you are not the
> addressee you may not copy, distribute or perform any other activities
> with this information. If you have received this transmission in
> error, please notify us by e-mail immediately. E-mail transmission
> cannot be guaranteed to be secure or error-free as information could
> be intercepted, corrupted, lost, destroyed, arrive late or incomplete,
> or contain viruses.
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180104/e23aace3/attachment.htm>

From Caspi at seznam.cz  Thu Jan  4 20:27:48 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Thu, 04 Jan 2018 20:27:48 +0100 (CET)
Subject: [midPoint] Protected
Message-ID: <U4L.vGu.ERPMWxSaP}.1QJe0q@seznam.cz>

Hi all,



I have a question about protected objects. I need to exclude multiple OU's 
in AD.




I tryed to do that by adding:





         <protected>

            <filter>

               <q:substring>

                  <q:matching>stringIgnoreCase</q:matching>

                  <q:path>declare namespace icfs='http://midpoint.evolveum.
com/xml/ns/public/connector/icf-1/resource-schema-3'; attributes/icfs:name</
q:path>

                  <q:value>ou=Global,dc=hell,dc=local</q:value>

                  <q:anchorEnd>true</q:anchorEnd>

               </q:substring>

            </filter>

         </protected>

         <protected>

            <filter>

               <q:substring>

                  <q:matching>stringIgnoreCase</q:matching>

                  <q:path>declare namespace icfs='http://midpoint.evolveum.
com/xml/ns/public/connector/icf-1/resource-schema-3'; attributes/icfs:name</
q:path>

                  <q:value>ou=CZ,dc=hell,dc=local</q:value>

                  <q:anchorEnd>true</q:anchorEnd>

               </q:substring>

            </filter>

         </protected>



         <protected>

            <filter>

               <q:substring>

                  <q:matching>stringIgnoreCase</q:matching>

                  <q:path>declare namespace icfs='http://midpoint.evolveum.
com/xml/ns/public/connector/icf-1/resource-schema-3'; attributes/icfs:name</
q:path>

                  <q:value>cz=Users,dc=hell,dc=local</q:value>

                  <q:anchorEnd>true</q:anchorEnd>

               </q:substring>

            </filter>

         </protected>





But it doesnt work. I am not able to see account in repository and resource.
If htere is only one protected OU then it works.

Where is an error?




Thanks 




Jan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180104/bd3dce13/attachment.htm>

From roman.pudil at ami.cz  Thu Jan  4 21:01:52 2018
From: roman.pudil at ami.cz (Roman Pudil - AMI Praha a.s.)
Date: Thu, 04 Jan 2018 20:01:52 +0000
Subject: [midPoint] Protected
In-Reply-To: <U4L.vGu.ERPMWxSaP}.1QJe0q@seznam.cz>
References: <U4L.vGu.ERPMWxSaP}.1QJe0q@seznam.cz>
Message-ID: <em8dc9b0e6-04f7-4b58-b38b-085f31ee24dd@rpudil-dell7440>

Hi Jan,
try this modified filter:


          <protected>
             <filter>
                <q:or>
                    <q:substring>
                       <q:matching>stringIgnoreCase</q:matching>
                       <q:path>declare namespace 
icfs='http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3'; 
attributes/icfs:name</q:path>
                       <q:value>ou=Global,dc=hell,dc=local</q:value>
                       <q:anchorEnd>true</q:anchorEnd>
                    </q:substring>
                    <q:substring>
                       <q:matching>stringIgnoreCase</q:matching>
                       <q:path>declare namespace 
icfs='http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3'; 
attributes/icfs:name</q:path>
                       <q:value>ou=CZ,dc=hell,dc=local</q:value>
                       <q:anchorEnd>true</q:anchorEnd>
                    </q:substring>
                    <q:substring>
                       <q:matching>stringIgnoreCase</q:matching>
                       <q:path>declare namespace 
icfs='http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3'; 
attributes/icfs:name</q:path>
                       <q:value>cz=Users,dc=hell,dc=local</q:value>
                       <q:anchorEnd>true</q:anchorEnd>
                    </q:substring>
                </q:or>
             </filter>
          </protected>

Regards

Roman Pudil
solution architect

gsm: [+420] 775 663 666
e-mail: roman.pudil at ami.cz


AMI Praha a.s.
Pláničkova 11
162 00 Praha 6
tel./fax: [+420] 274 783 239
web: www.ami.cz




<http://www.ami.cz/reseni-a-sluzby/bezpecnost-dat/identity-management>
Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za 
společnost AMI Praha a.s.
jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít 
výhradně písemnou formu.

------ Původní zpráva ------
Od: "Jan Kaspar" <Caspi at seznam.cz>
Komu: midpoint at lists.evolveum.com
Odesláno: 4.1.2018 20:27:48
Předmět: [midPoint] Protected

>Hi all,
>
>I have a question about protected objects. I need to exclude multiple 
>OU's in AD.
>
>I tryed to do that by adding:
>
>          <protected>
>             <filter>
>                <q:substring>
>                   <q:matching>stringIgnoreCase</q:matching>
>                   <q:path>declare namespace 
>icfs='http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3'; 
>attributes/icfs:name</q:path>
>                   <q:value>ou=Global,dc=hell,dc=local</q:value>
>                   <q:anchorEnd>true</q:anchorEnd>
>                </q:substring>
>             </filter>
>          </protected>
>          <protected>
>             <filter>
>                <q:substring>
>                   <q:matching>stringIgnoreCase</q:matching>
>                   <q:path>declare namespace 
>icfs='http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3'; 
>attributes/icfs:name</q:path>
>                   <q:value>ou=CZ,dc=hell,dc=local</q:value>
>                   <q:anchorEnd>true</q:anchorEnd>
>                </q:substring>
>             </filter>
>          </protected>
>          <protected>
>             <filter>
>                <q:substring>
>                   <q:matching>stringIgnoreCase</q:matching>
>                   <q:path>declare namespace 
>icfs='http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3'; 
>attributes/icfs:name</q:path>
>                   <q:value>cz=Users,dc=hell,dc=local</q:value>
>                   <q:anchorEnd>true</q:anchorEnd>
>                </q:substring>
>             </filter>
>          </protected>
>
>But it doesnt work. I am not able to see account in repository and 
>resource. If htere is only one protected OU then it works.
>Where is an error?
>
>Thanks
>
>Jan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180104/0a4a90e8/attachment.htm>

From Caspi at seznam.cz  Thu Jan  4 21:56:42 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Thu, 04 Jan 2018 21:56:42 +0100 (CET)
Subject: [midPoint] Protected
Message-ID: <UDF.vGy.3iHo9yqZFYm.1QJfKA@seznam.cz>

Hi Roman,



I tryed this but still same. bellow is the error.




Jan



operation.com.evolveum.midpoint.web.component.data.
SelectableBeanObjectDataProvider.searchObjects
Message
Couldn't list objects.






Error
com.evolveum.midpoint.util.exception.SchemaException: Could not find 
definition for item attributes/name
show
com.evolveum.midpoint.util.exception.SystemException: com.evolveum.midpoint.
util.exception.SchemaException: Could not find definition for item 
attributes/name at com.evolveum.midpoint.provisioning.impl.ShadowCache.
lambda$searchObjectsIterativeRepository$5(ShadowCache.java:1534) at com.
evolveum.midpoint.repo.cache.RepositoryCache$1.handle(RepositoryCache.java:
227) at com.evolveum.midpoint.repo.sql.helpers.ObjectRetriever.
searchObjectsIterativeAttempt(ObjectRetriever.java:704) at com.evolveum.
midpoint.repo.sql.SqlRepositoryServiceImpl.
searchObjectsIterativeBySingleTransaction(SqlRepositoryServiceImpl.java:843)
at com.evolveum.midpoint.repo.sql.SqlRepositoryServiceImpl.
searchObjectsIterative(SqlRepositoryServiceImpl.java:817) at com.evolveum.
midpoint.repo.cache.RepositoryCache.searchObjectsIterative(RepositoryCache.
java:230) at com.evolveum.midpoint.provisioning.impl.ShadowManager.
searchObjectsIterativeRepository(ShadowManager.java:690) at com.evolveum.
midpoint.provisioning.impl.ShadowCache.searchObjectsIterativeRepository
(ShadowCache.java:1538) at com.evolveum.midpoint.provisioning.impl.
ShadowCache.searchObjectsIterative(ShadowCache.java:1288) at com.evolveum.
midpoint.provisioning.impl.ShadowCache.searchObjectsIterative(ShadowCache.
java:1276) at com.evolveum.midpoint.provisioning.impl.
ProvisioningServiceImpl.searchObjectsIterative(ProvisioningServiceImpl.java:
1036) at com.evolveum.midpoint.provisioning.impl.ProvisioningServiceImpl.
searchObjects(ProvisioningServiceImpl.java:483) at com.evolveum.midpoint.
model.impl.controller.ModelController.searchObjects(ModelController.java:
781) at com.evolveum.midpoint.web.component.data.
SelectableBeanObjectDataProvider.internalIterator
(SelectableBeanObjectDataProvider.java:177) at com.evolveum.midpoint.web.
component.data.BaseSortableDataProvider.iterator(BaseSortableDataProvider.
java:225) at org.apache.wicket.markup.repeater.data.DataViewBase$
ModelIterator.<init>(DataViewBase.java:107) at org.apache.wicket.markup.
repeater.data.DataViewBase.getItemModels(DataViewBase.java:74) at org.
apache.wicket.markup.repeater.AbstractPageableView.getItemModels
(AbstractPageableView.java:101) at org.apache.wicket.markup.repeater.
RefreshingView.onPopulate(RefreshingView.java:93) at org.apache.wicket.
markup.repeater.AbstractRepeater.onBeforeRender(AbstractRepeater.java:124) 
at org.apache.wicket.markup.repeater.AbstractPageableView.onBeforeRender
(AbstractPageableView.java:115) at org.apache.wicket.Component.
internalBeforeRender(Component.java:950) at org.apache.wicket.Component.
beforeRender(Component.java:1018) at org.apache.wicket.MarkupContainer.
onBeforeRenderChildren(MarkupContainer.java:1825) at org.apache.wicket.
Component.onBeforeRender(Component.java:3916) at org.apache.wicket.
Component.internalBeforeRender(Component.java:950) at org.apache.wicket.
Component.beforeRender(Component.java:1018) at org.apache.wicket.
MarkupContainer.onBeforeRenderChildren(MarkupContainer.java:1825) at org.
apache.wicket.Component.onBeforeRender(Component.java:3916) at org.apache.
wicket.Component.internalBeforeRender(Component.java:950) at org.apache.
wicket.Component.beforeRender(Component.java:1018) at org.apache.wicket.
MarkupContainer.onBeforeRenderChildren(MarkupContainer.java:1825) at org.
apache.wicket.Component.onBeforeRender(Component.java:3916) at org.apache.
wicket.Component.internalBeforeRender(Component.java:950) at org.apache.
wicket.Component.beforeRender(Component.java:1018) at org.apache.wicket.
MarkupContainer.onBeforeRenderChildren(MarkupContainer.java:1825) at org.
apache.wicket.Component.onBeforeRender(Component.java:3916) at org.apache.
wicket.Component.internalBeforeRender(Component.java:950) at org.apache.
wicket.Component.beforeRender(Component.java:1018) at org.apache.wicket.
MarkupContainer.onBeforeRenderChildren(MarkupContainer.java:1825) at org.
apache.wicket.Component.onBeforeRender(Component.java:3916) at org.apache.
wicket.Component.internalBeforeRender(Component.java:950) at org.apache.
wicket.Component.beforeRender(Component.java:1018) at org.apache.wicket.
MarkupContainer.onBeforeRenderChildren(MarkupContainer.java:1825) at org.
apache.wicket.Component.onBeforeRender(Component.java:3916) at org.apache.
wicket.markup.html.form.Form.onBeforeRender(Form.java:1810) at org.apache.
wicket.Component.internalBeforeRender(Component.java:950) at org.apache.
wicket.Component.beforeRender(Component.java:1018) at org.apache.wicket.
MarkupContainer.onBeforeRenderChildren(MarkupContainer.java:1825) at org.
apache.wicket.Component.onBeforeRender(Component.java:3916) at org.apache.
wicket.Component.internalBeforeRender(Component.java:950) at org.apache.
wicket.Component.beforeRender(Component.java:1018) at org.apache.wicket.
MarkupContainer.onBeforeRenderChildren(MarkupContainer.java:1825) at org.
apache.wicket.Component.onBeforeRender(Component.java:3916) at org.apache.
wicket.Component.internalBeforeRender(Component.java:950) at org.apache.
wicket.Component.beforeRender(Component.java:1018) at org.apache.wicket.
MarkupContainer.onBeforeRenderChildren(MarkupContainer.java:1825) at org.
apache.wicket.Component.onBeforeRender(Component.java:3916) at org.apache.
wicket.markup.html.form.Form.onBeforeRender(Form.java:1810) at org.apache.
wicket.Component.internalBeforeRender(Component.java:950) at org.apache.
wicket.Component.beforeRender(Component.java:1018) at org.apache.wicket.
MarkupContainer.onBeforeRenderChildren(MarkupContainer.java:1825) at org.
apache.wicket.Component.onBeforeRender(Component.java:3916) at org.apache.
wicket.Component.internalBeforeRender(Component.java:950) at org.apache.
wicket.Component.beforeRender(Component.java:1018) at org.apache.wicket.
MarkupContainer.onBeforeRenderChildren(MarkupContainer.java:1825) at org.
apache.wicket.Component.onBeforeRender(Component.java:3916) at com.evolveum.
midpoint.web.component.TabbedPanel.onBeforeRender(TabbedPanel.java:255) at 
org.apache.wicket.Component.internalBeforeRender(Component.java:950) at org.
apache.wicket.Component.beforeRender(Component.java:1018) at org.apache.
wicket.Component.internalPrepareForRender(Component.java:2236) at org.
apache.wicket.Component.prepareForRender(Component.java:2275) at org.apache.
wicket.page.XmlPartialPageUpdate.writeComponent(XmlPartialPageUpdate.java:
98) at org.apache.wicket.page.PartialPageUpdate.writeComponents
(PartialPageUpdate.java:248) at org.apache.wicket.page.PartialPageUpdate.
writeTo(PartialPageUpdate.java:161) at org.apache.wicket.ajax.
AjaxRequestHandler.respond(AjaxRequestHandler.java:358) at org.apache.
wicket.request.cycle.RequestCycle$HandlerExecutor.respond(RequestCycle.java:
895) at org.apache.wicket.request.RequestHandlerStack.execute
(RequestHandlerStack.java:64) at org.apache.wicket.request.
RequestHandlerStack.execute(RequestHandlerStack.java:97) at org.apache.
wicket.request.cycle.RequestCycle.execute(RequestCycle.java:265) at org.
apache.wicket.request.cycle.RequestCycle.processRequest(RequestCycle.java:
222) at org.apache.wicket.request.cycle.RequestCycle.processRequestAndDetach
(RequestCycle.java:293) at org.apache.wicket.protocol.http.WicketFilter.
processRequestCycle(WicketFilter.java:261) at org.apache.wicket.protocol.
http.WicketFilter.processRequest(WicketFilter.java:203) at org.apache.
wicket.protocol.http.WicketFilter.doFilter(WicketFilter.java:284) at org.
apache.catalina.core.ApplicationFilterChain.internalDoFilter
(ApplicationFilterChain.java:193) at org.apache.catalina.core.
ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at com.
evolveum.midpoint.web.util.MidPointProfilingServletFilter.doFilter
(MidPointProfilingServletFilter.java:86) at org.apache.catalina.core.
ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at 
org.apache.catalina.core.ApplicationFilterChain.doFilter
(ApplicationFilterChain.java:166) at org.springframework.security.web.
FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:317) at 
org.springframework.security.web.access.intercept.FilterSecurityInterceptor.
invoke(FilterSecurityInterceptor.java:127) at org.springframework.security.
web.access.intercept.FilterSecurityInterceptor.doFilter
(FilterSecurityInterceptor.java:91) at org.springframework.security.web.
FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) at 
org.springframework.security.web.access.ExceptionTranslationFilter.doFilter
(ExceptionTranslationFilter.java:114) at org.springframework.security.web.
FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) at 
org.springframework.security.web.session.SessionManagementFilter.doFilter
(SessionManagementFilter.java:137) at org.springframework.security.web.
FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) at 
org.springframework.security.web.authentication.
AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:
111) at org.springframework.security.web.FilterChainProxy$
VirtualFilterChain.doFilter(FilterChainProxy.java:331) at org.
springframework.security.web.servletapi.
SecurityContextHolderAwareRequestFilter.doFilter
(SecurityContextHolderAwareRequestFilter.java:170) at org.springframework.
security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.
java:331) at org.springframework.security.web.savedrequest.
RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63) at org.
springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter
(FilterChainProxy.java:331) at org.springframework.security.web.session.
ConcurrentSessionFilter.doFilter(ConcurrentSessionFilter.java:155) at org.
springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter
(FilterChainProxy.java:331) at org.springframework.security.web.
authentication.AbstractAuthenticationProcessingFilter.doFilter
(AbstractAuthenticationProcessingFilter.java:200) at org.springframework.
security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.
java:331) at org.springframework.security.web.authentication.logout.
LogoutFilter.doFilter(LogoutFilter.java:116) at org.springframework.
security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.
java:331) at org.springframework.security.web.csrf.CsrfFilter.
doFilterInternal(CsrfFilter.java:100) at org.springframework.web.filter.
OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.
springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter
(FilterChainProxy.java:331) at org.springframework.security.web.context.
SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.
java:105) at org.springframework.security.web.FilterChainProxy$
VirtualFilterChain.doFilter(FilterChainProxy.java:331) at org.
springframework.security.web.context.request.async.
WebAsyncManagerIntegrationFilter.doFilterInternal
(WebAsyncManagerIntegrationFilter.java:56) at org.springframework.web.
filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.
springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter
(FilterChainProxy.java:331) at org.springframework.security.web.
FilterChainProxy.doFilterInternal(FilterChainProxy.java:214) at org.
springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.
java:177) at org.springframework.web.filter.DelegatingFilterProxy.
invokeDelegate(DelegatingFilterProxy.java:347) at org.springframework.web.
filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:263) at 
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter
(ApplicationFilterChain.java:193) at org.apache.catalina.core.
ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.
springframework.web.filter.RequestContextFilter.doFilterInternal
(RequestContextFilter.java:99) at org.springframework.web.filter.
OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.apache.
catalina.core.ApplicationFilterChain.internalDoFilter
(ApplicationFilterChain.java:193) at org.apache.catalina.core.
ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.
springframework.web.filter.HttpPutFormContentFilter.doFilterInternal
(HttpPutFormContentFilter.java:108) at org.springframework.web.filter.
OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.apache.
catalina.core.ApplicationFilterChain.internalDoFilter
(ApplicationFilterChain.java:193) at org.apache.catalina.core.
ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.
springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal
(HiddenHttpMethodFilter.java:81) at org.springframework.web.filter.
OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) at org.apache.
catalina.core.ApplicationFilterChain.internalDoFilter
(ApplicationFilterChain.java:193) at org.apache.catalina.core.
ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.
apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:
199) at org.apache.catalina.core.StandardContextValve.invoke
(StandardContextValve.java:96) at org.apache.catalina.authenticator.
AuthenticatorBase.invoke(AuthenticatorBase.java:478) at org.apache.catalina.
core.StandardHostValve.invoke(StandardHostValve.java:140) at org.apache.
catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81) at org.
apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:
342) at org.apache.coyote.http11.Http11Processor.service(Http11Processor.
java:803) at org.apache.coyote.AbstractProcessorLight.process
(AbstractProcessorLight.java:66) at org.apache.coyote.AbstractProtocol$
ConnectionHandler.process(AbstractProtocol.java:868) at org.apache.tomcat.
util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1459) at org.
apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) 
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at 
java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at org.
apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:
61) at java.lang.Thread.run(Unknown Source) Caused by: com.evolveum.
midpoint.util.exception.SchemaException: Could not find definition for item 
attributes/name at com.evolveum.midpoint.prism.query.ValueFilter.
getFilterItem(ValueFilter.java:278) at com.evolveum.midpoint.prism.query.
SubstringFilter.match(SubstringFilter.java:91) at com.evolveum.midpoint.
prism.query.OrFilter.match(OrFilter.java:63) at com.evolveum.midpoint.prism.
query.ObjectQuery.match(ObjectQuery.java:98) at com.evolveum.midpoint.
common.ResourceObjectPattern.matches(ResourceObjectPattern.java:76) at com.
evolveum.midpoint.common.ResourceObjectPattern.matches
(ResourceObjectPattern.java:66) at com.evolveum.midpoint.provisioning.util.
ProvisioningUtil.isProtectedShadow(ProvisioningUtil.java:336) at com.
evolveum.midpoint.provisioning.util.ProvisioningUtil.setProtectedFlag
(ProvisioningUtil.java:345) at com.evolveum.midpoint.provisioning.impl.
ShadowCache.lambda$searchObjectsIterativeRepository$5(ShadowCache.java:1506)
... 151 more
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180104/a39879ec/attachment.htm>

From roman.pudil at ami.cz  Thu Jan  4 22:06:09 2018
From: roman.pudil at ami.cz (Roman Pudil - AMI Praha a.s.)
Date: Thu, 04 Jan 2018 21:06:09 +0000
Subject: [midPoint] Protected
In-Reply-To: <UDF.vGy.3iHo9yqZFYm.1QJfKA@seznam.cz>
References: <UDF.vGy.3iHo9yqZFYm.1QJfKA@seznam.cz>
Message-ID: <emd0375be9-0ea1-41d8-ada0-f0445ae787ab@rpudil-dell7440>

Hi Jan,
try to change attributes/icfs:name to attributes/ri:dn

Regards


Roman Pudil
solution architect

gsm: [+420] 775 663 666
e-mail: roman.pudil at ami.cz


AMI Praha a.s.
Pláničkova 11
162 00 Praha 6
tel./fax: [+420] 274 783 239
web: www.ami.cz




<http://www.ami.cz/reseni-a-sluzby/bezpecnost-dat/identity-management>
Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za 
společnost AMI Praha a.s.
jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít 
výhradně písemnou formu.

------ Původní zpráva ------
Od: "Jan Kaspar" <Caspi at seznam.cz>
Komu: midpoint at lists.evolveum.com
Odesláno: 4.1.2018 21:56:42
Předmět: [midPoint] Protected

>Hi Roman,
>
>I tryed this but still same. bellow is the error.
>
>Jan
>
>operation.com.evolveum.midpoint.web.component.data.SelectableBeanObjectDataProvider.searchObjectsMessageCouldn't 
>list objects.Errorcom.evolveum.midpoint.util.exception.SchemaException: 
>Could not find definition for item 
>attributes/nameshowcom.evolveum.midpoint.util.exception.SystemException: 
>com.evolveum.midpoint.util.exception.SchemaException: Could not find 
>definition for item attributes/name 	at 
>com.evolveum.midpoint.provisioning.impl.ShadowCache.lambda$searchObjectsIterativeRepository$5(ShadowCache.java:1534) 
>	at 
>com.evolveum.midpoint.repo.cache.RepositoryCache$1.handle(RepositoryCache.java:227) 
>	at 
>com.evolveum.midpoint.repo.sql.helpers.ObjectRetriever.searchObjectsIterativeAttempt(ObjectRetriever.java:704) 
>	at 
>com.evolveum.midpoint.repo.sql.SqlRepositoryServiceImpl.searchObjectsIterativeBySingleTransaction(SqlRepositoryServiceImpl.java:843) 
>	at 
>com.evolveum.midpoint.repo.sql.SqlRepositoryServiceImpl.searchObjectsIterative(SqlRepositoryServiceImpl.java:817) 
>	at 
>com.evolveum.midpoint.repo.cache.RepositoryCache.searchObjectsIterative(RepositoryCache.java:230) 
>	at 
>com.evolveum.midpoint.provisioning.impl.ShadowManager.searchObjectsIterativeRepository(ShadowManager.java:690) 
>	at 
>com.evolveum.midpoint.provisioning.impl.ShadowCache.searchObjectsIterativeRepository(ShadowCache.java:1538) 
>	at 
>com.evolveum.midpoint.provisioning.impl.ShadowCache.searchObjectsIterative(ShadowCache.java:1288) 
>	at 
>com.evolveum.midpoint.provisioning.impl.ShadowCache.searchObjectsIterative(ShadowCache.java:1276) 
>	at 
>com.evolveum.midpoint.provisioning.impl.ProvisioningServiceImpl.searchObjectsIterative(ProvisioningServiceImpl.java:1036) 
>	at 
>com.evolveum.midpoint.provisioning.impl.ProvisioningServiceImpl.searchObjects(ProvisioningServiceImpl.java:483) 
>	at 
>com.evolveum.midpoint.model.impl.controller.ModelController.searchObjects(ModelController.java:781) 
>	at 
>com.evolveum.midpoint.web.component.data.SelectableBeanObjectDataProvider.internalIterator(SelectableBeanObjectDataProvider.java:177) 
>	at 
>com.evolveum.midpoint.web.component.data.BaseSortableDataProvider.iterator(BaseSortableDataProvider.java:225) 
>	at 
>org.apache.wicket.markup.repeater.data.DataViewBase$ModelIterator.<init>(DataViewBase.java:107) 
>	at 
>org.apache.wicket.markup.repeater.data.DataViewBase.getItemModels(DataViewBase.java:74) 
>	at 
>org.apache.wicket.markup.repeater.AbstractPageableView.getItemModels(AbstractPageableView.java:101) 
>	at 
>org.apache.wicket.markup.repeater.RefreshingView.onPopulate(RefreshingView.java:93) 
>	at 
>org.apache.wicket.markup.repeater.AbstractRepeater.onBeforeRender(AbstractRepeater.java:124) 
>	at 
>org.apache.wicket.markup.repeater.AbstractPageableView.onBeforeRender(AbstractPageableView.java:115) 
>	at 
>org.apache.wicket.Component.internalBeforeRender(Component.java:950) 
>	at org.apache.wicket.Component.beforeRender(Component.java:1018) 	at 
>org.apache.wicket.MarkupContainer.onBeforeRenderChildren(MarkupContainer.java:1825) 
>	at org.apache.wicket.Component.onBeforeRender(Component.java:3916) 	at 
>org.apache.wicket.Component.internalBeforeRender(Component.java:950) 
>	at org.apache.wicket.Component.beforeRender(Component.java:1018) 	at 
>org.apache.wicket.MarkupContainer.onBeforeRenderChildren(MarkupContainer.java:1825) 
>	at org.apache.wicket.Component.onBeforeRender(Component.java:3916) 	at 
>org.apache.wicket.Component.internalBeforeRender(Component.java:950) 
>	at org.apache.wicket.Component.beforeRender(Component.java:1018) 	at 
>org.apache.wicket.MarkupContainer.onBeforeRenderChildren(MarkupContainer.java:1825) 
>	at org.apache.wicket.Component.onBeforeRender(Component.java:3916) 	at 
>org.apache.wicket.Component.internalBeforeRender(Component.java:950) 
>	at org.apache.wicket.Component.beforeRender(Component.java:1018) 	at 
>org.apache.wicket.MarkupContainer.onBeforeRenderChildren(MarkupContainer.java:1825) 
>	at org.apache.wicket.Component.onBeforeRender(Component.java:3916) 	at 
>org.apache.wicket.Component.internalBeforeRender(Component.java:950) 
>	at org.apache.wicket.Component.beforeRender(Component.java:1018) 	at 
>org.apache.wicket.MarkupContainer.onBeforeRenderChildren(MarkupContainer.java:1825) 
>	at org.apache.wicket.Component.onBeforeRender(Component.java:3916) 	at 
>org.apache.wicket.Component.internalBeforeRender(Component.java:950) 
>	at org.apache.wicket.Component.beforeRender(Component.java:1018) 	at 
>org.apache.wicket.MarkupContainer.onBeforeRenderChildren(MarkupContainer.java:1825) 
>	at org.apache.wicket.Component.onBeforeRender(Component.java:3916) 	at 
>org.apache.wicket.markup.html.form.Form.onBeforeRender(Form.java:1810) 
>	at 
>org.apache.wicket.Component.internalBeforeRender(Component.java:950) 
>	at org.apache.wicket.Component.beforeRender(Component.java:1018) 	at 
>org.apache.wicket.MarkupContainer.onBeforeRenderChildren(MarkupContainer.java:1825) 
>	at org.apache.wicket.Component.onBeforeRender(Component.java:3916) 	at 
>org.apache.wicket.Component.internalBeforeRender(Component.java:950) 
>	at org.apache.wicket.Component.beforeRender(Component.java:1018) 	at 
>org.apache.wicket.MarkupContainer.onBeforeRenderChildren(MarkupContainer.java:1825) 
>	at org.apache.wicket.Component.onBeforeRender(Component.java:3916) 	at 
>org.apache.wicket.Component.internalBeforeRender(Component.java:950) 
>	at org.apache.wicket.Component.beforeRender(Component.java:1018) 	at 
>org.apache.wicket.MarkupContainer.onBeforeRenderChildren(MarkupContainer.java:1825) 
>	at org.apache.wicket.Component.onBeforeRender(Component.java:3916) 	at 
>org.apache.wicket.markup.html.form.Form.onBeforeRender(Form.java:1810) 
>	at 
>org.apache.wicket.Component.internalBeforeRender(Component.java:950) 
>	at org.apache.wicket.Component.beforeRender(Component.java:1018) 	at 
>org.apache.wicket.MarkupContainer.onBeforeRenderChildren(MarkupContainer.java:1825) 
>	at org.apache.wicket.Component.onBeforeRender(Component.java:3916) 	at 
>org.apache.wicket.Component.internalBeforeRender(Component.java:950) 
>	at org.apache.wicket.Component.beforeRender(Component.java:1018) 	at 
>org.apache.wicket.MarkupContainer.onBeforeRenderChildren(MarkupContainer.java:1825) 
>	at org.apache.wicket.Component.onBeforeRender(Component.java:3916) 	at 
>com.evolveum.midpoint.web.component.TabbedPanel.onBeforeRender(TabbedPanel.java:255) 
>	at 
>org.apache.wicket.Component.internalBeforeRender(Component.java:950) 
>	at org.apache.wicket.Component.beforeRender(Component.java:1018) 	at 
>org.apache.wicket.Component.internalPrepareForRender(Component.java:2236) 
>	at org.apache.wicket.Component.prepareForRender(Component.java:2275) 
>	at 
>org.apache.wicket.page.XmlPartialPageUpdate.writeComponent(XmlPartialPageUpdate.java:98) 
>	at 
>org.apache.wicket.page.PartialPageUpdate.writeComponents(PartialPageUpdate.java:248) 
>	at 
>org.apache.wicket.page.PartialPageUpdate.writeTo(PartialPageUpdate.java:161) 
>	at 
>org.apache.wicket.ajax.AjaxRequestHandler.respond(AjaxRequestHandler.java:358) 
>	at 
>org.apache.wicket.request.cycle.RequestCycle$HandlerExecutor.respond(RequestCycle.java:895) 
>	at 
>org.apache.wicket.request.RequestHandlerStack.execute(RequestHandlerStack.java:64) 
>	at 
>org.apache.wicket.request.RequestHandlerStack.execute(RequestHandlerStack.java:97) 
>	at 
>org.apache.wicket.request.cycle.RequestCycle.execute(RequestCycle.java:265) 
>	at 
>org.apache.wicket.request.cycle.RequestCycle.processRequest(RequestCycle.java:222) 
>	at 
>org.apache.wicket.request.cycle.RequestCycle.processRequestAndDetach(RequestCycle.java:293) 
>	at 
>org.apache.wicket.protocol.http.WicketFilter.processRequestCycle(WicketFilter.java:261) 
>	at 
>org.apache.wicket.protocol.http.WicketFilter.processRequest(WicketFilter.java:203) 
>	at 
>org.apache.wicket.protocol.http.WicketFilter.doFilter(WicketFilter.java:284) 
>	at 
>org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
>	at 
>org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
>	at 
>com.evolveum.midpoint.web.util.MidPointProfilingServletFilter.doFilter(MidPointProfilingServletFilter.java:86) 
>	at 
>org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
>	at 
>org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
>	at 
>org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:317) 
>	at 
>org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:127) 
>	at 
>org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91) 
>	at 
>org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) 
>	at 
>org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:114) 
>	at 
>org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) 
>	at 
>org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137) 
>	at 
>org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) 
>	at 
>org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111) 
>	at 
>org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) 
>	at 
>org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:170) 
>	at 
>org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) 
>	at 
>org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63) 
>	at 
>org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) 
>	at 
>org.springframework.security.web.session.ConcurrentSessionFilter.doFilter(ConcurrentSessionFilter.java:155) 
>	at 
>org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) 
>	at 
>org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:200) 
>	at 
>org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) 
>	at 
>org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116) 
>	at 
>org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) 
>	at 
>org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:100) 
>	at 
>org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
>	at 
>org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) 
>	at 
>org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105) 
>	at 
>org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) 
>	at 
>org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56) 
>	at 
>org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
>	at 
>org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331) 
>	at 
>org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:214) 
>	at 
>org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177) 
>	at 
>org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:347) 
>	at 
>org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:263) 
>	at 
>org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
>	at 
>org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
>	at 
>org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99) 
>	at 
>org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
>	at 
>org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
>	at 
>org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
>	at 
>org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:108) 
>	at 
>org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
>	at 
>org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
>	at 
>org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
>	at 
>org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:81) 
>	at 
>org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
>	at 
>org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
>	at 
>org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
>	at 
>org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:199) 
>	at 
>org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) 
>	at 
>org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:478) 
>	at 
>org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) 
>	at 
>org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81) 
>	at 
>org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) 
>	at 
>org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) 
>	at 
>org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:803) 
>	at 
>org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) 
>	at 
>org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868) 
>	at 
>org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1459) 
>	at 
>org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) 
>	at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) 
>	at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) 
>	at 
>org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) 
>	at java.lang.Thread.run(Unknown Source) Caused by: 
>com.evolveum.midpoint.util.exception.SchemaException: Could not find 
>definition for item attributes/name 	at 
>com.evolveum.midpoint.prism.query.ValueFilter.getFilterItem(ValueFilter.java:278) 
>	at 
>com.evolveum.midpoint.prism.query.SubstringFilter.match(SubstringFilter.java:91) 
>	at com.evolveum.midpoint.prism.query.OrFilter.match(OrFilter.java:63) 
>	at 
>com.evolveum.midpoint.prism.query.ObjectQuery.match(ObjectQuery.java:98) 
>	at 
>com.evolveum.midpoint.common.ResourceObjectPattern.matches(ResourceObjectPattern.java:76) 
>	at 
>com.evolveum.midpoint.common.ResourceObjectPattern.matches(ResourceObjectPattern.java:66) 
>	at 
>com.evolveum.midpoint.provisioning.util.ProvisioningUtil.isProtectedShadow(ProvisioningUtil.java:336) 
>	at 
>com.evolveum.midpoint.provisioning.util.ProvisioningUtil.setProtectedFlag(ProvisioningUtil.java:345) 
>	at 
>com.evolveum.midpoint.provisioning.impl.ShadowCache.lambda$searchObjectsIterativeRepository$5(ShadowCache.java:1506) 
>	... 151 more
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180104/0c5d7175/attachment.htm>

From Caspi at seznam.cz  Fri Jan  5 06:45:17 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Fri, 05 Jan 2018 06:45:17 +0100 (CET)
Subject: [midPoint] Protected
Message-ID: <UPU.vN6.6OOD75og6gX.1QJn3j@seznam.cz>

Hi Roman,



thanks, that was the problem




Jan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180105/8ec7ccc6/attachment.htm>

From vilo.repan at evolveum.com  Sat Jan  6 00:00:45 2018
From: vilo.repan at evolveum.com (Viliam Repan)
Date: Sat, 6 Jan 2018 00:00:45 +0100
Subject: [midPoint] MidPoint DB changes
Message-ID: <B8CF3509-569B-4045-81A7-2971A98C8353@evolveum.com>

Hi all,

I”ve just merged some changes related to hibernate 5 upgrade to MidPoint master branch. 
These changes will improve write speed of audit records, mainly in cases when there are many records in audit tables.
More performance improvements are on the way as well.

Current changes unfortunately means some DB changes as well. Simplest solution is to drop and recreate tables:

m_audit_ref_value
m_audit_prop_value
m_audit_item
m_audit_delta
m_audit_event

I’ve also created DB upgrade scripts, which do more intelligent version of upgrade as only “id” column has changed. 
Now it’s marked as auto_increment/identity column.

Pull requests with improvements for SQL scripts are more than welcomed.

Best regards,


viliam




From Caspi at seznam.cz  Sat Jan  6 19:59:41 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Sat, 06 Jan 2018 19:59:41 +0100 (CET)
Subject: [midPoint] Bulk Password change
Message-ID: <DHq.vNP.7rClgrAYc0P.1QKHoT@seznam.cz>

Hello,
I would like to ask for help with creating filter for bulk password change 
for users.




goal is to generate new password in all systems for batch of user based on 
attribute (employeeType) value.




I found that script but filters doesnt work for me.




What is correct filter? to filter all user with: employeeType == 'Internal'





<s:executeScript xmlns:s="http://midpoint.evolveum.com/xml/ns/public/model/
scripting-3"(http://midpoint.evolveum.com/xml/ns/public/model/scripting-3)

                 xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/
common-3"(http://midpoint.evolveum.com/xml/ns/public/common/common-3)

                 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
(http://www.w3.org/2001/XMLSchema-instance)

                 xmlns:api="http://midpoint.evolveum.com/xml/ns/public/
common/api-types-3"
(http://midpoint.evolveum.com/xml/ns/public/common/api-types-3)>

    <s:pipeline>

        <s:search>

            <s:type>ObjectType</s:type>

            <s:searchFilter>

                <q:inOid xmlns:q="http://prism.evolveum.com/xml/ns/public/
query-3"(http://prism.evolveum.com/xml/ns/public/query-3)>

                    <q:value>b87eb285-b4ae-43c0-9e4c-7ba651de81fa</q:value> 
 <!-- barkeeper -->

                    <q:value>469fd663-4492-4c24-8ce3-3907df7ac7ec</q:value> 
 <!-- bob -->

                    <q:value>f9be8006-fd58-43f9-99ff-311935d9d3d3</q:value> 
 <!-- carla -->

                    <q:value>b2a3f4ad-ad7b-4691-83d9-34d5ebb50a04</q:value> 
 <!-- cheese -->

                    <q:value>60dd9e6b-7403-4075-bcfa-d4566a552d41</q:value> 
 <!-- chef -->

                </q:inOid>

            </s:searchFilter>

        </s:search>

        <s:action>

            <s:type>generate-value</s:type>

            <s:parameter>

                <s:name>items</s:name>

                <c:value xsi:type="api:PolicyItemsDefinitionType">

                    <api:policyItemDefinition>

                        <api:target>

                            <api:path>credentials/password/value</api:path>

                        </api:target>

                        <api:execute>true</api:execute>

                    </api:policyItemDefinition>

                </c:value>

            </s:parameter>

        </s:action>       

        <s:filterContent>

            <s:keep>name</s:keep>

            <s:keep>credentials/password/value</s:keep>

        </s:filterContent>

    </s:pipeline>

    <s:options>

        <s:continueOnAnyError>true</s:continueOnAnyError>

    </s:options>

</s:executeScript>





Thanks Jan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180106/519fcd53/attachment.htm>

From mederly at evolveum.com  Sat Jan  6 20:35:22 2018
From: mederly at evolveum.com (Pavol Mederly)
Date: Sat, 6 Jan 2018 20:35:22 +0100
Subject: [midPoint] Bulk Password change
In-Reply-To: <DHq.vNP.7rClgrAYc0P.1QKHoT@seznam.cz>
References: <DHq.vNP.7rClgrAYc0P.1QKHoT@seznam.cz>
Message-ID: <28cb36aa-fa90-744a-f762-895b1374f53c@evolveum.com>

Hello Jan,

writing from memory but this should work:

<q:equal>
     <q:path>employeeType</q:path>
     <q:value>XYZ</q:value>
</q:equal>

but take care to use <s:type>UserType</s:type> instead of ObjectType as 
it is in your sample.

Best regards,

Pavol Mederly
Software developer
evolveum.com

On 06.01.2018 19:59, Jan Kaspar wrote:
> Hello,
> I would like to ask for help with creating filter for bulk password 
> change for users.
>
> goal is to generate new password in all systems for batch of user 
> based on attribute (employeeType) value.
>
> I found that script but filters doesnt work for me.
>
> What is correct filter? to filter all user with: employeeType == 
> 'Internal'
>
> |<||s:executeScript| 
> |xmlns:s||=||"http://midpoint.evolveum.com/xml/ns/public/model/scripting-3" 
> <http://midpoint.evolveum.com/xml/ns/public/model/scripting-3>|
> |||xmlns:c||=||"http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
> <http://midpoint.evolveum.com/xml/ns/public/common/common-3>|
> |||xmlns:xsi||=||"http://www.w3.org/2001/XMLSchema-instance" 
> <http://www.w3.org/2001/XMLSchema-instance>|
> |||xmlns:api||=||"http://midpoint.evolveum.com/xml/ns/public/common/api-types-3" 
> <http://midpoint.evolveum.com/xml/ns/public/common/api-types-3>||>|
> |||<||s:pipeline||>|
> |||<||s:search||>|
> |||<||s:type||>ObjectType</||s:type||>|
> |||<||s:searchFilter||>|
> |||<||q:inOid| 
> |xmlns:q||=||"http://prism.evolveum.com/xml/ns/public/query-3" 
> <http://prism.evolveum.com/xml/ns/public/query-3>||>|
> |||<||q:value||>b87eb285-b4ae-43c0-9e4c-7ba651de81fa</||q:value||> 
> ||<!-- barkeeper -->|
> |||<||q:value||>469fd663-4492-4c24-8ce3-3907df7ac7ec</||q:value||> 
> ||<!-- bob -->|
> |||<||q:value||>f9be8006-fd58-43f9-99ff-311935d9d3d3</||q:value||> 
> ||<!-- carla -->|
> |||<||q:value||>b2a3f4ad-ad7b-4691-83d9-34d5ebb50a04</||q:value||> 
> ||<!-- cheese -->|
> |||<||q:value||>60dd9e6b-7403-4075-bcfa-d4566a552d41</||q:value||> 
> ||<!-- chef -->|
> |||</||q:inOid||>|
> |||</||s:searchFilter||>|
> |||</||s:search||>|
> |||<||s:action||>|
> |||<||s:type||>generate-value</||s:type||>|
> |||<||s:parameter||>|
> |||<||s:name||>items</||s:name||>|
> |||<||c:value| |xsi:type||=||"api:PolicyItemsDefinitionType"||>|
> |||<||api:policyItemDefinition||>|
> |||<||api:target||>|
> |||<||api:path||>credentials/password/value</||api:path||>|
> |||</||api:target||>|
> |||<||api:execute||>true</||api:execute||>|
> |||</||api:policyItemDefinition||>|
> |||</||c:value||>|
> |||</||s:parameter||>|
> |||</||s:action||> |
> |||<||s:filterContent||>|
> |||<||s:keep||>name</||s:keep||>|
> |||<||s:keep||>credentials/password/value</||s:keep||>|
> |||</||s:filterContent||>|
> |||</||s:pipeline||>|
> |||<||s:options||>|
> |||<||s:continueOnAnyError||>true</||s:continueOnAnyError||>|
> |||</||s:options||>|
> |</||s:executeScript||>|
> |
> |
> |Thanks Jan|
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180106/c83cad78/attachment.htm>

From Caspi at seznam.cz  Sat Jan  6 21:12:35 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Sat, 06 Jan 2018 21:12:35 +0100 (CET)
Subject: [midPoint] Bulk Password change (Pavol Mederly)
Message-ID: <DNN.vNZ.14S2JDkRzIc.1QKIsp@seznam.cz>


Hi Pavol,




thanks for reply. I also try that but i got error:





  Couldn't parse bulk action object
  
 (http://192.168.4.104:8080/admin/config/bulk?270-1.ILinkListener-feedbackContainer-feedback-list-4-message-detailsBox-downloadXml)
  
 

 
 Operation
 operation.performBulkAction
 Message
 Couldn't parse bulk action object
 
 
 
 
 
 
 Error
 Error parsing XML document The prefix "q" for element "q:equal" is not 
 bound.
 show
 java.lang.IllegalStateException: Error parsing XML document The prefix "q" 
 for element "q:equal" is not bound. at com.evolveum.midpoint.util.DOMUtil.
 parse(DOMUtil.java:255) at com.evolveum.midpoint.prism.lex.dom.
 DomLexicalProcessor.read(DomLexicalProcessor.java:84) at com.evolveum.
 midpoint.prism.marshaller.PrismParserImpl.doParseRealValue(PrismParserImpl.
 java:157) at com.evolveum.midpoint.prism.marshaller.PrismParserImpl.
 doParseRealValue(PrismParserImpl.java:163) at com.evolveum.midpoint.prism.
 marshaller.PrismParserImplNoIO.parseRealValue(PrismParserImplNoIO.java:146)
 at com.evolveum.midpoint.web.page.admin.configuration.PageBulkAction.
 startPerformed(PageBulkAction.java:117)
 
 





<s:executeScript xmlns:s="http://midpoint.evolveum.com/xml/ns/public/model/
scripting-3"

                 xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/
common-3"

                 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

                 xmlns:api="http://midpoint.evolveum.com/xml/ns/public/
common/api-types-3">

    <s:pipeline>

    <s:search>

        <s:type>UserType</s:type>

        <s:searchFilter>

        <q:equal>

            <q:path>name</q:path>

            <q:value>jack</q:value>

        </q:equal>

            </s:searchFilter>

        </s:search>

        <s:action>

            <s:type>generate-value</s:type>

            <s:parameter>

                <s:name>items</s:name>

                <c:value xsi:type="api:PolicyItemsDefinitionType">

                    <api:policyItemDefinition>

                        <api:target>

                            <api:path>credentials/password/value</api:path>

                        </api:target>

                        <api:execute>true</api:execute>

                    </api:policyItemDefinition>

                </c:value>

            </s:parameter>

        </s:action>       

        <s:filterContent>

            <s:keep>name</s:keep>

            <s:keep>credentials/password/value</s:keep>

        </s:filterContent>

    </s:pipeline>

    <s:options>

        <s:continueOnAnyError>true</s:continueOnAnyError>

    </s:options>

</s:executeScript>




Jan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180106/afb49b23/attachment.htm>

From Caspi at seznam.cz  Sat Jan  6 21:16:28 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Sat, 06 Jan 2018 21:16:28 +0100 (CET)
Subject: [midPoint] Bulk Password change
Message-ID: <DNb.vNd.11r}ni1yCer.1QKIwS@seznam.cz>

Hi again,



got it. rmeove Q: and P: solved my problem. 




Jan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180106/711c3d49/attachment.htm>

From Caspi at seznam.cz  Sun Jan  7 14:31:39 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Sun, 07 Jan 2018 14:31:39 +0100 (CET)
Subject: [midPoint] Condition for role assignement
Message-ID: <XXS.vNo.5EyAvPvejJr.1QKY4x@seznam.cz>


Hi,




I am trying to create condition for Org assignement. Basicaly user type have
to be a Contractor and must be enabled.

Problem with this cone is an AND operator (&&). with this i cannot save the 
code. I am missing point. In other mappings i am using OR and it works.




See code bellow:

  

 <mapping id="8">

      <name>My Object Template: test assign orgs</name>

      <authoritative>false</authoritative>

      <strength>strong</strength>

      <source>

         <c:path>employeeType</c:path>

      </source>

      <source>

         <c:path>activation/effectiveStatus</c:path>

      </source>

      <expression>

         <value>

            <targetRef oid="bc5ee415-e570-44b3-a676-daee0aa7ab0e" type=
"OrgType"/>

         </value>

      </expression>

      <target>

         <c:path>assignment</c:path>

      </target>

      <condition>

         <script xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

                 xsi:type="c:ScriptExpressionEvaluatorType">

            <code>

                def tmpStatus = basic.norm(basic.stringify
(effectiveStatus))?.toString();

                log.info ("ORGANIZATION ASSIGNEMENT User Status = " + 
tmpStatus);

        tmpStatus == 'enabled' && employeeType == 'Contractor'

            </code>

         </script>

      </condition>

   </mapping>




Thanks for Help




Jan 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180107/e4001bde/attachment.htm>

From o.nekriach at dynatech.lv  Mon Jan  8 08:38:49 2018
From: o.nekriach at dynatech.lv (Oleksandr Nekriach)
Date: Mon, 8 Jan 2018 09:38:49 +0200
Subject: [midPoint] Condition for role assignement
In-Reply-To: <XXS.vNo.5EyAvPvejJr.1QKY4x@seznam.cz>
References: <XXS.vNo.5EyAvPvejJr.1QKY4x@seznam.cz>
Message-ID: <CANb693RapzL4GBhx4h4DrHKDjjF9VkG5PcizP8y4=sYi3Lq+Rg@mail.gmail.com>

Hello Jan,
You should use $amp; instead of & character

Best regards, Oleksandr

On 7 January 2018 at 15:31, Jan Kaspar <Caspi at seznam.cz> wrote:
> Hi,
>
> I am trying to create condition for Org assignement. Basicaly user type have
> to be a Contractor and must be enabled.
> Problem with this cone is an AND operator (&&). with this i cannot save the
> code. I am missing point. In other mappings i am using OR and it works.
>
> See code bellow:
>
>  <mapping id="8">
>       <name>My Object Template: test assign orgs</name>
>       <authoritative>false</authoritative>
>       <strength>strong</strength>
>       <source>
>          <c:path>employeeType</c:path>
>       </source>
>       <source>
>          <c:path>activation/effectiveStatus</c:path>
>       </source>
>       <expression>
>          <value>
>             <targetRef oid="bc5ee415-e570-44b3-a676-daee0aa7ab0e"
> type="OrgType"/>
>          </value>
>       </expression>
>       <target>
>          <c:path>assignment</c:path>
>       </target>
>       <condition>
>          <script xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
>                  xsi:type="c:ScriptExpressionEvaluatorType">
>             <code>
>                 def tmpStatus =
> basic.norm(basic.stringify(effectiveStatus))?.toString();
>                 log.info ("ORGANIZATION ASSIGNEMENT User Status = " +
> tmpStatus);
>         tmpStatus == 'enabled' && employeeType == 'Contractor'
>             </code>
>          </script>
>       </condition>
>    </mapping>
>
> Thanks for Help
>
> Jan
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>



-- 
Best regards,

Oleksandr Nekriach | Identity and access management engineer

Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia

+37125314685
,
o.nekriach at dynatech.lv
|
www.dynatech.lv




Stay connected:


Confidentiality Notice: This message contains confidential information
and is intended only for the named recipient(s). If you are not the
addressee you may not copy, distribute or perform any other activities
with this information. If you have received this transmission in
error, please notify us by e-mail immediately. E-mail transmission
cannot be guaranteed to be secure or error-free as information could
be intercepted, corrupted, lost, destroyed, arrive late or incomplete,
or contain viruses.


From o.nekriach at dynatech.lv  Mon Jan  8 08:40:12 2018
From: o.nekriach at dynatech.lv (Oleksandr Nekriach)
Date: Mon, 8 Jan 2018 09:40:12 +0200
Subject: [midPoint] Condition for role assignement
In-Reply-To: <CANb693RapzL4GBhx4h4DrHKDjjF9VkG5PcizP8y4=sYi3Lq+Rg@mail.gmail.com>
References: <XXS.vNo.5EyAvPvejJr.1QKY4x@seznam.cz>
 <CANb693RapzL4GBhx4h4DrHKDjjF9VkG5PcizP8y4=sYi3Lq+Rg@mail.gmail.com>
Message-ID: <CANb693RFGbTimDUXo70zmRYzarc4WrrS9g-EiaW4kzZdZYhi=Q@mail.gmail.com>

Sorry thi one is correct
&amp;

On 8 January 2018 at 09:38, Oleksandr Nekriach <o.nekriach at dynatech.lv> wrote:
> Hello Jan,
> You should use $amp; instead of & character
>
> Best regards, Oleksandr
>
> On 7 January 2018 at 15:31, Jan Kaspar <Caspi at seznam.cz> wrote:
>> Hi,
>>
>> I am trying to create condition for Org assignement. Basicaly user type have
>> to be a Contractor and must be enabled.
>> Problem with this cone is an AND operator (&&). with this i cannot save the
>> code. I am missing point. In other mappings i am using OR and it works.
>>
>> See code bellow:
>>
>>  <mapping id="8">
>>       <name>My Object Template: test assign orgs</name>
>>       <authoritative>false</authoritative>
>>       <strength>strong</strength>
>>       <source>
>>          <c:path>employeeType</c:path>
>>       </source>
>>       <source>
>>          <c:path>activation/effectiveStatus</c:path>
>>       </source>
>>       <expression>
>>          <value>
>>             <targetRef oid="bc5ee415-e570-44b3-a676-daee0aa7ab0e"
>> type="OrgType"/>
>>          </value>
>>       </expression>
>>       <target>
>>          <c:path>assignment</c:path>
>>       </target>
>>       <condition>
>>          <script xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
>>                  xsi:type="c:ScriptExpressionEvaluatorType">
>>             <code>
>>                 def tmpStatus =
>> basic.norm(basic.stringify(effectiveStatus))?.toString();
>>                 log.info ("ORGANIZATION ASSIGNEMENT User Status = " +
>> tmpStatus);
>>         tmpStatus == 'enabled' && employeeType == 'Contractor'
>>             </code>
>>          </script>
>>       </condition>
>>    </mapping>
>>
>> Thanks for Help
>>
>> Jan
>>
>> _______________________________________________
>> midPoint mailing list
>> midPoint at lists.evolveum.com
>> http://lists.evolveum.com/mailman/listinfo/midpoint
>>
>
>
>
> --
> Best regards,
>
> Oleksandr Nekriach | Identity and access management engineer
>
> Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia
>
> +37125314685
> ,
> o.nekriach at dynatech.lv
> |
> www.dynatech.lv
>
>
>
>
> Stay connected:
>
>
> Confidentiality Notice: This message contains confidential information
> and is intended only for the named recipient(s). If you are not the
> addressee you may not copy, distribute or perform any other activities
> with this information. If you have received this transmission in
> error, please notify us by e-mail immediately. E-mail transmission
> cannot be guaranteed to be secure or error-free as information could
> be intercepted, corrupted, lost, destroyed, arrive late or incomplete,
> or contain viruses.



-- 
Best regards,

Oleksandr Nekriach | Identity and access management engineer

Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia

+37125314685
,
o.nekriach at dynatech.lv
|
www.dynatech.lv




Stay connected:


Confidentiality Notice: This message contains confidential information
and is intended only for the named recipient(s). If you are not the
addressee you may not copy, distribute or perform any other activities
with this information. If you have received this transmission in
error, please notify us by e-mail immediately. E-mail transmission
cannot be guaranteed to be secure or error-free as information could
be intercepted, corrupted, lost, destroyed, arrive late or incomplete,
or contain viruses.


From o.nekriach at dynatech.lv  Mon Jan  8 15:49:58 2018
From: o.nekriach at dynatech.lv (Oleksandr Nekriach)
Date: Mon, 8 Jan 2018 16:49:58 +0200
Subject: [midPoint] Principle of Relativity
Message-ID: <CANb693QvoxPfO0sy8DKouWypxHdf7158mGf8Lomxeo9gw-oaNw@mail.gmail.com>

Hi guys,
Please answer me whether there is a way to recalculate all the
attributes and assignments that are assigned to users according to its
ObjectTemplate. Or the principle of Relativity can not be bypassed.
Example:
We have ObjectTemplate wich is applied during reconciliation. This
ObjectTemplate  assigns roles to the users. But after some time I have
found that the IDM administrators (Help Desk guys)  made some changes.
And I'm not sure whether all users have those assignments that were
automatically calculated according to ObjectTemplates or there is
something superfluous. And I would like to remove this unnecessary
assignments automatically.

-- 
Best regards,

Oleksandr Nekriach | Identity and access management engineer

Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia

+37125314685
,
o.nekriach at dynatech.lv
|
www.dynatech.lv




Stay connected:


Confidentiality Notice: This message contains confidential information
and is intended only for the named recipient(s). If you are not the
addressee you may not copy, distribute or perform any other activities
with this information. If you have received this transmission in
error, please notify us by e-mail immediately. E-mail transmission
cannot be guaranteed to be secure or error-free as information could
be intercepted, corrupted, lost, destroyed, arrive late or incomplete,
or contain viruses.


From Caspi at seznam.cz  Tue Jan  9 15:18:25 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Tue, 09 Jan 2018 15:18:25 +0100 (CET)
Subject: [midPoint] AD Attributes
Message-ID: <bgP.vMC.5zfOSTKbpGB.1QLCyn@seznam.cz>

Hi,



I need to be able to edit more attributes in Active Directory.

Attrributes are extensionAttribute1-10 for example. 





We are using them for other applications. 

How to do that? For now I am using ri:user and ri:group. 





Thanks 




Jan


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180109/9cbb6571/attachment.htm>

From ivan.noris at evolveum.com  Tue Jan  9 17:14:32 2018
From: ivan.noris at evolveum.com (Ivan Noris)
Date: Tue, 9 Jan 2018 17:14:32 +0100
Subject: [midPoint] AD Attributes
In-Reply-To: <bgP.vMC.5zfOSTKbpGB.1QLCyn@seznam.cz>
References: <bgP.vMC.5zfOSTKbpGB.1QLCyn@seznam.cz>
Message-ID: <5d595881-cae9-2ff9-35a6-648a36155b2f@evolveum.com>

Hi Jan,

if these attributes are not returned by the AD/connector, one possible
way is to configure them as operational attribute(s) in your AD/LDAP
resource configuration. E.g. this is from one of my projects:

<icfc:configurationProperties
xmlns:gen922="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/bundle/com.evolveum.polygon.connector-ldap/com.evolveum.polygon.connector.ldap.ad.AdLdapConnector"> 


. . .

 
<gen922:operationalAttributes>extensionAttribute15</gen922:operationalAttributes>

. . .

</icfc:configurationProperties>


Best regards,
Ivan

On 09.01.2018 15:18, Jan Kaspar wrote:
> Hi,
>
> I need to be able to edit more attributes in Active Directory.
> Attrributes are extensionAttribute1-10 for example. 
>
> We are using them for other applications. 
> How to do that? For now I am using ri:user and ri:group. 
>
> Thanks 
>
> Jan
>
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-- 
Ivan Noris
Senior Identity Engineer
evolveum.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180109/bfe1f47c/attachment.htm>

From wojciech.staszewski at diagnostyka.pl  Tue Jan  9 22:23:48 2018
From: wojciech.staszewski at diagnostyka.pl (Wojciech Staszewski)
Date: Tue, 9 Jan 2018 22:23:48 +0100
Subject: [midPoint]  V3.7 - approverRef and ownerRef
Message-ID: <e205c5e8-d114-2ec0-ef59-067df5763f94@diagnostyka.pl>

Hi All!

In the new version 3.7 the approverRef and ownerRef are marked by
exclamation mark in the role detail GUI as if they were deprecated.
But he new tab appeared: "Governance", where I can assign approvers,
managers and owners.

I assigned an approver to a role, but I cannot find this in the role xml.
I can see this only in the user xml in "targetRef/relation=org:approver"
section.

I want to make a role template where the approver is directly assigned
to the imported roles, without using metarole.
How should I do it?

Thanks!
WS
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180109/d325c9b7/attachment.htm>

From petr.gasparik at ami.cz  Tue Jan  9 22:54:39 2018
From: petr.gasparik at ami.cz (=?UTF-8?B?UGV0ciBHYcWhcGFyw61rIC0gQU1JIFByYWhhIGEucy4=?=)
Date: Tue, 9 Jan 2018 22:54:39 +0100
Subject: [midPoint] V3.7 - approverRef and ownerRef
In-Reply-To: <e205c5e8-d114-2ec0-ef59-067df5763f94@diagnostyka.pl>
References: <e205c5e8-d114-2ec0-ef59-067df5763f94@diagnostyka.pl>
Message-ID: <CABAspd0CepRSx12LgGRHDXxAaaRWj_k11C+rCakGs+b4k0ZBXA@mail.gmail.com>

Hi Wojciech,
I believe this was replaced by assignment type manager, approver, owner, ...

See old example:
https://wiki.evolveum.com/pages/viewpage.action?pageId=4882466

with link to new example:
https://wiki.evolveum.com/display/midPoint/Approval+sample+scenario+1%3A+Multi-level%2C+metarole-driven+approvals

--

s pozdravem

Petr Gašparík
solution architect

gsm: [+420] 603 523 860
e-mail: petr.gasparik at ami.cz


AMI Praha a.s.
Pláničkova 11
162 00 Praha 6
tel.: [+420] 274 783 239
web: www.ami.cz


[image: AMI Praha a.s.]

Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za
společnost AMI Praha a.s.
jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně
písemnou formu.


2018-01-09 22:23 GMT+01:00 Wojciech Staszewski <
wojciech.staszewski at diagnostyka.pl>:

> Hi All!
>
> In the new version 3.7 the approverRef and ownerRef are marked by exclamation
> mark in the role detail GUI as if they were deprecated.
> But he new tab appeared: "Governance", where I can assign approvers,
> managers and owners.
>
> I assigned an approver to a role, but I cannot find this in the role xml.
> I can see this only in the user xml in "targetRef/relation=org:approver"
> section.
>
> I want to make a role template where the approver is directly assigned to
> the imported roles, without using metarole.
> How should I do it?
> Thanks!
> WS
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180109/e2d43ea4/attachment.htm>

From wojciech.staszewski at diagnostyka.pl  Wed Jan 10 10:27:02 2018
From: wojciech.staszewski at diagnostyka.pl (Wojciech Staszewski)
Date: Wed, 10 Jan 2018 10:27:02 +0100
Subject: [midPoint] V3.7 - approverRef and ownerRef
In-Reply-To: <e205c5e8-d114-2ec0-ef59-067df5763f94@diagnostyka.pl>
References: <e205c5e8-d114-2ec0-ef59-067df5763f94@diagnostyka.pl>
Message-ID: <adc2ed40-8acf-f597-1cbc-a6c754b165f1@diagnostyka.pl>

Sorry but I don't get it. All of these examples use metaroles for approval and I want to assign approver explicitly/directly.
So I have to use role autoassignment with approver relation?

Regards!
WS

W dniu 09.01.2018 o 22:23, Wojciech Staszewski pisze:
> Hi All!
> 
> In the new version 3.7 the approverRef and ownerRef are marked by exclamation mark in the role detail GUI as if they were deprecated.
> But he new tab appeared: "Governance", where I can assign approvers, managers and owners.
> 
> I assigned an approver to a role, but I cannot find this in the role xml.
> I can see this only in the user xml in "targetRef/relation=org:approver" section.
> 
> I want to make a role template where the approver is directly assigned to the imported roles, without using metarole.
> How should I do it?
> 
> Thanks!
> WS
> 
> 
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>


From petr.gasparik at ami.cz  Wed Jan 10 11:25:40 2018
From: petr.gasparik at ami.cz (=?UTF-8?B?UGV0ciBHYcWhcGFyw61rIC0gQU1JIFByYWhhIGEucy4=?=)
Date: Wed, 10 Jan 2018 11:25:40 +0100
Subject: [midPoint] V3.7 - approverRef and ownerRef
In-Reply-To: <adc2ed40-8acf-f597-1cbc-a6c754b165f1@diagnostyka.pl>
References: <e205c5e8-d114-2ec0-ef59-067df5763f94@diagnostyka.pl>
 <adc2ed40-8acf-f597-1cbc-a6c754b165f1@diagnostyka.pl>
Message-ID: <CABAspd2jDbYPonHU-ZJt6r+kevM5T4H=q=w=Lcptt1SZ613UcQ@mail.gmail.com>

I leave this for Evolveum to answer
P.

--

s pozdravem

Petr Gašparík
solution architect

gsm: [+420] 603 523 860
e-mail: petr.gasparik at ami.cz


AMI Praha a.s.
Pláničkova 11
162 00 Praha 6
tel.: [+420] 274 783 239
web: www.ami.cz


[image: AMI Praha a.s.]

Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za
společnost AMI Praha a.s.
jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně
písemnou formu.


2018-01-10 10:27 GMT+01:00 Wojciech Staszewski <
wojciech.staszewski at diagnostyka.pl>:

> Sorry but I don't get it. All of these examples use metaroles for approval
> and I want to assign approver explicitly/directly.
> So I have to use role autoassignment with approver relation?
>
> Regards!
> WS
>
> W dniu 09.01.2018 o 22:23, Wojciech Staszewski pisze:
> > Hi All!
> >
> > In the new version 3.7 the approverRef and ownerRef are marked by
> exclamation mark in the role detail GUI as if they were deprecated.
> > But he new tab appeared: "Governance", where I can assign approvers,
> managers and owners.
> >
> > I assigned an approver to a role, but I cannot find this in the role xml.
> > I can see this only in the user xml in "targetRef/relation=org:approver"
> section.
> >
> > I want to make a role template where the approver is directly assigned
> to the imported roles, without using metarole.
> > How should I do it?
> >
> > Thanks!
> > WS
> >
> >
> > _______________________________________________
> > midPoint mailing list
> > midPoint at lists.evolveum.com
> > http://lists.evolveum.com/mailman/listinfo/midpoint
> >
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180110/031bc4cc/attachment.htm>

From radovan.semancik at evolveum.com  Wed Jan 10 13:57:34 2018
From: radovan.semancik at evolveum.com (Radovan Semancik)
Date: Wed, 10 Jan 2018 13:57:34 +0100
Subject: [midPoint] MidPoint in 2018
Message-ID: <d2a1ed63-5fa9-9ddb-60e8-9f72d7704207@evolveum.com>

Dear midPoint community,

Happy new year! 2018 is here. And it looks like a very exciting year for 
midPoint. There are new development plans for 2018 but also interesting 
changes in our business model. There is so much to look forward to in 
2018. I would like use this start-of-new-year period to share our plans 
with you. This is going to be quite a long mail. But there are important 
information to share with you. So please make yourself comfortable.

First let’s have a look back at 2017. This was yet another busy year for 
midPoint. Especially the Comenius release brought huge amount of new 
features. This was followed by Darwin which brought a wide range of 
evolutionary improvements. It means that MidPoint is now much more than 
just IDM. MidPoint is planted deeply in the identity governance field. 
In fact it is the first (and only) full-featured identity governance 
system in existence. Which I guess makes it a best-of-breed solution, 
doesn’t it? MidPoint is also recognized by major industry analysts and 
the number of midPoint deployment is growing. So, we can say that we 
have reached and even exceeded our plans for 2017.

And now the plans for 2018. The plan is, as usual, to have two releases. 
MidPoint 3.8 is planned for early spring, midPoint 3.9 will come in 
autumn. We have quite precise plans for 3.8, but there are preliminary 
plans for the whole of 2018. Let’s start at the beginning.

The development of midPoint 3.8 is already in full swing. There are two 
major focus areas: scalability and data protection. The goal is to run 
midPoint efficiently even for massive deployments. Currently it can 
handle deployments with few millions of identities – assuming 
appropriate configuration, environment and quite a bit of patience. But 
midPoint 3.8 should be able to go beyond that limit. Our team is working 
on the scalability and performance improvements right now. The second 
area where midPoint is being developed is data protection. Yes, that 
means GDPR. Identity management systems are almost ideal tools to 
support and automate data protection mechanisms. But midPoint goes a 
step further by introducing features specifically aimed at data 
protection into the base product. This is still a bit of a secret (as 
much as anything can really be a secret in an open source world). We are 
going to unveil the details at FOSDEM conference. So it might be a good 
idea to head for Brussels in first weekend in February. This is going to 
be fun:

https://fosdem.org/2018/schedule/event/idm_midpoint/

MidPoint 3.8 will be released quite soon, most likely early April. The 
plan is to get back to our original April/October release schedule.

Precise plans for midPoint 3.9 are still open. Significant part of 
development time is reserved for platform subscribers. But the 
preliminary plan for this release tentatively aims at improving user 
experience (UX) of the user interface. There was a gradual evolution of 
the user interface in every release to date. But current situation asks 
for a bigger review of the UX principles of midPoint user interface. The 
extent of the improvements is still not entirely certain. There are a 
lot of ideas and suggestions and it is quite clear that not all of them 
will make it to midPoint 3.9. Which improvements will be included mostly 
depends on preferences expressed by the subscribers. Therefore, it is 
perhaps a good idea to purchase your subscription now to make sure that 
your voice will be heard. There are only a few months left before 
midPoint 3.9 development starts.

There are also a couple changes to Evolveum business model. First change 
affects the lifetime of the releases. Up until now every release was 
supported for two years since the initial (minor) release. This was a 
good model when midPoint was young. It was ideal for early adopters that 
wanted new features very quickly. But now when midPoint is a mature 
product stability is much more important than rapid feature delivery. 
Therefore, in 2018 midPoint will be adopting the system of long-term 
support (LTS) releases. There will be an LTS release every two years and 
those releases will be supported for a longer time. The other (non-LTS) 
releases will be supported for a shorter time. There will also be a 
direct upgrade path between LTS releases. Therefore, the LTS releases 
are for those that prefer stability. Other feature releases are for 
those that prefer rapid delivery of new features. There is something for 
everybody.

The other change in our business is the strong preference of 
subscriptions over sponsoring. Up until now there was a possibility to 
directly sponsor a specific feature. We will be phasing out this 
offering during 2018. Sponsoring can pay for the development of a new 
feature. But it does not cover the maintenance cost. Only subscription 
can do that. MidPoint is now a mature system and feature stability and 
continuity is crucial. Therefore, we decided to support this stability 
with appropriate business model. From now on the right way to get your 
feature into midPoint is to use platform subscription:

https://evolveum.com/services/professional-support/

There is also one change that is very likely to affect this mailing 
list. Since the beginning of midPoint project back in 2011 we have used 
this mailing list as a primary means of technological communication. We 
definitely want to maintain that, and I take it as my personal new year 
resolution to try to communicate our plans more often and more clearly. 
The mailing list is also used as a community support forum. Which is 
good and it is a pleasant sight to see such a vibrant community growing 
around a product that we have created. However, having Evolveum 
engineers answer every community question is an enormous drain on our 
resources. You might have noticed that we have reduced the amount of 
time that our engineers use for community support during last year. I'm 
afraid that this is a trend that is very likely to continue. The 
community gets bigger and it is not possible to answer every question. 
Therefore we have to prioritize. And of course, midPoint subscribers get 
absolute priority. We will also try to answer as many community 
questions as possible, but only to the extent that time availability of 
our engineers permits. I'm sorry about this, but even our engineers need 
to get a bit of sleep occasionally. On the other hand as midPoint 
community grows there are more and more cases when a community question 
is answered by another community member. And I must say that I'm very 
happy that midPoint community has this life of its own. Thank you all 
for that!

There is a similar situation when it comes to bug reports. It is always 
good practice to file a bug report in our Jira. However, I would like to 
clarify the expectations about the fix. All issues reported by midPoint 
subscribers will be prioritized. Subscriber issues will be handled as 
soon as possible. If the subscriber specified a higher priority for the 
issue then the issue will be fixed in next (minor) midPoint release. If 
the subscriber indicated that this issues should be part of a 
maintenance release then we will backport the fix. To summarize: 
subscriber is a king. Then there are (non-subscriber) community issues. 
We will prioritize fixing community issues only in two cases: if it is a 
security issue or if the bug affects huge number of midPoint deployments 
(security issues will always get highest priority regardless of who has 
reported them). Other community issues have to wait. We will not work on 
these issues immediately. We will not ignore the issues, we will just 
assign lower priority to them. We have a test/bugfix cycle before every 
midPoint release. That's the time when community issues may get fixed - 
but only after all the subscriber issues are fixed. However, the 
experience from recent midPoint releases tells that this time is very 
limited. Community issues will not block scheduled midPoint release. 
Therefore it is not realistic to expect that all community issues will 
get fixed. Unfixed issues are postponed for the next release. But the 
priority stays the same. So there may be quite a long time before the 
issues get fixed. In fact there are community issues that are already 
postponed for several years. I'm sorry for this. We would really like to 
fix all the issues. But our capacity to fix community issues is limited. 
At this point I'm quite certain that you are aware where this all leads 
to. And you are right. Please, get midPoint subscription. That is the 
right thing to do to keep midPoint project going.

So, this is the current state of midPoint project and those are our 
plans for 2018. MidPoint is the biggest open source IDM system out 
there. It is actually bigger than all the other open source IDM systems 
combined – both in the quantity of the code and quality of the features. 
MidPoint is the only open source system that implements strong identity 
governance. The midPoint project is a great success. All these years of 
hard work were worth it. Even though vast majority of the work was done 
by the core team in Evolveum, the project would not be possible without 
you: midPoint community. We would like to thank all midPoint 
contributors and especially midPoint subscribers. MidPoint would not be 
such a great product without all your support. Thank you!

-- 
Radovan Semancik
Software Architect
evolveum.com



From wojciech.staszewski at diagnostyka.pl  Wed Jan 10 14:32:37 2018
From: wojciech.staszewski at diagnostyka.pl (Wojciech Staszewski)
Date: Wed, 10 Jan 2018 14:32:37 +0100
Subject: [midPoint] MidPoint in 2018
In-Reply-To: <d2a1ed63-5fa9-9ddb-60e8-9f72d7704207@evolveum.com>
References: <d2a1ed63-5fa9-9ddb-60e8-9f72d7704207@evolveum.com>
Message-ID: <ab7701e9-08c7-7eb2-66d5-baf687181021@diagnostyka.pl>

Hello!

About this mailing list: As I understand, the list will remain as the main communication channel and there's no plans for a community forum/board?
I have nothing against the mailing list, except the fact that our e-mail addresses are exhibited for public access in the archives,
for the spam scanners too... :(

Best regards!
WS

W dniu 10.01.2018 o 13:57, Radovan Semancik pisze:
> Dear midPoint community,
> 
[...]



From radovan.semancik at evolveum.com  Wed Jan 10 15:06:26 2018
From: radovan.semancik at evolveum.com (Radovan Semancik)
Date: Wed, 10 Jan 2018 15:06:26 +0100
Subject: [midPoint] MidPoint in 2018
In-Reply-To: <ab7701e9-08c7-7eb2-66d5-baf687181021@diagnostyka.pl>
References: <d2a1ed63-5fa9-9ddb-60e8-9f72d7704207@evolveum.com>
 <ab7701e9-08c7-7eb2-66d5-baf687181021@diagnostyka.pl>
Message-ID: <221f0e77-54d9-93b4-3709-162e7d7cbef3@evolveum.com>

Hi,

Yes, the mailing list will remain. We have no specific plans for the 
forum. Some time ago we have been looking at the options that we have. 
We definitely want to keep the mailing-list character (mail-based 
communication) as I believe this brings a level of civility that is 
rarely seen in Internet forums. But we have not been able to identity 
any reasonable software that would combine the advantages of mailing 
list and forum. That would indeed be very attractive. Just we have just 
found no viable options. But, as always, we are open to suggestions.

-- 
Radovan Semancik
Software Architect
evolveum.com



On 01/10/2018 02:32 PM, Wojciech Staszewski wrote:
> Hello!
>
> About this mailing list: As I understand, the list will remain as the main communication channel and there's no plans for a community forum/board?
> I have nothing against the mailing list, except the fact that our e-mail addresses are exhibited for public access in the archives,
> for the spam scanners too... :(
>
> Best regards!
> WS
>
> W dniu 10.01.2018 o 13:57, Radovan Semancik pisze:
>> Dear midPoint community,
>>
> [...]
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint




From martin.lizner at ami.cz  Wed Jan 10 15:21:54 2018
From: martin.lizner at ami.cz (=?UTF-8?Q?Martin_L=C3=ADzner_=2D_AMI_Praha_a=2Es=2E?=)
Date: Wed, 10 Jan 2018 15:21:54 +0100
Subject: [midPoint] V3.7 - approverRef and ownerRef
In-Reply-To: <adc2ed40-8acf-f597-1cbc-a6c754b165f1@diagnostyka.pl>
References: <e205c5e8-d114-2ec0-ef59-067df5763f94@diagnostyka.pl>
 <adc2ed40-8acf-f597-1cbc-a6c754b165f1@diagnostyka.pl>
Message-ID: <CALOh8ePXiU7pHkOUhrSEO=z7Evb9XC++PkAZcQN4DA76Ri_Xcg@mail.gmail.com>

Hi,

storing approvers in role object is obsoleted indeed. New approach is
storing this information as focus (user, role, org) assignment with special
relation. This allows new features like delegation and certification.

You dont need to use metaroles or autoassignment for role approvers. You
can do it via direct assignment from user to role with special relation set
(relation=approver). In GUI, you can e.g. set it from role detail -
Governance tab.

M.

Martin Lízner
solution architect

gsm: [+420] 737 745 571
e-mail: martin.lizner at ami.cz


AMI Praha a.s.
Pláničkova 11
162 00 Praha 6
tel.: [+420] 274 783 239
web: www.ami.cz



[image: AMI Praha a.s.] <http://www.skyidentity.com/>

Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za
společnost AMI Praha a.s.
jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně
písemnou formu.


2018-01-10 10:27 GMT+01:00 Wojciech Staszewski <
wojciech.staszewski at diagnostyka.pl>:

> Sorry but I don't get it. All of these examples use metaroles for approval
> and I want to assign approver explicitly/directly.
> So I have to use role autoassignment with approver relation?
>
> Regards!
> WS
>
> W dniu 09.01.2018 o 22:23, Wojciech Staszewski pisze:
> > Hi All!
> >
> > In the new version 3.7 the approverRef and ownerRef are marked by
> exclamation mark in the role detail GUI as if they were deprecated.
> > But he new tab appeared: "Governance", where I can assign approvers,
> managers and owners.
> >
> > I assigned an approver to a role, but I cannot find this in the role xml.
> > I can see this only in the user xml in "targetRef/relation=org:approver"
> section.
> >
> > I want to make a role template where the approver is directly assigned
> to the imported roles, without using metarole.
> > How should I do it?
> >
> > Thanks!
> > WS
> >
> >
> > _______________________________________________
> > midPoint mailing list
> > midPoint at lists.evolveum.com
> > http://lists.evolveum.com/mailman/listinfo/midpoint
> >
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180110/ab33b8cd/attachment.htm>

From wojciech.staszewski at diagnostyka.pl  Wed Jan 10 15:27:35 2018
From: wojciech.staszewski at diagnostyka.pl (Wojciech Staszewski)
Date: Wed, 10 Jan 2018 15:27:35 +0100
Subject: [midPoint] V3.7 - approverRef and ownerRef
In-Reply-To: <CALOh8ePXiU7pHkOUhrSEO=z7Evb9XC++PkAZcQN4DA76Ri_Xcg@mail.gmail.com>
References: <e205c5e8-d114-2ec0-ef59-067df5763f94@diagnostyka.pl>
 <adc2ed40-8acf-f597-1cbc-a6c754b165f1@diagnostyka.pl>
 <CALOh8ePXiU7pHkOUhrSEO=z7Evb9XC++PkAZcQN4DA76Ri_Xcg@mail.gmail.com>
Message-ID: <9e06800d-8746-af38-cd63-5681036882c3@diagnostyka.pl>

Hi!
I know how to do it in GUI, I want to know how to do it in role template :)

Best regards!
WS

W dniu 10.01.2018 o 15:21, Martin Lízner - AMI Praha a.s. pisze:
> Hi, 
> 
> storing approvers in role object is obsoleted indeed. New approach is storing this information as focus (user, role, org) assignment with special relation. This allows new features like delegation and certification. 
> 
> You dont need to use metaroles or autoassignment for role approvers. You can do it via direct assignment from user to role with special relation set (relation=approver). In GUI, you can e.g. set it from role detail - Governance tab.
> 
> M.
> 
> Martin Lízner
> solution architect
> 
> gsm: [+420] 737 745 571
> e-mail: martin.lizner at ami.cz <mailto:martin.lizner at ami.cz>
> 
> 	   	   	
> 
> AMI Praha a.s.
> Pláničkova 11
> 162 00 Praha 6
> tel.: [+420] 274 783 239
> web: www.ami.cz <http://www.ami.cz/>
> 
> 	   	   	
> 
> 
> AMI Praha a.s. <http://www.skyidentity.com/>
> 
> Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za společnost AMI Praha a.s.
> jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně písemnou formu.
> 
> 
> 
> 2018-01-10 10:27 GMT+01:00 Wojciech Staszewski <wojciech.staszewski at diagnostyka.pl <mailto:wojciech.staszewski at diagnostyka.pl>>:
> 
>     Sorry but I don't get it. All of these examples use metaroles for approval and I want to assign approver explicitly/directly.
>     So I have to use role autoassignment with approver relation?
> 
>     Regards!
>     WS
> 
>     W dniu 09.01.2018 o 22:23, Wojciech Staszewski pisze:
>     > Hi All!
>     >
>     > In the new version 3.7 the approverRef and ownerRef are marked by exclamation mark in the role detail GUI as if they were deprecated.
>     > But he new tab appeared: "Governance", where I can assign approvers, managers and owners.
>     >
>     > I assigned an approver to a role, but I cannot find this in the role xml.
>     > I can see this only in the user xml in "targetRef/relation=org:approver" section.
>     >
>     > I want to make a role template where the approver is directly assigned to the imported roles, without using metarole.
>     > How should I do it?
>     >
>     > Thanks!
>     > WS
>     >
>     >
>     > _______________________________________________
>     > midPoint mailing list
>     > midPoint at lists.evolveum.com <mailto:midPoint at lists.evolveum.com>
>     > http://lists.evolveum.com/mailman/listinfo/midpoint <http://lists.evolveum.com/mailman/listinfo/midpoint>
>     >
>     _______________________________________________
>     midPoint mailing list
>     midPoint at lists.evolveum.com <mailto:midPoint at lists.evolveum.com>
>     http://lists.evolveum.com/mailman/listinfo/midpoint <http://lists.evolveum.com/mailman/listinfo/midpoint>
> 
> 
> 
> 
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
> 


From martin.lizner at ami.cz  Wed Jan 10 15:33:21 2018
From: martin.lizner at ami.cz (=?UTF-8?Q?Martin_L=C3=ADzner_=2D_AMI_Praha_a=2Es=2E?=)
Date: Wed, 10 Jan 2018 15:33:21 +0100
Subject: [midPoint] Principle of Relativity
In-Reply-To: <CANb693QvoxPfO0sy8DKouWypxHdf7158mGf8Lomxeo9gw-oaNw@mail.gmail.com>
References: <CANb693QvoxPfO0sy8DKouWypxHdf7158mGf8Lomxeo9gw-oaNw@mail.gmail.com>
Message-ID: <CALOh8eMp=iYe2i1=QPd9aQZ_5ZfTNjBMupFzB3j=0ZAnsnz6fA@mail.gmail.com>

Hi, try using strength=strong for your object template mappings. Should do
for most cases. Default is strength=normal, which triggers mapping only
when mapping sources are changed. M.

Martin Lízner
solution architect

gsm: [+420] 737 745 571
e-mail: martin.lizner at ami.cz


AMI Praha a.s.
Pláničkova 11
162 00 Praha 6
tel.: [+420] 274 783 239
web: www.ami.cz



[image: AMI Praha a.s.] <http://www.skyidentity.com/>

Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za
společnost AMI Praha a.s.
jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně
písemnou formu.


2018-01-08 15:49 GMT+01:00 Oleksandr Nekriach <o.nekriach at dynatech.lv>:

> Hi guys,
> Please answer me whether there is a way to recalculate all the
> attributes and assignments that are assigned to users according to its
> ObjectTemplate. Or the principle of Relativity can not be bypassed.
> Example:
> We have ObjectTemplate wich is applied during reconciliation. This
> ObjectTemplate  assigns roles to the users. But after some time I have
> found that the IDM administrators (Help Desk guys)  made some changes.
> And I'm not sure whether all users have those assignments that were
> automatically calculated according to ObjectTemplates or there is
> something superfluous. And I would like to remove this unnecessary
> assignments automatically.
>
> --
> Best regards,
>
> Oleksandr Nekriach | Identity and access management engineer
>
> Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia
>
> +37125314685
> ,
> o.nekriach at dynatech.lv
> |
> www.dynatech.lv
>
>
>
>
> Stay connected:
>
>
> Confidentiality Notice: This message contains confidential information
> and is intended only for the named recipient(s). If you are not the
> addressee you may not copy, distribute or perform any other activities
> with this information. If you have received this transmission in
> error, please notify us by e-mail immediately. E-mail transmission
> cannot be guaranteed to be secure or error-free as information could
> be intercepted, corrupted, lost, destroyed, arrive late or incomplete,
> or contain viruses.
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180110/14f6c805/attachment.htm>

From Caspi at seznam.cz  Wed Jan 10 16:12:27 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Wed, 10 Jan 2018 16:12:27 +0100 (CET)
Subject: [midPoint] Protected OUs
Message-ID: <jQ.vMS.4hKupz7x8PO.1QLYrR@seznam.cz>

Hi All,



I have a question about filtering in resource (AD). I have an example of OU 
structure that contains hundrets of OU on same level.




OU=1,OU=Country, DC=Company, DC=local

.

..

OU=500,OU=Country, DC=Company, DC=local




There is a need to work only with OU 1-10. Others must be protected. Is 
there a way how to accomplish that?

There is not posibility to change OU structure. 





Thanks,




Jan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180110/8c24e180/attachment.htm>

From o.nekriach at dynatech.lv  Wed Jan 10 16:29:03 2018
From: o.nekriach at dynatech.lv (Oleksandr Nekriach)
Date: Wed, 10 Jan 2018 17:29:03 +0200
Subject: [midPoint] Principle of Relativity
In-Reply-To: <CALOh8eMp=iYe2i1=QPd9aQZ_5ZfTNjBMupFzB3j=0ZAnsnz6fA@mail.gmail.com>
References: <CANb693QvoxPfO0sy8DKouWypxHdf7158mGf8Lomxeo9gw-oaNw@mail.gmail.com>
 <CALOh8eMp=iYe2i1=QPd9aQZ_5ZfTNjBMupFzB3j=0ZAnsnz6fA@mail.gmail.com>
Message-ID: <CANb693RMvVG+d=YdJnURi8KuL=ostopcSEuJYp8YkPzhg53ssg@mail.gmail.com>

Hi Martin,
I have already tried this approach but had not success in my case.

   <mapping>
      <description>Assigment Agents to Agents Role</description>
      <authoritative>true</authoritative>
      <strength>strong</strength>
      <source>
         <c:path>$user/employeeType</c:path>
      </source>
      <source>
         <name>formerEmployee</name>
         <c:path>$user/extension/formerEmployee</c:path>
      </source>
      <expression>
         <value>
            <targetRef oid="cdbe899a-527b-4774-accc-8d1a7f000000"
type="c:RoleType"/>
         </value>
      </expression>
      <target>
         <c:path>assignment</c:path>
      </target>
      <condition>
         <script xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                 xsi:type="c:ScriptExpressionEvaluatorType">
            <code>employeeType =='Agent' &amp;&amp; formerEmployee ==
'false'</code>
         </script>
      </condition>
   </mapping>

On 10 January 2018 at 16:33, Martin Lízner - AMI Praha a.s. <
martin.lizner at ami.cz> wrote:

> Hi, try using strength=strong for your object template mappings. Should do
> for most cases. Default is strength=normal, which triggers mapping only
> when mapping sources are changed. M.
>
> Martin Lízner
> solution architect
>
> gsm: [+420] 737 745 571 <+420%20737%20745%20571>
> e-mail: martin.lizner at ami.cz
>
>
> AMI Praha a.s.
> Pláničkova 11
> 162 00 Praha 6
> tel.: [+420] 274 783 239 <+420%20274%20783%20239>
> web: www.ami.cz
>
>
>
> [image: AMI Praha a.s.] <http://www.skyidentity.com/>
>
> Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za
> společnost AMI Praha a.s.
> jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně
> písemnou formu.
>
>
> 2018-01-08 15:49 GMT+01:00 Oleksandr Nekriach <o.nekriach at dynatech.lv>:
>
>> Hi guys,
>> Please answer me whether there is a way to recalculate all the
>> attributes and assignments that are assigned to users according to its
>> ObjectTemplate. Or the principle of Relativity can not be bypassed.
>> Example:
>> We have ObjectTemplate wich is applied during reconciliation. This
>> ObjectTemplate  assigns roles to the users. But after some time I have
>> found that the IDM administrators (Help Desk guys)  made some changes.
>> And I'm not sure whether all users have those assignments that were
>> automatically calculated according to ObjectTemplates or there is
>> something superfluous. And I would like to remove this unnecessary
>> assignments automatically.
>>
>> --
>> Best regards,
>>
>> Oleksandr Nekriach | Identity and access management engineer
>>
>> Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia
>>
>> +37125314685
>> ,
>> o.nekriach at dynatech.lv
>> |
>> www.dynatech.lv
>>
>>
>>
>>
>> Stay connected:
>>
>>
>> Confidentiality Notice: This message contains confidential information
>> and is intended only for the named recipient(s). If you are not the
>> addressee you may not copy, distribute or perform any other activities
>> with this information. If you have received this transmission in
>> error, please notify us by e-mail immediately. E-mail transmission
>> cannot be guaranteed to be secure or error-free as information could
>> be intercepted, corrupted, lost, destroyed, arrive late or incomplete,
>> or contain viruses.
>> _______________________________________________
>> midPoint mailing list
>> midPoint at lists.evolveum.com
>> http://lists.evolveum.com/mailman/listinfo/midpoint
>>
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>


-- 
Best regards,

Oleksandr Nekriach | Identity and access management engineer

Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia

+37125314685 <+371%2025%20314%20685>
,
o.nekriach at dynatech.lv
|
www.dynatech.lv




Stay connected:
<https://www.facebook.com/DynatechLatvia/?ref=br_rs>
<https://www.linkedin.com/company-beta/17893047/>


Confidentiality Notice: This message contains confidential information and
is intended only for the named recipient(s). If you are not the addressee
you may not copy, distribute or perform any other activities with this
information. If you have received this transmission in error, please notify
us by e-mail immediately. E-mail transmission cannot be guaranteed to be
secure or error-free as information could be intercepted, corrupted, lost,
destroyed, arrive late or incomplete, or contain viruses.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180110/100d6ab5/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: o.nekriach at dynatech.lv1502777022855-7771
Type: image/png
Size: 790 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180110/100d6ab5/attachment.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: o.nekriach at dynatech.lv1502777022855-7770
Type: image/png
Size: 2602 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180110/100d6ab5/attachment-0001.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: o.nekriach at dynatech.lv1502777022855-7772
Type: image/png
Size: 786 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180110/100d6ab5/attachment-0002.png>

From petr.gasparik at ami.cz  Wed Jan 10 16:53:26 2018
From: petr.gasparik at ami.cz (=?UTF-8?B?UGV0ciBHYcWhcGFyw61rIC0gQU1JIFByYWhhIGEucy4=?=)
Date: Wed, 10 Jan 2018 16:53:26 +0100
Subject: [midPoint] MidPoint in 2018
In-Reply-To: <221f0e77-54d9-93b4-3709-162e7d7cbef3@evolveum.com>
References: <d2a1ed63-5fa9-9ddb-60e8-9f72d7704207@evolveum.com>
 <ab7701e9-08c7-7eb2-66d5-baf687181021@diagnostyka.pl>
 <221f0e77-54d9-93b4-3709-162e7d7cbef3@evolveum.com>
Message-ID: <CABAspd3MQuu90Rn+FYAL-CRh72u1-23g0iQYDUoACsJG5Ac3zA@mail.gmail.com>

Google groups combine this, mail+web interface, you can use both. See
Apereo maillist :)

--

s pozdravem

Petr Gašparík
solution architect

gsm: [+420] 603 523 860
e-mail: petr.gasparik at ami.cz


AMI Praha a.s.
Pláničkova 11
162 00 Praha 6
tel.: [+420] 274 783 239
web: www.ami.cz


[image: AMI Praha a.s.]

Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za
společnost AMI Praha a.s.
jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně
písemnou formu.


2018-01-10 15:06 GMT+01:00 Radovan Semancik <radovan.semancik at evolveum.com>:

> Hi,
>
> Yes, the mailing list will remain. We have no specific plans for the
> forum. Some time ago we have been looking at the options that we have. We
> definitely want to keep the mailing-list character (mail-based
> communication) as I believe this brings a level of civility that is rarely
> seen in Internet forums. But we have not been able to identity any
> reasonable software that would combine the advantages of mailing list and
> forum. That would indeed be very attractive. Just we have just found no
> viable options. But, as always, we are open to suggestions.
>
> --
> Radovan Semancik
> Software Architect
> evolveum.com
>
>
>
> On 01/10/2018 02:32 PM, Wojciech Staszewski wrote:
>
>> Hello!
>>
>> About this mailing list: As I understand, the list will remain as the
>> main communication channel and there's no plans for a community forum/board?
>> I have nothing against the mailing list, except the fact that our e-mail
>> addresses are exhibited for public access in the archives,
>> for the spam scanners too... :(
>>
>> Best regards!
>> WS
>>
>> W dniu 10.01.2018 o 13:57, Radovan Semancik pisze:
>>
>>> Dear midPoint community,
>>>
>>> [...]
>>
>> _______________________________________________
>> midPoint mailing list
>> midPoint at lists.evolveum.com
>> http://lists.evolveum.com/mailman/listinfo/midpoint
>>
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180110/f76518eb/attachment.htm>

From Caspi at seznam.cz  Thu Jan 11 00:07:54 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Thu, 11 Jan 2018 00:07:54 +0100 (CET)
Subject: [midPoint] remove roles from disabled users
Message-ID: <1YG.vMi.5eUEY1pvU2p.1QLfpA@seznam.cz>

Hello All,



can someone help me with change of following script?  Script is removing 
roles from users that were administratively marked as disabled (activation 
status -> combobox). I would like to have it also in case that user is 
disabled by Valid To attribute.





<hook>

    <name>Remove assignments from disabled users</name>

    <state>secondary</state>

    <focusType>c:UserType</focusType>

    <script>

       <code>

            import com.evolveum.midpoint.prism.delta.*;

            import com.evolveum.midpoint.xml.ns._public.common.common_3.*;

 

            UserType user = (UserType) focus;

            ActivationStatusType administrativeStatus = user.getActivation()
.getAdministrativeStatus();

            if (administrativeStatus == ActivationStatusType.DISABLED) {    
 

                changed = false;              

                for (AssignmentType assign : user.getAssignment()) {

                    assignmentDelta = ContainerDelta.
createModificationDelete(UserType.F_ASSIGNMENT, UserType.class, 
prismContext, assign.clone());                                              
             

                    log.debug('Removing assignment ' + assignmentDelta + ' 
from disabled user ' + user.getName());                   

                    modelContext.getFocusContext().swallowToSecondaryDelta
(assignmentDelta);

                    changed = true;

                }

                if (changed) { 

                    modelContext.rot(); // this makes Projector to recompute
the model context

                }

            }

        </code>

    </script>

</hook>





Thanks Jan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180111/880d50d3/attachment.htm>

From caspi at caspi.cz  Wed Jan 10 13:36:00 2018
From: caspi at caspi.cz (=?UTF-8?Q?Jan_Ka=C5=A1par?=)
Date: Wed, 10 Jan 2018 13:36:00 +0100
Subject: [midPoint]  AD Attributes
Message-ID: <CABtVEc-MMgTk8L=aJ1TKvo1qwY-sMCkDTVtBWwr9oQbjAA4iBA@mail.gmail.com>

Hi Ivan,

thank you very much. It works!


S pozdravem

Jan Kašpar
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180110/7c95ac28/attachment.htm>

From Caspi at seznam.cz  Thu Jan 11 09:17:11 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Thu, 11 Jan 2018 09:17:11 +0100 (CET)
Subject: [midPoint] remove roles from disabled users
Message-ID: <1sT.vMm.2euxT8KfU61.1QLns7@seznam.cz>


Hi,



Found solution.



Jan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180111/3efb33b9/attachment.htm>

From o.nekriach at dynatech.lv  Thu Jan 11 09:26:07 2018
From: o.nekriach at dynatech.lv (Oleksandr Nekriach)
Date: Thu, 11 Jan 2018 10:26:07 +0200
Subject: [midPoint] remove roles from disabled users
In-Reply-To: <1sT.vMm.2euxT8KfU61.1QLns7@seznam.cz>
References: <1sT.vMm.2euxT8KfU61.1QLns7@seznam.cz>
Message-ID: <CANb693QmuhRV1mbgrwZnbzt=SuMQ__8QZk0G0nwFLEkfHCkFsw@mail.gmail.com>

Hi, Jan
What is correct one?

On 11 January 2018 at 10:17, Jan Kaspar <Caspi at seznam.cz> wrote:
> Hi,
>
> Found solution.
>
> Jan
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>



-- 
Best regards,

Oleksandr Nekriach | Identity and access management engineer

Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia

+37125314685
,
o.nekriach at dynatech.lv
|
www.dynatech.lv




Stay connected:


Confidentiality Notice: This message contains confidential information
and is intended only for the named recipient(s). If you are not the
addressee you may not copy, distribute or perform any other activities
with this information. If you have received this transmission in
error, please notify us by e-mail immediately. E-mail transmission
cannot be guaranteed to be secure or error-free as information could
be intercepted, corrupted, lost, destroyed, arrive late or incomplete,
or contain viruses.


From ivan.noris at evolveum.com  Thu Jan 11 10:19:16 2018
From: ivan.noris at evolveum.com (Ivan Noris)
Date: Thu, 11 Jan 2018 10:19:16 +0100
Subject: [midPoint] Principle of Relativity
In-Reply-To: <CANb693RMvVG+d=YdJnURi8KuL=ostopcSEuJYp8YkPzhg53ssg@mail.gmail.com>
References: <CANb693QvoxPfO0sy8DKouWypxHdf7158mGf8Lomxeo9gw-oaNw@mail.gmail.com>
 <CALOh8eMp=iYe2i1=QPd9aQZ_5ZfTNjBMupFzB3j=0ZAnsnz6fA@mail.gmail.com>
 <CANb693RMvVG+d=YdJnURi8KuL=ostopcSEuJYp8YkPzhg53ssg@mail.gmail.com>
Message-ID: <b91415f4-23da-4ffa-af3d-262963b988ae@evolveum.com>

Hi Oleksandr,

one thing is to have strong mappings for assigning the roles through the
template. But to really apply anything to target systems you also have
to have strong mappings in schema handling/roles (outbound mappings) in
all resources where you want this.

Then reconciliation (or any other synchronization, including
provisioning) will always try to push the values which should be in the
target system account attributes.

The default mapping strength is normal as Martin said; that means, only
changes are synchronized.

Regards,

Ivan


On 10.01.2018 16:29, Oleksandr Nekriach wrote:
> Hi Martin,
> I have already tried this approach but had not success in my case.
>
>    <mapping>
>       <description>Assigment Agents to Agents Role</description>
>       <authoritative>true</authoritative>
>       <strength>strong</strength>
>       <source>
>          <c:path>$user/employeeType</c:path>
>       </source>
>       <source>
>          <name>formerEmployee</name>
>          <c:path>$user/extension/formerEmployee</c:path>
>       </source>
>       <expression>
>          <value>
>             <targetRef oid="cdbe899a-527b-4774-accc-8d1a7f000000"
> type="c:RoleType"/>
>          </value>
>       </expression>
>       <target>
>          <c:path>assignment</c:path>
>       </target>
>       <condition>
>          <script xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
>                  xsi:type="c:ScriptExpressionEvaluatorType">
>             <code>employeeType =='Agent' &amp;&amp; formerEmployee ==
> 'false'</code>
>          </script>
>       </condition>
>    </mapping>
>
> On 10 January 2018 at 16:33, Martin Lízner - AMI Praha a.s.
> <martin.lizner at ami.cz <mailto:martin.lizner at ami.cz>> wrote:
>
>     Hi, try using strength=strong for your object template mappings.
>     Should do for most cases. Default is strength=normal, which
>     triggers mapping only when mapping sources are changed. M.
>
>     Martin Lízner
>     solution architect
>
>     gsm: [+420] 737 745 571 <tel:+420%20737%20745%20571>
>     e-mail: martin.lizner at ami.cz <mailto:martin.lizner at ami.cz>
>
>     	    	    	
>
>     AMI Praha a.s.
>     Pláničkova 11
>     162 00 Praha 6
>     tel.: [+420] 274 783 239 <tel:+420%20274%20783%20239>
>     web: www.ami.cz <http://www.ami.cz/>
>
>     	    	    	
>
>
>
>     AMI Praha a.s. <http://www.skyidentity.com/>
>
>     Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá
>     za společnost AMI Praha a.s.
>     jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít
>     výhradně písemnou formu.
>
>
>
>     2018-01-08 15:49 GMT+01:00 Oleksandr Nekriach
>     <o.nekriach at dynatech.lv <mailto:o.nekriach at dynatech.lv>>:
>
>         Hi guys,
>         Please answer me whether there is a way to recalculate all the
>         attributes and assignments that are assigned to users
>         according to its
>         ObjectTemplate. Or the principle of Relativity can not be
>         bypassed.
>         Example:
>         We have ObjectTemplate wich is applied during reconciliation. This
>         ObjectTemplate  assigns roles to the users. But after some
>         time I have
>         found that the IDM administrators (Help Desk guys)  made some
>         changes.
>         And I'm not sure whether all users have those assignments that
>         were
>         automatically calculated according to ObjectTemplates or there is
>         something superfluous. And I would like to remove this unnecessary
>         assignments automatically.
>
>         --
>         Best regards,
>
>         Oleksandr Nekriach | Identity and access management engineer
>
>         Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia
>
>         +37125314685 <tel:%2B37125314685>
>         ,
>         o.nekriach at dynatech.lv <mailto:o.nekriach at dynatech.lv>
>         |
>         www.dynatech.lv <http://www.dynatech.lv>
>
>
>
>
>         Stay connected:
>
>
>         Confidentiality Notice: This message contains confidential
>         information
>         and is intended only for the named recipient(s). If you are
>         not the
>         addressee you may not copy, distribute or perform any other
>         activities
>         with this information. If you have received this transmission in
>         error, please notify us by e-mail immediately. E-mail transmission
>         cannot be guaranteed to be secure or error-free as information
>         could
>         be intercepted, corrupted, lost, destroyed, arrive late or
>         incomplete,
>         or contain viruses.
>         _______________________________________________
>         midPoint mailing list
>         midPoint at lists.evolveum.com <mailto:midPoint at lists.evolveum.com>
>         http://lists.evolveum.com/mailman/listinfo/midpoint
>         <http://lists.evolveum.com/mailman/listinfo/midpoint>
>
>
>
>     _______________________________________________
>     midPoint mailing list
>     midPoint at lists.evolveum.com <mailto:midPoint at lists.evolveum.com>
>     http://lists.evolveum.com/mailman/listinfo/midpoint
>     <http://lists.evolveum.com/mailman/listinfo/midpoint>
>
>
>
>
> -- 
> Best regards,
>
> Oleksandr Nekriach | Identity and access management engineer
>
> Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia
>
> +37125314685 <tel:+371%2025%20314%20685>
> ,
> o.nekriach at dynatech.lv <mailto:o.nekriach at dynatech.lv>
> |
> www.dynatech.lv <http://www.dynatech.lv>
>
>
>
>
> Stay connected:
> <https://www.facebook.com/DynatechLatvia/?ref=br_rs>
> <https://www.linkedin.com/company-beta/17893047/>
>
>
> Confidentiality Notice: This message contains confidential information
> and is intended only for the named recipient(s). If you are not the
> addressee you may not copy, distribute or perform any other activities
> with this information. If you have received this transmission in
> error, please notify us by e-mail immediately. E-mail transmission
> cannot be guaranteed to be secure or error-free as information could
> be intercepted, corrupted, lost, destroyed, arrive late or incomplete,
> or contain viruses.
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-- 
Ivan Noris
Senior Identity Engineer
evolveum.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180111/3a3382a0/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: o.nekriach at dynatech.lv1502777022855-7770
Type: image/png
Size: 2602 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180111/3a3382a0/attachment.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: o.nekriach at dynatech.lv1502777022855-7771
Type: image/png
Size: 790 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180111/3a3382a0/attachment-0001.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: o.nekriach at dynatech.lv1502777022855-7772
Type: image/png
Size: 786 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180111/3a3382a0/attachment-0002.png>

From Caspi at seznam.cz  Thu Jan 11 11:41:49 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Thu, 11 Jan 2018 11:41:49 +0100 (CET)
Subject: [midPoint] remove roles from disabled users
Message-ID: <2Cw.vMu.1Xhk25JW}ou.1QLpzj@seznam.cz>

Hi Oleksandr,



I just change :




 ActivationStatusType administrativeStatus = user.getActivation().
getEffectiveStatus();




Jan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180111/946d6118/attachment.htm>

From gustav.palos at evolveum.com  Thu Jan 11 12:27:00 2018
From: gustav.palos at evolveum.com (=?UTF-8?B?UMOhbG9zIEd1c3TDoXY=?=)
Date: Thu, 11 Jan 2018 12:27:00 +0100
Subject: [midPoint] Cannot sync attributes to AD
In-Reply-To: <L2Y.vIq.6rr69OWxgUC.1QHdan@seznam.cz>
References: <L2Y.vIq.6rr69OWxgUC.1QHdan@seznam.cz>
Message-ID: <CAPXQVkdKctZuyb1tU+JqPm0Ax08N25gWLscOJxVy2h288LVL0A@mail.gmail.com>

Hi Jan,

try to use maxOccurs=1, like:
<attribute>
<c:ref>ri:description</c:ref>
<displayName>Description</displayName>
<!-- in AD schema defined as multi value, but in realistic single -->
<limitations>
<minOccurs>0</minOccurs>
<maxOccurs>1</maxOccurs>
</limitations>
<outbound>
.....
</outbound>
</attribute>

2017-12-29 18:19 GMT+01:00 Jan Kaspar <Caspi at seznam.cz>:

> Hi all,
>
> I have latest midpoint 3.7 version and I am expiriencing an error with
> syncing description on user and group object ou to AD.
> When object in AD has null value of description attribute it works. I can
> easily add description and suffix " - managed by MidPoint"
> Problem is when i change the value to difedrent one, or in ad there is
> already some value.
>
> then i got and error:
> OperationAdd attribute values (Icf)MessageInvalid attribute:
> org.identityconnectors.framework.common.exceptions.
> InvalidAttributeValueException(Error modifying LDAP entry
> CN=Blanca.Parker,OU=Users,OU=CZ,DC=HELL,DC=LOCAL: [add:description:
> pepina1 - Managed by MidPoint,]: attributeOrValueExists: 00002081: AtrErr:
> DSID-030F181A, #1:??0: 00002081: DSID-030F181A, problem 1006
> (ATT_OR_VALUE_EXISTS), data 0, Att d (description)?? (20))Parameters
> uid [e61d0dc3-33dc-4ba1-a623-a243edbdfa52]
> objectClass [crOCD ({http://midpoint.evolveum.com/xml/ns/public/resource/
> instance-3}user)]
> options [OperationOptions: {}]
> attributes [[Attribute: {Name=description, Value=[pepina1 - Managed by
> MidPoint]}]]Context
> connector [class org.identityconnectors.framework.impl.api.local.
> LocalConnectorFacadeImpl]ErrorInvalid attribute: org.identityconnectors.
> framework.common.exceptions.InvalidAttributeValueException(Error
> modifying LDAP entry CN=Blanca.Parker,OU=Users,OU=CZ,DC=HELL,DC=LOCAL:
> [add:description: pepina1 - Managed by MidPoint,]: attributeOrValueExists:
> 00002081: AtrErr: DSID-030F181A, #1:??0: 00002081: DSID-030F181A, problem
> 1006 (ATT_OR_VALUE_EXISTS), data 0, Att d (description)?? (20))show
> com.evolveum.midpoint.util.exception.SchemaException: Invalid attribute:
> org.identityconnectors.framework.common.exceptions.
> InvalidAttributeValueException(Error modifying LDAP entry
> CN=Blanca.Parker,OU=Users,OU=CZ,DC=HELL,DC=LOCAL: [add:description:
> pepina1 - Managed by MidPoint,]: attributeOrValueExists: 00002081: AtrErr:
> DSID-030F181A, #1:??0: 00002081: DSID-030F181A, problem 1006
> (ATT_OR_VALUE_EXISTS), data 0, Att d (description)?? (20)) at
> com.evolveum.midpoint.provisioning.ucf.impl.connid.
> ConnIdUtil.lookForKnownCause(ConnIdUtil.java:352) at
> com.evolveum.midpoint.provisioning.ucf.impl.connid.ConnIdUtil.
> processConnIdException(ConnIdUtil.java:215) at com.evolveum.midpoint.
> provisioning.ucf.impl.connid.ConnectorInstanceConnIdImpl.modifyObject(
> ConnectorInstanceConnIdImpl.java:1715) at com.evolveum.midpoint.
> provisioning.impl.ResourceObjectConverter.executeModify(
> ResourceObjectConverter.java:769) at com.evolveum.midpoint.
> provisioning.impl.ResourceObjectConverter.modifyResourceObject(
> ResourceObjectConverter.java:571) at com.evolveum.midpoint.
> provisioning.impl.ShadowCache.modifyShadow(ShadowCache.java:745) at
> com.evolveum.midpoint.provisioning.impl.ProvisioningServiceImpl.
> modifyObject(ProvisioningServiceImpl.java:671) at
> com.evolveum.midpoint.model.impl.lens.ChangeExecutor.
> modifyProvisioningObject(ChangeExecutor.java:1495) at
> com.evolveum.midpoint.model.impl.lens.ChangeExecutor.executeModification(ChangeExecutor.java:1369)
> at com.evolveum.midpoint.model.impl.lens.ChangeExecutor.
> executeDelta(ChangeExecutor.java:909) at com.evolveum.midpoint.model.
> impl.lens.ChangeExecutor.executeChanges(ChangeExecutor.java:318) at
> com.evolveum.midpoint.model.impl.lens.Clockwork.lambda$
> processSecondary$0(Clockwork.java:635) at com.evolveum.midpoint.model.
> impl.lens.LensUtil.partialExecute(LensUtil.java:947) at
> com.evolveum.midpoint.model.impl.lens.LensUtil.
> partialExecute(LensUtil.java:934) at com.evolveum.midpoint.model.
> impl.lens.Clockwork.processSecondary(Clockwork.java:633) at
> com.evolveum.midpoint.model.impl.lens.Clockwork.click(Clockwork.java:479)
> at com.evolveum.midpoint.model.impl.lens.Clockwork.run(Clockwork.java:202)
> at com.evolveum.midpoint.model.impl.controller.ModelController.
> executeChanges(ModelController.java:538) at com.evolveum.midpoint.web.
> component.progress.ProgressPanel$14.callWithContextPrepared(ProgressPanel.java:605)
> at com.evolveum.midpoint.web.component.progress.ProgressPanel$14.
> callWithContextPrepared(ProgressPanel.java:591) at
> com.evolveum.midpoint.web.component.SecurityContextAwareCallable.call(
> SecurityContextAwareCallable.java:59) at java.util.concurrent.FutureTask.run(Unknown
> Source) at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown
> Source) at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown
> Source) at java.lang.Thread.run(Unknown Source)
>
> Thanks Jan
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>


-- 
Gustáv Pálos
Identity Engineer
evolveum.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180111/31264eb2/attachment.htm>

From o.nekriach at dynatech.lv  Fri Jan 12 09:10:39 2018
From: o.nekriach at dynatech.lv (Oleksandr Nekriach)
Date: Fri, 12 Jan 2018 10:10:39 +0200
Subject: [midPoint] Issue with midPoint cluster (Cannot connect to the
 remote node: no such object in table)
Message-ID: <CANb693T3Vs_YmO_OOL+PCLW0cMfD5k8ff8EwB_2rF4Rzuo-F=w@mail.gmail.com>

Dear colleagues,
Please help me to solve the issue with cluster deployment.
I have setup midpoint cluster on tomcat servers with two nodes NodeA
and NodeB (using Sun JDK 8).
Everything seems correct in logs during startup only INFO messages are there.
2018-01-12 07:23:18,152 [] [localhost-startStop-1] INFO
(com.evolveum.midpoint.task.quartzimpl.cluster.NodeRegistrar):
Registering this node in th
e repository as NodeB at sec-idm2:20001
2018-01-12 07:23:19,071 [] [localhost-startStop-1] INFO
(com.evolveum.midpoint.task.quartzimpl.execution.LocalNodeManager):
Initializing Quartz sc
heduler (but not starting it yet).
2018-01-12 07:23:19,151 [] [localhost-startStop-1] INFO
(com.evolveum.midpoint.task.quartzimpl.execution.LocalNodeManager):
... Quartz scheduler i
nitialized.
2018-01-12 07:23:19,153 [] [localhost-startStop-1] INFO
(com.evolveum.midpoint.task.quartzimpl.execution.TaskSynchronizer):
Synchronizing Quartz j
ob store with midPoint repository.

But when I navigate to Server tasks (in administrative interface) I
receive error messages  in logs (see below) and status messages in
interface Cannot connect to the remote node NodeA at sec-idm1:20001:
no such object in table
sec-idm2:~# telnet sec-idm1 20001
Trying 10.176.0.11...
Connected to sec-idm1.
Escape character is '^]'.
The same situation when I try it from the second NodeB. In this case
Cannot connect to the remote node NodeB at sec-idm2:20001: no such
object in table
sec-idm1:~# telnet sec-idm2 20001
Trying 10.176.1.11...
Connected to sec-idm2.
Escape character is '^]'.

2018-01-12 07:58:38,045 [] [http-nio-8080-exec-8] ERROR
(com.evolveum.midpoint.task.quartzimpl.execution.RemoteNodesManager):
Cannot connect to the remote node NodeA at sec-idm1:20001.
java.rmi.NoSuchObjectException: no such object in table
        at sun.rmi.transport.StreamRemoteCall.exceptionReceivedFromServer(StreamRemoteCall.java:283)
~[na:1.8.0_151]
        at sun.rmi.transport.StreamRemoteCall.executeCall(StreamRemoteCall.java:260)
~[na:1.8.0_151]
        at sun.rmi.server.UnicastRef.invoke(UnicastRef.java:161) ~[na:1.8.0_151]
        at java.rmi.server.RemoteObjectInvocationHandler.invokeRemoteMethod(RemoteObjectInvocationHandler.java:227)
~[na:1.8.0_151]
        at java.rmi.server.RemoteObjectInvocationHandler.invoke(RemoteObjectInvocationHandler.java:179)
~[na:1.8.0_151]
        at com.sun.proxy.$Proxy182.newClient(Unknown Source) ~[na:na]
        at javax.management.remote.rmi.RMIConnector.getConnection(RMIConnector.java:2430)
~[na:1.8.0_151]
        at javax.management.remote.rmi.RMIConnector.connect(RMIConnector.java:308)
~[na:1.8.0_151]
        at javax.management.remote.JMXConnectorFactory.connect(JMXConnectorFactory.java:270)
~[na:1.8.0_151]
        at com.evolveum.midpoint.task.quartzimpl.execution.JmxClient$1.run(JmxClient.java:45)
~[task-quartz-impl-3.6.1.jar:na]
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
~[na:1.8.0_151]
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
~[na:1.8.0_151]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
~[na:1.8.0_151]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
~[na:1.8.0_151]
        at java.lang.Thread.run(Thread.java:748) [na:1.8.0_151]


-- 
Best regards,

Oleksandr Nekriach | Identity and access management engineer

Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia

+37125314685
,
o.nekriach at dynatech.lv
|
www.dynatech.lv




Stay connected:


Confidentiality Notice: This message contains confidential information
and is intended only for the named recipient(s). If you are not the
addressee you may not copy, distribute or perform any other activities
with this information. If you have received this transmission in
error, please notify us by e-mail immediately. E-mail transmission
cannot be guaranteed to be secure or error-free as information could
be intercepted, corrupted, lost, destroyed, arrive late or incomplete,
or contain viruses.


From m.benucci at nsr.it  Fri Jan 12 09:50:00 2018
From: m.benucci at nsr.it (Marco Benucci)
Date: Fri, 12 Jan 2018 09:50:00 +0100
Subject: [midPoint] password storage method "hash" and users with empty
	password
Message-ID: <f7cd818b-68dd-61d7-783b-22f45496f1ba@nsr.it>

Hi,

we are running midpoint 3.6 and we would like to switch the password 
storage method from enrcyption to hash.
Now, if we create a new user with an empty password from the gui, we got 
this error:

java.lang.IllegalStateException: Subresult 
com.evolveum.midpoint.model.impl.lens.ChangeExecutor.execute of 
operation com.evolveum.midpoint.model.api.ModelService.executeChanges is 
still UNKNOWN during cleanup; during handling of exception 
java.lang.NullPointerException
     at 
com.evolveum.midpoint.schema.result.OperationResult.cleanupResult(OperationResult.java:1277)
     at 
com.evolveum.midpoint.model.impl.controller.ModelUtils.recordFatalError(ModelUtils.java:75)
     at 
com.evolveum.midpoint.model.impl.controller.ModelUtils.recordFatalError(ModelUtils.java:66)
     at 
com.evolveum.midpoint.model.impl.controller.ModelController.executeChanges(ModelController.java:596)
     at sun.reflect.GeneratedMethodAccessor1772.invoke(Unknown Source)
     at 
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
     at java.lang.reflect.Method.invoke(Method.java:498)
     at 
org.apache.wicket.proxy.LazyInitProxyFactory$JdkHandler.invoke(LazyInitProxyFactory.java:507)
     at com.sun.proxy.$Proxy166.executeChanges(Unknown Source)
     at 
com.evolveum.midpoint.web.component.progress.ProgressReporter.lambda$executeChangesAsync$0(ProgressReporter.java:187)
     at java.lang.Thread.run(Thread.java:745)
Caused by: java.lang.NullPointerException
     at 
com.evolveum.midpoint.model.impl.lens.projector.credentials.CredentialsProcessor.transformFocusExectionDeltaCredential(CredentialsProcessor.java:232)
     at 
com.evolveum.midpoint.model.impl.lens.projector.credentials.CredentialsProcessor.transformFocusExectionDelta(CredentialsProcessor.java:207)
     at 
com.evolveum.midpoint.model.impl.lens.ChangeExecutor.executeChanges(ChangeExecutor.java:187)
     at 
com.evolveum.midpoint.model.impl.lens.Clockwork.lambda$processSecondary$0(Clockwork.java:481)
     at 
com.evolveum.midpoint.model.impl.lens.LensUtil.partialExecute(LensUtil.java:1253)
     at 
com.evolveum.midpoint.model.impl.lens.LensUtil.partialExecute(LensUtil.java:1240)
     at 
com.evolveum.midpoint.model.impl.lens.Clockwork.processSecondary(Clockwork.java:479)
     at 
com.evolveum.midpoint.model.impl.lens.Clockwork.click(Clockwork.java:327)
     at 
com.evolveum.midpoint.model.impl.lens.Clockwork.run(Clockwork.java:203)
     at 
com.evolveum.midpoint.model.impl.controller.ModelController.executeChanges(ModelController.java:569)

with encryption method this error does not happen and one can create a 
new user from the gui without add the password.

Is this a bug?


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180112/967f13e1/attachment.htm>

From o.nekriach at dynatech.lv  Fri Jan 12 13:52:44 2018
From: o.nekriach at dynatech.lv (Oleksandr Nekriach)
Date: Fri, 12 Jan 2018 14:52:44 +0200
Subject: [midPoint] Issue with midPoint cluster (Cannot connect to the
 remote node: no such object in table)
In-Reply-To: <CANb693T3Vs_YmO_OOL+PCLW0cMfD5k8ff8EwB_2rF4Rzuo-F=w@mail.gmail.com>
References: <CANb693T3Vs_YmO_OOL+PCLW0cMfD5k8ff8EwB_2rF4Rzuo-F=w@mail.gmail.com>
Message-ID: <CANb693ToLo446nrAS+b6g_Zu2H7qUkV52mygx5EvLKkys_RiXA@mail.gmail.com>

Hello guys.
I have found cause.
It was my fault I have missed to configure dataSource atttribute for
taskManager in config.xml

On 12 January 2018 at 10:10, Oleksandr Nekriach <o.nekriach at dynatech.lv> wrote:
> Dear colleagues,
> Please help me to solve the issue with cluster deployment.
> I have setup midpoint cluster on tomcat servers with two nodes NodeA
> and NodeB (using Sun JDK 8).
> Everything seems correct in logs during startup only INFO messages are there.
> 2018-01-12 07:23:18,152 [] [localhost-startStop-1] INFO
> (com.evolveum.midpoint.task.quartzimpl.cluster.NodeRegistrar):
> Registering this node in th
> e repository as NodeB at sec-idm2:20001
> 2018-01-12 07:23:19,071 [] [localhost-startStop-1] INFO
> (com.evolveum.midpoint.task.quartzimpl.execution.LocalNodeManager):
> Initializing Quartz sc
> heduler (but not starting it yet).
> 2018-01-12 07:23:19,151 [] [localhost-startStop-1] INFO
> (com.evolveum.midpoint.task.quartzimpl.execution.LocalNodeManager):
> ... Quartz scheduler i
> nitialized.
> 2018-01-12 07:23:19,153 [] [localhost-startStop-1] INFO
> (com.evolveum.midpoint.task.quartzimpl.execution.TaskSynchronizer):
> Synchronizing Quartz j
> ob store with midPoint repository.
>
> But when I navigate to Server tasks (in administrative interface) I
> receive error messages  in logs (see below) and status messages in
> interface Cannot connect to the remote node NodeA at sec-idm1:20001:
> no such object in table
> sec-idm2:~# telnet sec-idm1 20001
> Trying 10.176.0.11...
> Connected to sec-idm1.
> Escape character is '^]'.
> The same situation when I try it from the second NodeB. In this case
> Cannot connect to the remote node NodeB at sec-idm2:20001: no such
> object in table
> sec-idm1:~# telnet sec-idm2 20001
> Trying 10.176.1.11...
> Connected to sec-idm2.
> Escape character is '^]'.
>
> 2018-01-12 07:58:38,045 [] [http-nio-8080-exec-8] ERROR
> (com.evolveum.midpoint.task.quartzimpl.execution.RemoteNodesManager):
> Cannot connect to the remote node NodeA at sec-idm1:20001.
> java.rmi.NoSuchObjectException: no such object in table
>         at sun.rmi.transport.StreamRemoteCall.exceptionReceivedFromServer(StreamRemoteCall.java:283)
> ~[na:1.8.0_151]
>         at sun.rmi.transport.StreamRemoteCall.executeCall(StreamRemoteCall.java:260)
> ~[na:1.8.0_151]
>         at sun.rmi.server.UnicastRef.invoke(UnicastRef.java:161) ~[na:1.8.0_151]
>         at java.rmi.server.RemoteObjectInvocationHandler.invokeRemoteMethod(RemoteObjectInvocationHandler.java:227)
> ~[na:1.8.0_151]
>         at java.rmi.server.RemoteObjectInvocationHandler.invoke(RemoteObjectInvocationHandler.java:179)
> ~[na:1.8.0_151]
>         at com.sun.proxy.$Proxy182.newClient(Unknown Source) ~[na:na]
>         at javax.management.remote.rmi.RMIConnector.getConnection(RMIConnector.java:2430)
> ~[na:1.8.0_151]
>         at javax.management.remote.rmi.RMIConnector.connect(RMIConnector.java:308)
> ~[na:1.8.0_151]
>         at javax.management.remote.JMXConnectorFactory.connect(JMXConnectorFactory.java:270)
> ~[na:1.8.0_151]
>         at com.evolveum.midpoint.task.quartzimpl.execution.JmxClient$1.run(JmxClient.java:45)
> ~[task-quartz-impl-3.6.1.jar:na]
>         at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
> ~[na:1.8.0_151]
>         at java.util.concurrent.FutureTask.run(FutureTask.java:266)
> ~[na:1.8.0_151]
>         at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
> ~[na:1.8.0_151]
>         at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
> ~[na:1.8.0_151]
>         at java.lang.Thread.run(Thread.java:748) [na:1.8.0_151]
>
>
> --
> Best regards,
>
> Oleksandr Nekriach | Identity and access management engineer
>
> Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia
>
> +37125314685
> ,
> o.nekriach at dynatech.lv
> |
> www.dynatech.lv
>
>
>
>
> Stay connected:
>
>
> Confidentiality Notice: This message contains confidential information
> and is intended only for the named recipient(s). If you are not the
> addressee you may not copy, distribute or perform any other activities
> with this information. If you have received this transmission in
> error, please notify us by e-mail immediately. E-mail transmission
> cannot be guaranteed to be secure or error-free as information could
> be intercepted, corrupted, lost, destroyed, arrive late or incomplete,
> or contain viruses.



-- 
Best regards,

Oleksandr Nekriach | Identity and access management engineer

Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia

+37125314685
,
o.nekriach at dynatech.lv
|
www.dynatech.lv




Stay connected:


Confidentiality Notice: This message contains confidential information
and is intended only for the named recipient(s). If you are not the
addressee you may not copy, distribute or perform any other activities
with this information. If you have received this transmission in
error, please notify us by e-mail immediately. E-mail transmission
cannot be guaranteed to be secure or error-free as information could
be intercepted, corrupted, lost, destroyed, arrive late or incomplete,
or contain viruses.


From Caspi at seznam.cz  Sat Jan 13 14:25:09 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Sat, 13 Jan 2018 14:25:09 +0100 (CET)
Subject: [midPoint] Group Membership
Message-ID: <5JH.vLN.6u6J10yrrKt.1QMWYr@seznam.cz>

Hello All,



I have a question about group membership. I have hundrets of groups in AD.




For begining I would like to force membership only for selected groups.




I tryed to do that with tolerancy but it is resource wide configuration. So 
all groups are affected.




Is there a way how to do that?




Thanks Jan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180113/4a47be23/attachment.htm>

From Caspi at seznam.cz  Sat Jan 13 18:20:08 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Sat, 13 Jan 2018 18:20:08 +0100 (CET)
Subject: [midPoint] AD groups import
Message-ID: <5XP.vLZ.725ZuPwYU2U.1QMZ}8@seznam.cz>

Hi All,



I need help with AD group import to Midpoint. I have MP 3.7 installed and 
sync of users from CSV and matching to AD is working OK.




Problem is with groups. We have hundrets of groups and I need to import 
groups and start to manage them. If I try to import groups to MP it cause 
also deleting of those group in AD. I tryed to create in schema handling 
only IN direction for name and description. But it didnt helped it still 
delete groups in AD.




I am attaching resourse config. 




Hope i described correctly.




Jan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180113/f184d452/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ExportedData_ResourceType_1515857588240 (1).xml
Type: text/xml
Size: 680977 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180113/f184d452/attachment.xml>

From mederly at evolveum.com  Sat Jan 13 20:21:45 2018
From: mederly at evolveum.com (Pavol Mederly)
Date: Sat, 13 Jan 2018 20:21:45 +0100
Subject: [midPoint] AD groups import
In-Reply-To: <5XP.vLZ.725ZuPwYU2U.1QMZ}8@seznam.cz>
References: <5XP.vLZ.725ZuPwYU2U.1QMZ}8@seznam.cz>
Message-ID: <d77bf5ba-09c5-80bc-ae68-f4e873d58ccc@evolveum.com>

Hello Jan.

What is your assignmentPolicyEnforcement setting? Please see check in 
the system configuration.

Best regards,

Pavol Mederly
Software developer
evolveum.com

On 13.01.2018 18:20, Jan Kaspar wrote:
> Hi All,
>
> I need help with AD group import to Midpoint. I have MP 3.7 installed 
> and sync of users from CSV and matching to AD is working OK.
>
> Problem is with groups. We have hundrets of groups and I need to 
> import groups and start to manage them. If I try to import groups to 
> MP it cause also deleting of those group in AD. I tryed to create in 
> schema handling only IN direction for name and description. But it 
> didnt helped it still delete groups in AD.
>
> I am attaching resourse config.
>
> Hope i described correctly.
>
> Jan
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180113/6a8f7995/attachment.htm>

From mederly at evolveum.com  Sat Jan 13 20:43:33 2018
From: mederly at evolveum.com (Pavol Mederly)
Date: Sat, 13 Jan 2018 20:43:33 +0100
Subject: [midPoint] AD groups import
In-Reply-To: <d77bf5ba-09c5-80bc-ae68-f4e873d58ccc@evolveum.com>
References: <5XP.vLZ.725ZuPwYU2U.1QMZ}8@seznam.cz>
 <d77bf5ba-09c5-80bc-ae68-f4e873d58ccc@evolveum.com>
Message-ID: <c1ecaff2-28f4-c620-6895-5de1385b7b5a@evolveum.com>

Not sure that I will be at a computer during the rest of weekend. So, 
please check it is not FULL. It should be the default (I think it is 
"relative").

Pavol Mederly
Software developer
evolveum.com

On 13.01.2018 20:21, Pavol Mederly wrote:
>
> Hello Jan.
>
> What is your assignmentPolicyEnforcement setting? Please see check in 
> the system configuration.
>
> Best regards,
>
> Pavol Mederly
> Software developer
> evolveum.com
> On 13.01.2018 18:20, Jan Kaspar wrote:
>> Hi All,
>>
>> I need help with AD group import to Midpoint. I have MP 3.7 installed 
>> and sync of users from CSV and matching to AD is working OK.
>>
>> Problem is with groups. We have hundrets of groups and I need to 
>> import groups and start to manage them. If I try to import groups to 
>> MP it cause also deleting of those group in AD. I tryed to create in 
>> schema handling only IN direction for name and description. But it 
>> didnt helped it still delete groups in AD.
>>
>> I am attaching resourse config.
>>
>> Hope i described correctly.
>>
>> Jan
>>
>>
>> _______________________________________________
>> midPoint mailing list
>> midPoint at lists.evolveum.com
>> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180113/6ec52957/attachment.htm>

From Caspi at seznam.cz  Sat Jan 13 21:23:39 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Sat, 13 Jan 2018 21:23:39 +0100 (CET)
Subject: [midPoint] AD groups import
Message-ID: <5ld.vLj.2GoYh0N5cmW.1QMchB@seznam.cz>

Hi All,



I have it tested with 3.6 and it works with same configuration.




So there is some bug in connector v1.5.1.




Jan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180113/07433004/attachment.htm>

From Caspi at seznam.cz  Sat Jan 13 22:52:05 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Sat, 13 Jan 2018 22:52:05 +0100 (CET)
Subject: [midPoint] AD groups import
Message-ID: <5po.vLt.6U96}5PnrEV.1QMd{5@seznam.cz>

Hi Pavol,



thank you! you are right. I hav configured Full assignement policy 
enforcement




Jan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180113/f65bcf84/attachment.htm>

From oskar.butovic at ami.cz  Mon Jan 15 11:08:07 2018
From: oskar.butovic at ami.cz (=?UTF-8?Q?Oskar_Butovi=C4=8D_=2D_AMI_Praha_a=2Es=2E?=)
Date: Mon, 15 Jan 2018 11:08:07 +0100
Subject: [midPoint] Group Membership
In-Reply-To: <5JH.vLN.6u6J10yrrKt.1QMWYr@seznam.cz>
References: <5JH.vLN.6u6J10yrrKt.1QMWYr@seznam.cz>
Message-ID: <CAE8MtZB8tGHvufkpMDbC4D8utErYvokosOs9YgxuHE6321QsGA@mail.gmail.com>

Hello Jan,

for this type of problem, I suggest first reconcile group membership from
AD to midpoint by inbound mapping. After that, you can do pretty much
anything with assignments in midpoint and provision them strong and
tolerant false to AD.(use midPoint as authoritative source after initial
sync.)

Best Regards
Oskar Butovič

2018-01-13 14:25 GMT+01:00 Jan Kaspar <Caspi at seznam.cz>:

> Hello All,
>
> I have a question about group membership. I have hundrets of groups in AD.
>
> For begining I would like to force membership only for selected groups.
>
> I tryed to do that with tolerancy but it is resource wide configuration.
> So all groups are affected.
>
> Is there a way how to do that?
>
> Thanks Jan
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>


-- 

Oskar Butovič
solution architect

gsm: [+420] 774 480 101
e-mail: oskar.butovic at ami.cz


AMI Praha a.s.
Pláničkova 11
162 00 Praha 6
tel.: [+420] 274 783 239
web: www.ami.cz


[image: AMI Praha a.s.]

[image: AMI Praha a.s.]
<http://www.ami.cz/reseni-a-sluzby/bezpecnost-dat/identity-management>

Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za
společnost AMI Praha a.s.
jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně
písemnou formu.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180115/db2f7d8b/attachment.htm>

From srpenn at us.ibm.com  Mon Jan 15 17:40:42 2018
From: srpenn at us.ibm.com (Sean R Penndorf)
Date: Mon, 15 Jan 2018 16:40:42 +0000
Subject: [midPoint] Can't get a link resource to user
Message-ID: <OF78C44F10.9CB0AFFE-ON85258216.005AE3B8-85258216.005B9D70@notes.na.collabserv.com>

Hello Community,

I have a pre-existing user in Midpoint.
When I run a reconcile against our HR database, I never get it to link up 
the resource record (shadow?) to the user.
I'm trying to match based on employeeNumber.

I gotta be missing something very simple.

Could someone review my XML and give me any pointers?  THANKS!!!!





------------------
Sean Penndorf
SaaS Operational Services (SOS) - ID Management
IBM Cloud
srpenn at us.ibm.com
Office: 248-552-4791   TL  623-9966



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180115/b4b35026/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: User.xml
Type: application/octet-stream
Size: 1187 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180115/b4b35026/attachment.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Resource.xml
Type: application/octet-stream
Size: 10692 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180115/b4b35026/attachment-0001.obj>

From oskar.butovic at ami.cz  Mon Jan 15 17:46:12 2018
From: oskar.butovic at ami.cz (=?UTF-8?Q?Oskar_Butovi=C4=8D_=2D_AMI_Praha_a=2Es=2E?=)
Date: Mon, 15 Jan 2018 17:46:12 +0100
Subject: [midPoint] Can't get a link resource to user
In-Reply-To: <OF78C44F10.9CB0AFFE-ON85258216.005AE3B8-85258216.005B9D70@notes.na.collabserv.com>
References: <OF78C44F10.9CB0AFFE-ON85258216.005AE3B8-85258216.005B9D70@notes.na.collabserv.com>
Message-ID: <CAE8MtZDjRA+v6GHP7H22vY-90qeJLVfXYy5-nkjAbShn3joa5A@mail.gmail.com>

Hello Sean,

your correlation should look probably like this:

<correlation>
<q:equal>
   <q:path>employeeNumber</q:path>
   <expression>
  <c:path>$shadow/attributes/ri:serialnumber</c:path>
   </expression>
</q:equal>
</correlation>

Best Regards
Oskar Butovič

2018-01-15 17:40 GMT+01:00 Sean R Penndorf <srpenn at us.ibm.com>:

> Hello Community,
>
> I have a pre-existing user in Midpoint.
> When I run a reconcile against our HR database, I never get it to link up
> the resource record (shadow?) to the user.
> I'm trying to match based on employeeNumber.
>
> I gotta be missing something very simple.
>
> Could someone review my XML and give me any pointers?  THANKS!!!!
>
>
>
>
>
> ------------------
> *Sean Penndorf*
> SaaS Operational Services (SOS) - ID Management
> IBM Cloud
> srpenn at us.ibm.com
> Office: 248-552-4791 <(248)%20552-4791>   TL  623-9966
>
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>


-- 

Oskar Butovič
solution architect

gsm: [+420] 774 480 101
e-mail: oskar.butovic at ami.cz


AMI Praha a.s.
Pláničkova 11
162 00 Praha 6
tel.: [+420] 274 783 239
web: www.ami.cz


[image: AMI Praha a.s.]

[image: AMI Praha a.s.]
<http://www.ami.cz/reseni-a-sluzby/bezpecnost-dat/identity-management>

Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za
společnost AMI Praha a.s.
jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně
písemnou formu.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180115/b3ef3a5e/attachment.htm>

From srpenn at us.ibm.com  Mon Jan 15 18:22:25 2018
From: srpenn at us.ibm.com (Sean R Penndorf)
Date: Mon, 15 Jan 2018 12:22:25 -0500
Subject: [midPoint] Can't get a link resource to user
In-Reply-To: <CAE8MtZDjRA+v6GHP7H22vY-90qeJLVfXYy5-nkjAbShn3joa5A@mail.gmail.com>
References: <OF78C44F10.9CB0AFFE-ON85258216.005AE3B8-85258216.005B9D70@notes.na.collabserv.com>
 <CAE8MtZDjRA+v6GHP7H22vY-90qeJLVfXYy5-nkjAbShn3joa5A@mail.gmail.com>
Message-ID: <OFF13891A6.765E1B20-ON85258216.005F5533-85258216.005F6F3E@notes.na.collabserv.com>

Thank you Oskar! 

That put me on the right track.
Turns out the attribute name also was case sensitive.

  <c:path>$shadow/attributes/ri:serialNumber</c:path>     (I needed a 
capital N)

------------------
Sean Penndorf
SaaS Operational Services (SOS) - ID Management
IBM Cloud
srpenn at us.ibm.com
Office: 248-552-4791   TL  623-9966





From:   Oskar Butovič - AMI Praha a.s. <oskar.butovic at ami.cz>
To:     midPoint General Discussion <midpoint at lists.evolveum.com>
Date:   01/15/2018 11:48 AM
Subject:        Re: [midPoint] Can't get a link resource to user
Sent by:        "midPoint" <midpoint-bounces at lists.evolveum.com>



Hello Sean,

your correlation should look probably like this:

<correlation>
<q:equal>
   <q:path>employeeNumber</q:path>
   <expression>
  <c:path>$shadow/attributes/ri:serialnumber</c:path>
   </expression>
</q:equal>
</correlation>

Best Regards
Oskar Butovič

2018-01-15 17:40 GMT+01:00 Sean R Penndorf <srpenn at us.ibm.com>:
Hello Community,

I have a pre-existing user in Midpoint.
When I run a reconcile against our HR database, I never get it to link up 
the resource record (shadow?) to the user.
I'm trying to match based on employeeNumber.

I gotta be missing something very simple.

Could someone review my XML and give me any pointers?  THANKS!!!!





------------------
Sean Penndorf
SaaS Operational Services (SOS) - ID Management
IBM Cloud
srpenn at us.ibm.com
Office: 248-552-4791   TL  623-9966



_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint




-- 
Oskar Butovič
solution architect

gsm: [+420] 774 480 101
e-mail: oskar.butovic at ami.cz
   
   
AMI Praha a.s.
Pláničkova 11
162 00 Praha 6
tel.: [+420] 274 783 239
web: www.ami.cz
   
   




Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za 
společnost AMI Praha a.s.
jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně 
písemnou formu.


_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.evolveum.com_mailman_listinfo_midpoint&d=DwIGaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=qEACHutvsppyidQwf1kYntDY-ZKom0n1kiWqpNpwVXg&m=pHHy0Hn4L4ctXKLUpDwYvqjfzXhbm5-1xaLDgGaw9co&s=2AJ3jezKsWfBunz1b5jo0UQoLs-1mnzTOwrUcA_OUHg&e=





-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180115/0781cba5/attachment.htm>

From caspi at caspi.cz  Tue Jan 16 11:47:01 2018
From: caspi at caspi.cz (=?UTF-8?Q?Jan_Ka=C5=A1par?=)
Date: Tue, 16 Jan 2018 11:47:01 +0100
Subject: [midPoint] Group Membership
Message-ID: <CABtVEc__K640SRZ-HiDo3n-JF0MnKzn5R17=6nkXuaNjhpWzPg@mail.gmail.com>

Hi Oskar, All,

Yes i know that, this is what i already have. Hundrets of groups were
already imported.
But now i would like to force group memberships only to some groups.

So apply tolerance only for groups I define.


S pozdravem

Jan Kašpar
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180116/d285f302/attachment.htm>

From oskar.butovic at ami.cz  Tue Jan 16 13:28:18 2018
From: oskar.butovic at ami.cz (=?UTF-8?Q?Oskar_Butovi=C4=8D_=2D_AMI_Praha_a=2Es=2E?=)
Date: Tue, 16 Jan 2018 13:28:18 +0100
Subject: [midPoint] Group Membership
In-Reply-To: <CABtVEc__K640SRZ-HiDo3n-JF0MnKzn5R17=6nkXuaNjhpWzPg@mail.gmail.com>
References: <CABtVEc__K640SRZ-HiDo3n-JF0MnKzn5R17=6nkXuaNjhpWzPg@mail.gmail.com>
Message-ID: <CAE8MtZB9-+OdzEB=PzRtK2TWyUyW=8zBPg=0+J7d8iT8BS9-pw@mail.gmail.com>

Hi Jan,

so you have all the users and groups. Do you also have assignments? That
every role is assigned to same users in Idm in the same way as in external
system?

What I suggested is to sync assignments also. And after that, the
assignment mess is same in IdM as in external system you can clear it from
Idm. By some hook or template or bulk task.

Best Regards
Oskar Butovič

2018-01-16 11:47 GMT+01:00 Jan Kašpar <caspi at caspi.cz>:

> Hi Oskar, All,
>
> Yes i know that, this is what i already have. Hundrets of groups were
> already imported.
> But now i would like to force group memberships only to some groups.
>
> So apply tolerance only for groups I define.
>
>
> S pozdravem
>
> Jan Kašpar
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>


-- 

Oskar Butovič
solution architect

gsm: [+420] 774 480 101
e-mail: oskar.butovic at ami.cz


AMI Praha a.s.
Pláničkova 11
162 00 Praha 6
tel.: [+420] 274 783 239
web: www.ami.cz


[image: AMI Praha a.s.]

[image: AMI Praha a.s.]
<http://www.ami.cz/reseni-a-sluzby/bezpecnost-dat/identity-management>

Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za
společnost AMI Praha a.s.
jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně
písemnou formu.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180116/dad1d234/attachment.htm>

From ethan at unc.edu  Tue Jan 16 15:07:50 2018
From: ethan at unc.edu (Kromhout, Ethan A.)
Date: Tue, 16 Jan 2018 14:07:50 +0000
Subject: [midPoint] Upgrades and version consistency
Message-ID: <BLUPR03MB1394E8D1DFB2D707201C2500AEEA0@BLUPR03MB1394.namprd03.prod.outlook.com>

If someone were to fail to run database upgrade scripts, but did deploy and upgrade war file in the scenario described in upgrade "Type 1" at the wiki page https://wiki.evolveum.com/display/midPoint/Upgrade+HOWTO, either through carelessness or because of a technical problem. Would the application check the database version and refuse to start, or would the error be more subtle? Is there a way to query to check that the database scripts have been run and are on the correct version?

This is just a rhetorical question to clarify what might happen in different upgrade scenarios as we'll be working with some campus's on upgrade procedures and wanted to document possible failure modes.

Thanks,

Ethan

From wojciech.staszewski at diagnostyka.pl  Tue Jan 16 15:29:12 2018
From: wojciech.staszewski at diagnostyka.pl (Wojciech Staszewski)
Date: Tue, 16 Jan 2018 15:29:12 +0100
Subject: [midPoint] Upgrades and version consistency
In-Reply-To: <BLUPR03MB1394E8D1DFB2D707201C2500AEEA0@BLUPR03MB1394.namprd03.prod.outlook.com>
References: <BLUPR03MB1394E8D1DFB2D707201C2500AEEA0@BLUPR03MB1394.namprd03.prod.outlook.com>
Message-ID: <2b80be60-2daa-164c-24b8-83e9968a9bc2@diagnostyka.pl>

Hello!

This is a great idea.
I'm using software where the update is handled beautifuly.

First, database is versioned.

Second, The SQL update script lifts up the db version after each correctly ended query.
If the update script is finished OK, the database is in version XXX.
If the update failed for some reason (eg. DB tables partitioning), I know exactly which step failed and after I fix the problem I can run whole script once again and
it starts from the failed step.

Third: DB version is checked on application startup. Application won't run if DB version is incorrect.

Simple and nerve-saving. I'd like to see something like that in MP.

Regards,
WS

W dniu 16.01.2018 o 15:07, Kromhout, Ethan A. pisze:
> If someone were to fail to run database upgrade scripts, but did deploy and upgrade war file in the scenario described in upgrade "Type 1" at the wiki page https://wiki.evolveum.com/display/midPoint/Upgrade+HOWTO, either through carelessness or because of a technical problem. Would the application check the database version and refuse to start, or would the error be more subtle? Is there a way to query to check that the database scripts have been run and are on the correct version?
> 
> This is just a rhetorical question to clarify what might happen in different upgrade scenarios as we'll be working with some campus's on upgrade procedures and wanted to document possible failure modes.
> 
> Thanks,
> 
> Ethan
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>


From ivan.noris at evolveum.com  Tue Jan 16 15:45:56 2018
From: ivan.noris at evolveum.com (Ivan Noris)
Date: Tue, 16 Jan 2018 15:45:56 +0100
Subject: [midPoint] Upgrades and version consistency
In-Reply-To: <BLUPR03MB1394E8D1DFB2D707201C2500AEEA0@BLUPR03MB1394.namprd03.prod.outlook.com>
References: <BLUPR03MB1394E8D1DFB2D707201C2500AEEA0@BLUPR03MB1394.namprd03.prod.outlook.com>
Message-ID: <028c30a4-3bdc-759e-6613-f8fd45cce3ac@evolveum.com>

Hi Ethan,

from my experience, everytime I forgot to run upgrade scripts (read:
during experimenting with midpoint; did not happen in production),
midPoint refused to start and there will be an error in idm.log /
midpoint.log. So midPoint will not start.

I think it's connected to "validate" option in config.xml:

      <hibernateHbm2ddl>validate</hibernateHbm2ddl>
(for embedded H2 repository this can be set to "update" and it will
update the db structure).

Best regards,

Ivan


On 16.01.2018 15:07, Kromhout, Ethan A. wrote:
> If someone were to fail to run database upgrade scripts, but did deploy and upgrade war file in the scenario described in upgrade "Type 1" at the wiki page https://wiki.evolveum.com/display/midPoint/Upgrade+HOWTO, either through carelessness or because of a technical problem. Would the application check the database version and refuse to start, or would the error be more subtle? Is there a way to query to check that the database scripts have been run and are on the correct version?
>
> This is just a rhetorical question to clarify what might happen in different upgrade scenarios as we'll be working with some campus's on upgrade procedures and wanted to document possible failure modes.
>
> Thanks,
>
> Ethan
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-- 
Ivan Noris
Senior Identity Engineer
evolveum.com



From ethan at unc.edu  Tue Jan 16 16:07:57 2018
From: ethan at unc.edu (Kromhout, Ethan A.)
Date: Tue, 16 Jan 2018 15:07:57 +0000
Subject: [midPoint] Upgrades and version consistency
In-Reply-To: <028c30a4-3bdc-759e-6613-f8fd45cce3ac@evolveum.com>
References: <BLUPR03MB1394E8D1DFB2D707201C2500AEEA0@BLUPR03MB1394.namprd03.prod.outlook.com>,
 <028c30a4-3bdc-759e-6613-f8fd45cce3ac@evolveum.com>
Message-ID: <BLUPR03MB139428F3B15BEAFF148677C1AEEA0@BLUPR03MB1394.namprd03.prod.outlook.com>

Thanks very much Ivan, this is exactly the information I was looking for.

Ethan
________________________________________
From: midPoint <midpoint-bounces at lists.evolveum.com> on behalf of Ivan Noris <ivan.noris at evolveum.com>
Sent: Tuesday, January 16, 2018 9:45 AM
To: midpoint at lists.evolveum.com
Subject: Re: [midPoint] Upgrades and version consistency

Hi Ethan,

from my experience, everytime I forgot to run upgrade scripts (read:
during experimenting with midpoint; did not happen in production),
midPoint refused to start and there will be an error in idm.log /
midpoint.log. So midPoint will not start.

I think it's connected to "validate" option in config.xml:

      <hibernateHbm2ddl>validate</hibernateHbm2ddl>
(for embedded H2 repository this can be set to "update" and it will
update the db structure).

Best regards,

Ivan


On 16.01.2018 15:07, Kromhout, Ethan A. wrote:
> If someone were to fail to run database upgrade scripts, but did deploy and upgrade war file in the scenario described in upgrade "Type 1" at the wiki page https://wiki.evolveum.com/display/midPoint/Upgrade+HOWTO, either through carelessness or because of a technical problem. Would the application check the database version and refuse to start, or would the error be more subtle? Is there a way to query to check that the database scripts have been run and are on the correct version?
>
> This is just a rhetorical question to clarify what might happen in different upgrade scenarios as we'll be working with some campus's on upgrade procedures and wanted to document possible failure modes.
>
> Thanks,
>
> Ethan
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

--
Ivan Noris
Senior Identity Engineer
evolveum.com

_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint


From mederly at evolveum.com  Tue Jan 16 16:23:07 2018
From: mederly at evolveum.com (Pavol Mederly)
Date: Tue, 16 Jan 2018 16:23:07 +0100
Subject: [midPoint] Upgrades and version consistency
In-Reply-To: <BLUPR03MB139428F3B15BEAFF148677C1AEEA0@BLUPR03MB1394.namprd03.prod.outlook.com>
References: <BLUPR03MB1394E8D1DFB2D707201C2500AEEA0@BLUPR03MB1394.namprd03.prod.outlook.com>
 <028c30a4-3bdc-759e-6613-f8fd45cce3ac@evolveum.com>
 <BLUPR03MB139428F3B15BEAFF148677C1AEEA0@BLUPR03MB1394.namprd03.prod.outlook.com>
Message-ID: <d6515584-0c55-2369-5780-87e52beed67e@evolveum.com>

To be honest, the error message is a bit cryptic. But, nevertheless, 
midPoint will not start.

And yes, it requires the "validate" option to be set. It is the default 
for all databases other than H2.

Pavol Mederly
Software developer
evolveum.com

On 16.01.2018 16:07, Kromhout, Ethan A. wrote:
> Thanks very much Ivan, this is exactly the information I was looking for.
>
> Ethan
> ________________________________________
> From: midPoint <midpoint-bounces at lists.evolveum.com> on behalf of Ivan Noris <ivan.noris at evolveum.com>
> Sent: Tuesday, January 16, 2018 9:45 AM
> To: midpoint at lists.evolveum.com
> Subject: Re: [midPoint] Upgrades and version consistency
>
> Hi Ethan,
>
> from my experience, everytime I forgot to run upgrade scripts (read:
> during experimenting with midpoint; did not happen in production),
> midPoint refused to start and there will be an error in idm.log /
> midpoint.log. So midPoint will not start.
>
> I think it's connected to "validate" option in config.xml:
>
>        <hibernateHbm2ddl>validate</hibernateHbm2ddl>
> (for embedded H2 repository this can be set to "update" and it will
> update the db structure).
>
> Best regards,
>
> Ivan
>
>
> On 16.01.2018 15:07, Kromhout, Ethan A. wrote:
>> If someone were to fail to run database upgrade scripts, but did deploy and upgrade war file in the scenario described in upgrade "Type 1" at the wiki page https://wiki.evolveum.com/display/midPoint/Upgrade+HOWTO, either through carelessness or because of a technical problem. Would the application check the database version and refuse to start, or would the error be more subtle? Is there a way to query to check that the database scripts have been run and are on the correct version?
>>
>> This is just a rhetorical question to clarify what might happen in different upgrade scenarios as we'll be working with some campus's on upgrade procedures and wanted to document possible failure modes.
>>
>> Thanks,
>>
>> Ethan
>> _______________________________________________
>> midPoint mailing list
>> midPoint at lists.evolveum.com
>> http://lists.evolveum.com/mailman/listinfo/midpoint
> --
> Ivan Noris
> Senior Identity Engineer
> evolveum.com
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint



From srpenn at us.ibm.com  Tue Jan 16 16:24:20 2018
From: srpenn at us.ibm.com (Sean R Penndorf)
Date: Tue, 16 Jan 2018 10:24:20 -0500
Subject: [midPoint] No definition for 'manager' in user
Message-ID: <OF40E2B943.1D3C46D6-ON85258217.00540D20-85258217.00549F0C@notes.na.collabserv.com>

Hi Community,

Clearly, I'm missing something simple here....running Midpoint 3.7
I have an extended attribute "manager", it shows up in the GUI when 
looking at User properties.
But I keep getting an error with my inbound mapping:  "No definition for 
'manager' in user."
I've tried a number of variations in the inbound mapping, but I can't get 
the field to populate.
Any assistance is greatly appreciated.


** Extended Attribute: **

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!-- This is a runtime schema that defines data types used in the
<extension> part of the objects. It is used in some built-in samples. -->
<xsd:schema elementFormDefault="qualified"
            targetNamespace="http://sos.ibm.com/xml/ns/sosSchema"
            xmlns:tns="http://sos.ibm.com/xml/ns/sosSchema"
            xmlns:a="http://prism.evolveum.com/xml/ns/public/annotation-3"
            xmlns:c="
http://midpoint.evolveum.com/xml/ns/public/common/common-3"
            xmlns:xsd="http://www.w3.org/2001/XMLSchema">

    <xsd:complexType name="UserExtensionType">
        <xsd:annotation>
            <xsd:appinfo>
                <a:extension ref="c:UserType"/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="manager" type="xsd:string" minOccurs="0" 
maxOccurs="1">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:indexed>true</a:indexed>
                        <a:displayName>manager</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
</xsd:schema>


** Inbound Mapping: **

         <attribute id="9">
            <c:ref>ri:manager</c:ref>
            <matchingRule xmlns:gen316="
http://prism.evolveum.com/xml/ns/public/matching-rule-3
">gen316:distinguishedName</matchingRule>
            <tolerant>true</tolerant>
            <exclusiveStrong>true</exclusiveStrong>
            <fetchStrategy>explicit</fetchStrategy>
            <inbound id="10">
               <authoritative>true</authoritative>
               <exclusive>true</exclusive>
               <strength>strong</strength>
               <expression>
                  <c:path xmlns:ext="http://sos.ibm.com/xml/ns/sosSchema"
                          xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"
 xsi:type="t:ItemPathType">$user/extension/ext:manager</c:path>
               </expression>
               <target>
                  <c:path xmlns:ext="http://sos.ibm.com/xml/ns/sosSchema
">ext:manager</c:path>
               </target>
            </inbound>
         </attribute>









------------------
Sean Penndorf
SaaS Operational Services (SOS) - ID Management
IBM Cloud
srpenn at us.ibm.com
Office: 248-552-4791   TL  623-9966



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180116/d495dc77/attachment.htm>

From ivan.noris at evolveum.com  Tue Jan 16 17:28:07 2018
From: ivan.noris at evolveum.com (Ivan Noris)
Date: Tue, 16 Jan 2018 17:28:07 +0100
Subject: [midPoint] No definition for 'manager' in user
In-Reply-To: <OF40E2B943.1D3C46D6-ON85258217.00540D20-85258217.00549F0C@notes.na.collabserv.com>
References: <OF40E2B943.1D3C46D6-ON85258217.00540D20-85258217.00549F0C@notes.na.collabserv.com>
Message-ID: <34cccc18-acf2-e07a-13a9-1648d8edecec@evolveum.com>

Hi Sean,

the extension looks ok.

The inbound is incorrect.

It should look similar to this:

<attribute>

  <ref>ri:cn</ref>

. . .

  <inbound>

  <expression>

  ... <!-- probably you need to do something here from the resource
attribute -->

  </expression>

    <target>$user/extension/manager</target> <!-- or
$user/extension/ext:manager if ext namespace prefix is defined -->

  </inbound>

</attribute>

This artificial example takes "cn" attribute from LDAP and copies it to
$user/extension/manager.

Best regards,

Ivan


On 16.01.2018 16:24, Sean R Penndorf wrote:
> Hi Community,
>
> Clearly, I'm missing something simple here....running Midpoint 3.7
> I have an extended attribute "manager", it shows up in the GUI when
> looking at User properties.
> But I keep getting an error with my inbound mapping:  "No definition
> for 'manager' in user."
> I've tried a number of variations in the inbound mapping, but I can't
> get the field to populate.
> Any assistance is greatly appreciated.
>
>
> ** Extended Attribute: **
>
> <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
> <!-- This is a runtime schema that defines data types used in the
> <extension> part of the objects. It is used in some built-in samples. -->
> <xsd:schema elementFormDefault="qualified"
>             targetNamespace="http://sos.ibm.com/xml/ns/sosSchema"
>             xmlns:tns="http://sos.ibm.com/xml/ns/sosSchema"
>             xmlns:a="http://prism.evolveum.com/xml/ns/public/annotation-3"
>            
> xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
>             xmlns:xsd="http://www.w3.org/2001/XMLSchema">
>
>     <xsd:complexType name="UserExtensionType">
>         <xsd:annotation>
>             <xsd:appinfo>
>                 <a:extension ref="c:UserType"/>
>             </xsd:appinfo>
>         </xsd:annotation>
>         <xsd:sequence>
>             <xsd:element name="manager" type="xsd:string"
> minOccurs="0" maxOccurs="1">
>                 <xsd:annotation>
>                     <xsd:appinfo>
>                         <a:indexed>true</a:indexed>
>                         <a:displayName>manager</a:displayName>
>                     </xsd:appinfo>
>                 </xsd:annotation>
>             </xsd:element>
>         </xsd:sequence>
>     </xsd:complexType>
> </xsd:schema>
>
>
> ** Inbound Mapping: **
>
>          <attribute id="9">
>             <c:ref>ri:manager</c:ref>
>             <matchingRule
> xmlns:gen316="http://prism.evolveum.com/xml/ns/public/matching-rule-3">gen316:distinguishedName</matchingRule>
>             <tolerant>true</tolerant>
>             <exclusiveStrong>true</exclusiveStrong>
>             <fetchStrategy>explicit</fetchStrategy>
>             <inbound id="10">
>                <authoritative>true</authoritative>
>                <exclusive>true</exclusive>
>                <strength>strong</strength>
>                <expression>
>                   <c:path xmlns:ext="http://sos.ibm.com/xml/ns/sosSchema"
>                          
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
>                          
> xsi:type="t:ItemPathType">$user/extension/ext:manager</c:path>
>                </expression>
>                <target>
>                   <c:path
> xmlns:ext="http://sos.ibm.com/xml/ns/sosSchema">ext:manager</c:path>
>                </target>
>             </inbound>
>          </attribute>
>
>
>
>
>
>
>
>
>
> ------------------
> *Sean Penndorf*
> SaaS Operational Services (SOS) - ID Management
> IBM Cloud
> srpenn at us.ibm.com
> Office: 248-552-4791   TL  623-9966
>
>
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-- 
Ivan Noris
Senior Identity Engineer
evolveum.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180116/f9702f65/attachment.htm>

From srpenn at us.ibm.com  Tue Jan 16 20:22:51 2018
From: srpenn at us.ibm.com (Sean R Penndorf)
Date: Tue, 16 Jan 2018 14:22:51 -0500
Subject: [midPoint] No definition for 'manager' in user
In-Reply-To: <34cccc18-acf2-e07a-13a9-1648d8edecec@evolveum.com>
References: <OF40E2B943.1D3C46D6-ON85258217.00540D20-85258217.00549F0C@notes.na.collabserv.com>
 <34cccc18-acf2-e07a-13a9-1648d8edecec@evolveum.com>
Message-ID: <OF54DE801B.06989668-ON85258217.006A6E92-85258217.006A778F@notes.na.collabserv.com>

Unfortunately that did not work.
Any other ideas?

------------------
Sean Penndorf
SaaS Operational Services (SOS) - ID Management
IBM Cloud
srpenn at us.ibm.com
Office: 248-552-4791   TL  623-9966





From:   Ivan Noris <ivan.noris at evolveum.com>
To:     midpoint at lists.evolveum.com
Date:   01/16/2018 11:39 AM
Subject:        Re: [midPoint] No definition for 'manager' in user
Sent by:        "midPoint" <midpoint-bounces at lists.evolveum.com>



Hi Sean,
the extension looks ok.
The inbound is incorrect.
It should look similar to this:
<attribute>
  <ref>ri:cn</ref>
. . .
  <inbound>
  <expression>
  ... <!-- probably you need to do something here from the resource 
attribute -->
  </expression>
    <target>$user/extension/manager</target> <!-- or 
$user/extension/ext:manager if ext namespace prefix is defined -->
  </inbound>
</attribute>
This artificial example takes "cn" attribute from LDAP and copies it to 
$user/extension/manager.
Best regards,
Ivan

On 16.01.2018 16:24, Sean R Penndorf wrote:
Hi Community,

Clearly, I'm missing something simple here....running Midpoint 3.7
I have an extended attribute "manager", it shows up in the GUI when 
looking at User properties.
But I keep getting an error with my inbound mapping:  "No definition for 
'manager' in user."
I've tried a number of variations in the inbound mapping, but I can't get 
the field to populate.
Any assistance is greatly appreciated.


** Extended Attribute: **

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!-- This is a runtime schema that defines data types used in the
<extension> part of the objects. It is used in some built-in samples. -->
<xsd:schema elementFormDefault="qualified"
            targetNamespace="http://sos.ibm.com/xml/ns/sosSchema"
            xmlns:tns="http://sos.ibm.com/xml/ns/sosSchema"
            xmlns:a="http://prism.evolveum.com/xml/ns/public/annotation-3"
            xmlns:c="
http://midpoint.evolveum.com/xml/ns/public/common/common-3"
            xmlns:xsd="http://www.w3.org/2001/XMLSchema">

    <xsd:complexType name="UserExtensionType">
        <xsd:annotation>
            <xsd:appinfo>
                <a:extension ref="c:UserType"/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="manager" type="xsd:string" minOccurs="0" 
maxOccurs="1">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:indexed>true</a:indexed>
                        <a:displayName>manager</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
</xsd:schema>


** Inbound Mapping: **

         <attribute id="9">
            <c:ref>ri:manager</c:ref>
            <matchingRule xmlns:gen316="
http://prism.evolveum.com/xml/ns/public/matching-rule-3
">gen316:distinguishedName</matchingRule>
            <tolerant>true</tolerant>
            <exclusiveStrong>true</exclusiveStrong>
            <fetchStrategy>explicit</fetchStrategy>
            <inbound id="10">
               <authoritative>true</authoritative>
               <exclusive>true</exclusive>
               <strength>strong</strength>
               <expression>
                  <c:path xmlns:ext="http://sos.ibm.com/xml/ns/sosSchema"
                          xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"
                          
xsi:type="t:ItemPathType">$user/extension/ext:manager</c:path>
               </expression>
               <target>
                  <c:path xmlns:ext="http://sos.ibm.com/xml/ns/sosSchema
">ext:manager</c:path>
               </target>
            </inbound>
         </attribute>









------------------
Sean Penndorf
SaaS Operational Services (SOS) - ID Management
IBM Cloud
srpenn at us.ibm.com
Office: 248-552-4791   TL  623-9966




_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint


-- 
Ivan Noris
Senior Identity Engineer
evolveum.com

_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.evolveum.com_mailman_listinfo_midpoint&d=DwIGaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=qEACHutvsppyidQwf1kYntDY-ZKom0n1kiWqpNpwVXg&m=mxBoJ1lXgvvfo5l-Tjy10yyDc2y8S5YU7eMgXL9B6BQ&s=YqKtO-IFuxFGGiIQqHy-7o7tAszxg427o-T2utRX374&e=





-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180116/aa4c8dbe/attachment.htm>

From wojciech.staszewski at diagnostyka.pl  Tue Jan 16 23:22:53 2018
From: wojciech.staszewski at diagnostyka.pl (Wojciech Staszewski)
Date: Tue, 16 Jan 2018 23:22:53 +0100
Subject: [midPoint] No definition for 'manager' in user
In-Reply-To: <OF54DE801B.06989668-ON85258217.006A6E92-85258217.006A778F@notes.na.collabserv.com>
References: <OF40E2B943.1D3C46D6-ON85258217.00540D20-85258217.00549F0C@notes.na.collabserv.com>
 <34cccc18-acf2-e07a-13a9-1648d8edecec@evolveum.com>
 <OF54DE801B.06989668-ON85258217.006A6E92-85258217.006A778F@notes.na.collabserv.com>
Message-ID: <b1e8f21c-4fc1-50b7-68bd-d769495a7846@diagnostyka.pl>

Or just "extension/manager" as below:

<attribute>
            <c:ref>ri:manager</c:ref>
            <inbound>
               <authoritative>true</authoritative>
               <exclusive>false</exclusive>
               <strength>normal</strength>
               <target>
                  <c:path>extension/manager</c:path>
               </target>
            </inbound>
</attribute>


On 16.01.2018 20:22, Sean R Penndorf wrote:
> Unfortunately that did not work.
> Any other ideas?
>
> ------------------
> *Sean Penndorf*
> SaaS Operational Services (SOS) - ID Management
> IBM Cloud
> srpenn at us.ibm.com
> Office: 248-552-4791   TL  623-9966
>
>
>
>
>
> From:        Ivan Noris <ivan.noris at evolveum.com>
> To:        midpoint at lists.evolveum.com
> Date:        01/16/2018 11:39 AM
> Subject:        Re: [midPoint] No definition for 'manager' in user
> Sent by:        "midPoint" <midpoint-bounces at lists.evolveum.com>
> ------------------------------------------------------------------------
>
>
>
> Hi Sean,
> the extension looks ok.
> The inbound is incorrect.
> It should look similar to this:
> <attribute>
>   <ref>ri:cn</ref>
> . . .
>   <inbound>
>   <expression>
>   ... <!-- probably you need to do something here from the resource
> attribute -->
>   </expression>
>     <target>$user/extension/manager</target> <!-- or
> $user/extension/ext:manager if ext namespace prefix is defined -->
>   </inbound>
> </attribute>
> This artificial example takes "cn" attribute from LDAP and copies it
> to $user/extension/manager.
> Best regards,
> Ivan
>
> On 16.01.2018 16:24, Sean R Penndorf wrote:
> Hi Community,
>
> Clearly, I'm missing something simple here....running Midpoint 3.7
> I have an extended attribute "manager", it shows up in the GUI when
> looking at User properties.
> But I keep getting an error with my inbound mapping:  "No definition
> for 'manager' in user."
> I've tried a number of variations in the inbound mapping, but I can't
> get the field to populate.
> Any assistance is greatly appreciated.
>
>
> ** Extended Attribute: **
>
> <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
> <!-- This is a runtime schema that defines data types used in the
> <extension> part of the objects. It is used in some built-in samples. -->
> <xsd:schema elementFormDefault="qualified"
>             targetNamespace="_http://sos.ibm.com/xml/ns/sosSchema_"
>             xmlns:tns="_http://sos.ibm.com/xml/ns/sosSchema_"
>            
> xmlns:a="_http://prism.evolveum.com/xml/ns/public/annotation-3_
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__prism.evolveum.com_xml_ns_public_annotation-2D3&d=DwMFaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=qEACHutvsppyidQwf1kYntDY-ZKom0n1kiWqpNpwVXg&m=mxBoJ1lXgvvfo5l-Tjy10yyDc2y8S5YU7eMgXL9B6BQ&s=bIaBYPuc1u5al6hHQ48UgGmtuDbHWpR55AlVBf3UnKI&e=>"
>            
> xmlns:c="_http://midpoint.evolveum.com/xml/ns/public/common/common-3_
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__midpoint.evolveum.com_xml_ns_public_common_common-2D3&d=DwMFaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=qEACHutvsppyidQwf1kYntDY-ZKom0n1kiWqpNpwVXg&m=mxBoJ1lXgvvfo5l-Tjy10yyDc2y8S5YU7eMgXL9B6BQ&s=Po5lsDn_3SH_tcMeFelSnvpOC6gc5ZbY7gA5NJNJDqE&e=>"
>             xmlns:xsd="_http://www.w3.org/2001/XMLSchema_
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.w3.org_2001_XMLSchema&d=DwMFaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=qEACHutvsppyidQwf1kYntDY-ZKom0n1kiWqpNpwVXg&m=mxBoJ1lXgvvfo5l-Tjy10yyDc2y8S5YU7eMgXL9B6BQ&s=Fk4p9aHHGNqfpEf8C9vsZCGXaXL9eji3vv_wx181aqc&e=>">
>
>     <xsd:complexType name="UserExtensionType">
>         <xsd:annotation>
>             <xsd:appinfo>
>                 <a:extension ref="c:UserType"/>
>             </xsd:appinfo>
>         </xsd:annotation>
>         <xsd:sequence>
>             <xsd:element name="manager" type="xsd:string"
> minOccurs="0" maxOccurs="1">
>                 <xsd:annotation>
>                     <xsd:appinfo>
>                         <a:indexed>true</a:indexed>
>                         <a:displayName>manager</a:displayName>
>                     </xsd:appinfo>
>                 </xsd:annotation>
>             </xsd:element>
>         </xsd:sequence>
>     </xsd:complexType>
> </xsd:schema>
>
>
> ** Inbound Mapping: **
>
>          <attribute id="9">
>             <c:ref>ri:manager</c:ref>
>             <matchingRule
> xmlns:gen316="_http://prism.evolveum.com/xml/ns/public/matching-rule-3_
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__prism.evolveum.com_xml_ns_public_matching-2Drule-2D3&d=DwMFaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=qEACHutvsppyidQwf1kYntDY-ZKom0n1kiWqpNpwVXg&m=mxBoJ1lXgvvfo5l-Tjy10yyDc2y8S5YU7eMgXL9B6BQ&s=kC89zKx6OSbrF6ywodIAcc_8EEUW99WsepE9P6pJEds&e=>">gen316:distinguishedName</matchingRule>
>             <tolerant>true</tolerant>
>             <exclusiveStrong>true</exclusiveStrong>
>             <fetchStrategy>explicit</fetchStrategy>
>             <inbound id="10">
>                <authoritative>true</authoritative>
>                <exclusive>true</exclusive>
>                <strength>strong</strength>
>                <expression>
>                   <c:path
> xmlns:ext="_http://sos.ibm.com/xml/ns/sosSchema_"
>                          
> xmlns:xsi="_http://www.w3.org/2001/XMLSchema-instance_
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.w3.org_2001_XMLSchema-2Dinstance&d=DwMFaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=qEACHutvsppyidQwf1kYntDY-ZKom0n1kiWqpNpwVXg&m=mxBoJ1lXgvvfo5l-Tjy10yyDc2y8S5YU7eMgXL9B6BQ&s=VixtHwcJ2vs4aZeyK3O6ns-wyNgjhwJI5z2jBRydNe8&e=>"
>                          
> xsi:type="t:ItemPathType">$user/extension/ext:manager</c:path>
>                </expression>
>                <target>
>                   <c:path
> xmlns:ext="_http://sos.ibm.com/xml/ns/sosSchema_">ext:manager</c:path>
>                </target>
>             </inbound>
>          </attribute>
>
>
>
>
>
>
>
>
>
> ------------------*
> Sean Penndorf*
> SaaS Operational Services (SOS) - ID Management
> IBM Cloud_
> __srpenn at us.ibm.com_ <mailto:srpenn at us.ibm.com>
> Office: 248-552-4791   TL  623-9966
>
>
>
>
> _______________________________________________
> midPoint mailing list
> _midPoint at lists.evolveum.com_ <mailto:midPoint at lists.evolveum.com>
> _http://lists.evolveum.com/mailman/listinfo/midpoint_
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.evolveum.com_mailman_listinfo_midpoint&d=DwMFaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=qEACHutvsppyidQwf1kYntDY-ZKom0n1kiWqpNpwVXg&m=mxBoJ1lXgvvfo5l-Tjy10yyDc2y8S5YU7eMgXL9B6BQ&s=YqKtO-IFuxFGGiIQqHy-7o7tAszxg427o-T2utRX374&e=>
>
>
> -- 
> Ivan Noris
> Senior Identity Engineer
> evolveum.com
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.evolveum.com_mailman_listinfo_midpoint&d=DwIGaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=qEACHutvsppyidQwf1kYntDY-ZKom0n1kiWqpNpwVXg&m=mxBoJ1lXgvvfo5l-Tjy10yyDc2y8S5YU7eMgXL9B6BQ&s=YqKtO-IFuxFGGiIQqHy-7o7tAszxg427o-T2utRX374&e=
>
>
>
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-- 
Wojciech Staszewski
Administrator Systemów Sieciowych
tel. kom: 663 680 236
www.diagnostyka.pl
Diagnostyka Sp. z o. o.
ul. Prof. M. Życzkowskiego 16, 31-864 Kraków
Numer KRS: 0000381559 (Sąd Rejonowy dla Krakowa-Śródmieścia w Krakowie, XI Wydział Gospodarczy KRS)
NIP: 675-12-65-009; REGON: 356366975
Kapitał zakładowy: 33 756 500 zł.

Pomyśl o środowisku zanim wydrukujesz ten e-mail.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180116/0038d6d4/attachment.htm>

From Caspi at seznam.cz  Wed Jan 17 06:06:23 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Wed, 17 Jan 2018 06:06:23 +0100 (CET)
Subject: [midPoint] Group Membership
Message-ID: <BxH.vKg.3QLldrdBwXk.1QNjdF@seznam.cz>

Hi Oskar,



I have only users and groups (roles) without members imported.




I found this http://lists.evolveum.com/pipermail/midpoint/2016-May/001884.
html




as a posible solution. But now i am stucked in user template. My extension 
is filled by DN

and i shoudl parse it and get CN from that. I am trying to use regex, but 
still not working.

In other languages no problem to parse this, but in groovy still no luck.




Do you have this template done? Can you share this? 




Jan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180117/4439ec41/attachment.htm>

From caspi at caspi.cz  Tue Jan 16 20:28:58 2018
From: caspi at caspi.cz (=?UTF-8?Q?Jan_Ka=C5=A1par?=)
Date: Tue, 16 Jan 2018 20:28:58 +0100
Subject: [midPoint] Group Membership
Message-ID: <CABtVEc81G3BqF7jQ+aORYeVypp=RaLpN5ydcJS+PgYfJ4paNog@mail.gmail.com>

Hi Oskar,

I have only users and groups without membership. I didnt found sway how to
import groups includint membership. If you have some config please share
this. In documentation there are no examples.

S pozdravem

Jan Kašpar
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180116/4bffa89e/attachment.htm>

From ivan.noris at evolveum.com  Wed Jan 17 09:54:28 2018
From: ivan.noris at evolveum.com (Ivan Noris)
Date: Wed, 17 Jan 2018 09:54:28 +0100
Subject: [midPoint] No definition for 'manager' in user
In-Reply-To: <OF54DE801B.06989668-ON85258217.006A6E92-85258217.006A778F@notes.na.collabserv.com>
References: <OF40E2B943.1D3C46D6-ON85258217.00540D20-85258217.00549F0C@notes.na.collabserv.com>
 <34cccc18-acf2-e07a-13a9-1648d8edecec@evolveum.com>
 <OF54DE801B.06989668-ON85258217.006A6E92-85258217.006A778F@notes.na.collabserv.com>
Message-ID: <a6d570ca-1f30-cc16-0f7f-f804c6cdf065@evolveum.com>

Hi,


what was your error message in this case after my proposed change..?

Ivan


On 16.01.2018 20:22, Sean R Penndorf wrote:
> Unfortunately that did not work.
> Any other ideas?
>
> ------------------
> *Sean Penndorf*
> SaaS Operational Services (SOS) - ID Management
> IBM Cloud
> srpenn at us.ibm.com
> Office: 248-552-4791   TL  623-9966
>
>
>
>
>
> From:        Ivan Noris <ivan.noris at evolveum.com>
> To:        midpoint at lists.evolveum.com
> Date:        01/16/2018 11:39 AM
> Subject:        Re: [midPoint] No definition for 'manager' in user
> Sent by:        "midPoint" <midpoint-bounces at lists.evolveum.com>
> ------------------------------------------------------------------------
>
>
>
> Hi Sean,
> the extension looks ok.
> The inbound is incorrect.
> It should look similar to this:
> <attribute>
>   <ref>ri:cn</ref>
> . . .
>   <inbound>
>   <expression>
>   ... <!-- probably you need to do something here from the resource
> attribute -->
>   </expression>
>     <target>$user/extension/manager</target> <!-- or
> $user/extension/ext:manager if ext namespace prefix is defined -->
>   </inbound>
> </attribute>
> This artificial example takes "cn" attribute from LDAP and copies it
> to $user/extension/manager.
> Best regards,
> Ivan
>
> On 16.01.2018 16:24, Sean R Penndorf wrote:
> Hi Community,
>
> Clearly, I'm missing something simple here....running Midpoint 3.7
> I have an extended attribute "manager", it shows up in the GUI when
> looking at User properties.
> But I keep getting an error with my inbound mapping:  "No definition
> for 'manager' in user."
> I've tried a number of variations in the inbound mapping, but I can't
> get the field to populate.
> Any assistance is greatly appreciated.
>
>
> ** Extended Attribute: **
>
> <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
> <!-- This is a runtime schema that defines data types used in the
> <extension> part of the objects. It is used in some built-in samples. -->
> <xsd:schema elementFormDefault="qualified"
>             targetNamespace="_http://sos.ibm.com/xml/ns/sosSchema_"
>             xmlns:tns="_http://sos.ibm.com/xml/ns/sosSchema_"
>            
> xmlns:a="_http://prism.evolveum.com/xml/ns/public/annotation-3_
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__prism.evolveum.com_xml_ns_public_annotation-2D3&d=DwMFaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=qEACHutvsppyidQwf1kYntDY-ZKom0n1kiWqpNpwVXg&m=mxBoJ1lXgvvfo5l-Tjy10yyDc2y8S5YU7eMgXL9B6BQ&s=bIaBYPuc1u5al6hHQ48UgGmtuDbHWpR55AlVBf3UnKI&e=>"
>            
> xmlns:c="_http://midpoint.evolveum.com/xml/ns/public/common/common-3_
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__midpoint.evolveum.com_xml_ns_public_common_common-2D3&d=DwMFaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=qEACHutvsppyidQwf1kYntDY-ZKom0n1kiWqpNpwVXg&m=mxBoJ1lXgvvfo5l-Tjy10yyDc2y8S5YU7eMgXL9B6BQ&s=Po5lsDn_3SH_tcMeFelSnvpOC6gc5ZbY7gA5NJNJDqE&e=>"
>             xmlns:xsd="_http://www.w3.org/2001/XMLSchema_
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.w3.org_2001_XMLSchema&d=DwMFaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=qEACHutvsppyidQwf1kYntDY-ZKom0n1kiWqpNpwVXg&m=mxBoJ1lXgvvfo5l-Tjy10yyDc2y8S5YU7eMgXL9B6BQ&s=Fk4p9aHHGNqfpEf8C9vsZCGXaXL9eji3vv_wx181aqc&e=>">
>
>     <xsd:complexType name="UserExtensionType">
>         <xsd:annotation>
>             <xsd:appinfo>
>                 <a:extension ref="c:UserType"/>
>             </xsd:appinfo>
>         </xsd:annotation>
>         <xsd:sequence>
>             <xsd:element name="manager" type="xsd:string"
> minOccurs="0" maxOccurs="1">
>                 <xsd:annotation>
>                     <xsd:appinfo>
>                         <a:indexed>true</a:indexed>
>                         <a:displayName>manager</a:displayName>
>                     </xsd:appinfo>
>                 </xsd:annotation>
>             </xsd:element>
>         </xsd:sequence>
>     </xsd:complexType>
> </xsd:schema>
>
>
> ** Inbound Mapping: **
>
>          <attribute id="9">
>             <c:ref>ri:manager</c:ref>
>             <matchingRule
> xmlns:gen316="_http://prism.evolveum.com/xml/ns/public/matching-rule-3_
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__prism.evolveum.com_xml_ns_public_matching-2Drule-2D3&d=DwMFaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=qEACHutvsppyidQwf1kYntDY-ZKom0n1kiWqpNpwVXg&m=mxBoJ1lXgvvfo5l-Tjy10yyDc2y8S5YU7eMgXL9B6BQ&s=kC89zKx6OSbrF6ywodIAcc_8EEUW99WsepE9P6pJEds&e=>">gen316:distinguishedName</matchingRule>
>             <tolerant>true</tolerant>
>             <exclusiveStrong>true</exclusiveStrong>
>             <fetchStrategy>explicit</fetchStrategy>
>             <inbound id="10">
>                <authoritative>true</authoritative>
>                <exclusive>true</exclusive>
>                <strength>strong</strength>
>                <expression>
>                   <c:path
> xmlns:ext="_http://sos.ibm.com/xml/ns/sosSchema_"
>                          
> xmlns:xsi="_http://www.w3.org/2001/XMLSchema-instance_
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.w3.org_2001_XMLSchema-2Dinstance&d=DwMFaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=qEACHutvsppyidQwf1kYntDY-ZKom0n1kiWqpNpwVXg&m=mxBoJ1lXgvvfo5l-Tjy10yyDc2y8S5YU7eMgXL9B6BQ&s=VixtHwcJ2vs4aZeyK3O6ns-wyNgjhwJI5z2jBRydNe8&e=>"
>                          
> xsi:type="t:ItemPathType">$user/extension/ext:manager</c:path>
>                </expression>
>                <target>
>                   <c:path
> xmlns:ext="_http://sos.ibm.com/xml/ns/sosSchema_">ext:manager</c:path>
>                </target>
>             </inbound>
>          </attribute>
>
>
>
>
>
>
>
>
>
> ------------------*
> Sean Penndorf*
> SaaS Operational Services (SOS) - ID Management
> IBM Cloud_
> __srpenn at us.ibm.com_ <mailto:srpenn at us.ibm.com>
> Office: 248-552-4791   TL  623-9966
>
>
>
>
> _______________________________________________
> midPoint mailing list
> _midPoint at lists.evolveum.com_ <mailto:midPoint at lists.evolveum.com>
> _http://lists.evolveum.com/mailman/listinfo/midpoint_
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.evolveum.com_mailman_listinfo_midpoint&d=DwMFaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=qEACHutvsppyidQwf1kYntDY-ZKom0n1kiWqpNpwVXg&m=mxBoJ1lXgvvfo5l-Tjy10yyDc2y8S5YU7eMgXL9B6BQ&s=YqKtO-IFuxFGGiIQqHy-7o7tAszxg427o-T2utRX374&e=>
>
>
> -- 
> Ivan Noris
> Senior Identity Engineer
> evolveum.com
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.evolveum.com_mailman_listinfo_midpoint&d=DwIGaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=qEACHutvsppyidQwf1kYntDY-ZKom0n1kiWqpNpwVXg&m=mxBoJ1lXgvvfo5l-Tjy10yyDc2y8S5YU7eMgXL9B6BQ&s=YqKtO-IFuxFGGiIQqHy-7o7tAszxg427o-T2utRX374&e=
>
>
>
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-- 
Ivan Noris
Senior Identity Engineer
evolveum.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180117/36cc4f05/attachment.htm>

From radovan.semancik at evolveum.com  Wed Jan 17 10:04:04 2018
From: radovan.semancik at evolveum.com (Radovan Semancik)
Date: Wed, 17 Jan 2018 10:04:04 +0100
Subject: [midPoint] Upgrades and version consistency
In-Reply-To: <BLUPR03MB1394E8D1DFB2D707201C2500AEEA0@BLUPR03MB1394.namprd03.prod.outlook.com>
References: <BLUPR03MB1394E8D1DFB2D707201C2500AEEA0@BLUPR03MB1394.namprd03.prod.outlook.com>
Message-ID: <43e75a06-8e44-3eb3-4010-c9092f79209e@evolveum.com>

Hi,

There will be an error on startup if the database model is not 
compatible (e.g. there are missing columns). However, I would say that 
midPoint will continue to operate if the database model is compatible, 
e.g. tables were extended with additional (non-mandatory) columns.

-- 
Radovan Semancik
Software Architect
evolveum.com




On 01/16/2018 03:07 PM, Kromhout, Ethan A. wrote:
> If someone were to fail to run database upgrade scripts, but did deploy and upgrade war file in the scenario described in upgrade "Type 1" at the wiki page https://wiki.evolveum.com/display/midPoint/Upgrade+HOWTO, either through carelessness or because of a technical problem. Would the application check the database version and refuse to start, or would the error be more subtle? Is there a way to query to check that the database scripts have been run and are on the correct version?
>
> This is just a rhetorical question to clarify what might happen in different upgrade scenarios as we'll be working with some campus's on upgrade procedures and wanted to document possible failure modes.
>
> Thanks,
>
> Ethan
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint




From radovan.semancik at evolveum.com  Wed Jan 17 10:06:20 2018
From: radovan.semancik at evolveum.com (Radovan Semancik)
Date: Wed, 17 Jan 2018 10:06:20 +0100
Subject: [midPoint] Upgrades and version consistency
In-Reply-To: <2b80be60-2daa-164c-24b8-83e9968a9bc2@diagnostyka.pl>
References: <BLUPR03MB1394E8D1DFB2D707201C2500AEEA0@BLUPR03MB1394.namprd03.prod.outlook.com>
 <2b80be60-2daa-164c-24b8-83e9968a9bc2@diagnostyka.pl>
Message-ID: <ccb44cc6-bb6d-a5d7-86bb-cc1d74c4ce3d@evolveum.com>

Hello,

Indeed, that would be a nice feature. Anybody willing to use his/her 
platform subscription to endorse this feature?

-- 
Radovan Semancik
Software Architect
evolveum.com



On 01/16/2018 03:29 PM, Wojciech Staszewski wrote:
> Hello!
>
> This is a great idea.
> I'm using software where the update is handled beautifuly.
>
> First, database is versioned.
>
> Second, The SQL update script lifts up the db version after each correctly ended query.
> If the update script is finished OK, the database is in version XXX.
> If the update failed for some reason (eg. DB tables partitioning), I know exactly which step failed and after I fix the problem I can run whole script once again and
> it starts from the failed step.
>
> Third: DB version is checked on application startup. Application won't run if DB version is incorrect.
>
> Simple and nerve-saving. I'd like to see something like that in MP.
>
> Regards,
> WS
>
> W dniu 16.01.2018 o 15:07, Kromhout, Ethan A. pisze:
>> If someone were to fail to run database upgrade scripts, but did deploy and upgrade war file in the scenario described in upgrade "Type 1" at the wiki page https://wiki.evolveum.com/display/midPoint/Upgrade+HOWTO, either through carelessness or because of a technical problem. Would the application check the database version and refuse to start, or would the error be more subtle? Is there a way to query to check that the database scripts have been run and are on the correct version?
>>
>> This is just a rhetorical question to clarify what might happen in different upgrade scenarios as we'll be working with some campus's on upgrade procedures and wanted to document possible failure modes.
>>
>> Thanks,
>>
>> Ethan
>> _______________________________________________
>> midPoint mailing list
>> midPoint at lists.evolveum.com
>> http://lists.evolveum.com/mailman/listinfo/midpoint
>>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint




From petr.kulheim at ibacz.eu  Wed Jan 17 12:34:48 2018
From: petr.kulheim at ibacz.eu (petr.kulheim at ibacz.eu)
Date: Wed, 17 Jan 2018 12:34:48 +0100
Subject: [midPoint] Fw: Null parent for value PCV(1) Exception during
 reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1
Message-ID: <OFAACD6EB0.6563B937-ONC1258218.003F879F-C1258218.003F9C9B@ibacz.eu>

hi guys, 

we have customer's test environment where we have upgraded midpoint from 
3.5.1 to 3.6.1
After this upgrade we have some users, about 30, having following 
Exception during reconsiliation:

2018-01-15 17:33:30,325 [] [Thread-77] ERROR 
(com.evolveum.midpoint.web.component.progress.ProgressReporter): Error 
executing changes.
java.lang.IllegalStateException: Null parent for value PCV(1):[PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
in item PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}assignment):[PCV(1):[PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
(assignment in user:09cff951-c031-4033-95a9-de85812ccc46(testovic)); in 
current user in 
LensFocusContext(UserType:09cff951-c031-4033-95a9-de85812ccc46)
        at 
com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:495) 
~[model-impl-3.6.1.jar:na]
        at 
com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:461) 
~[model-impl-3.6.1.jar:na]
        at 
com.evolveum.midpoint.model.impl.lens.LensFocusContext.checkConsistence(LensFocusContext.java:459) 
~[model-impl-3.6.1.jar:na]
        at 
com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:453) 
~[model-impl-3.6.1.jar:na]
        at 
com.evolveum.midpoint.model.impl.lens.LensContext.checkConsistence(LensContext.java:678) 
~[model-impl-3.6.1.jar:na]
        at 
com.evolveum.midpoint.model.impl.lens.projector.FocusProcessor.processFocusFocus(FocusProcessor.java:398) 
~[model-impl-3.6.1.jar:na]
        at 
com.evolveum.midpoint.model.impl.lens.projector.FocusProcessor.processFocus(FocusProcessor.java:173) 
~[model-impl-3.6.1.jar:na]
        at 
com.evolveum.midpoint.model.impl.lens.projector.Projector.lambda$projectInternal$1(Projector.java:227) 
~[model-impl-3.6.1.jar:na]
        at 
com.evolveum.midpoint.model.impl.lens.LensUtil.partialExecute(LensUtil.java:1254) 
~[model-impl-3.6.1.jar:na]
        at 
com.evolveum.midpoint.model.impl.lens.projector.Projector.projectInternal(Projector.java:225) 
~[model-impl-3.6.1.jar:na]
        at 
com.evolveum.midpoint.model.impl.lens.projector.Projector.project(Projector.java:114) 
~[model-impl-3.6.1.jar:na]
        at 
com.evolveum.midpoint.model.impl.lens.Clockwork.click(Clockwork.java:440) 
~[model-impl-3.6.1.jar:na]
        at 
com.evolveum.midpoint.model.impl.lens.Clockwork.run(Clockwork.java:197) 
~[model-impl-3.6.1.jar:na]
        at 
com.evolveum.midpoint.model.impl.controller.ModelController.executeChanges(ModelController.java:572) 
~[model-impl-3.6.1.jar:na]
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
~[na:1.8.0_111]
        at 
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) 
~[na:1.8.0_111]
        at 
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) 
~[na:1.8.0_111]
        at java.lang.reflect.Method.invoke(Method.java:498) 
~[na:1.8.0_111]
        at 
org.apache.wicket.proxy.LazyInitProxyFactory$JdkHandler.invoke(LazyInitProxyFactory.java:507) 
~[wicket-ioc-7.6.0.jar:7.6.0]
        at com.sun.proxy.$Proxy164.executeChanges(Unknown Source) ~[na:na]
        at 
com.evolveum.midpoint.web.component.progress.ProgressReporter.lambda$executeChangesAsync$0(ProgressReporter.java:187) 
~[classes/:na]
        at java.lang.Thread.run(Thread.java:745) ~[na:1.8.0_111]
Caused by: java.lang.IllegalStateException: Null parent for value 
PCV(1):[PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
in item PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}assignment):[PCV(1):[PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
(assignment in user:09cff951-c031-4033-95a9-de85812ccc46(testovic))
        at 
com.evolveum.midpoint.prism.Item.checkConsistenceInternal(Item.java:748) 
~[prism-3.6.1.jar:na]
        at 
com.evolveum.midpoint.prism.PrismContainer.checkConsistenceInternal(PrismContainer.java:688) 
~[prism-3.6.1.jar:na]
        at 
com.evolveum.midpoint.prism.PrismContainerValue.checkConsistenceInternal(PrismContainerValue.java:1271) 
~[prism-3.6.1.jar:na]
        at 
com.evolveum.midpoint.prism.Item.checkConsistenceInternal(Item.java:754) 
~[prism-3.6.1.jar:na]
        at 
com.evolveum.midpoint.prism.PrismContainer.checkConsistenceInternal(PrismContainer.java:688) 
~[prism-3.6.1.jar:na]
        at 
com.evolveum.midpoint.prism.PrismObject.checkConsistenceInternal(PrismObject.java:409) 
~[prism-3.6.1.jar:na]
        at 
com.evolveum.midpoint.prism.Item.checkConsistence(Item.java:709) 
~[prism-3.6.1.jar:na]
        at 
com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:491) 
~[model-impl-3.6.1.jar:na]
        ... 21 common frames omitted


I have found it comes from 
com.evolveum.midpoint.prism.Item radek 748, 

                        if (val.getParent() == null) {
                                throw new IllegalStateException("Null 
parent for value "+val+" in item "+this+" ("+path+" in "+rootItem+")");
                        }


So far we haven't found any suspicious Users/Accounts metadata.
Likely it is related to AD resource.
Any hint or advice would be appreciated.

Thx

Petr Kulheim
JEE Developer

IBA CZ, s.r.o.
Office: Petržílkova 2565/23, 158 00 Praha, CZ
Phone: +420 603 272826
E-mail: petr.kulheim at ibacz.eu



Disclaimer:

The information contained in this communication is intended solely for the 
use of the individual or entity to whom it is addressed and others 
authorized to receive it.
It may contain confidential or legally privileged information.
If you are not the intended recipient you are hereby notified that any 
disclosure, copying, distribution or taking any action in reliance on the 
contents of this information is strictly prohibited and may be unlawful.
If you have received this communication in error, please notify us 
immediately by forwarding this email to ict at ibacz.eu and then delete it 
from your system.
IBA Group is neither liable for the proper and complete transmission of 
the information contained in this communication nor for any delay in its 
receipt.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180117/77e3fbac/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 48578 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180117/77e3fbac/attachment.png>

From mederly at evolveum.com  Wed Jan 17 16:01:05 2018
From: mederly at evolveum.com (Pavol Mederly)
Date: Wed, 17 Jan 2018 16:01:05 +0100
Subject: [midPoint] Fw: Null parent for value PCV(1) Exception during
 reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1
In-Reply-To: <OFAACD6EB0.6563B937-ONC1258218.003F879F-C1258218.003F9C9B@ibacz.eu>
References: <OFAACD6EB0.6563B937-ONC1258218.003F879F-C1258218.003F9C9B@ibacz.eu>
Message-ID: <248efbb6-ffb6-dd87-5bb0-d2cccdf0d56f@evolveum.com>

Hello Petr,

just to make sure: You wrote that the exception occurs during 
reconciliation. I assume you mean reconciliation task.

But the stack trace corresponds to a GUI operation.

So, what's the case? Does it occur within a task or in GUI? If in GUI, 
is it replicable?

Pavol Mederly
Software developer
evolveum.com

On 17.01.2018 12:34, petr.kulheim at ibacz.eu wrote:
> hi guys,
>
> we have customer's test environment where we have upgraded midpoint 
> from 3.5.1 to 3.6.1
> After this upgrade we have some users, about 30, having following 
> Exception during reconsiliation:
>
> 2018-01-15 17:33:30,325 [] [Thread-77] ERROR 
> (com.evolveum.midpoint.web.component.progress.ProgressReporter): Error 
> executing changes.
> java.lang.IllegalStateException: Null parent for value 
> PCV(1):[PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
> in item 
> PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3}assignment):[PCV(1):[PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
> (assignment in user:09cff951-c031-4033-95a9-de85812ccc46(testovic)); 
> in current user in 
> LensFocusContext(UserType:09cff951-c031-4033-95a9-de85812ccc46)
>         at 
> com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:495) 
> ~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:461) 
> ~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensFocusContext.checkConsistence(LensFocusContext.java:459) 
> ~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:453) 
> ~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensContext.checkConsistence(LensContext.java:678) 
> ~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.projector.FocusProcessor.processFocusFocus(FocusProcessor.java:398) 
> ~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.projector.FocusProcessor.processFocus(FocusProcessor.java:173) 
> ~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.projector.Projector.lambda$projectInternal$1(Projector.java:227) 
> ~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensUtil.partialExecute(LensUtil.java:1254) 
> ~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.projector.Projector.projectInternal(Projector.java:225) 
> ~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.projector.Projector.project(Projector.java:114) 
> ~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.Clockwork.click(Clockwork.java:440) 
> ~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.Clockwork.run(Clockwork.java:197) 
> ~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.controller.ModelController.executeChanges(ModelController.java:572) 
> ~[model-impl-3.6.1.jar:na]
>         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
> ~[na:1.8.0_111]
>         at 
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) 
> ~[na:1.8.0_111]
>         at 
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) 
> ~[na:1.8.0_111]
>         at java.lang.reflect.Method.invoke(Method.java:498) 
> ~[na:1.8.0_111]
>         at 
> org.apache.wicket.proxy.LazyInitProxyFactory$JdkHandler.invoke(LazyInitProxyFactory.java:507) 
> ~[wicket-ioc-7.6.0.jar:7.6.0]
>         at com.sun.proxy.$Proxy164.executeChanges(Unknown Source) 
> ~[na:na]
>         at 
> com.evolveum.midpoint.web.component.progress.ProgressReporter.lambda$executeChangesAsync$0(ProgressReporter.java:187) 
> ~[classes/:na]
>         at java.lang.Thread.run(Thread.java:745) ~[na:1.8.0_111]
> Caused by: java.lang.IllegalStateException: Null parent for value 
> PCV(1):[PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
> in item 
> PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3}assignment):[PCV(1):[PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
> (assignment in user:09cff951-c031-4033-95a9-de85812ccc46(testovic))
>         at 
> com.evolveum.midpoint.prism.Item.checkConsistenceInternal(Item.java:748) 
> ~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.PrismContainer.checkConsistenceInternal(PrismContainer.java:688) 
> ~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.PrismContainerValue.checkConsistenceInternal(PrismContainerValue.java:1271) 
> ~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.Item.checkConsistenceInternal(Item.java:754) 
> ~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.PrismContainer.checkConsistenceInternal(PrismContainer.java:688) 
> ~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.PrismObject.checkConsistenceInternal(PrismObject.java:409) 
> ~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.Item.checkConsistence(Item.java:709) 
> ~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:491) 
> ~[model-impl-3.6.1.jar:na]
>         ... 21 common frames omitted
>
>
> I have found it comes from
> com.evolveum.midpoint.prism.Item radek 748,
>
>               if (val.getParent() == null) {
>       throw new IllegalStateException("Null parent for value "+val+" 
> in item "+this+" ("+path+" in "+rootItem+")");
>               }
>
>
> So far we haven't found any suspicious Users/Accounts metadata.
> Likely it is related to AD resource.
> Any hint or advice would be appreciated.
>
> Thx
>
> Petr Kulheim
> JEE Developer
>
> IBA CZ, s.r.o.
> Office: Petržílkova 2565/23, 158 00 Praha, CZ
> Phone: +420 603 272826
> E-mail: petr.kulheim at ibacz.eu
>
> IBACZ email signature <http://www.ibacz.eu/email-signature/index.html>
>
>
> ------------------------------------------------------------------------
> Disclaimer:
>
> The information contained in this communication is intended solely for 
> the use of the individual or entity to whom it is addressed and others 
> authorized to receive it.
> It may contain confidential or legally privileged information.
> If you are not the intended recipient you are hereby notified that any 
> disclosure, copying, distribution or taking any action in reliance on 
> the contents of this information is strictly prohibited and may be 
> unlawful.
> If you have received this communication in error, please notify us 
> immediately by forwarding this email to ict at ibacz.eu and then delete 
> it from your system.
> IBA Group is neither liable for the proper and complete transmission 
> of the information contained in this communication nor for any delay 
> in its receipt.
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180117/08ada077/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jbmkejinghegchdf.png
Type: image/png
Size: 48578 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180117/08ada077/attachment.png>

From petr.kulheim at ibacz.eu  Wed Jan 17 17:10:37 2018
From: petr.kulheim at ibacz.eu (petr.kulheim at ibacz.eu)
Date: Wed, 17 Jan 2018 17:10:37 +0100
Subject: [midPoint] Fw: Null parent for value PCV(1) Exception during
 reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1
In-Reply-To: <248efbb6-ffb6-dd87-5bb0-d2cccdf0d56f@evolveum.com>
References: <OFAACD6EB0.6563B937-ONC1258218.003F879F-C1258218.003F9C9B@ibacz.eu>
 <248efbb6-ffb6-dd87-5bb0-d2cccdf0d56f@evolveum.com>
Message-ID: <OFA87C0D87.0CB4F554-ONC1258218.00563B9D-C1258218.0058DCE4@ibacz.eu>

Hi Pavol,
provided exception bellow is from GUI action SAVE, with reconsiliation 
checkbox checked, no changed done. It is replicable.

If we run recosiliation task, there are about  30 errors in 
      <partialResults>
 
<operation>com.evolveum.midpoint.common.operation.reconciliation.errors</operation>
         <status>not_applicable</status>
         <token>1000000000000030110</token>
         <message>Last 30 failures:
      <partialResults>
 
<operation>com.evolveum.midpoint.common.operation.reconciliation.errors</operation>
         <status>not_applicable</status>
         <token>1000000000000030110</token>
         <message>Last 30 failures:
CN=Jan novak,OU=BRC,DC=wintest,DC=bbb,DC=sk: 
java.lang.IllegalStateException: Null parent for value PCV(1):[PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
in item PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}assignment):[PCV(1):[PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]], 
PCV(2):[PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import
)]]], PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}construction):[PCV(null):[PrismReference({.../common/common-3}resourceRef):[PRV(oid=feed0000-0000-0000-0000-000000000001, 
targetType={.../common/common-3}ResourceType, 
relation={.../common/org-3}default)]]], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
(assignment in user:f259bab2-48eb-4e0f-b426-6b58445fdbae(jnovak)); in 
current user in 
LensFocusContext(UserType:f259bab2-48eb-4e0f-b426-6b58445fdbae)
.....


Looks like the same error as from GUI action, but no stack trace.
thx a lot

Petr






From:   Pavol Mederly <mederly at evolveum.com>
To:     midpoint at lists.evolveum.com
Date:   17/01/2018 16:05
Subject:        Re: [midPoint] Fw: Null parent for value PCV(1) Exception 
during reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1
Sent by:        "midPoint" <midpoint-bounces at lists.evolveum.com>



Hello Petr,
just to make sure: You wrote that the exception occurs during 
reconciliation. I assume you mean reconciliation task.
But the stack trace corresponds to a GUI operation.
So, what's the case? Does it occur within a task or in GUI? If in GUI, is 
it replicable?
Pavol Mederly
Software developer
evolveum.com

On 17.01.2018 12:34, petr.kulheim at ibacz.eu wrote:
hi guys, 

we have customer's test environment where we have upgraded midpoint from 
3.5.1 to 3.6.1 
After this upgrade we have some users, about 30, having following 
Exception during reconsiliation: 

2018-01-15 17:33:30,325 [] [Thread-77] ERROR 
(com.evolveum.midpoint.web.component.progress.ProgressReporter): Error 
executing changes. 
java.lang.IllegalStateException: Null parent for value PCV(1):[PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
in item PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}assignment):[PCV(1):[PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
(assignment in user:09cff951-c031-4033-95a9-de85812ccc46(testovic)); in 
current user in 
LensFocusContext(UserType:09cff951-c031-4033-95a9-de85812ccc46) 
        at 
com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:495) 
~[model-impl-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:461) 
~[model-impl-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.model.impl.lens.LensFocusContext.checkConsistence(LensFocusContext.java:459) 
~[model-impl-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:453) 
~[model-impl-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.model.impl.lens.LensContext.checkConsistence(LensContext.java:678) 
~[model-impl-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.model.impl.lens.projector.FocusProcessor.processFocusFocus(FocusProcessor.java:398) 
~[model-impl-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.model.impl.lens.projector.FocusProcessor.processFocus(FocusProcessor.java:173) 
~[model-impl-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.model.impl.lens.projector.Projector.lambda$projectInternal$1(Projector.java:227) 
~[model-impl-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.model.impl.lens.LensUtil.partialExecute(LensUtil.java:1254) 
~[model-impl-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.model.impl.lens.projector.Projector.projectInternal(Projector.java:225) 
~[model-impl-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.model.impl.lens.projector.Projector.project(Projector.java:114) 
~[model-impl-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.model.impl.lens.Clockwork.click(Clockwork.java:440) 
~[model-impl-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.model.impl.lens.Clockwork.run(Clockwork.java:197) 
~[model-impl-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.model.impl.controller.ModelController.executeChanges(ModelController.java:572) 
~[model-impl-3.6.1.jar:na] 
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
~[na:1.8.0_111] 
        at 
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) 
~[na:1.8.0_111] 
        at 
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) 
~[na:1.8.0_111] 
        at java.lang.reflect.Method.invoke(Method.java:498) 
~[na:1.8.0_111] 
        at 
org.apache.wicket.proxy.LazyInitProxyFactory$JdkHandler.invoke(LazyInitProxyFactory.java:507) 
~[wicket-ioc-7.6.0.jar:7.6.0] 
        at com.sun.proxy.$Proxy164.executeChanges(Unknown Source) ~[na:na] 

        at 
com.evolveum.midpoint.web.component.progress.ProgressReporter.lambda$executeChangesAsync$0(ProgressReporter.java:187) 
~[classes/:na] 
        at java.lang.Thread.run(Thread.java:745) ~[na:1.8.0_111] 
Caused by: java.lang.IllegalStateException: Null parent for value 
PCV(1):[PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
in item PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}assignment):[PCV(1):[PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
(assignment in user:09cff951-c031-4033-95a9-de85812ccc46(testovic)) 
        at 
com.evolveum.midpoint.prism.Item.checkConsistenceInternal(Item.java:748) 
~[prism-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.prism.PrismContainer.checkConsistenceInternal(PrismContainer.java:688) 
~[prism-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.prism.PrismContainerValue.checkConsistenceInternal(PrismContainerValue.java:1271) 
~[prism-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.prism.Item.checkConsistenceInternal(Item.java:754) 
~[prism-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.prism.PrismContainer.checkConsistenceInternal(PrismContainer.java:688) 
~[prism-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.prism.PrismObject.checkConsistenceInternal(PrismObject.java:409) 
~[prism-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.prism.Item.checkConsistence(Item.java:709) 
~[prism-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:491) 
~[model-impl-3.6.1.jar:na] 
        ... 21 common frames omitted 


I have found it comes from 
com.evolveum.midpoint.prism.Item radek 748, 

                        if (val.getParent() == null) { 
                                throw new IllegalStateException("Null 
parent for value "+val+" in item "+this+" ("+path+" in "+rootItem+")"); 
                        } 


So far we haven't found any suspicious Users/Accounts metadata. 
Likely it is related to AD resource. 
Any hint or advice would be appreciated. 

Thx 

Petr Kulheim
JEE Developer

IBA CZ, s.r.o.
Office: Petržílkova 2565/23, 158 00 Praha, CZ
Phone: +420 603 272826
E-mail: petr.kulheim at ibacz.eu 



Disclaimer:

The information contained in this communication is intended solely for the 
use of the individual or entity to whom it is addressed and others 
authorized to receive it.
It may contain confidential or legally privileged information.
If you are not the intended recipient you are hereby notified that any 
disclosure, copying, distribution or taking any action in reliance on the 
contents of this information is strictly prohibited and may be unlawful.
If you have received this communication in error, please notify us 
immediately by forwarding this email to ict at ibacz.eu and then delete it 
from your system.
IBA Group is neither liable for the proper and complete transmission of 
the information contained in this communication nor for any delay in its 
receipt. 


_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint

_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint



Disclaimer:

The information contained in this communication is intended solely for the 
use of the individual or entity to whom it is addressed and others 
authorized to receive it.
It may contain confidential or legally privileged information.
If you are not the intended recipient you are hereby notified that any 
disclosure, copying, distribution or taking any action in reliance on the 
contents of this information is strictly prohibited and may be unlawful.
If you have received this communication in error, please notify us 
immediately by forwarding this email to ict at ibacz.eu and then delete it 
from your system.
IBA Group is neither liable for the proper and complete transmission of 
the information contained in this communication nor for any delay in its 
receipt.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180117/98e3b5c0/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 48578 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180117/98e3b5c0/attachment.png>

From mederly at evolveum.com  Wed Jan 17 17:23:17 2018
From: mederly at evolveum.com (Pavol Mederly)
Date: Wed, 17 Jan 2018 17:23:17 +0100
Subject: [midPoint] Fw: Null parent for value PCV(1) Exception during
 reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1
In-Reply-To: <OFA87C0D87.0CB4F554-ONC1258218.00563B9D-C1258218.0058DCE4@ibacz.eu>
References: <OFAACD6EB0.6563B937-ONC1258218.003F879F-C1258218.003F9C9B@ibacz.eu>
 <248efbb6-ffb6-dd87-5bb0-d2cccdf0d56f@evolveum.com>
 <OFA87C0D87.0CB4F554-ONC1258218.00563B9D-C1258218.0058DCE4@ibacz.eu>
Message-ID: <0ddd3193-f6b7-bc58-e7f6-7329384c77a1@evolveum.com>

Petr,

thanks for the information. I think I understood. So, let's have a look 
at it:

The problem is related to the assignment of a role with OID 
feed0000-0000-0000-0003-000000000001.

How was that assignment created? Manually through a GUI? I assume it was 
created via some mapping. Can you post here the mapping?

Pavol Mederly
Software developer
evolveum.com

On 17.01.2018 17:10, petr.kulheim at ibacz.eu wrote:
> Hi Pavol,
> provided exception bellow is from GUI action SAVE, with reconsiliation 
> checkbox checked, no changed done. It is replicable.
>
> If we run recosiliation task, there are about  30 errors in
>       <partialResults>
>  <operation>com.evolveum.midpoint.common.operation.reconciliation.errors</operation>
>  <status>not_applicable</status>
>  <token>1000000000000030110</token>
>          <message>Last 30 failures:
>       <partialResults>
>  <operation>com.evolveum.midpoint.common.operation.reconciliation.errors</operation>
>  <status>not_applicable</status>
>  <token>1000000000000030110</token>
>          <message>Last 30 failures:
> CN=Jan novak,OU=BRC,DC=wintest,DC=bbb,DC=sk: 
> java.lang.IllegalStateException: Null parent for value 
> PCV(1):[PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
> in item 
> PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3}assignment):[PCV(1):[PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]], 
> PCV(2):[PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import)]]], 
> PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3}construction):[PCV(null):[PrismReference({.../common/common-3}resourceRef):[PRV(oid=feed0000-0000-0000-0000-000000000001, 
> targetType={.../common/common-3}ResourceType, 
> relation={.../common/org-3}default)]]], 
> PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
> (assignment in user:f259bab2-48eb-4e0f-b426-6b58445fdbae(jnovak)); in 
> current user in 
> LensFocusContext(UserType:f259bab2-48eb-4e0f-b426-6b58445fdbae)
> .....
>
>
> Looks like the same error as from GUI action, but no stack trace.
> thx a lot
>
> Petr
>
>
>
>
>
>
> From: Pavol Mederly <mederly at evolveum.com>
> To: midpoint at lists.evolveum.com
> Date: 17/01/2018 16:05
> Subject: Re: [midPoint] Fw: Null parent for value PCV(1) Exception 
> during reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1
> Sent by: "midPoint" <midpoint-bounces at lists.evolveum.com>
> ------------------------------------------------------------------------
>
>
>
> Hello Petr,
>
> just to make sure: You wrote that the exception occurs during 
> reconciliation. I assume you mean reconciliation task.
>
> But the stack trace corresponds to a GUI operation.
>
> So, what's the case? Does it occur within a task or in GUI? If in GUI, 
> is it replicable?
>
> Pavol Mederly
> Software developer
> evolveum.com
>
> On 17.01.2018 12:34, _petr.kulheim at ibacz.eu_ 
> <mailto:petr.kulheim at ibacz.eu>wrote:
> hi guys,
>
> we have customer's test environment where we have upgraded midpoint 
> from 3.5.1 to 3.6.1
> After this upgrade we have some users, about 30, having following 
> Exception during reconsiliation:
>
> 2018-01-15 17:33:30,325 [] [Thread-77] ERROR 
> (com.evolveum.midpoint.web.component.progress.ProgressReporter): Error 
> executing changes.
> java.lang.IllegalStateException: Null parent for value 
> PCV(1):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation_)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
> in item 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}assignment):[PCV(1):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation_)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
> (assignment in user:09cff951-c031-4033-95a9-de85812ccc46(testovic)); 
> in current user in 
> LensFocusContext(UserType:09cff951-c031-4033-95a9-de85812ccc46)
>         at 
> com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:495)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:461)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensFocusContext.checkConsistence(LensFocusContext.java:459)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:453)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensContext.checkConsistence(LensContext.java:678)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.projector.FocusProcessor.processFocusFocus(FocusProcessor.java:398)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.projector.FocusProcessor.processFocus(FocusProcessor.java:173)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.projector.Projector.lambda$projectInternal$1(Projector.java:227)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensUtil.partialExecute(LensUtil.java:1254)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.projector.Projector.projectInternal(Projector.java:225)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.projector.Projector.project(Projector.java:114)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.Clockwork.click(Clockwork.java:440)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.Clockwork.run(Clockwork.java:197) 
> ~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.controller.ModelController.executeChanges(ModelController.java:572)~[model-impl-3.6.1.jar:na]
>         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
> ~[na:1.8.0_111]
>         at 
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)~[na:1.8.0_111]
>         at 
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)~[na:1.8.0_111]
>         at java.lang.reflect.Method.invoke(Method.java:498) 
> ~[na:1.8.0_111]
>         at 
> org.apache.wicket.proxy.LazyInitProxyFactory$JdkHandler.invoke(LazyInitProxyFactory.java:507)~[wicket-ioc-7.6.0.jar:7.6.0]
>         at com.sun.proxy.$Proxy164.executeChanges(Unknown Source) ~[na:na]
>         at 
> com.evolveum.midpoint.web.component.progress.ProgressReporter.lambda$executeChangesAsync$0(ProgressReporter.java:187)~[classes/:na]
>         at java.lang.Thread.run(Thread.java:745) ~[na:1.8.0_111]
> Caused by: java.lang.IllegalStateException: Null parent for value 
> PCV(1):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation_)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
> in item 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}assignment):[PCV(1):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation_)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
> (assignment in user:09cff951-c031-4033-95a9-de85812ccc46(testovic))
>         at 
> com.evolveum.midpoint.prism.Item.checkConsistenceInternal(Item.java:748) 
> ~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.PrismContainer.checkConsistenceInternal(PrismContainer.java:688)~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.PrismContainerValue.checkConsistenceInternal(PrismContainerValue.java:1271)~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.Item.checkConsistenceInternal(Item.java:754) 
> ~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.PrismContainer.checkConsistenceInternal(PrismContainer.java:688)~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.PrismObject.checkConsistenceInternal(PrismObject.java:409)~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.Item.checkConsistence(Item.java:709) 
> ~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:491)~[model-impl-3.6.1.jar:na]
>         ... 21 common frames omitted
>
>
> I have found it comes from
> com.evolveum.midpoint.prism.Item radek 748,
>
>   if (val.getParent() == null) {
>           throw new IllegalStateException("Null parent for value 
> "+val+" in item "+this+" ("+path+" in "+rootItem+")");
>   }
>
>
> So far we haven't found any suspicious Users/Accounts metadata.
> Likely it is related to AD resource.
> Any hint or advice would be appreciated.
>
> Thx
>
> Petr Kulheim
> JEE Developer
>
> IBA CZ, s.r.o.
> Office: Petržílkova 2565/23, 158 00 Praha, CZ
> Phone: +420 603 272826
> E-mail: _petr.kulheim at ibacz.eu_ <mailto:petr.kulheim at ibacz.eu>
>
> IBACZ email signature <http://www.ibacz.eu/email-signature/index.html>
>
> ------------------------------------------------------------------------
> Disclaimer:
>
> The information contained in this communication is intended solely for 
> the use of the individual or entity to whom it is addressed and others 
> authorized to receive it.
> It may contain confidential or legally privileged information.
> If you are not the intended recipient you are hereby notified that any 
> disclosure, copying, distribution or taking any action in reliance on 
> the contents of this information is strictly prohibited and may be 
> unlawful.
> If you have received this communication in error, please notify us 
> immediately by forwarding this email to _ict at ibacz.eu_ 
> <mailto:ict at ibacz.eu>and then delete it from your system.
> IBA Group is neither liable for the proper and complete transmission 
> of the information contained in this communication nor for any delay 
> in its receipt.
>
>
> _______________________________________________
> midPoint mailing list
> _midPoint at lists.evolveum.com_ <mailto:midPoint at lists.evolveum.com>
> _http://lists.evolveum.com/mailman/listinfo/midpoint_
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>
>
> ------------------------------------------------------------------------
> Disclaimer:
>
> The information contained in this communication is intended solely for 
> the use of the individual or entity to whom it is addressed and others 
> authorized to receive it.
> It may contain confidential or legally privileged information.
> If you are not the intended recipient you are hereby notified that any 
> disclosure, copying, distribution or taking any action in reliance on 
> the contents of this information is strictly prohibited and may be 
> unlawful.
> If you have received this communication in error, please notify us 
> immediately by forwarding this email to ict at ibacz.eu and then delete 
> it from your system.
> IBA Group is neither liable for the proper and complete transmission 
> of the information contained in this communication nor for any delay 
> in its receipt.
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180117/4bdec7f9/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: mjcmdmkokdlphcep.png
Type: image/png
Size: 48578 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180117/4bdec7f9/attachment.png>

From petr.kulheim at ibacz.eu  Wed Jan 17 17:50:34 2018
From: petr.kulheim at ibacz.eu (petr.kulheim at ibacz.eu)
Date: Wed, 17 Jan 2018 17:50:34 +0100
Subject: [midPoint] Fw: Null parent for value PCV(1) Exception during
 reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1
In-Reply-To: <0ddd3193-f6b7-bc58-e7f6-7329384c77a1@evolveum.com>
References: <OFAACD6EB0.6563B937-ONC1258218.003F879F-C1258218.003F9C9B@ibacz.eu>
 <248efbb6-ffb6-dd87-5bb0-d2cccdf0d56f@evolveum.com>
 <OFA87C0D87.0CB4F554-ONC1258218.00563B9D-C1258218.0058DCE4@ibacz.eu>
 <0ddd3193-f6b7-bc58-e7f6-7329384c77a1@evolveum.com>
Message-ID: <OFD057A993.87E1A850-ONC1258218.005C473B-C1258218.005C8575@ibacz.eu>

Pavol,
I guess it was assigned by User's object template mapping, pls see here:

<mapping>
      <name>Zamestnanec role assignment</name>
      <strength>strong</strength>
      <source>
         <c:path>$user/employeeType</c:path>
      </source>
      <expression>
         <assignmentTargetSearch xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"
 xsi:type="c:SearchObjectRefExpressionEvaluatorType">
            <targetType>c:RoleType</targetType>
            <oid>feed0000-0000-0000-0003-000000000001</oid>
         </assignmentTargetSearch>
      </expression>
      <target>
         <c:path>assignment</c:path>
      </target>
      <condition>
         <script xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                 xsi:type="c:ScriptExpressionEvaluatorType">
            <code>
                    employeeType != null &amp;&amp; employeeType == 'Z'
                </code>
         </script>
      </condition>
   </mapping>

and also I attaching the Role definition.


Thx
Petr 






From:   Pavol Mederly <mederly at evolveum.com>
To:     midpoint at lists.evolveum.com
Date:   17/01/2018 17:26
Subject:        Re: [midPoint] Fw: Null parent for value PCV(1) Exception 
during reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1
Sent by:        "midPoint" <midpoint-bounces at lists.evolveum.com>



Petr,
thanks for the information. I think I understood. So, let's have a look at 
it:
The problem is related to the assignment of a role with OID 
feed0000-0000-0000-0003-000000000001.
How was that assignment created? Manually through a GUI? I assume it was 
created via some mapping. Can you post here the mapping?
Pavol Mederly
Software developer
evolveum.com

On 17.01.2018 17:10, petr.kulheim at ibacz.eu wrote:
Hi Pavol, 
provided exception bellow is from GUI action SAVE, with reconsiliation 
checkbox checked, no changed done. It is replicable. 

If we run recosiliation task, there are about  30 errors in   
      <partialResults> 
        
 <operation>com.evolveum.midpoint.common.operation.reconciliation.errors</operation>
         <status>not_applicable</status> 
         <token>1000000000000030110</token> 
         <message>Last 30 failures: 
      <partialResults> 
        
 <operation>com.evolveum.midpoint.common.operation.reconciliation.errors</operation>
         <status>not_applicable</status> 
         <token>1000000000000030110</token> 
         <message>Last 30 failures: 
CN=Jan novak,OU=BRC,DC=wintest,DC=bbb,DC=sk: 
java.lang.IllegalStateException: Null parent for value PCV(1):[PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
in item PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}assignment):[PCV(1):[PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]], 
PCV(2):[PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import
)]]], PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}construction):[PCV(null):[PrismReference({.../common/common-3}resourceRef):[PRV(oid=feed0000-0000-0000-0000-000000000001, 
targetType={.../common/common-3}ResourceType, 
relation={.../common/org-3}default)]]], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
(assignment in user:f259bab2-48eb-4e0f-b426-6b58445fdbae(jnovak)); in 
current user in 
LensFocusContext(UserType:f259bab2-48eb-4e0f-b426-6b58445fdbae) 
..... 


Looks like the same error as from GUI action, but no stack trace. 
thx a lot 

Petr 






From:        Pavol Mederly <mederly at evolveum.com> 
To:        midpoint at lists.evolveum.com 
Date:        17/01/2018 16:05 
Subject:        Re: [midPoint] Fw: Null parent for value PCV(1) Exception 
during reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1 
Sent by:        "midPoint" <midpoint-bounces at lists.evolveum.com> 



Hello Petr, 
just to make sure: You wrote that the exception occurs during 
reconciliation. I assume you mean reconciliation task. 
But the stack trace corresponds to a GUI operation. 
So, what's the case? Does it occur within a task or in GUI? If in GUI, is 
it replicable? 
Pavol Mederly
Software developer
evolveum.com

On 17.01.2018 12:34, petr.kulheim at ibacz.eu wrote: 
hi guys, 

we have customer's test environment where we have upgraded midpoint from 
3.5.1 to 3.6.1 
After this upgrade we have some users, about 30, having following 
Exception during reconsiliation: 

2018-01-15 17:33:30,325 [] [Thread-77] ERROR 
(com.evolveum.midpoint.web.component.progress.ProgressReporter): Error 
executing changes. 
java.lang.IllegalStateException: Null parent for value PCV(1):[PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
in item PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}assignment):[PCV(1):[PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
(assignment in user:09cff951-c031-4033-95a9-de85812ccc46(testovic)); in 
current user in 
LensFocusContext(UserType:09cff951-c031-4033-95a9-de85812ccc46) 
        at 
com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:495)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:461)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.LensFocusContext.checkConsistence(LensFocusContext.java:459)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:453)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.LensContext.checkConsistence(LensContext.java:678)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.projector.FocusProcessor.processFocusFocus(FocusProcessor.java:398)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.projector.FocusProcessor.processFocus(FocusProcessor.java:173)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.projector.Projector.lambda$projectInternal$1(Projector.java:227)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.LensUtil.partialExecute(LensUtil.java:1254)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.projector.Projector.projectInternal(Projector.java:225)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.projector.Projector.project(Projector.java:114)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.Clockwork.click(Clockwork.java:440)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.Clockwork.run(Clockwork.java:197) 
~[model-impl-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.model.impl.controller.ModelController.executeChanges(ModelController.java:572)~[model-impl-3.6.1.jar:na] 

        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
~[na:1.8.0_111] 
        at 
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)~[na:1.8.0_111] 

        at 
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)~[na:1.8.0_111] 

        at java.lang.reflect.Method.invoke(Method.java:498) 
~[na:1.8.0_111] 
        at 
org.apache.wicket.proxy.LazyInitProxyFactory$JdkHandler.invoke(LazyInitProxyFactory.java:507)~[wicket-ioc-7.6.0.jar:7.6.0] 

        at com.sun.proxy.$Proxy164.executeChanges(Unknown Source) ~[na:na] 

        at 
com.evolveum.midpoint.web.component.progress.ProgressReporter.lambda$executeChangesAsync$0(ProgressReporter.java:187)~[classes/:na] 

        at java.lang.Thread.run(Thread.java:745) ~[na:1.8.0_111] 
Caused by: java.lang.IllegalStateException: Null parent for value 
PCV(1):[PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
in item PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}assignment):[PCV(1):[PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
(assignment in user:09cff951-c031-4033-95a9-de85812ccc46(testovic)) 
        at 
com.evolveum.midpoint.prism.Item.checkConsistenceInternal(Item.java:748) 
~[prism-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.prism.PrismContainer.checkConsistenceInternal(PrismContainer.java:688)~[prism-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.prism.PrismContainerValue.checkConsistenceInternal(PrismContainerValue.java:1271)~[prism-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.prism.Item.checkConsistenceInternal(Item.java:754) 
~[prism-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.prism.PrismContainer.checkConsistenceInternal(PrismContainer.java:688)~[prism-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.prism.PrismObject.checkConsistenceInternal(PrismObject.java:409)~[prism-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.prism.Item.checkConsistence(Item.java:709) 
~[prism-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:491)~[model-impl-3.6.1.jar:na] 

        ... 21 common frames omitted 


I have found it comes from 
com.evolveum.midpoint.prism.Item radek 748, 

                        if (val.getParent() == null) { 
                                throw new IllegalStateException("Null 
parent for value "+val+" in item "+this+" ("+path+" in "+rootItem+")"); 
                        } 


So far we haven't found any suspicious Users/Accounts metadata. 
Likely it is related to AD resource. 
Any hint or advice would be appreciated. 

Thx 

Petr Kulheim
JEE Developer

IBA CZ, s.r.o.
Office: Petržílkova 2565/23, 158 00 Praha, CZ
Phone: +420 603 272826
E-mail: petr.kulheim at ibacz.eu 


Disclaimer:

The information contained in this communication is intended solely for the 
use of the individual or entity to whom it is addressed and others 
authorized to receive it.
It may contain confidential or legally privileged information.
If you are not the intended recipient you are hereby notified that any 
disclosure, copying, distribution or taking any action in reliance on the 
contents of this information is strictly prohibited and may be unlawful.
If you have received this communication in error, please notify us 
immediately by forwarding this email to ict at ibacz.eu and then delete it 
from your system.
IBA Group is neither liable for the proper and complete transmission of 
the information contained in this communication nor for any delay in its 
receipt. 


_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint

_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint



Disclaimer:

The information contained in this communication is intended solely for the 
use of the individual or entity to whom it is addressed and others 
authorized to receive it.
It may contain confidential or legally privileged information.
If you are not the intended recipient you are hereby notified that any 
disclosure, copying, distribution or taking any action in reliance on the 
contents of this information is strictly prohibited and may be unlawful.
If you have received this communication in error, please notify us 
immediately by forwarding this email to ict at ibacz.eu and then delete it 
from your system.
IBA Group is neither liable for the proper and complete transmission of 
the information contained in this communication nor for any delay in its 
receipt. 


_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint

_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint



Disclaimer:

The information contained in this communication is intended solely for the 
use of the individual or entity to whom it is addressed and others 
authorized to receive it.
It may contain confidential or legally privileged information.
If you are not the intended recipient you are hereby notified that any 
disclosure, copying, distribution or taking any action in reliance on the 
contents of this information is strictly prohibited and may be unlawful.
If you have received this communication in error, please notify us 
immediately by forwarding this email to ict at ibacz.eu and then delete it 
from your system.
IBA Group is neither liable for the proper and complete transmission of 
the information contained in this communication nor for any delay in its 
receipt.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180117/8c083cc6/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 48578 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180117/8c083cc6/attachment.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ExportedData_RoleType_1516161790929.xml
Type: application/octet-stream
Size: 3300 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180117/8c083cc6/attachment.obj>

From mederly at evolveum.com  Wed Jan 17 18:38:21 2018
From: mederly at evolveum.com (Pavol Mederly)
Date: Wed, 17 Jan 2018 18:38:21 +0100
Subject: [midPoint] Fw: Null parent for value PCV(1) Exception during
 reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1
In-Reply-To: <OFD057A993.87E1A850-ONC1258218.005C473B-C1258218.005C8575@ibacz.eu>
References: <OFAACD6EB0.6563B937-ONC1258218.003F879F-C1258218.003F9C9B@ibacz.eu>
 <248efbb6-ffb6-dd87-5bb0-d2cccdf0d56f@evolveum.com>
 <OFA87C0D87.0CB4F554-ONC1258218.00563B9D-C1258218.0058DCE4@ibacz.eu>
 <0ddd3193-f6b7-bc58-e7f6-7329384c77a1@evolveum.com>
 <OFD057A993.87E1A850-ONC1258218.005C473B-C1258218.005C8575@ibacz.eu>
Message-ID: <9e03ee25-8d84-3cd7-28f1-17d13bfae393@evolveum.com>

Interesting. Please, could you send here one such user that causes 
midPoint to fail when recomputed? (after removing personal information - 
if any)

Thank you.

Pavol Mederly
Software developer
evolveum.com

On 17.01.2018 17:50, petr.kulheim at ibacz.eu wrote:
> Pavol,
> I guess it was assigned by User's object template mapping, pls see here:
>
> <mapping>
>       <name>Zamestnanec role assignment</name>
> <strength>strong</strength>
>       <source>
>  <c:path>$user/employeeType</c:path>
>       </source>
>       <expression>
>  <assignmentTargetSearch 
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
>  xsi:type="c:SearchObjectRefExpressionEvaluatorType">
> <targetType>c:RoleType</targetType>
> <oid>feed0000-0000-0000-0003-000000000001</oid>
>  </assignmentTargetSearch>
>       </expression>
>       <target>
>  <c:path>assignment</c:path>
>       </target>
>       <condition>
>          <script xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
>      xsi:type="c:ScriptExpressionEvaluatorType">
> <code>
>         employeeType != null &amp;&amp; employeeType == 'Z'
>     </code>
>          </script>
>       </condition>
>    </mapping>
>
> and also I attaching the Role definition.
>
>
> Thx
> Petr
>
>
>
>
>
>
> From: Pavol Mederly <mederly at evolveum.com>
> To: midpoint at lists.evolveum.com
> Date: 17/01/2018 17:26
> Subject: Re: [midPoint] Fw: Null parent for value PCV(1) Exception 
> during reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1
> Sent by: "midPoint" <midpoint-bounces at lists.evolveum.com>
> ------------------------------------------------------------------------
>
>
>
> Petr,
>
> thanks for the information. I think I understood. So, let's have a 
> look at it:
>
> The problem is related to the assignment of a role with OID 
> feed0000-0000-0000-0003-000000000001.
>
> How was that assignment created? Manually through a GUI? I assume it 
> was created via some mapping. Can you post here the mapping?
>
> Pavol Mederly
> Software developer
> evolveum.com
>
> On 17.01.2018 17:10, _petr.kulheim at ibacz.eu_ 
> <mailto:petr.kulheim at ibacz.eu>wrote:
> Hi Pavol,
> provided exception bellow is from GUI action SAVE, with reconsiliation 
> checkbox checked, no changed done. It is replicable.
>
> If we run recosiliation task, there are about  30 errors in
>       <partialResults>
>  <operation>com.evolveum.midpoint.common.operation.reconciliation.errors</operation>
>          <status>not_applicable</status>
>          <token>1000000000000030110</token>
>          <message>Last 30 failures:
>       <partialResults>
>  <operation>com.evolveum.midpoint.common.operation.reconciliation.errors</operation>
>          <status>not_applicable</status>
>          <token>1000000000000030110</token>
>          <message>Last 30 failures:
> CN=Jan novak,OU=BRC,DC=wintest,DC=bbb,DC=sk: 
> java.lang.IllegalStateException: Null parent for value 
> PCV(1):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import_)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
> in item 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}assignment):[PCV(1):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import_)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]], 
> PCV(2):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import_)]]], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}construction):[PCV(null):[PrismReference({.../common/common-3}resourceRef):[PRV(oid=feed0000-0000-0000-0000-000000000001, 
> targetType={.../common/common-3}ResourceType, 
> relation={.../common/org-3}default)]]], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
> (assignment in user:f259bab2-48eb-4e0f-b426-6b58445fdbae(jnovak)); in 
> current user in 
> LensFocusContext(UserType:f259bab2-48eb-4e0f-b426-6b58445fdbae)
> .....
>
>
> Looks like the same error as from GUI action, but no stack trace.
> thx a lot
>
> Petr
>
>
>
>
>
>
> From: Pavol Mederly _<mederly at evolveum.com>_ <mailto:mederly at evolveum.com>
> To: _midpoint at lists.evolveum.com_ <mailto:midpoint at lists.evolveum.com>
> Date: 17/01/2018 16:05
> Subject: Re: [midPoint] Fw: Null parent for value PCV(1) Exception 
> during reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1
> Sent by: "midPoint" _<midpoint-bounces at lists.evolveum.com>_ 
> <mailto:midpoint-bounces at lists.evolveum.com>
>
> ------------------------------------------------------------------------
>
>
>
> Hello Petr,
>
> just to make sure: You wrote that the exception occurs during 
> reconciliation. I assume you mean reconciliation task.
>
> But the stack trace corresponds to a GUI operation.
>
> So, what's the case? Does it occur within a task or in GUI? If in GUI, 
> is it replicable?
>
> Pavol Mederly
> Software developer
> evolveum.com
>
> On 17.01.2018 12:34, _petr.kulheim at ibacz.eu_ 
> <mailto:petr.kulheim at ibacz.eu>wrote:
> hi guys,
>
> we have customer's test environment where we have upgraded midpoint 
> from 3.5.1 to 3.6.1
> After this upgrade we have some users, about 30, having following 
> Exception during reconsiliation:
>
> 2018-01-15 17:33:30,325 [] [Thread-77] ERROR 
> (com.evolveum.midpoint.web.component.progress.ProgressReporter): Error 
> executing changes.
> java.lang.IllegalStateException: Null parent for value 
> PCV(1):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation_)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
> in item 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}assignment):[PCV(1):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation_)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
> (assignment in user:09cff951-c031-4033-95a9-de85812ccc46(testovic)); 
> in current user in 
> LensFocusContext(UserType:09cff951-c031-4033-95a9-de85812ccc46)
>         at 
> com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:495)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:461)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensFocusContext.checkConsistence(LensFocusContext.java:459)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:453)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensContext.checkConsistence(LensContext.java:678)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.projector.FocusProcessor.processFocusFocus(FocusProcessor.java:398)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.projector.FocusProcessor.processFocus(FocusProcessor.java:173)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.projector.Projector.lambda$projectInternal$1(Projector.java:227)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensUtil.partialExecute(LensUtil.java:1254)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.projector.Projector.projectInternal(Projector.java:225)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.projector.Projector.project(Projector.java:114)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.Clockwork.click(Clockwork.java:440)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.Clockwork.run(Clockwork.java:197) 
> ~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.controller.ModelController.executeChanges(ModelController.java:572)~[model-impl-3.6.1.jar:na]
>         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
> ~[na:1.8.0_111]
>         at 
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)~[na:1.8.0_111]
>         at 
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)~[na:1.8.0_111]
>         at java.lang.reflect.Method.invoke(Method.java:498) 
> ~[na:1.8.0_111]
>         at 
> org.apache.wicket.proxy.LazyInitProxyFactory$JdkHandler.invoke(LazyInitProxyFactory.java:507)~[wicket-ioc-7.6.0.jar:7.6.0]
>         at com.sun.proxy.$Proxy164.executeChanges(Unknown Source) ~[na:na]
>         at 
> com.evolveum.midpoint.web.component.progress.ProgressReporter.lambda$executeChangesAsync$0(ProgressReporter.java:187)~[classes/:na]
>         at java.lang.Thread.run(Thread.java:745) ~[na:1.8.0_111]
> Caused by: java.lang.IllegalStateException: Null parent for value 
> PCV(1):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation_)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
> in item 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}assignment):[PCV(1):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation_)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
> (assignment in user:09cff951-c031-4033-95a9-de85812ccc46(testovic))
>         at 
> com.evolveum.midpoint.prism.Item.checkConsistenceInternal(Item.java:748) 
> ~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.PrismContainer.checkConsistenceInternal(PrismContainer.java:688)~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.PrismContainerValue.checkConsistenceInternal(PrismContainerValue.java:1271)~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.Item.checkConsistenceInternal(Item.java:754) 
> ~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.PrismContainer.checkConsistenceInternal(PrismContainer.java:688)~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.PrismObject.checkConsistenceInternal(PrismObject.java:409)~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.Item.checkConsistence(Item.java:709) 
> ~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:491)~[model-impl-3.6.1.jar:na]
>         ... 21 common frames omitted
>
>
> I have found it comes from
> com.evolveum.midpoint.prism.Item radek 748,
>
>   if (val.getParent() == null) {
>           throw new IllegalStateException("Null parent for value 
> "+val+" in item "+this+" ("+path+" in "+rootItem+")");
>   }
>
>
> So far we haven't found any suspicious Users/Accounts metadata.
> Likely it is related to AD resource.
> Any hint or advice would be appreciated.
>
> Thx
>
> Petr Kulheim
> JEE Developer
>
> IBA CZ, s.r.o.
> Office: Petržílkova 2565/23, 158 00 Praha, CZ
> Phone: +420 603 272826
> E-mail: _petr.kulheim at ibacz.eu_ <mailto:petr.kulheim at ibacz.eu>
>
> IBACZ email signature <http://www.ibacz.eu/email-signature/index.html>
>
> ------------------------------------------------------------------------
> Disclaimer:
>
> The information contained in this communication is intended solely for 
> the use of the individual or entity to whom it is addressed and others 
> authorized to receive it.
> It may contain confidential or legally privileged information.
> If you are not the intended recipient you are hereby notified that any 
> disclosure, copying, distribution or taking any action in reliance on 
> the contents of this information is strictly prohibited and may be 
> unlawful.
> If you have received this communication in error, please notify us 
> immediately by forwarding this email to _ict at ibacz.eu_ 
> <mailto:ict at ibacz.eu>and then delete it from your system.
> IBA Group is neither liable for the proper and complete transmission 
> of the information contained in this communication nor for any delay 
> in its receipt.
>
>
> _______________________________________________
> midPoint mailing list_
> __midPoint at lists.evolveum.com_ <mailto:midPoint at lists.evolveum.com>_
> __http://lists.evolveum.com/mailman/listinfo/midpoint_
>
> _______________________________________________
> midPoint mailing list_
> __midPoint at lists.evolveum.com_ <mailto:midPoint at lists.evolveum.com>_
> __http://lists.evolveum.com/mailman/listinfo/midpoint_
>
>
>
> ------------------------------------------------------------------------
> Disclaimer:
>
> The information contained in this communication is intended solely for 
> the use of the individual or entity to whom it is addressed and others 
> authorized to receive it.
> It may contain confidential or legally privileged information.
> If you are not the intended recipient you are hereby notified that any 
> disclosure, copying, distribution or taking any action in reliance on 
> the contents of this information is strictly prohibited and may be 
> unlawful.
> If you have received this communication in error, please notify us 
> immediately by forwarding this email to _ict at ibacz.eu_ 
> <mailto:ict at ibacz.eu>and then delete it from your system.
> IBA Group is neither liable for the proper and complete transmission 
> of the information contained in this communication nor for any delay 
> in its receipt.
>
>
> _______________________________________________
> midPoint mailing list
> _midPoint at lists.evolveum.com_ <mailto:midPoint at lists.evolveum.com>
> _http://lists.evolveum.com/mailman/listinfo/midpoint_
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>
>
> ------------------------------------------------------------------------
> Disclaimer:
>
> The information contained in this communication is intended solely for 
> the use of the individual or entity to whom it is addressed and others 
> authorized to receive it.
> It may contain confidential or legally privileged information.
> If you are not the intended recipient you are hereby notified that any 
> disclosure, copying, distribution or taking any action in reliance on 
> the contents of this information is strictly prohibited and may be 
> unlawful.
> If you have received this communication in error, please notify us 
> immediately by forwarding this email to ict at ibacz.eu and then delete 
> it from your system.
> IBA Group is neither liable for the proper and complete transmission 
> of the information contained in this communication nor for any delay 
> in its receipt.
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180117/f457928c/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: hmfkinifecahokig.png
Type: image/png
Size: 48578 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180117/f457928c/attachment.png>

From srpenn at us.ibm.com  Wed Jan 17 18:38:45 2018
From: srpenn at us.ibm.com (Sean R Penndorf)
Date: Wed, 17 Jan 2018 12:38:45 -0500
Subject: [midPoint] No definition for 'manager' in user
In-Reply-To: <b1e8f21c-4fc1-50b7-68bd-d769495a7846@diagnostyka.pl>
References: <OF40E2B943.1D3C46D6-ON85258217.00540D20-85258217.00549F0C@notes.na.collabserv.com>
 <34cccc18-acf2-e07a-13a9-1648d8edecec@evolveum.com>
 <OF54DE801B.06989668-ON85258217.006A6E92-85258217.006A778F@notes.na.collabserv.com>
 <b1e8f21c-4fc1-50b7-68bd-d769495a7846@diagnostyka.pl>
Message-ID: <OFCA85FF81.E94E4054-ON85258218.0060DE1B-85258218.0060EE99@notes.na.collabserv.com>

After backing out my previous attempts, I tried this and it worked!
Thanks Wojciech!

------------------
Sean Penndorf
SaaS Operational Services (SOS) - ID Management
IBM Cloud
srpenn at us.ibm.com
Office: 248-552-4791   TL  623-9966





From:   Wojciech Staszewski <wojciech.staszewski at diagnostyka.pl>
To:     midpoint at lists.evolveum.com
Date:   01/16/2018 05:26 PM
Subject:        Re: [midPoint] No definition for 'manager' in user
Sent by:        "midPoint" <midpoint-bounces at lists.evolveum.com>



Or just "extension/manager" as below:
<attribute>
            <c:ref>ri:manager</c:ref>
            <inbound>
               <authoritative>true</authoritative>
               <exclusive>false</exclusive>
               <strength>normal</strength>
               <target>
                  <c:path>extension/manager</c:path>
               </target>
            </inbound>
</attribute>

On 16.01.2018 20:22, Sean R Penndorf wrote:
Unfortunately that did not work.
Any other ideas?

------------------
Sean Penndorf
SaaS Operational Services (SOS) - ID Management
IBM Cloud
srpenn at us.ibm.com
Office: 248-552-4791   TL  623-9966





From:        Ivan Noris <ivan.noris at evolveum.com>
To:        midpoint at lists.evolveum.com
Date:        01/16/2018 11:39 AM
Subject:        Re: [midPoint] No definition for 'manager' in user
Sent by:        "midPoint" <midpoint-bounces at lists.evolveum.com>



Hi Sean,
the extension looks ok.
The inbound is incorrect.
It should look similar to this:
<attribute>
  <ref>ri:cn</ref>
. . .
  <inbound>
  <expression>
  ... <!-- probably you need to do something here from the resource 
attribute -->
  </expression>
    <target>$user/extension/manager</target> <!-- or 
$user/extension/ext:manager if ext namespace prefix is defined -->
  </inbound>
</attribute>
This artificial example takes "cn" attribute from LDAP and copies it to 
$user/extension/manager.
Best regards,
Ivan

On 16.01.2018 16:24, Sean R Penndorf wrote:
Hi Community,

Clearly, I'm missing something simple here....running Midpoint 3.7
I have an extended attribute "manager", it shows up in the GUI when 
looking at User properties.
But I keep getting an error with my inbound mapping:  "No definition for 
'manager' in user."
I've tried a number of variations in the inbound mapping, but I can't get 
the field to populate.
Any assistance is greatly appreciated.


** Extended Attribute: **

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!-- This is a runtime schema that defines data types used in the
<extension> part of the objects. It is used in some built-in samples. -->
<xsd:schema elementFormDefault="qualified"
            targetNamespace="http://sos.ibm.com/xml/ns/sosSchema"
            xmlns:tns="http://sos.ibm.com/xml/ns/sosSchema"
            xmlns:a="http://prism.evolveum.com/xml/ns/public/annotation-3"
            xmlns:c="
http://midpoint.evolveum.com/xml/ns/public/common/common-3"
            xmlns:xsd="http://www.w3.org/2001/XMLSchema">

    <xsd:complexType name="UserExtensionType">
        <xsd:annotation>
            <xsd:appinfo>
                <a:extension ref="c:UserType"/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="manager" type="xsd:string" minOccurs="0" 
maxOccurs="1">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:indexed>true</a:indexed>
                        <a:displayName>manager</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
</xsd:schema>


** Inbound Mapping: **

         <attribute id="9">
            <c:ref>ri:manager</c:ref>
            <matchingRule xmlns:gen316="
http://prism.evolveum.com/xml/ns/public/matching-rule-3
">gen316:distinguishedName</matchingRule>
            <tolerant>true</tolerant>
            <exclusiveStrong>true</exclusiveStrong>
            <fetchStrategy>explicit</fetchStrategy>
            <inbound id="10">
               <authoritative>true</authoritative>
               <exclusive>true</exclusive>
               <strength>strong</strength>
               <expression>
                  <c:path xmlns:ext="http://sos.ibm.com/xml/ns/sosSchema"
                          xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"
                          
xsi:type="t:ItemPathType">$user/extension/ext:manager</c:path>
               </expression>
               <target>
                  <c:path xmlns:ext="http://sos.ibm.com/xml/ns/sosSchema
">ext:manager</c:path>
               </target>
            </inbound>
         </attribute>









------------------
Sean Penndorf
SaaS Operational Services (SOS) - ID Management
IBM Cloud
srpenn at us.ibm.com
Office: 248-552-4791   TL  623-9966




_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint


-- 
Ivan Noris
Senior Identity Engineer
evolveum.com

_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.evolveum.com_mailman_listinfo_midpoint&d=DwIGaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=qEACHutvsppyidQwf1kYntDY-ZKom0n1kiWqpNpwVXg&m=mxBoJ1lXgvvfo5l-Tjy10yyDc2y8S5YU7eMgXL9B6BQ&s=YqKtO-IFuxFGGiIQqHy-7o7tAszxg427o-T2utRX374&e=






_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint


-- 
Wojciech Staszewski
Administrator Systemów Sieciowych
tel. kom: 663 680 236
www.diagnostyka.pl
Diagnostyka Sp. z o. o.
ul. Prof. M. Życzkowskiego 16, 31-864 Kraków
Numer KRS: 0000381559 (Sąd Rejonowy dla Krakowa-Śródmieścia w Krakowie, XI 
Wydział Gospodarczy KRS)
NIP: 675-12-65-009; REGON: 356366975
Kapitał zakładowy: 33 756 500 zł.

Pomyśl o środowisku zanim wydrukujesz ten e-mail.
_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.evolveum.com_mailman_listinfo_midpoint&d=DwIGaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=qEACHutvsppyidQwf1kYntDY-ZKom0n1kiWqpNpwVXg&m=0NyyT20Jic5wSOtpsSnc5Smp14l43A3wPrfOkc9x23c&s=kPclXy26IJ7-JRAJOhEpf8C1aACEtnddxTY3xsT7E7o&e=





-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180117/884732ef/attachment.htm>

From srpenn at us.ibm.com  Wed Jan 17 18:39:53 2018
From: srpenn at us.ibm.com (Sean R Penndorf)
Date: Wed, 17 Jan 2018 12:39:53 -0500
Subject: [midPoint] No definition for 'manager' in user
In-Reply-To: <a6d570ca-1f30-cc16-0f7f-f804c6cdf065@evolveum.com>
References: <OF40E2B943.1D3C46D6-ON85258217.00540D20-85258217.00549F0C@notes.na.collabserv.com>
 <34cccc18-acf2-e07a-13a9-1648d8edecec@evolveum.com>
 <OF54DE801B.06989668-ON85258217.006A6E92-85258217.006A778F@notes.na.collabserv.com>
 <a6d570ca-1f30-cc16-0f7f-f804c6cdf065@evolveum.com>
Message-ID: <OF0C6BA4CF.16A2D53F-ON85258218.0060FBA2-85258218.0061092D@notes.na.collabserv.com>

Hi Ivan,

I backed out all my changes and tried simply "extension/manager" and it 
worked.
Thanks for your help!!!

------------------
Sean Penndorf
SaaS Operational Services (SOS) - ID Management
IBM Cloud
srpenn at us.ibm.com
Office: 248-552-4791   TL  623-9966





From:   Ivan Noris <ivan.noris at evolveum.com>
To:     midpoint at lists.evolveum.com
Date:   01/17/2018 03:57 AM
Subject:        Re: [midPoint] No definition for 'manager' in user
Sent by:        "midPoint" <midpoint-bounces at lists.evolveum.com>



Hi,

what was your error message in this case after my proposed change..?
Ivan

On 16.01.2018 20:22, Sean R Penndorf wrote:
Unfortunately that did not work.
Any other ideas?

------------------
Sean Penndorf
SaaS Operational Services (SOS) - ID Management
IBM Cloud
srpenn at us.ibm.com
Office: 248-552-4791   TL  623-9966





From:        Ivan Noris <ivan.noris at evolveum.com>
To:        midpoint at lists.evolveum.com
Date:        01/16/2018 11:39 AM
Subject:        Re: [midPoint] No definition for 'manager' in user
Sent by:        "midPoint" <midpoint-bounces at lists.evolveum.com>



Hi Sean,
the extension looks ok.
The inbound is incorrect.
It should look similar to this:
<attribute>
  <ref>ri:cn</ref>
. . .
  <inbound>
  <expression>
  ... <!-- probably you need to do something here from the resource 
attribute -->
  </expression>
    <target>$user/extension/manager</target> <!-- or 
$user/extension/ext:manager if ext namespace prefix is defined -->
  </inbound>
</attribute>
This artificial example takes "cn" attribute from LDAP and copies it to 
$user/extension/manager.
Best regards,
Ivan

On 16.01.2018 16:24, Sean R Penndorf wrote:
Hi Community,

Clearly, I'm missing something simple here....running Midpoint 3.7
I have an extended attribute "manager", it shows up in the GUI when 
looking at User properties.
But I keep getting an error with my inbound mapping:  "No definition for 
'manager' in user."
I've tried a number of variations in the inbound mapping, but I can't get 
the field to populate.
Any assistance is greatly appreciated.


** Extended Attribute: **

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!-- This is a runtime schema that defines data types used in the
<extension> part of the objects. It is used in some built-in samples. -->
<xsd:schema elementFormDefault="qualified"
            targetNamespace="http://sos.ibm.com/xml/ns/sosSchema"
            xmlns:tns="http://sos.ibm.com/xml/ns/sosSchema"
            xmlns:a="http://prism.evolveum.com/xml/ns/public/annotation-3"
            xmlns:c="
http://midpoint.evolveum.com/xml/ns/public/common/common-3"
            xmlns:xsd="http://www.w3.org/2001/XMLSchema">

    <xsd:complexType name="UserExtensionType">
        <xsd:annotation>
            <xsd:appinfo>
                <a:extension ref="c:UserType"/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="manager" type="xsd:string" minOccurs="0" 
maxOccurs="1">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:indexed>true</a:indexed>
                        <a:displayName>manager</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
</xsd:schema>


** Inbound Mapping: **

         <attribute id="9">
            <c:ref>ri:manager</c:ref>
            <matchingRule xmlns:gen316="
http://prism.evolveum.com/xml/ns/public/matching-rule-3
">gen316:distinguishedName</matchingRule>
            <tolerant>true</tolerant>
            <exclusiveStrong>true</exclusiveStrong>
            <fetchStrategy>explicit</fetchStrategy>
            <inbound id="10">
               <authoritative>true</authoritative>
               <exclusive>true</exclusive>
               <strength>strong</strength>
               <expression>
                  <c:path xmlns:ext="http://sos.ibm.com/xml/ns/sosSchema"
                          xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"
                          
xsi:type="t:ItemPathType">$user/extension/ext:manager</c:path>
               </expression>
               <target>
                  <c:path xmlns:ext="http://sos.ibm.com/xml/ns/sosSchema
">ext:manager</c:path>
               </target>
            </inbound>
         </attribute>









------------------
Sean Penndorf
SaaS Operational Services (SOS) - ID Management
IBM Cloud
srpenn at us.ibm.com
Office: 248-552-4791   TL  623-9966




_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint


-- 
Ivan Noris
Senior Identity Engineer
evolveum.com

_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.evolveum.com_mailman_listinfo_midpoint&d=DwIGaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=qEACHutvsppyidQwf1kYntDY-ZKom0n1kiWqpNpwVXg&m=mxBoJ1lXgvvfo5l-Tjy10yyDc2y8S5YU7eMgXL9B6BQ&s=YqKtO-IFuxFGGiIQqHy-7o7tAszxg427o-T2utRX374&e=






_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint


-- 
Ivan Noris
Senior Identity Engineer
evolveum.com

_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.evolveum.com_mailman_listinfo_midpoint&d=DwIGaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=qEACHutvsppyidQwf1kYntDY-ZKom0n1kiWqpNpwVXg&m=8pUgR5ERb9sBFfc9TicPbbyzpoCoCQbj58mC7r_z6KE&s=95LwkJm0xL2XCvQQiTbQfysNW1RjbqKh8R28p6EgY_w&e=





-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180117/3cd54384/attachment.htm>

From mederly at evolveum.com  Wed Jan 17 18:47:39 2018
From: mederly at evolveum.com (Pavol Mederly)
Date: Wed, 17 Jan 2018 18:47:39 +0100
Subject: [midPoint] Fw: Null parent for value PCV(1) Exception during
 reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1
In-Reply-To: <OFD057A993.87E1A850-ONC1258218.005C473B-C1258218.005C8575@ibacz.eu>
References: <OFAACD6EB0.6563B937-ONC1258218.003F879F-C1258218.003F9C9B@ibacz.eu>
 <248efbb6-ffb6-dd87-5bb0-d2cccdf0d56f@evolveum.com>
 <OFA87C0D87.0CB4F554-ONC1258218.00563B9D-C1258218.0058DCE4@ibacz.eu>
 <0ddd3193-f6b7-bc58-e7f6-7329384c77a1@evolveum.com>
 <OFD057A993.87E1A850-ONC1258218.005C473B-C1258218.005C8575@ibacz.eu>
Message-ID: <e4a4ad20-eb72-2273-26ce-d1413042f9bf@evolveum.com>

...and one more idea to try:

instead of <assignmentTargetSearch> element, could you try something 
like this and tell us if it helped?

<expression>
     <value>
         <targetRef oid="feed0000-0000-0000-0003-000000000001" 
type="c:RoleType"/>
     </value>
</expression>

It might behave differently from assignmentTargetSearch in some cases (I 
am not sure now), but at least it would provide us with a hint on where 
the problem could be.

(BTW, I was not able to replicate the problem with your configuration on 
my machine.)

Pavol Mederly
Software developer
evolveum.com

On 17.01.2018 17:50, petr.kulheim at ibacz.eu wrote:
> Pavol,
> I guess it was assigned by User's object template mapping, pls see here:
>
> <mapping>
>       <name>Zamestnanec role assignment</name>
> <strength>strong</strength>
>       <source>
>  <c:path>$user/employeeType</c:path>
>       </source>
>       <expression>
>  <assignmentTargetSearch 
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
>  xsi:type="c:SearchObjectRefExpressionEvaluatorType">
> <targetType>c:RoleType</targetType>
> <oid>feed0000-0000-0000-0003-000000000001</oid>
>  </assignmentTargetSearch>
>       </expression>
>       <target>
>  <c:path>assignment</c:path>
>       </target>
>       <condition>
>          <script xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
>      xsi:type="c:ScriptExpressionEvaluatorType">
> <code>
>         employeeType != null &amp;&amp; employeeType == 'Z'
>     </code>
>          </script>
>       </condition>
>    </mapping>
>
> and also I attaching the Role definition.
>
>
> Thx
> Petr
>
>
>
>
>
>
> From: Pavol Mederly <mederly at evolveum.com>
> To: midpoint at lists.evolveum.com
> Date: 17/01/2018 17:26
> Subject: Re: [midPoint] Fw: Null parent for value PCV(1) Exception 
> during reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1
> Sent by: "midPoint" <midpoint-bounces at lists.evolveum.com>
> ------------------------------------------------------------------------
>
>
>
> Petr,
>
> thanks for the information. I think I understood. So, let's have a 
> look at it:
>
> The problem is related to the assignment of a role with OID 
> feed0000-0000-0000-0003-000000000001.
>
> How was that assignment created? Manually through a GUI? I assume it 
> was created via some mapping. Can you post here the mapping?
>
> Pavol Mederly
> Software developer
> evolveum.com
>
> On 17.01.2018 17:10, _petr.kulheim at ibacz.eu_ 
> <mailto:petr.kulheim at ibacz.eu>wrote:
> Hi Pavol,
> provided exception bellow is from GUI action SAVE, with reconsiliation 
> checkbox checked, no changed done. It is replicable.
>
> If we run recosiliation task, there are about  30 errors in
>       <partialResults>
>  <operation>com.evolveum.midpoint.common.operation.reconciliation.errors</operation>
>          <status>not_applicable</status>
>          <token>1000000000000030110</token>
>          <message>Last 30 failures:
>       <partialResults>
>  <operation>com.evolveum.midpoint.common.operation.reconciliation.errors</operation>
>          <status>not_applicable</status>
>          <token>1000000000000030110</token>
>          <message>Last 30 failures:
> CN=Jan novak,OU=BRC,DC=wintest,DC=bbb,DC=sk: 
> java.lang.IllegalStateException: Null parent for value 
> PCV(1):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import_)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
> in item 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}assignment):[PCV(1):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import_)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]], 
> PCV(2):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import_)]]], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}construction):[PCV(null):[PrismReference({.../common/common-3}resourceRef):[PRV(oid=feed0000-0000-0000-0000-000000000001, 
> targetType={.../common/common-3}ResourceType, 
> relation={.../common/org-3}default)]]], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
> (assignment in user:f259bab2-48eb-4e0f-b426-6b58445fdbae(jnovak)); in 
> current user in 
> LensFocusContext(UserType:f259bab2-48eb-4e0f-b426-6b58445fdbae)
> .....
>
>
> Looks like the same error as from GUI action, but no stack trace.
> thx a lot
>
> Petr
>
>
>
>
>
>
> From: Pavol Mederly _<mederly at evolveum.com>_ <mailto:mederly at evolveum.com>
> To: _midpoint at lists.evolveum.com_ <mailto:midpoint at lists.evolveum.com>
> Date: 17/01/2018 16:05
> Subject: Re: [midPoint] Fw: Null parent for value PCV(1) Exception 
> during reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1
> Sent by: "midPoint" _<midpoint-bounces at lists.evolveum.com>_ 
> <mailto:midpoint-bounces at lists.evolveum.com>
>
> ------------------------------------------------------------------------
>
>
>
> Hello Petr,
>
> just to make sure: You wrote that the exception occurs during 
> reconciliation. I assume you mean reconciliation task.
>
> But the stack trace corresponds to a GUI operation.
>
> So, what's the case? Does it occur within a task or in GUI? If in GUI, 
> is it replicable?
>
> Pavol Mederly
> Software developer
> evolveum.com
>
> On 17.01.2018 12:34, _petr.kulheim at ibacz.eu_ 
> <mailto:petr.kulheim at ibacz.eu>wrote:
> hi guys,
>
> we have customer's test environment where we have upgraded midpoint 
> from 3.5.1 to 3.6.1
> After this upgrade we have some users, about 30, having following 
> Exception during reconsiliation:
>
> 2018-01-15 17:33:30,325 [] [Thread-77] ERROR 
> (com.evolveum.midpoint.web.component.progress.ProgressReporter): Error 
> executing changes.
> java.lang.IllegalStateException: Null parent for value 
> PCV(1):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation_)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
> in item 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}assignment):[PCV(1):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation_)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
> (assignment in user:09cff951-c031-4033-95a9-de85812ccc46(testovic)); 
> in current user in 
> LensFocusContext(UserType:09cff951-c031-4033-95a9-de85812ccc46)
>         at 
> com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:495)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:461)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensFocusContext.checkConsistence(LensFocusContext.java:459)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:453)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensContext.checkConsistence(LensContext.java:678)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.projector.FocusProcessor.processFocusFocus(FocusProcessor.java:398)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.projector.FocusProcessor.processFocus(FocusProcessor.java:173)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.projector.Projector.lambda$projectInternal$1(Projector.java:227)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensUtil.partialExecute(LensUtil.java:1254)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.projector.Projector.projectInternal(Projector.java:225)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.projector.Projector.project(Projector.java:114)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.Clockwork.click(Clockwork.java:440)~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.Clockwork.run(Clockwork.java:197) 
> ~[model-impl-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.controller.ModelController.executeChanges(ModelController.java:572)~[model-impl-3.6.1.jar:na]
>         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
> ~[na:1.8.0_111]
>         at 
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)~[na:1.8.0_111]
>         at 
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)~[na:1.8.0_111]
>         at java.lang.reflect.Method.invoke(Method.java:498) 
> ~[na:1.8.0_111]
>         at 
> org.apache.wicket.proxy.LazyInitProxyFactory$JdkHandler.invoke(LazyInitProxyFactory.java:507)~[wicket-ioc-7.6.0.jar:7.6.0]
>         at com.sun.proxy.$Proxy164.executeChanges(Unknown Source) ~[na:na]
>         at 
> com.evolveum.midpoint.web.component.progress.ProgressReporter.lambda$executeChangesAsync$0(ProgressReporter.java:187)~[classes/:na]
>         at java.lang.Thread.run(Thread.java:745) ~[na:1.8.0_111]
> Caused by: java.lang.IllegalStateException: Null parent for value 
> PCV(1):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation_)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
> in item 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}assignment):[PCV(1):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation_)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
> (assignment in user:09cff951-c031-4033-95a9-de85812ccc46(testovic))
>         at 
> com.evolveum.midpoint.prism.Item.checkConsistenceInternal(Item.java:748) 
> ~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.PrismContainer.checkConsistenceInternal(PrismContainer.java:688)~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.PrismContainerValue.checkConsistenceInternal(PrismContainerValue.java:1271)~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.Item.checkConsistenceInternal(Item.java:754) 
> ~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.PrismContainer.checkConsistenceInternal(PrismContainer.java:688)~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.PrismObject.checkConsistenceInternal(PrismObject.java:409)~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.prism.Item.checkConsistence(Item.java:709) 
> ~[prism-3.6.1.jar:na]
>         at 
> com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:491)~[model-impl-3.6.1.jar:na]
>         ... 21 common frames omitted
>
>
> I have found it comes from
> com.evolveum.midpoint.prism.Item radek 748,
>
>   if (val.getParent() == null) {
>           throw new IllegalStateException("Null parent for value 
> "+val+" in item "+this+" ("+path+" in "+rootItem+")");
>   }
>
>
> So far we haven't found any suspicious Users/Accounts metadata.
> Likely it is related to AD resource.
> Any hint or advice would be appreciated.
>
> Thx
>
> Petr Kulheim
> JEE Developer
>
> IBA CZ, s.r.o.
> Office: Petržílkova 2565/23, 158 00 Praha, CZ
> Phone: +420 603 272826
> E-mail: _petr.kulheim at ibacz.eu_ <mailto:petr.kulheim at ibacz.eu>
>
> IBACZ email signature <http://www.ibacz.eu/email-signature/index.html>
>
> ------------------------------------------------------------------------
> Disclaimer:
>
> The information contained in this communication is intended solely for 
> the use of the individual or entity to whom it is addressed and others 
> authorized to receive it.
> It may contain confidential or legally privileged information.
> If you are not the intended recipient you are hereby notified that any 
> disclosure, copying, distribution or taking any action in reliance on 
> the contents of this information is strictly prohibited and may be 
> unlawful.
> If you have received this communication in error, please notify us 
> immediately by forwarding this email to _ict at ibacz.eu_ 
> <mailto:ict at ibacz.eu>and then delete it from your system.
> IBA Group is neither liable for the proper and complete transmission 
> of the information contained in this communication nor for any delay 
> in its receipt.
>
>
> _______________________________________________
> midPoint mailing list_
> __midPoint at lists.evolveum.com_ <mailto:midPoint at lists.evolveum.com>_
> __http://lists.evolveum.com/mailman/listinfo/midpoint_
>
> _______________________________________________
> midPoint mailing list_
> __midPoint at lists.evolveum.com_ <mailto:midPoint at lists.evolveum.com>_
> __http://lists.evolveum.com/mailman/listinfo/midpoint_
>
>
>
> ------------------------------------------------------------------------
> Disclaimer:
>
> The information contained in this communication is intended solely for 
> the use of the individual or entity to whom it is addressed and others 
> authorized to receive it.
> It may contain confidential or legally privileged information.
> If you are not the intended recipient you are hereby notified that any 
> disclosure, copying, distribution or taking any action in reliance on 
> the contents of this information is strictly prohibited and may be 
> unlawful.
> If you have received this communication in error, please notify us 
> immediately by forwarding this email to _ict at ibacz.eu_ 
> <mailto:ict at ibacz.eu>and then delete it from your system.
> IBA Group is neither liable for the proper and complete transmission 
> of the information contained in this communication nor for any delay 
> in its receipt.
>
>
> _______________________________________________
> midPoint mailing list
> _midPoint at lists.evolveum.com_ <mailto:midPoint at lists.evolveum.com>
> _http://lists.evolveum.com/mailman/listinfo/midpoint_
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>
>
> ------------------------------------------------------------------------
> Disclaimer:
>
> The information contained in this communication is intended solely for 
> the use of the individual or entity to whom it is addressed and others 
> authorized to receive it.
> It may contain confidential or legally privileged information.
> If you are not the intended recipient you are hereby notified that any 
> disclosure, copying, distribution or taking any action in reliance on 
> the contents of this information is strictly prohibited and may be 
> unlawful.
> If you have received this communication in error, please notify us 
> immediately by forwarding this email to ict at ibacz.eu and then delete 
> it from your system.
> IBA Group is neither liable for the proper and complete transmission 
> of the information contained in this communication nor for any delay 
> in its receipt.
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180117/99cc0b8b/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: fjajgfmmeidimici.png
Type: image/png
Size: 48578 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180117/99cc0b8b/attachment.png>

From petr.kulheim at ibacz.eu  Wed Jan 17 19:40:49 2018
From: petr.kulheim at ibacz.eu (petr.kulheim at ibacz.eu)
Date: Wed, 17 Jan 2018 19:40:49 +0100
Subject: [midPoint] Fw: Null parent for value PCV(1) Exception during
 reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1
In-Reply-To: <e4a4ad20-eb72-2273-26ce-d1413042f9bf@evolveum.com>
References: <OFAACD6EB0.6563B937-ONC1258218.003F879F-C1258218.003F9C9B@ibacz.eu>
 <248efbb6-ffb6-dd87-5bb0-d2cccdf0d56f@evolveum.com>
 <OFA87C0D87.0CB4F554-ONC1258218.00563B9D-C1258218.0058DCE4@ibacz.eu>
 <0ddd3193-f6b7-bc58-e7f6-7329384c77a1@evolveum.com>
 <OFD057A993.87E1A850-ONC1258218.005C473B-C1258218.005C8575@ibacz.eu>
 <e4a4ad20-eb72-2273-26ce-d1413042f9bf@evolveum.com>
Message-ID: <OF4784ACD6.6B6ED882-ONC1258218.0064E885-C1258218.00669D46@ibacz.eu>

we will try yesterday as I do not have direct access to the system, but 
colleagues have.
thx
Petr





From:   Pavol Mederly <mederly at evolveum.com>
To:     midpoint at lists.evolveum.com
Date:   17/01/2018 19:03
Subject:        Re: [midPoint] Fw: Null parent for value PCV(1) Exception 
during reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1
Sent by:        "midPoint" <midpoint-bounces at lists.evolveum.com>



...and one more idea to try:
instead of <assignmentTargetSearch> element, could you try something like 
this and tell us if it helped?
<expression>
    <value>
        <targetRef oid="feed0000-0000-0000-0003-000000000001" 
type="c:RoleType"/>
    </value>
</expression>
It might behave differently from assignmentTargetSearch in some cases (I 
am not sure now), but at least it would provide us with a hint on where 
the problem could be.
(BTW, I was not able to replicate the problem with your configuration on 
my machine.)
Pavol Mederly
Software developer
evolveum.com

On 17.01.2018 17:50, petr.kulheim at ibacz.eu wrote:
Pavol, 
I guess it was assigned by User's object template mapping, pls see here: 

<mapping> 
      <name>Zamestnanec role assignment</name> 
      <strength>strong</strength> 
      <source> 
         <c:path>$user/employeeType</c:path> 
      </source> 
      <expression> 
         <assignmentTargetSearch xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" 
                                
 xsi:type="c:SearchObjectRefExpressionEvaluatorType"> 
            <targetType>c:RoleType</targetType> 
            <oid>feed0000-0000-0000-0003-000000000001</oid> 
         </assignmentTargetSearch> 
      </expression> 
      <target> 
         <c:path>assignment</c:path> 
      </target> 
      <condition> 
         <script xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
                 xsi:type="c:ScriptExpressionEvaluatorType"> 
            <code> 
                    employeeType != null &amp;&amp; employeeType == 'Z' 
                </code> 
         </script> 
      </condition> 
   </mapping> 

and also I attaching the Role definition. 


Thx 
Petr 






From:        Pavol Mederly <mederly at evolveum.com> 
To:        midpoint at lists.evolveum.com 
Date:        17/01/2018 17:26 
Subject:        Re: [midPoint] Fw: Null parent for value PCV(1) Exception 
during reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1 
Sent by:        "midPoint" <midpoint-bounces at lists.evolveum.com> 



Petr, 
thanks for the information. I think I understood. So, let's have a look at 
it: 
The problem is related to the assignment of a role with OID 
feed0000-0000-0000-0003-000000000001. 
How was that assignment created? Manually through a GUI? I assume it was 
created via some mapping. Can you post here the mapping? 
Pavol Mederly
Software developer
evolveum.com

On 17.01.2018 17:10, petr.kulheim at ibacz.eu wrote: 
Hi Pavol, 
provided exception bellow is from GUI action SAVE, with reconsiliation 
checkbox checked, no changed done. It is replicable. 

If we run recosiliation task, there are about  30 errors in   
      <partialResults> 
        
 <operation>com.evolveum.midpoint.common.operation.reconciliation.errors</operation>
         <status>not_applicable</status> 
         <token>1000000000000030110</token> 
         <message>Last 30 failures: 
      <partialResults> 
        
 <operation>com.evolveum.midpoint.common.operation.reconciliation.errors</operation>
         <status>not_applicable</status> 
         <token>1000000000000030110</token> 
         <message>Last 30 failures: 
CN=Jan novak,OU=BRC,DC=wintest,DC=bbb,DC=sk: 
java.lang.IllegalStateException: Null parent for value PCV(1):[PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
in item PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}assignment):[PCV(1):[PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]], 
PCV(2):[PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import
)]]], PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}construction):[PCV(null):[PrismReference({.../common/common-3}resourceRef):[PRV(oid=feed0000-0000-0000-0000-000000000001, 
targetType={.../common/common-3}ResourceType, 
relation={.../common/org-3}default)]]], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
(assignment in user:f259bab2-48eb-4e0f-b426-6b58445fdbae(jnovak)); in 
current user in 
LensFocusContext(UserType:f259bab2-48eb-4e0f-b426-6b58445fdbae) 
..... 


Looks like the same error as from GUI action, but no stack trace. 
thx a lot 

Petr 






From:        Pavol Mederly <mederly at evolveum.com> 
To:        midpoint at lists.evolveum.com 
Date:        17/01/2018 16:05 
Subject:        Re: [midPoint] Fw: Null parent for value PCV(1) Exception 
during reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1 
Sent by:        "midPoint" <midpoint-bounces at lists.evolveum.com> 



Hello Petr, 
just to make sure: You wrote that the exception occurs during 
reconciliation. I assume you mean reconciliation task. 
But the stack trace corresponds to a GUI operation. 
So, what's the case? Does it occur within a task or in GUI? If in GUI, is 
it replicable? 
Pavol Mederly
Software developer
evolveum.com

On 17.01.2018 12:34, petr.kulheim at ibacz.eu wrote: 
hi guys, 

we have customer's test environment where we have upgraded midpoint from 
3.5.1 to 3.6.1 
After this upgrade we have some users, about 30, having following 
Exception during reconsiliation: 

2018-01-15 17:33:30,325 [] [Thread-77] ERROR 
(com.evolveum.midpoint.web.component.progress.ProgressReporter): Error 
executing changes. 
java.lang.IllegalStateException: Null parent for value PCV(1):[PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
in item PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}assignment):[PCV(1):[PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
(assignment in user:09cff951-c031-4033-95a9-de85812ccc46(testovic)); in 
current user in 
LensFocusContext(UserType:09cff951-c031-4033-95a9-de85812ccc46) 
        at 
com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:495)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:461)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.LensFocusContext.checkConsistence(LensFocusContext.java:459)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:453)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.LensContext.checkConsistence(LensContext.java:678)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.projector.FocusProcessor.processFocusFocus(FocusProcessor.java:398)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.projector.FocusProcessor.processFocus(FocusProcessor.java:173)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.projector.Projector.lambda$projectInternal$1(Projector.java:227)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.LensUtil.partialExecute(LensUtil.java:1254)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.projector.Projector.projectInternal(Projector.java:225)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.projector.Projector.project(Projector.java:114)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.Clockwork.click(Clockwork.java:440)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.Clockwork.run(Clockwork.java:197) 
~[model-impl-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.model.impl.controller.ModelController.executeChanges(ModelController.java:572)~[model-impl-3.6.1.jar:na] 

        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
~[na:1.8.0_111] 
        at 
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)~[na:1.8.0_111] 

        at 
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)~[na:1.8.0_111] 

        at java.lang.reflect.Method.invoke(Method.java:498) 
~[na:1.8.0_111] 
        at 
org.apache.wicket.proxy.LazyInitProxyFactory$JdkHandler.invoke(LazyInitProxyFactory.java:507)~[wicket-ioc-7.6.0.jar:7.6.0] 

        at com.sun.proxy.$Proxy164.executeChanges(Unknown Source) ~[na:na] 

        at 
com.evolveum.midpoint.web.component.progress.ProgressReporter.lambda$executeChangesAsync$0(ProgressReporter.java:187)~[classes/:na] 

        at java.lang.Thread.run(Thread.java:745) ~[na:1.8.0_111] 
Caused by: java.lang.IllegalStateException: Null parent for value 
PCV(1):[PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
in item PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}assignment):[PCV(1):[PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
(assignment in user:09cff951-c031-4033-95a9-de85812ccc46(testovic)) 
        at 
com.evolveum.midpoint.prism.Item.checkConsistenceInternal(Item.java:748) 
~[prism-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.prism.PrismContainer.checkConsistenceInternal(PrismContainer.java:688)~[prism-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.prism.PrismContainerValue.checkConsistenceInternal(PrismContainerValue.java:1271)~[prism-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.prism.Item.checkConsistenceInternal(Item.java:754) 
~[prism-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.prism.PrismContainer.checkConsistenceInternal(PrismContainer.java:688)~[prism-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.prism.PrismObject.checkConsistenceInternal(PrismObject.java:409)~[prism-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.prism.Item.checkConsistence(Item.java:709) 
~[prism-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:491)~[model-impl-3.6.1.jar:na] 

        ... 21 common frames omitted 


I have found it comes from 
com.evolveum.midpoint.prism.Item radek 748, 

                        if (val.getParent() == null) { 
                                throw new IllegalStateException("Null 
parent for value "+val+" in item "+this+" ("+path+" in "+rootItem+")"); 
                        } 


So far we haven't found any suspicious Users/Accounts metadata. 
Likely it is related to AD resource. 
Any hint or advice would be appreciated. 

Thx 

Petr Kulheim
JEE Developer

IBA CZ, s.r.o.
Office: Petržílkova 2565/23, 158 00 Praha, CZ
Phone: +420 603 272826
E-mail: petr.kulheim at ibacz.eu 

Disclaimer:

The information contained in this communication is intended solely for the 
use of the individual or entity to whom it is addressed and others 
authorized to receive it.
It may contain confidential or legally privileged information.
If you are not the intended recipient you are hereby notified that any 
disclosure, copying, distribution or taking any action in reliance on the 
contents of this information is strictly prohibited and may be unlawful.
If you have received this communication in error, please notify us 
immediately by forwarding this email to ict at ibacz.eu and then delete it 
from your system.
IBA Group is neither liable for the proper and complete transmission of 
the information contained in this communication nor for any delay in its 
receipt. 


_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint

_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint



Disclaimer:

The information contained in this communication is intended solely for the 
use of the individual or entity to whom it is addressed and others 
authorized to receive it.
It may contain confidential or legally privileged information.
If you are not the intended recipient you are hereby notified that any 
disclosure, copying, distribution or taking any action in reliance on the 
contents of this information is strictly prohibited and may be unlawful.
If you have received this communication in error, please notify us 
immediately by forwarding this email to ict at ibacz.eu and then delete it 
from your system.
IBA Group is neither liable for the proper and complete transmission of 
the information contained in this communication nor for any delay in its 
receipt. 


_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint

_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint



Disclaimer:

The information contained in this communication is intended solely for the 
use of the individual or entity to whom it is addressed and others 
authorized to receive it.
It may contain confidential or legally privileged information.
If you are not the intended recipient you are hereby notified that any 
disclosure, copying, distribution or taking any action in reliance on the 
contents of this information is strictly prohibited and may be unlawful.
If you have received this communication in error, please notify us 
immediately by forwarding this email to ict at ibacz.eu and then delete it 
from your system.
IBA Group is neither liable for the proper and complete transmission of 
the information contained in this communication nor for any delay in its 
receipt. 


_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint

_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint



Disclaimer:

The information contained in this communication is intended solely for the 
use of the individual or entity to whom it is addressed and others 
authorized to receive it.
It may contain confidential or legally privileged information.
If you are not the intended recipient you are hereby notified that any 
disclosure, copying, distribution or taking any action in reliance on the 
contents of this information is strictly prohibited and may be unlawful.
If you have received this communication in error, please notify us 
immediately by forwarding this email to ict at ibacz.eu and then delete it 
from your system.
IBA Group is neither liable for the proper and complete transmission of 
the information contained in this communication nor for any delay in its 
receipt.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180117/28dd1695/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 48578 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180117/28dd1695/attachment.png>

From petr.kulheim at ibacz.eu  Thu Jan 18 09:13:27 2018
From: petr.kulheim at ibacz.eu (petr.kulheim at ibacz.eu)
Date: Thu, 18 Jan 2018 09:13:27 +0100
Subject: [midPoint] Fw: Null parent for value PCV(1) Exception during
 reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1
In-Reply-To: <OF4784ACD6.6B6ED882-ONC1258218.0064E885-C1258218.00669D46@ibacz.eu>
References: <OFAACD6EB0.6563B937-ONC1258218.003F879F-C1258218.003F9C9B@ibacz.eu>
 <248efbb6-ffb6-dd87-5bb0-d2cccdf0d56f@evolveum.com>
 <OFA87C0D87.0CB4F554-ONC1258218.00563B9D-C1258218.0058DCE4@ibacz.eu>
 <0ddd3193-f6b7-bc58-e7f6-7329384c77a1@evolveum.com>
 <OFD057A993.87E1A850-ONC1258218.005C473B-C1258218.005C8575@ibacz.eu>
 <e4a4ad20-eb72-2273-26ce-d1413042f9bf@evolveum.com>
 <OF4784ACD6.6B6ED882-ONC1258218.0064E885-C1258218.00669D46@ibacz.eu>
Message-ID: <OFFBEB74ED.7B7172FA-ONC1258219.002C6CCD-C1258219.002D2D9A@ibacz.eu>

hi Pavol,
with Peter Holes we have tried to change the role mapping on your 
suggesting but unfortunately it hasn't helped.

One more thing I have noticed: the user, which suffers the issue from GUI, 
the exception I have provided at the begging, is not in a list of users 
with the error from reconsiliation task.
We are going to check these users.

--pk






From:   petr.kulheim at ibacz.eu
To:     midPoint General Discussion <midpoint at lists.evolveum.com>
Date:   17/01/2018 19:44
Subject:        Re: [midPoint] Fw: Null parent for value PCV(1) Exception 
during reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1
Sent by:        "midPoint" <midpoint-bounces at lists.evolveum.com>



we will try yesterday as I do not have direct access to the system, but 
colleagues have. 
thx 
Petr 





From:        Pavol Mederly <mederly at evolveum.com> 
To:        midpoint at lists.evolveum.com 
Date:        17/01/2018 19:03 
Subject:        Re: [midPoint] Fw: Null parent for value PCV(1) Exception 
during reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1 
Sent by:        "midPoint" <midpoint-bounces at lists.evolveum.com> 



...and one more idea to try: 
instead of <assignmentTargetSearch> element, could you try something like 
this and tell us if it helped? 
<expression>
    <value>
        <targetRef oid="feed0000-0000-0000-0003-000000000001" 
type="c:RoleType"/>
    </value>
</expression> 
It might behave differently from assignmentTargetSearch in some cases (I 
am not sure now), but at least it would provide us with a hint on where 
the problem could be. 
(BTW, I was not able to replicate the problem with your configuration on 
my machine.) 
Pavol Mederly
Software developer
evolveum.com

On 17.01.2018 17:50, petr.kulheim at ibacz.eu wrote: 
Pavol, 
I guess it was assigned by User's object template mapping, pls see here: 

<mapping> 
      <name>Zamestnanec role assignment</name> 
      <strength>strong</strength> 
      <source> 
         <c:path>$user/employeeType</c:path> 
      </source> 
      <expression> 
         <assignmentTargetSearch xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" 
 xsi:type="c:SearchObjectRefExpressionEvaluatorType"> 
            <targetType>c:RoleType</targetType> 
            <oid>feed0000-0000-0000-0003-000000000001</oid> 
         </assignmentTargetSearch> 
      </expression> 
      <target> 
         <c:path>assignment</c:path> 
      </target> 
      <condition> 
         <script xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
                 xsi:type="c:ScriptExpressionEvaluatorType"> 
            <code> 
                    employeeType != null &amp;&amp; employeeType == 'Z' 
                </code> 
         </script> 
      </condition> 
   </mapping> 

and also I attaching the Role definition. 


Thx 
Petr 






From:        Pavol Mederly <mederly at evolveum.com> 
To:        midpoint at lists.evolveum.com 
Date:        17/01/2018 17:26 
Subject:        Re: [midPoint] Fw: Null parent for value PCV(1) Exception 
during reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1 
Sent by:        "midPoint" <midpoint-bounces at lists.evolveum.com> 



Petr, 
thanks for the information. I think I understood. So, let's have a look at 
it: 
The problem is related to the assignment of a role with OID 
feed0000-0000-0000-0003-000000000001. 
How was that assignment created? Manually through a GUI? I assume it was 
created via some mapping. Can you post here the mapping? 
Pavol Mederly
Software developer
evolveum.com

On 17.01.2018 17:10, petr.kulheim at ibacz.eu wrote: 
Hi Pavol, 
provided exception bellow is from GUI action SAVE, with reconsiliation 
checkbox checked, no changed done. It is replicable. 

If we run recosiliation task, there are about  30 errors in   
      <partialResults> 
 
<operation>com.evolveum.midpoint.common.operation.reconciliation.errors</operation>
         <status>not_applicable</status> 
         <token>1000000000000030110</token> 
         <message>Last 30 failures: 
      <partialResults> 
 
<operation>com.evolveum.midpoint.common.operation.reconciliation.errors</operation>
         <status>not_applicable</status> 
         <token>1000000000000030110</token> 
         <message>Last 30 failures: 
CN=Jan novak,OU=BRC,DC=wintest,DC=bbb,DC=sk: 
java.lang.IllegalStateException: Null parent for value PCV(1):[PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
in item PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}assignment):[PCV(1):[PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]], 
PCV(2):[PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import
)]]], PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}construction):[PCV(null):[PrismReference({.../common/common-3}resourceRef):[PRV(oid=feed0000-0000-0000-0000-000000000001, 
targetType={.../common/common-3}ResourceType, 
relation={.../common/org-3}default)]]], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
(assignment in user:f259bab2-48eb-4e0f-b426-6b58445fdbae(jnovak)); in 
current user in 
LensFocusContext(UserType:f259bab2-48eb-4e0f-b426-6b58445fdbae) 
..... 


Looks like the same error as from GUI action, but no stack trace. 
thx a lot 

Petr 






From:        Pavol Mederly <mederly at evolveum.com> 
To:        midpoint at lists.evolveum.com 
Date:        17/01/2018 16:05 
Subject:        Re: [midPoint] Fw: Null parent for value PCV(1) Exception 
during reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1 
Sent by:        "midPoint" <midpoint-bounces at lists.evolveum.com> 



Hello Petr, 
just to make sure: You wrote that the exception occurs during 
reconciliation. I assume you mean reconciliation task. 
But the stack trace corresponds to a GUI operation. 
So, what's the case? Does it occur within a task or in GUI? If in GUI, is 
it replicable? 
Pavol Mederly
Software developer
evolveum.com

On 17.01.2018 12:34, petr.kulheim at ibacz.eu wrote: 
hi guys, 

we have customer's test environment where we have upgraded midpoint from 
3.5.1 to 3.6.1 
After this upgrade we have some users, about 30, having following 
Exception during reconsiliation: 

2018-01-15 17:33:30,325 [] [Thread-77] ERROR 
(com.evolveum.midpoint.web.component.progress.ProgressReporter): Error 
executing changes. 
java.lang.IllegalStateException: Null parent for value PCV(1):[PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
in item PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}assignment):[PCV(1):[PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
(assignment in user:09cff951-c031-4033-95a9-de85812ccc46(testovic)); in 
current user in 
LensFocusContext(UserType:09cff951-c031-4033-95a9-de85812ccc46) 
        at 
com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:495)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:461)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.LensFocusContext.checkConsistence(LensFocusContext.java:459)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:453)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.LensContext.checkConsistence(LensContext.java:678)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.projector.FocusProcessor.processFocusFocus(FocusProcessor.java:398)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.projector.FocusProcessor.processFocus(FocusProcessor.java:173)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.projector.Projector.lambda$projectInternal$1(Projector.java:227)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.LensUtil.partialExecute(LensUtil.java:1254)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.projector.Projector.projectInternal(Projector.java:225)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.projector.Projector.project(Projector.java:114)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.Clockwork.click(Clockwork.java:440)~[model-impl-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.model.impl.lens.Clockwork.run(Clockwork.java:197) 
~[model-impl-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.model.impl.controller.ModelController.executeChanges(ModelController.java:572)~[model-impl-3.6.1.jar:na] 

        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
~[na:1.8.0_111] 
        at 
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)~[na:1.8.0_111] 

        at 
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)~[na:1.8.0_111] 

        at java.lang.reflect.Method.invoke(Method.java:498) 
~[na:1.8.0_111] 
        at 
org.apache.wicket.proxy.LazyInitProxyFactory$JdkHandler.invoke(LazyInitProxyFactory.java:507)~[wicket-ioc-7.6.0.jar:7.6.0] 

        at com.sun.proxy.$Proxy164.executeChanges(Unknown Source) ~[na:na] 

        at 
com.evolveum.midpoint.web.component.progress.ProgressReporter.lambda$executeChangesAsync$0(ProgressReporter.java:187)~[classes/:na] 

        at java.lang.Thread.run(Thread.java:745) ~[na:1.8.0_111] 
Caused by: java.lang.IllegalStateException: Null parent for value 
PCV(1):[PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
in item PC({http://midpoint.evolveum.com/xml/ns/public/common/common-3
}assignment):[PCV(1):[PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
targetType={.../common/common-3}UserType, 
relation={.../common/org-3}default)], 
PP({.../common/common-3}createChannel):[PPV(String:
http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation
)]]], 
PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
targetType={.../common/common-3}RoleType, 
relation={.../common/org-3}default)], PC({
http://midpoint.evolveum.com/xml/ns/public/common/common-3
}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
(assignment in user:09cff951-c031-4033-95a9-de85812ccc46(testovic)) 
        at 
com.evolveum.midpoint.prism.Item.checkConsistenceInternal(Item.java:748) 
~[prism-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.prism.PrismContainer.checkConsistenceInternal(PrismContainer.java:688)~[prism-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.prism.PrismContainerValue.checkConsistenceInternal(PrismContainerValue.java:1271)~[prism-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.prism.Item.checkConsistenceInternal(Item.java:754) 
~[prism-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.prism.PrismContainer.checkConsistenceInternal(PrismContainer.java:688)~[prism-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.prism.PrismObject.checkConsistenceInternal(PrismObject.java:409)~[prism-3.6.1.jar:na] 

        at 
com.evolveum.midpoint.prism.Item.checkConsistence(Item.java:709) 
~[prism-3.6.1.jar:na] 
        at 
com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:491)~[model-impl-3.6.1.jar:na] 

        ... 21 common frames omitted 


I have found it comes from 
com.evolveum.midpoint.prism.Item radek 748, 

                        if (val.getParent() == null) { 
                                throw new IllegalStateException("Null 
parent for value "+val+" in item "+this+" ("+path+" in "+rootItem+")"); 
                        } 


So far we haven't found any suspicious Users/Accounts metadata. 
Likely it is related to AD resource. 
Any hint or advice would be appreciated. 

Thx 

Petr Kulheim
JEE Developer

IBA CZ, s.r.o.
Office: Petržílkova 2565/23, 158 00 Praha, CZ
Phone: +420 603 272826
E-mail: petr.kulheim at ibacz.eu 

Disclaimer:

The information contained in this communication is intended solely for the 
use of the individual or entity to whom it is addressed and others 
authorized to receive it.
It may contain confidential or legally privileged information.
If you are not the intended recipient you are hereby notified that any 
disclosure, copying, distribution or taking any action in reliance on the 
contents of this information is strictly prohibited and may be unlawful.
If you have received this communication in error, please notify us 
immediately by forwarding this email to ict at ibacz.eu and then delete it 
from your system.
IBA Group is neither liable for the proper and complete transmission of 
the information contained in this communication nor for any delay in its 
receipt. 


_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint

_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint



Disclaimer:

The information contained in this communication is intended solely for the 
use of the individual or entity to whom it is addressed and others 
authorized to receive it.
It may contain confidential or legally privileged information.
If you are not the intended recipient you are hereby notified that any 
disclosure, copying, distribution or taking any action in reliance on the 
contents of this information is strictly prohibited and may be unlawful.
If you have received this communication in error, please notify us 
immediately by forwarding this email to ict at ibacz.eu and then delete it 
from your system.
IBA Group is neither liable for the proper and complete transmission of 
the information contained in this communication nor for any delay in its 
receipt. 


_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint

_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint



Disclaimer:

The information contained in this communication is intended solely for the 
use of the individual or entity to whom it is addressed and others 
authorized to receive it.
It may contain confidential or legally privileged information.
If you are not the intended recipient you are hereby notified that any 
disclosure, copying, distribution or taking any action in reliance on the 
contents of this information is strictly prohibited and may be unlawful.
If you have received this communication in error, please notify us 
immediately by forwarding this email to ict at ibacz.eu and then delete it 
from your system.
IBA Group is neither liable for the proper and complete transmission of 
the information contained in this communication nor for any delay in its 
receipt. 


_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint

_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint



Disclaimer:

The information contained in this communication is intended solely for the 
use of the individual or entity to whom it is addressed and others 
authorized to receive it.
It may contain confidential or legally privileged information.
If you are not the intended recipient you are hereby notified that any 
disclosure, copying, distribution or taking any action in reliance on the 
contents of this information is strictly prohibited and may be unlawful.
If you have received this communication in error, please notify us 
immediately by forwarding this email to ict at ibacz.eu and then delete it 
from your system.
IBA Group is neither liable for the proper and complete transmission of 
the information contained in this communication nor for any delay in its 
receipt. _______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
http://lists.evolveum.com/mailman/listinfo/midpoint



Disclaimer:

The information contained in this communication is intended solely for the 
use of the individual or entity to whom it is addressed and others 
authorized to receive it.
It may contain confidential or legally privileged information.
If you are not the intended recipient you are hereby notified that any 
disclosure, copying, distribution or taking any action in reliance on the 
contents of this information is strictly prohibited and may be unlawful.
If you have received this communication in error, please notify us 
immediately by forwarding this email to ict at ibacz.eu and then delete it 
from your system.
IBA Group is neither liable for the proper and complete transmission of 
the information contained in this communication nor for any delay in its 
receipt.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180118/c25473be/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 48578 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180118/c25473be/attachment.png>

From Caspi at seznam.cz  Thu Jan 18 10:00:16 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Thu, 18 Jan 2018 10:00:16 +0100 (CET)
Subject: [midPoint] Meta Role
Message-ID: <EHs.vRD.2rGa6S2}36N.1QO68W@seznam.cz>

Hi,



I have a question regarding assingning meta roles.




How can I automatically assign metarole to imported group from AD?




Now i am assigning meta role to roles based on roleType attribute. 




Imported roles have only names imported and projection filed by resource.

Is there posibility to create condition based on projection?




Thanks 




Jan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180118/eef947d2/attachment.htm>

From roman.pudil at ami.cz  Thu Jan 18 10:07:26 2018
From: roman.pudil at ami.cz (Roman Pudil - AMI Praha a.s.)
Date: Thu, 18 Jan 2018 09:07:26 +0000
Subject: [midPoint] Meta Role
In-Reply-To: <EHs.vRD.2rGa6S2}36N.1QO68W@seznam.cz>
References: <EHs.vRD.2rGa6S2}36N.1QO68W@seznam.cz>
Message-ID: <em0a3803bb-e981-41f8-b09c-cdb5618b96db@rpudil-dell7440>

Hi Jan,

1) look in documentation on wiki (especially for 
https://wiki.evolveum.com/display/midPoint/Active+Directory+Group+Synchronization+HOWTO)
2) look in examples in /samples/ directory on midPoint project (look 
there for Object Templates)

Regards

Roman Pudil
solution architect

gsm: [+420] 775 663 666
e-mail: roman.pudil at ami.cz


AMI Praha a.s.
Pláničkova 11
162 00 Praha 6
tel./fax: [+420] 274 783 239
web: www.ami.cz




<http://www.ami.cz/reseni-a-sluzby/bezpecnost-dat/identity-management>

Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za 
společnost AMI Praha a.s.
jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít 
výhradně písemnou formu.

------ Původní zpráva ------
Od: "Jan Kaspar" <Caspi at seznam.cz>
Komu: midpoint at lists.evolveum.com
Odesláno: 18.1.2018 10:00:16
Předmět: [midPoint] Meta Role

>Hi,
>
>I have a question regarding assingning meta roles.
>
>How can I automatically assign metarole to imported group from AD?
>
>Now i am assigning meta role to roles based on roleType attribute.
>
>Imported roles have only names imported and projection filed by 
>resource.
>Is there posibility to create condition based on projection?
>
>Thanks
>
>Jan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180118/6ea24cdb/attachment.htm>

From alcides.neto at gmail.com  Thu Jan 18 18:59:29 2018
From: alcides.neto at gmail.com (Alcides Carlos de Moraes Neto)
Date: Thu, 18 Jan 2018 15:59:29 -0200
Subject: [midPoint] Changes to Resource Object Template not affecting
	existing Objects
Message-ID: <CAMLLNm=DOQSBBEHbJzgsqVBmdKsbJ35f03Eg8SsfCf0nE+8M_A@mail.gmail.com>

Hello List,

I have a very simple SQL Resource that creates Org Strutucture from HR
System.

I have a Template for this resource and it is working OK.
However, I made some changes to this template, added some mappings with
conditions, and these are not applied to existing objects. I have tried
Recompute, Reconcile, Import accounts.
Only the new Orgs that were imported got the new mappings/assignments.

How can I apply my template changes to my existing objects?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180118/0a017bab/attachment.htm>

From alcides.neto at gmail.com  Thu Jan 18 19:02:59 2018
From: alcides.neto at gmail.com (Alcides Carlos de Moraes Neto)
Date: Thu, 18 Jan 2018 16:02:59 -0200
Subject: [midPoint] How to set AD password from Midpoint?
In-Reply-To: <CABAspd0_BMHpoccmHce6cc3gFO9AH7CfEr4sdsi=UEpFQH+jow@mail.gmail.com>
References: <CAMLLNmksQFzzJNxBhAmZzi+6UNcvCXUzt7QVWg=MLN2V4wQ6XQ@mail.gmail.com>
 <CANb693QrokdHFwFOJwUAcnu0smw2FxuPErvOPBtF5B4YXvY3Ng@mail.gmail.com>
 <CAMLLNmmxwej3sAvTusiJSNjxVeF3wL5AvoS9YXs7amY8_=q=yA@mail.gmail.com>
 <CANb693RtZCjUi-0LUJPEWABoqXmuy5ooKVeecP1sWFVYa8hxKA@mail.gmail.com>
 <CABAspd0_BMHpoccmHce6cc3gFO9AH7CfEr4sdsi=UEpFQH+jow@mail.gmail.com>
Message-ID: <CAMLLNm=b4e2nM615qyfS34wvDadYZv1RWucTL8CqRt32m8X6Yw@mail.gmail.com>

Forgot to reply to this, I got it working with the credentials tag, thanks!
I had to use the explicit fetchStrategy, or it wouldn't work.

 I generated the password instead of replicating from Midpoint, like this:

         <credentials>
            <password>
               <fetchStrategy>explicit</fetchStrategy>
               <outbound>
                  <authoritative>false</authoritative>
                  <exclusive>false</exclusive>
                  <strength>weak</strength>
                  <expression>
                     <generate xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"
                               xsi:type="c:GenerateExpressionEvaluatorType">
                        <valuePolicyRef
oid="00000000-0000-0000-0000-000000000003"/>
                     </generate>
                  </expression>
               </outbound>
            </password>
         </credentials>

2018-01-04 6:11 GMT-02:00 Petr Gašparík - AMI Praha a.s. <
petr.gasparik at ami.cz>:

> Hi, as Oleksandr says, AD disallows manipulating with userPassword
> directly. Instead, credential tag is used.
> Also, SSL is a must.
>
> in general. WILL_NOT_PERFORM is almost always wrongly set password - in
> our cases mostly policy violation (weak or no/bad set password)
>
> Petr
>
> --
>
> s pozdravem
>
> Petr Gašparík
> solution architect
>
> gsm: [+420] 603 523 860 <+420%20603%20523%20860>
> e-mail: petr.gasparik at ami.cz
>
>
> AMI Praha a.s.
> Pláničkova 11
> 162 00 Praha 6
> tel.: [+420] 274 783 239 <+420%20274%20783%20239>
> web: www.ami.cz
>
>
> [image: AMI Praha a.s.]
>
> Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za
> společnost AMI Praha a.s.
> jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně
> písemnou formu.
>
>
> 2018-01-04 8:39 GMT+01:00 Oleksandr Nekriach <o.nekriach at dynatech.lv>:
>
>> Hello,
>> It is strange I was sure that problem is in SSL.
>> See
>> Known Causes
>> - This is caused when you don't use SSL in your LDAP connection and AD
>> enforces SSL connection.
>> - There are password policies in the AD environment
>>
>> In my Midpoint instance I don't use "direct" outbound  mapping for
>> userPassword.
>> Instead, I use
>>
>>        <credentials>
>>             <password>
>>                <outbound>
>>                   <expression>
>>                      <asIs xsi:type="c:AsIsExpressionEvaluatorType"/>
>>                   </expression>
>>                </outbound>
>>             </password>
>>          </credentials>
>>
>> On 4 January 2018 at 02:00, Alcides Carlos de Moraes Neto
>> <alcides.neto at gmail.com> wrote:
>> > Hello,
>> >
>> > Yes, I'm using ldaps.
>> >
>> > 2018-01-02 5:16 GMT-02:00 Oleksandr Nekriach <o.nekriach at dynatech.lv>:
>> >>
>> >> Happy new year!
>> >> Hi Alcides,
>> >> Do you use secure communication for AD connection (ldaps) or not?
>> >> Some AD settings does not allow to manage password via open
>> >> communications.
>> >> I had similar issue few years ago with Oracle connector ;)
>> >>
>> >> Regards, Oleksandr
>> >>
>> >>
>> >> On 28 December 2017 at 21:30, Alcides Carlos de Moraes Neto
>> >> <alcides.neto at gmail.com> wrote:
>> >> > Hello list,
>> >> >
>> >> > I'm trying to create AD users from Midpoint. I'm getting the 53
>> >> > WILL_NOT_PERFORM error, which it seems to be related to the password
>> >> > policy.
>> >> > The AD I'm using does have a password policy.
>> >> >
>> >> > So I'm trying to set some literal, strong password as a placeholder,
>> but
>> >> > I
>> >> > don't think my mapping is working. How should I configure it? I
>> cannot
>> >> > find
>> >> > any examples. Below are the error I get and the password outbound
>> >> > mapping.
>> >> >
>> >> > com.evolveum.midpoint.util.exception.SystemException: Got unexpected
>> >> > exception:
>> >> >
>> >> > org.identityconnectors.framework.common.exceptions.Permissio
>> nDeniedException:
>> >> > Error adding LDAP entry CN=JOHN DOE,OU=Users,DC=midpoint,DC=local:
>> >> > unwillingToPerform: 0000052D: SvcErr: DSID-031A12D2, problem 5003
>> >> > (WILL_NOT_PERFORM), data 0?? (53)
>> >> >
>> >> > <attribute>
>> >> >             <c:ref>ri:userPassword</c:ref>
>> >> >             <tolerant>true</tolerant>
>> >> >             <exclusiveStrong>false</exclusiveStrong>
>> >> >             <fetchStrategy>explicit</fetchStrategy>
>> >> >             <outbound>
>> >> >                <authoritative>true</authoritative>
>> >> >                <exclusive>false</exclusive>
>> >> >                <strength>normal</strength>
>> >> >                <expression>
>> >> >                   <value>Midpoint2018*</value>
>> >> >                </expression>
>> >> >             </outbound>
>> >> > </attribute>
>> >> >
>> >> >
>> >> > Thanks and happy new year to all =)
>> >> >
>> >> > _______________________________________________
>> >> > midPoint mailing list
>> >> > midPoint at lists.evolveum.com
>> >> > http://lists.evolveum.com/mailman/listinfo/midpoint
>> >> >
>> >>
>> >>
>> >>
>> >> --
>> >> Best regards,
>> >>
>> >> Oleksandr Nekriach | Identity and access management engineer
>> >>
>> >> Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia
>> >>
>> >> +37125314685
>> >> ,
>> >> o.nekriach at dynatech.lv
>> >> |
>> >> www.dynatech.lv
>> >>
>> >>
>> >>
>> >>
>> >> Stay connected:
>> >>
>> >>
>> >> Confidentiality Notice: This message contains confidential information
>> >> and is intended only for the named recipient(s). If you are not the
>> >> addressee you may not copy, distribute or perform any other activities
>> >> with this information. If you have received this transmission in
>> >> error, please notify us by e-mail immediately. E-mail transmission
>> >> cannot be guaranteed to be secure or error-free as information could
>> >> be intercepted, corrupted, lost, destroyed, arrive late or incomplete,
>> >> or contain viruses.
>> >> _______________________________________________
>> >> midPoint mailing list
>> >> midPoint at lists.evolveum.com
>> >> http://lists.evolveum.com/mailman/listinfo/midpoint
>> >
>> >
>> >
>> > _______________________________________________
>> > midPoint mailing list
>> > midPoint at lists.evolveum.com
>> > http://lists.evolveum.com/mailman/listinfo/midpoint
>> >
>>
>>
>>
>> --
>> Best regards,
>>
>> Oleksandr Nekriach | Identity and access management engineer
>>
>> Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia
>>
>> +37125314685
>> ,
>> o.nekriach at dynatech.lv
>> |
>> www.dynatech.lv
>>
>>
>>
>>
>> Stay connected:
>>
>>
>> Confidentiality Notice: This message contains confidential information
>> and is intended only for the named recipient(s). If you are not the
>> addressee you may not copy, distribute or perform any other activities
>> with this information. If you have received this transmission in
>> error, please notify us by e-mail immediately. E-mail transmission
>> cannot be guaranteed to be secure or error-free as information could
>> be intercepted, corrupted, lost, destroyed, arrive late or incomplete,
>> or contain viruses.
>> _______________________________________________
>> midPoint mailing list
>> midPoint at lists.evolveum.com
>> http://lists.evolveum.com/mailman/listinfo/midpoint
>>
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180118/f0933296/attachment.htm>

From arnost.starosta at ami.cz  Fri Jan 19 09:55:43 2018
From: arnost.starosta at ami.cz (=?UTF-8?Q?Arno=C5=A1t_Starosta_=2D_AMI_Praha_a=2Es=2E?=)
Date: Fri, 19 Jan 2018 09:55:43 +0100
Subject: [midPoint] Changes to Resource Object Template not affecting
 existing Objects
In-Reply-To: <CAMLLNm=DOQSBBEHbJzgsqVBmdKsbJ35f03Eg8SsfCf0nE+8M_A@mail.gmail.com>
References: <CAMLLNm=DOQSBBEHbJzgsqVBmdKsbJ35f03Eg8SsfCf0nE+8M_A@mail.gmail.com>
Message-ID: <CAGPA3FLF9jfMB_Bx8yF=XoXtF-hyOBfWVNDGgWOLXL8s-CQ0Xw@mail.gmail.com>

Hi Carlos,

is the strength of your mappings normal or weak? Than they would be
'applied' to existing objects, but since there is no change in source
attributes or target attributes already have values, the mapping would be
skipped.

You can try changing the mapping strength to strong to compute the target
values all the time.

arnost

2018-01-18 18:59 GMT+01:00 Alcides Carlos de Moraes Neto <
alcides.neto at gmail.com>:

> Hello List,
>
> I have a very simple SQL Resource that creates Org Strutucture from HR
> System.
>
> I have a Template for this resource and it is working OK.
> However, I made some changes to this template, added some mappings with
> conditions, and these are not applied to existing objects. I have tried
> Recompute, Reconcile, Import accounts.
> Only the new Orgs that were imported got the new mappings/assignments.
>
> How can I apply my template changes to my existing objects?
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>


-- 

Arnošt Starosta
solution architect

gsm: [+420] 603 794 932
e-mail: arnost.starosta at ami.cz


AMI Praha a.s.
Pláničkova 11
162 00 Praha 6
tel.: [+420] 274 783 239
web: www.ami.cz


[image: AMI Praha a.s.]

[image: AMI Praha a.s.]
<http://www.ami.cz/reseni-a-sluzby/bezpecnost-dat/identity-management>

Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za
společnost AMI Praha a.s.
jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně
písemnou formu.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180119/f5e7b257/attachment.htm>

From alcides.neto at gmail.com  Fri Jan 19 17:37:27 2018
From: alcides.neto at gmail.com (Alcides Carlos de Moraes Neto)
Date: Fri, 19 Jan 2018 14:37:27 -0200
Subject: [midPoint] Changes to Resource Object Template not affecting
 existing Objects
In-Reply-To: <CAGPA3FLF9jfMB_Bx8yF=XoXtF-hyOBfWVNDGgWOLXL8s-CQ0Xw@mail.gmail.com>
References: <CAMLLNm=DOQSBBEHbJzgsqVBmdKsbJ35f03Eg8SsfCf0nE+8M_A@mail.gmail.com>
 <CAGPA3FLF9jfMB_Bx8yF=XoXtF-hyOBfWVNDGgWOLXL8s-CQ0Xw@mail.gmail.com>
Message-ID: <CAMLLNmkfcBPmYAHR_QZE4wcF_j4GiJ75P4SOf_NiC3s91YoXig@mail.gmail.com>

Hi Arnošt,

The new mappings are all strong and authoritative.

I'm logging to TRACE and the template is not even mentioned in the
CLOCKWORK SUMMARY, and the expressions are not called for existing objects,
only new ones.
I tested deleting one Org and Reimporting it, and that worked. But I cannot
delete all the Org Structure everytime I change the template...


2018-01-19 6:55 GMT-02:00 Arnošt Starosta - AMI Praha a.s. <
arnost.starosta at ami.cz>:

> Hi Carlos,
>
> is the strength of your mappings normal or weak? Than they would be
> 'applied' to existing objects, but since there is no change in source
> attributes or target attributes already have values, the mapping would be
> skipped.
>
> You can try changing the mapping strength to strong to compute the target
> values all the time.
>
> arnost
>
> 2018-01-18 18:59 GMT+01:00 Alcides Carlos de Moraes Neto <
> alcides.neto at gmail.com>:
>
>> Hello List,
>>
>> I have a very simple SQL Resource that creates Org Strutucture from HR
>> System.
>>
>> I have a Template for this resource and it is working OK.
>> However, I made some changes to this template, added some mappings with
>> conditions, and these are not applied to existing objects. I have tried
>> Recompute, Reconcile, Import accounts.
>> Only the new Orgs that were imported got the new mappings/assignments.
>>
>> How can I apply my template changes to my existing objects?
>>
>> _______________________________________________
>> midPoint mailing list
>> midPoint at lists.evolveum.com
>> http://lists.evolveum.com/mailman/listinfo/midpoint
>>
>>
>
>
> --
>
> Arnošt Starosta
> solution architect
>
> gsm: [+420] 603 794 932 <+420%20603%20794%20932>
> e-mail: arnost.starosta at ami.cz
>
>
> AMI Praha a.s.
> Pláničkova 11
> 162 00 Praha 6
> tel.: [+420] 274 783 239 <+420%20274%20783%20239>
> web: www.ami.cz
>
>
> [image: AMI Praha a.s.]
>
> [image: AMI Praha a.s.]
> <http://www.ami.cz/reseni-a-sluzby/bezpecnost-dat/identity-management>
>
> Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za
> společnost AMI Praha a.s.
> jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně
> písemnou formu.
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180119/1efe8b83/attachment.htm>

From ivan.noris at evolveum.com  Fri Jan 19 17:45:25 2018
From: ivan.noris at evolveum.com (Ivan Noris)
Date: Fri, 19 Jan 2018 17:45:25 +0100
Subject: [midPoint] Changes to Resource Object Template not affecting
 existing Objects
In-Reply-To: <CAMLLNmkfcBPmYAHR_QZE4wcF_j4GiJ75P4SOf_NiC3s91YoXig@mail.gmail.com>
References: <CAMLLNm=DOQSBBEHbJzgsqVBmdKsbJ35f03Eg8SsfCf0nE+8M_A@mail.gmail.com>
 <CAGPA3FLF9jfMB_Bx8yF=XoXtF-hyOBfWVNDGgWOLXL8s-CQ0Xw@mail.gmail.com>
 <CAMLLNmkfcBPmYAHR_QZE4wcF_j4GiJ75P4SOf_NiC3s91YoXig@mail.gmail.com>
Message-ID: <34ebc157-b314-0226-97b5-73f9f6b0b293@evolveum.com>

Hi,

where is your object template? Is it global (i.e. set in System
configuration) or is it a template in your resource referenced in your
synchronization actions?

Because if it's resource-referenced object template, maybe it is not
processed if you change something in organization in midPoint. It should
be however processed if the change comes from your resource.

Globally configured object template with strong authoritative mappings
should work in any case...

Best regards,

Ivan


On 19.01.2018 17:37, Alcides Carlos de Moraes Neto wrote:
> Hi Arnošt,
>
> The new mappings are all strong and authoritative.
>
> I'm logging to TRACE and the template is not even mentioned in the
> CLOCKWORK SUMMARY, and the expressions are not called for existing
> objects, only new ones.
> I tested deleting one Org and Reimporting it, and that worked. But I
> cannot delete all the Org Structure everytime I change the template...
>
>
> 2018-01-19 6:55 GMT-02:00 Arnošt Starosta - AMI Praha a.s.
> <arnost.starosta at ami.cz <mailto:arnost.starosta at ami.cz>>:
>
>     Hi Carlos,
>
>     is the strength of your mappings normal or weak? Than they would
>     be 'applied' to existing objects, but since there is no change in
>     source attributes or target attributes already have values, the
>     mapping would be skipped.
>
>     You can try changing the mapping strength to strong to compute the
>     target values all the time.
>
>     arnost
>
>     2018-01-18 18:59 GMT+01:00 Alcides Carlos de Moraes Neto
>     <alcides.neto at gmail.com <mailto:alcides.neto at gmail.com>>:
>
>         Hello List,
>
>         I have a very simple SQL Resource that creates Org Strutucture
>         from HR System.
>
>         I have a Template for this resource and it is working OK. 
>         However, I made some changes to this template, added some
>         mappings with conditions, and these are not applied to
>         existing objects. I have tried Recompute, Reconcile, Import
>         accounts.
>         Only the new Orgs that were imported got the new
>         mappings/assignments.
>
>         How can I apply my template changes to my existing objects?
>
>         _______________________________________________
>         midPoint mailing list
>         midPoint at lists.evolveum.com <mailto:midPoint at lists.evolveum.com>
>         http://lists.evolveum.com/mailman/listinfo/midpoint
>         <http://lists.evolveum.com/mailman/listinfo/midpoint>
>
>
>
>
>     -- 
>
>     Arnošt Starosta
>     solution architect
>
>     gsm: [+420] 603 794 932 <tel:+420%20603%20794%20932>
>     e-mail: arnost.starosta at ami.cz <mailto:arnost.starosta at ami.cz>
>
>     	    	    	
>
>     AMI Praha a.s.
>     Pláničkova 11
>     162 00 Praha 6
>     tel.: [+420] 274 783 239 <tel:+420%20274%20783%20239>
>     web: www.ami.cz <http://www.ami.cz/>
>
>     	    	    	
>
>     AMI Praha a.s.
>
>
>     AMI Praha a.s.
>     <http://www.ami.cz/reseni-a-sluzby/bezpecnost-dat/identity-management>
>
>
>     Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá
>     za společnost AMI Praha a.s.
>     jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít
>     výhradně písemnou formu.
>
>
>     _______________________________________________
>     midPoint mailing list
>     midPoint at lists.evolveum.com <mailto:midPoint at lists.evolveum.com>
>     http://lists.evolveum.com/mailman/listinfo/midpoint
>     <http://lists.evolveum.com/mailman/listinfo/midpoint>
>
>
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-- 
Ivan Noris
Senior Identity Engineer
evolveum.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180119/d6d71792/attachment.htm>

From alcides.neto at gmail.com  Fri Jan 19 18:06:43 2018
From: alcides.neto at gmail.com (Alcides Carlos de Moraes Neto)
Date: Fri, 19 Jan 2018 15:06:43 -0200
Subject: [midPoint] Changes to Resource Object Template not affecting
 existing Objects
In-Reply-To: <34ebc157-b314-0226-97b5-73f9f6b0b293@evolveum.com>
References: <CAMLLNm=DOQSBBEHbJzgsqVBmdKsbJ35f03Eg8SsfCf0nE+8M_A@mail.gmail.com>
 <CAGPA3FLF9jfMB_Bx8yF=XoXtF-hyOBfWVNDGgWOLXL8s-CQ0Xw@mail.gmail.com>
 <CAMLLNmkfcBPmYAHR_QZE4wcF_j4GiJ75P4SOf_NiC3s91YoXig@mail.gmail.com>
 <34ebc157-b314-0226-97b5-73f9f6b0b293@evolveum.com>
Message-ID: <CAMLLNmm0C_F8VA-YGHSmeKPm+HLaH+s0Oc9ndn9DhcSerR4WuQ@mail.gmail.com>

Hi Ivan,

Yes, it is a resource referenced template for OrgType objects. I understand
now why it doesn't work, thanks!

Is there a way to create a default Org Template in system configuration? I
already have a default user template.

2018-01-19 14:45 GMT-02:00 Ivan Noris <ivan.noris at evolveum.com>:

> Hi,
>
> where is your object template? Is it global (i.e. set in System
> configuration) or is it a template in your resource referenced in your
> synchronization actions?
>
> Because if it's resource-referenced object template, maybe it is not
> processed if you change something in organization in midPoint. It should be
> however processed if the change comes from your resource.
>
> Globally configured object template with strong authoritative mappings
> should work in any case...
>
> Best regards,
>
> Ivan
>
> On 19.01.2018 17:37, Alcides Carlos de Moraes Neto wrote:
>
> Hi Arnošt,
>
> The new mappings are all strong and authoritative.
>
> I'm logging to TRACE and the template is not even mentioned in the
> CLOCKWORK SUMMARY, and the expressions are not called for existing objects,
> only new ones.
> I tested deleting one Org and Reimporting it, and that worked. But I
> cannot delete all the Org Structure everytime I change the template...
>
>
> 2018-01-19 6:55 GMT-02:00 Arnošt Starosta - AMI Praha a.s. <
> arnost.starosta at ami.cz>:
>
>> Hi Carlos,
>>
>> is the strength of your mappings normal or weak? Than they would be
>> 'applied' to existing objects, but since there is no change in source
>> attributes or target attributes already have values, the mapping would be
>> skipped.
>>
>> You can try changing the mapping strength to strong to compute the target
>> values all the time.
>>
>> arnost
>>
>> 2018-01-18 18:59 GMT+01:00 Alcides Carlos de Moraes Neto <
>> alcides.neto at gmail.com>:
>>
>>> Hello List,
>>>
>>> I have a very simple SQL Resource that creates Org Strutucture from HR
>>> System.
>>>
>>> I have a Template for this resource and it is working OK.
>>> However, I made some changes to this template, added some mappings with
>>> conditions, and these are not applied to existing objects. I have tried
>>> Recompute, Reconcile, Import accounts.
>>> Only the new Orgs that were imported got the new mappings/assignments.
>>>
>>> How can I apply my template changes to my existing objects?
>>>
>>> _______________________________________________
>>> midPoint mailing list
>>> midPoint at lists.evolveum.com
>>> http://lists.evolveum.com/mailman/listinfo/midpoint
>>>
>>>
>>
>>
>> --
>>
>> Arnošt Starosta
>> solution architect
>>
>> gsm: [+420] 603 794 932 <+420%20603%20794%20932>
>> e-mail: arnost.starosta at ami.cz
>>
>>
>> AMI Praha a.s.
>> Pláničkova 11
>> 162 00 Praha 6
>> tel.: [+420] 274 783 239 <+420%20274%20783%20239>
>> web: www.ami.cz
>>
>>
>> [image: AMI Praha a.s.]
>>
>> [image: AMI Praha a.s.]
>> <http://www.ami.cz/reseni-a-sluzby/bezpecnost-dat/identity-management>
>>
>> Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za
>> společnost AMI Praha a.s.
>> jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně
>> písemnou formu.
>>
>>
>> _______________________________________________
>> midPoint mailing list
>> midPoint at lists.evolveum.com
>> http://lists.evolveum.com/mailman/listinfo/midpoint
>>
>>
>
>
> _______________________________________________
> midPoint mailing listmidPoint at lists.evolveum.comhttp://lists.evolveum.com/mailman/listinfo/midpoint
>
>
> --
> Ivan Noris
> Senior Identity Engineerevolveum.com
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180119/12541bae/attachment.htm>

From o.nekriach at dynatech.lv  Fri Jan 19 18:09:10 2018
From: o.nekriach at dynatech.lv (Oleksandr Nekriach)
Date: Fri, 19 Jan 2018 19:09:10 +0200
Subject: [midPoint] Changes to Resource Object Template not affecting
 existing Objects
In-Reply-To: <CAMLLNmkfcBPmYAHR_QZE4wcF_j4GiJ75P4SOf_NiC3s91YoXig@mail.gmail.com>
References: <CAMLLNm=DOQSBBEHbJzgsqVBmdKsbJ35f03Eg8SsfCf0nE+8M_A@mail.gmail.com>
 <CAGPA3FLF9jfMB_Bx8yF=XoXtF-hyOBfWVNDGgWOLXL8s-CQ0Xw@mail.gmail.com>
 <CAMLLNmkfcBPmYAHR_QZE4wcF_j4GiJ75P4SOf_NiC3s91YoXig@mail.gmail.com>
Message-ID: <CANb693Ty4T9yXUh5otNO44=DchDjhoPGNw51+v+0iXawJM6eAw@mail.gmail.com>

Hi  Alcides,
I have the same issue with role assignment through User Object template and
I am stuck.
See my Post with subject "Principle of Relativity"

Best regards, Oleksandr

On 19 January 2018 at 18:37, Alcides Carlos de Moraes Neto <
alcides.neto at gmail.com> wrote:

> Hi Arnošt,
>
> The new mappings are all strong and authoritative.
>
> I'm logging to TRACE and the template is not even mentioned in the
> CLOCKWORK SUMMARY, and the expressions are not called for existing objects,
> only new ones.
> I tested deleting one Org and Reimporting it, and that worked. But I
> cannot delete all the Org Structure everytime I change the template...
>
>
> 2018-01-19 6:55 GMT-02:00 Arnošt Starosta - AMI Praha a.s. <
> arnost.starosta at ami.cz>:
>
>> Hi Carlos,
>>
>> is the strength of your mappings normal or weak? Than they would be
>> 'applied' to existing objects, but since there is no change in source
>> attributes or target attributes already have values, the mapping would be
>> skipped.
>>
>> You can try changing the mapping strength to strong to compute the target
>> values all the time.
>>
>> arnost
>>
>> 2018-01-18 18:59 GMT+01:00 Alcides Carlos de Moraes Neto <
>> alcides.neto at gmail.com>:
>>
>>> Hello List,
>>>
>>> I have a very simple SQL Resource that creates Org Strutucture from HR
>>> System.
>>>
>>> I have a Template for this resource and it is working OK.
>>> However, I made some changes to this template, added some mappings with
>>> conditions, and these are not applied to existing objects. I have tried
>>> Recompute, Reconcile, Import accounts.
>>> Only the new Orgs that were imported got the new mappings/assignments.
>>>
>>> How can I apply my template changes to my existing objects?
>>>
>>> _______________________________________________
>>> midPoint mailing list
>>> midPoint at lists.evolveum.com
>>> http://lists.evolveum.com/mailman/listinfo/midpoint
>>>
>>>
>>
>>
>> --
>>
>> Arnošt Starosta
>> solution architect
>>
>> gsm: [+420] 603 794 932 <+420%20603%20794%20932>
>> e-mail: arnost.starosta at ami.cz
>>
>>
>> AMI Praha a.s.
>> Pláničkova 11
>> 162 00 Praha 6
>> tel.: [+420] 274 783 239 <+420%20274%20783%20239>
>> web: www.ami.cz
>>
>>
>> [image: AMI Praha a.s.]
>>
>> [image: AMI Praha a.s.]
>> <http://www.ami.cz/reseni-a-sluzby/bezpecnost-dat/identity-management>
>>
>> Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za
>> společnost AMI Praha a.s.
>> jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně
>> písemnou formu.
>>
>>
>> _______________________________________________
>> midPoint mailing list
>> midPoint at lists.evolveum.com
>> http://lists.evolveum.com/mailman/listinfo/midpoint
>>
>>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>


-- 
Best regards,

Oleksandr Nekriach | Identity and access management engineer

Dynatech, Mednieku str. 4a, Riga, LV-1010, Latvia

+37125314685 <+371%2025%20314%20685>
,
o.nekriach at dynatech.lv
|
www.dynatech.lv




Stay connected:
<https://www.facebook.com/DynatechLatvia/?ref=br_rs>
<https://www.linkedin.com/company-beta/17893047/>


Confidentiality Notice: This message contains confidential information and
is intended only for the named recipient(s). If you are not the addressee
you may not copy, distribute or perform any other activities with this
information. If you have received this transmission in error, please notify
us by e-mail immediately. E-mail transmission cannot be guaranteed to be
secure or error-free as information could be intercepted, corrupted, lost,
destroyed, arrive late or incomplete, or contain viruses.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180119/db61d788/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: o.nekriach at dynatech.lv1502777022855-7770
Type: image/png
Size: 2602 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180119/db61d788/attachment.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: o.nekriach at dynatech.lv1502777022855-7771
Type: image/png
Size: 790 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180119/db61d788/attachment-0001.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: o.nekriach at dynatech.lv1502777022855-7772
Type: image/png
Size: 786 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180119/db61d788/attachment-0002.png>

From ivan.noris at evolveum.com  Fri Jan 19 18:12:18 2018
From: ivan.noris at evolveum.com (Ivan Noris)
Date: Fri, 19 Jan 2018 18:12:18 +0100
Subject: [midPoint] Changes to Resource Object Template not affecting
 existing Objects
In-Reply-To: <CAMLLNmm0C_F8VA-YGHSmeKPm+HLaH+s0Oc9ndn9DhcSerR4WuQ@mail.gmail.com>
References: <CAMLLNm=DOQSBBEHbJzgsqVBmdKsbJ35f03Eg8SsfCf0nE+8M_A@mail.gmail.com>
 <CAGPA3FLF9jfMB_Bx8yF=XoXtF-hyOBfWVNDGgWOLXL8s-CQ0Xw@mail.gmail.com>
 <CAMLLNmkfcBPmYAHR_QZE4wcF_j4GiJ75P4SOf_NiC3s91YoXig@mail.gmail.com>
 <34ebc157-b314-0226-97b5-73f9f6b0b293@evolveum.com>
 <CAMLLNmm0C_F8VA-YGHSmeKPm+HLaH+s0Oc9ndn9DhcSerR4WuQ@mail.gmail.com>
Message-ID: <cce424fc-b472-b5a5-ec2c-8e24701ba117@evolveum.com>

Hi,

yes certainly. Go to to same place where you define default user
template (in GUI, but it differs a little for 3.7 and earlier versions),
and add another entry using "+" button: object type = OrgType and refer
to your template. Do not forget to save. And comment the template
reference in the resource before trying.

Ivan


On 19.01.2018 18:06, Alcides Carlos de Moraes Neto wrote:
> Hi Ivan,
>
> Yes, it is a resource referenced template for OrgType objects. I
> understand now why it doesn't work, thanks!
>
> Is there a way to create a default Org Template in system
> configuration? I already have a default user template.
>
> 2018-01-19 14:45 GMT-02:00 Ivan Noris <ivan.noris at evolveum.com
> <mailto:ivan.noris at evolveum.com>>:
>
>     Hi,
>
>     where is your object template? Is it global (i.e. set in System
>     configuration) or is it a template in your resource referenced in
>     your synchronization actions?
>
>     Because if it's resource-referenced object template, maybe it is
>     not processed if you change something in organization in midPoint.
>     It should be however processed if the change comes from your resource.
>
>     Globally configured object template with strong authoritative
>     mappings should work in any case...
>
>     Best regards,
>
>     Ivan
>
>
>     On 19.01.2018 17:37, Alcides Carlos de Moraes Neto wrote:
>>     Hi Arnošt,
>>
>>     The new mappings are all strong and authoritative.
>>
>>     I'm logging to TRACE and the template is not even mentioned in
>>     the CLOCKWORK SUMMARY, and the expressions are not called for
>>     existing objects, only new ones.
>>     I tested deleting one Org and Reimporting it, and that worked.
>>     But I cannot delete all the Org Structure everytime I change the
>>     template...
>>
>>
>>     2018-01-19 6:55 GMT-02:00 Arnošt Starosta - AMI Praha a.s.
>>     <arnost.starosta at ami.cz <mailto:arnost.starosta at ami.cz>>:
>>
>>         Hi Carlos,
>>
>>         is the strength of your mappings normal or weak? Than they
>>         would be 'applied' to existing objects, but since there is no
>>         change in source attributes or target attributes already have
>>         values, the mapping would be skipped.
>>
>>         You can try changing the mapping strength to strong to
>>         compute the target values all the time.
>>
>>         arnost
>>
>>         2018-01-18 18:59 GMT+01:00 Alcides Carlos de Moraes Neto
>>         <alcides.neto at gmail.com <mailto:alcides.neto at gmail.com>>:
>>
>>             Hello List,
>>
>>             I have a very simple SQL Resource that creates Org
>>             Strutucture from HR System.
>>
>>             I have a Template for this resource and it is working OK. 
>>             However, I made some changes to this template, added some
>>             mappings with conditions, and these are not applied to
>>             existing objects. I have tried Recompute, Reconcile,
>>             Import accounts.
>>             Only the new Orgs that were imported got the new
>>             mappings/assignments.
>>
>>             How can I apply my template changes to my existing objects?
>>
>>             _______________________________________________
>>             midPoint mailing list
>>             midPoint at lists.evolveum.com
>>             <mailto:midPoint at lists.evolveum.com>
>>             http://lists.evolveum.com/mailman/listinfo/midpoint
>>             <http://lists.evolveum.com/mailman/listinfo/midpoint>
>>
>>
>>
>>
>>         -- 
>>
>>         Arnošt Starosta
>>         solution architect
>>
>>         gsm: [+420] 603 794 932 <tel:+420%20603%20794%20932>
>>         e-mail: arnost.starosta at ami.cz <mailto:arnost.starosta at ami.cz>
>>
>>         	    	    	
>>
>>         AMI Praha a.s.
>>         Pláničkova 11
>>         162 00 Praha 6
>>         tel.: [+420] 274 783 239 <tel:+420%20274%20783%20239>
>>         web: www.ami.cz <http://www.ami.cz/>
>>
>>         	    	    	
>>
>>         AMI Praha a.s.
>>
>>
>>         AMI Praha a.s.
>>         <http://www.ami.cz/reseni-a-sluzby/bezpecnost-dat/identity-management>
>>
>>
>>         Textem tohoto e-mailu podepisující neslibuje uzavřít ani
>>         neuzavírá za společnost AMI Praha a.s.
>>         jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí
>>         mít výhradně písemnou formu.
>>
>>
>>         _______________________________________________
>>         midPoint mailing list
>>         midPoint at lists.evolveum.com <mailto:midPoint at lists.evolveum.com>
>>         http://lists.evolveum.com/mailman/listinfo/midpoint
>>         <http://lists.evolveum.com/mailman/listinfo/midpoint>
>>
>>
>>
>>
>>     _______________________________________________
>>     midPoint mailing list
>>     midPoint at lists.evolveum.com <mailto:midPoint at lists.evolveum.com>
>>     http://lists.evolveum.com/mailman/listinfo/midpoint
>>     <http://lists.evolveum.com/mailman/listinfo/midpoint>
>
>     -- 
>     Ivan Noris
>     Senior Identity Engineer
>     evolveum.com <http://evolveum.com>
>
>
>     _______________________________________________
>     midPoint mailing list
>     midPoint at lists.evolveum.com <mailto:midPoint at lists.evolveum.com>
>     http://lists.evolveum.com/mailman/listinfo/midpoint
>     <http://lists.evolveum.com/mailman/listinfo/midpoint>
>
>
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-- 
Ivan Noris
Senior Identity Engineer
evolveum.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180119/d9fec8b7/attachment.htm>

From alcides.neto at gmail.com  Fri Jan 19 18:43:09 2018
From: alcides.neto at gmail.com (Alcides Carlos de Moraes Neto)
Date: Fri, 19 Jan 2018 15:43:09 -0200
Subject: [midPoint] Changes to Resource Object Template not affecting
 existing Objects
In-Reply-To: <cce424fc-b472-b5a5-ec2c-8e24701ba117@evolveum.com>
References: <CAMLLNm=DOQSBBEHbJzgsqVBmdKsbJ35f03Eg8SsfCf0nE+8M_A@mail.gmail.com>
 <CAGPA3FLF9jfMB_Bx8yF=XoXtF-hyOBfWVNDGgWOLXL8s-CQ0Xw@mail.gmail.com>
 <CAMLLNmkfcBPmYAHR_QZE4wcF_j4GiJ75P4SOf_NiC3s91YoXig@mail.gmail.com>
 <34ebc157-b314-0226-97b5-73f9f6b0b293@evolveum.com>
 <CAMLLNmm0C_F8VA-YGHSmeKPm+HLaH+s0Oc9ndn9DhcSerR4WuQ@mail.gmail.com>
 <cce424fc-b472-b5a5-ec2c-8e24701ba117@evolveum.com>
Message-ID: <CAMLLNmkX+QgGV_C5mkZcG4x3ritWp99EGRGoixigQTjvDk021A@mail.gmail.com>

Yes! Did not know about defaultObjectPolicyConfiguration, only
defaultUserTemplate.
It's now working, thank you very much! :)

2018-01-19 15:12 GMT-02:00 Ivan Noris <ivan.noris at evolveum.com>:

> Hi,
>
> yes certainly. Go to to same place where you define default user template
> (in GUI, but it differs a little for 3.7 and earlier versions), and add
> another entry using "+" button: object type = OrgType and refer to your
> template. Do not forget to save. And comment the template reference in the
> resource before trying.
>
> Ivan
>
> On 19.01.2018 18:06, Alcides Carlos de Moraes Neto wrote:
>
> Hi Ivan,
>
> Yes, it is a resource referenced template for OrgType objects. I
> understand now why it doesn't work, thanks!
>
> Is there a way to create a default Org Template in system configuration? I
> already have a default user template.
>
> 2018-01-19 14:45 GMT-02:00 Ivan Noris <ivan.noris at evolveum.com>:
>
>> Hi,
>>
>> where is your object template? Is it global (i.e. set in System
>> configuration) or is it a template in your resource referenced in your
>> synchronization actions?
>>
>> Because if it's resource-referenced object template, maybe it is not
>> processed if you change something in organization in midPoint. It should be
>> however processed if the change comes from your resource.
>>
>> Globally configured object template with strong authoritative mappings
>> should work in any case...
>>
>> Best regards,
>>
>> Ivan
>>
>> On 19.01.2018 17:37, Alcides Carlos de Moraes Neto wrote:
>>
>> Hi Arnošt,
>>
>> The new mappings are all strong and authoritative.
>>
>> I'm logging to TRACE and the template is not even mentioned in the
>> CLOCKWORK SUMMARY, and the expressions are not called for existing objects,
>> only new ones.
>> I tested deleting one Org and Reimporting it, and that worked. But I
>> cannot delete all the Org Structure everytime I change the template...
>>
>>
>> 2018-01-19 6:55 GMT-02:00 Arnošt Starosta - AMI Praha a.s. <
>> arnost.starosta at ami.cz>:
>>
>>> Hi Carlos,
>>>
>>> is the strength of your mappings normal or weak? Than they would be
>>> 'applied' to existing objects, but since there is no change in source
>>> attributes or target attributes already have values, the mapping would be
>>> skipped.
>>>
>>> You can try changing the mapping strength to strong to compute the
>>> target values all the time.
>>>
>>> arnost
>>>
>>> 2018-01-18 18:59 GMT+01:00 Alcides Carlos de Moraes Neto <
>>> alcides.neto at gmail.com>:
>>>
>>>> Hello List,
>>>>
>>>> I have a very simple SQL Resource that creates Org Strutucture from HR
>>>> System.
>>>>
>>>> I have a Template for this resource and it is working OK.
>>>> However, I made some changes to this template, added some mappings with
>>>> conditions, and these are not applied to existing objects. I have tried
>>>> Recompute, Reconcile, Import accounts.
>>>> Only the new Orgs that were imported got the new mappings/assignments.
>>>>
>>>> How can I apply my template changes to my existing objects?
>>>>
>>>> _______________________________________________
>>>> midPoint mailing list
>>>> midPoint at lists.evolveum.com
>>>> http://lists.evolveum.com/mailman/listinfo/midpoint
>>>>
>>>>
>>>
>>>
>>> --
>>>
>>> Arnošt Starosta
>>> solution architect
>>>
>>> gsm: [+420] 603 794 932 <+420%20603%20794%20932>
>>> e-mail: arnost.starosta at ami.cz
>>>
>>>
>>> AMI Praha a.s.
>>> Pláničkova 11
>>> 162 00 Praha 6
>>> tel.: [+420] 274 783 239 <+420%20274%20783%20239>
>>> web: www.ami.cz
>>>
>>>
>>> [image: AMI Praha a.s.]
>>>
>>> [image: AMI Praha a.s.]
>>> <http://www.ami.cz/reseni-a-sluzby/bezpecnost-dat/identity-management>
>>>
>>> Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za
>>> společnost AMI Praha a.s.
>>> jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít
>>> výhradně písemnou formu.
>>>
>>>
>>> _______________________________________________
>>> midPoint mailing list
>>> midPoint at lists.evolveum.com
>>> http://lists.evolveum.com/mailman/listinfo/midpoint
>>>
>>>
>>
>>
>> _______________________________________________
>> midPoint mailing listmidPoint at lists.evolveum.comhttp://lists.evolveum.com/mailman/listinfo/midpoint
>>
>>
>> --
>> Ivan Noris
>> Senior Identity Engineerevolveum.com
>>
>>
>> _______________________________________________
>> midPoint mailing list
>> midPoint at lists.evolveum.com
>> http://lists.evolveum.com/mailman/listinfo/midpoint
>>
>>
>
>
> _______________________________________________
> midPoint mailing listmidPoint at lists.evolveum.comhttp://lists.evolveum.com/mailman/listinfo/midpoint
>
>
> --
> Ivan Noris
> Senior Identity Engineerevolveum.com
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180119/7eae5034/attachment.htm>

From Ivan.Noris at evolveum.com  Fri Jan 19 21:31:18 2018
From: Ivan.Noris at evolveum.com (Ivan Noris)
Date: Fri, 19 Jan 2018 21:31:18 +0100 (CET)
Subject: [midPoint] Changes to Resource Object Template not affecting
 existing Objects
In-Reply-To: <CAMLLNmkX+QgGV_C5mkZcG4x3ritWp99EGRGoixigQTjvDk021A@mail.gmail.com>
References: <CAMLLNm=DOQSBBEHbJzgsqVBmdKsbJ35f03Eg8SsfCf0nE+8M_A@mail.gmail.com>
 <CAGPA3FLF9jfMB_Bx8yF=XoXtF-hyOBfWVNDGgWOLXL8s-CQ0Xw@mail.gmail.com>
 <CAMLLNmkfcBPmYAHR_QZE4wcF_j4GiJ75P4SOf_NiC3s91YoXig@mail.gmail.com>
 <34ebc157-b314-0226-97b5-73f9f6b0b293@evolveum.com>
 <CAMLLNmm0C_F8VA-YGHSmeKPm+HLaH+s0Oc9ndn9DhcSerR4WuQ@mail.gmail.com>
 <cce424fc-b472-b5a5-ec2c-8e24701ba117@evolveum.com>
 <CAMLLNmkX+QgGV_C5mkZcG4x3ritWp99EGRGoixigQTjvDk021A@mail.gmail.com>
Message-ID: <241731219.1337259.1516393878328.JavaMail.zimbra@evolveum.com>

That was all related to midpoint 3.0 with generic synchronization :) Since that we can synchronize much more than just users and accounts. defaultUserTemplate was pre-3.0 setting. 

I'm glad it worked. 

Best regards, 
Ivan 

----- Original Message -----

> From: "Alcides Carlos de Moraes Neto" <alcides.neto at gmail.com>
> To: "midPoint General Discussion" <midpoint at lists.evolveum.com>
> Sent: Friday, January 19, 2018 6:43:09 PM
> Subject: Re: [midPoint] Changes to Resource Object Template not affecting
> existing Objects

> Yes! Did not know about defaultObjectPolicyConfiguration, only
> defaultUserTemplate.
> It's now working, thank you very much! :)

> 2018-01-19 15:12 GMT-02:00 Ivan Noris < ivan.noris at evolveum.com > :

> > Hi,
> 

> > yes certainly. Go to to same place where you define default user template
> > (in
> > GUI, but it differs a little for 3.7 and earlier versions), and add another
> > entry using "+" button: object type = OrgType and refer to your template.
> > Do
> > not forget to save. And comment the template reference in the resource
> > before trying.
> 

> > Ivan
> 

> > On 19.01.2018 18:06, Alcides Carlos de Moraes Neto wrote:
> 

> > > Hi Ivan,
> > 
> 

> > > Yes, it is a resource referenced template for OrgType objects. I
> > > understand
> > > now why it doesn't work, thanks!
> > 
> 

> > > Is there a way to create a default Org Template in system configuration?
> > > I
> > > already have a default user template.
> > 
> 

> > > 2018-01-19 14:45 GMT-02:00 Ivan Noris < ivan.noris at evolveum.com > :
> > 
> 

> > > > Hi,
> > > 
> > 
> 

> > > > where is your object template? Is it global (i.e. set in System
> > > > configuration) or is it a template in your resource referenced in your
> > > > synchronization actions?
> > > 
> > 
> 

> > > > Because if it's resource-referenced object template, maybe it is not
> > > > processed if you change something in organization in midPoint. It
> > > > should
> > > > be
> > > > however processed if the change comes from your resource.
> > > 
> > 
> 

> > > > Globally configured object template with strong authoritative mappings
> > > > should
> > > > work in any case...
> > > 
> > 
> 

> > > > Best regards,
> > > 
> > 
> 

> > > > Ivan
> > > 
> > 
> 

> > > > On 19.01.2018 17:37, Alcides Carlos de Moraes Neto wrote:
> > > 
> > 
> 

> > > > > Hi Arnošt,
> > > > 
> > > 
> > 
> 

> > > > > The new mappings are all strong and authoritative.
> > > > 
> > > 
> > 
> 

> > > > > I'm logging to TRACE and the template is not even mentioned in the
> > > > > CLOCKWORK
> > > > > SUMMARY, and the expressions are not called for existing objects,
> > > > > only
> > > > > new
> > > > > ones.
> > > > 
> > > 
> > 
> 
> > > > > I tested deleting one Org and Reimporting it, and that worked. But I
> > > > > cannot
> > > > > delete all the Org Structure everytime I change the template...
> > > > 
> > > 
> > 
> 

> > > > > 2018-01-19 6:55 GMT-02:00 Arnošt Starosta - AMI Praha a.s. <
> > > > > arnost.starosta at ami.cz > :
> > > > 
> > > 
> > 
> 

> > > > > > Hi Carlos,
> > > > > 
> > > > 
> > > 
> > 
> 

> > > > > > is the strength of your mappings normal or weak? Than they would be
> > > > > > 'applied'
> > > > > > to existing objects, but since there is no change in source
> > > > > > attributes
> > > > > > or
> > > > > > target attributes already have values, the mapping would be
> > > > > > skipped.
> > > > > 
> > > > 
> > > 
> > 
> 

> > > > > > You can try changing the mapping strength to strong to compute the
> > > > > > target
> > > > > > values all the time.
> > > > > 
> > > > 
> > > 
> > 
> 

> > > > > > arnost
> > > > > 
> > > > 
> > > 
> > 
> 

> > > > > > 2018-01-18 18:59 GMT+01:00 Alcides Carlos de Moraes Neto <
> > > > > > alcides.neto at gmail.com > :
> > > > > 
> > > > 
> > > 
> > 
> 

> > > > > > > Hello List,
> > > > > > 
> > > > > 
> > > > 
> > > 
> > 
> 

> > > > > > > I have a very simple SQL Resource that creates Org Strutucture
> > > > > > > from
> > > > > > > HR
> > > > > > > System.
> > > > > > 
> > > > > 
> > > > 
> > > 
> > 
> 

> > > > > > > I have a Template for this resource and it is working OK.
> > > > > > 
> > > > > 
> > > > 
> > > 
> > 
> 
> > > > > > > However, I made some changes to this template, added some
> > > > > > > mappings
> > > > > > > with
> > > > > > > conditions, and these are not applied to existing objects. I have
> > > > > > > tried
> > > > > > > Recompute, Reconcile, Import accounts.
> > > > > > 
> > > > > 
> > > > 
> > > 
> > 
> 
> > > > > > > Only the new Orgs that were imported got the new
> > > > > > > mappings/assignments.
> > > > > > 
> > > > > 
> > > > 
> > > 
> > 
> 

> > > > > > > How can I apply my template changes to my existing objects?
> > > > > > 
> > > > > 
> > > > 
> > > 
> > 
> 

> > > > > > > _______________________________________________
> > > > > > 
> > > > > 
> > > > 
> > > 
> > 
> 
> > > > > > > midPoint mailing list
> > > > > > 
> > > > > 
> > > > 
> > > 
> > 
> 
> > > > > > > midPoint at lists.evolveum.com
> > > > > > 
> > > > > 
> > > > 
> > > 
> > 
> 
> > > > > > > http://lists.evolveum.com/mailman/listinfo/midpoint
> > > > > > 
> > > > > 
> > > > 
> > > 
> > 
> 

> > > > > > --
> > > > > 
> > > > 
> > > 
> > 
> 

> > > > > > Arnošt Starosta
> > > > > 
> > > > 
> > > 
> > 
> 
> > > > > > solution architect
> > > > > 
> > > > 
> > > 
> > 
> 

> > > > > > gsm: [+420] 603 794 932
> > > > > 
> > > > 
> > > 
> > 
> 
> > > > > > e-mail: arnost.starosta at ami.cz
> > > > > 
> > > > 
> > > 
> > 
> 
> > > > > > 
> > > > > 
> > > > 
> > > 
> > 
> 

> > > > > > AMI Praha a.s.
> > > > > 
> > > > 
> > > 
> > 
> 
> > > > > > Pláničkova 11
> > > > > 
> > > > 
> > > 
> > 
> 
> > > > > > 162 00 Praha 6
> > > > > 
> > > > 
> > > 
> > 
> 
> > > > > > tel.: [+420] 274 783 239
> > > > > 
> > > > 
> > > 
> > 
> 
> > > > > > web: www.ami.cz
> > > > > 
> > > > 
> > > 
> > 
> 
> > > > > > 
> > > > > 
> > > > 
> > > 
> > 
> 

> > > > > > Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá
> > > > > > za
> > > > > > společnost AMI Praha a.s.
> > > > > 
> > > > 
> > > 
> > 
> 
> > > > > > jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít
> > > > > > výhradně
> > > > > > písemnou formu.
> > > > > 
> > > > 
> > > 
> > 
> 

> > > > > > _______________________________________________
> > > > > 
> > > > 
> > > 
> > 
> 
> > > > > > midPoint mailing list
> > > > > 
> > > > 
> > > 
> > 
> 
> > > > > > midPoint at lists.evolveum.com
> > > > > 
> > > > 
> > > 
> > 
> 
> > > > > > http://lists.evolveum.com/mailman/listinfo/midpoint
> > > > > 
> > > > 
> > > 
> > 
> 

> > > > > _______________________________________________
> > > > 
> > > 
> > 
> 
> > > > > midPoint mailing list midPoint at lists.evolveum.com
> > > > > http://lists.evolveum.com/mailman/listinfo/midpoint
> > > > 
> > > 
> > 
> 

> > > > --
> > > 
> > 
> 
> > > > Ivan Noris
> > > 
> > 
> 
> > > > Senior Identity Engineer evolveum.com
> > > 
> > 
> 

> > > > _______________________________________________
> > > 
> > 
> 
> > > > midPoint mailing list
> > > 
> > 
> 
> > > > midPoint at lists.evolveum.com
> > > 
> > 
> 
> > > > http://lists.evolveum.com/mailman/listinfo/midpoint
> > > 
> > 
> 

> > > _______________________________________________
> > 
> 
> > > midPoint mailing list midPoint at lists.evolveum.com
> > > http://lists.evolveum.com/mailman/listinfo/midpoint
> > 
> 

> > --
> 
> > Ivan Noris
> 
> > Senior Identity Engineer evolveum.com
> 

> > _______________________________________________
> 
> > midPoint mailing list
> 
> > midPoint at lists.evolveum.com
> 
> > http://lists.evolveum.com/mailman/listinfo/midpoint
> 

> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-- 
Ivan Noris 
Senior Identity Engineer 
evolveum.com 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180119/e251d892/attachment.htm>

From Caspi at seznam.cz  Sat Jan 20 19:56:44 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Sat, 20 Jan 2018 19:56:44 +0100 (CET)
Subject: [midPoint] Template modification
Message-ID: <3eA.vRv.1QmTpD}yTN9.1QOv3i@seznam.cz>



        Hi all,
        
        
        
        I need help with modification of template. I have following mapping 
        in template:
        
        
        
        
        
           <mapping id="13">
        
              <name>User - AD Role mapping</name>
        
              <authoritative>true</authoritative>
        
              <strength>strong</strength>
        
              <source>
        
                 <name>ADGroup</name>
        
                 <c:path>extension/ADGroups</c:path>
        
              </source>
        
              <expression>
        
                 <script xmlns:xsi="http://www.w3.org/2001/XMLSchema-
        instance(http://www.w3.org/2001/XMLSchema-instance)"
        
                         xsi:type="c:ScriptExpressionEvaluatorType">
        
                    <code>
        
           import com.evolveum.midpoint.xml.ns._public.common.common_3.
        AssignmentType
        (http://com.evolveum.midpoint.xml.ns._public.common.common_3.assignmenttype/)
        ;
        
            import com.evolveum.midpoint.xml.ns._public.common.common_3.
        ObjectReferenceType
        (http://com.evolveum.midpoint.xml.ns._public.common.common_3.objectreferencetype/)
        ;
        
            import com.evolveum.midpoint.xml.ns._public.common.common_3.
        RoleType
        (http://com.evolveum.midpoint.xml.ns._public.common.common_3.roletype/)
        ;
        
            import com.evolveum.midpoint.xml.ns._public.common.common_3.
        OrgType
        (http://com.evolveum.midpoint.xml.ns._public.common.common_3.orgtype/)
        ;
        
            import java.util.*;
        
           
        
            log.warn("AD Role mapping {}" , ADGroup)
        
           if (ADGroup != null){
        
        orgName = ADGroup;
        
            
        
                        org = midpoint.searchObjectByName(RoleType.class, 
        orgName);
        
                            log.info("org {}" , org)
        
        
                            orgOrt = new ObjectReferenceType();
        
                 orgOrt.setOid(org.getOid());
        
                       orgOrt.setType(RoleType.COMPLEX_TYPE);
        
                AssignmentType assignment = new AssignmentType();
        
                assignment.asPrismContainerValue()
        
                assignment.setTargetRef(orgOrt);
        
                return assignment
        
        
        
        
           }
        
            </code>
        
                 </script>
        
              </expression>
        
              <target>
        
                 <c:path>assignment</c:path>
        
              </target>
        
              <condition>
        
                 <script xmlns:xsi="http://www.w3.org/2001/XMLSchema-
        instance(http://www.w3.org/2001/XMLSchema-instance)"
        
                         xsi:type="c:ScriptExpressionEvaluatorType">
        
                    <code>
        
                log.info("AD Role mapping {}, ADGroup {}" , (ADGroup != 
        null), ADGroup)
        
                     return ADGroup != null
        
                    </code>
        
                 </script>
        
              </condition>
        
           </mapping>
        
        
        
        
        
        
        
        
        It works fine, users are imported with attribute ADGroups and all is
        OK. But some users have in thei attributes groups,
        
        that are not managed and imported to IDM. Typicaly protected admins 
        group. (Schema Admins, SQL Admins etc.)
        
        
        
        
        How can I update this template to skip those groups? Now i am 
        getting error:
        
        
        
        
        Couldn't reconcile user user:f4f60447-77d9-4a9e-a5f7-6f43b34c834f
        (jan.kaspar).
        
        
        
        
        
        
        Error
        java.lang.NullPointerException
        (http://java.lang.nullpointerexception/): Cannot invoke method 
        getOid() on null object in expression in mapping 'User - AD Role 
        mapping' in template mapping 'User - AD Role mapping' in 
        objectTemplate:84769304-7776-11e2-b582-001e8c717e5b(Default User 
        Template)(ADGroup=Schema Admins; ) in expression in mapping 'User - 
        AD Role mapping' in template mapping 'User - AD Role mapping' in 
        objectTemplate:84769304-7776-11e2-b582-001e8c717e5b(Default User 
        Template)
        show
        com.evolveum.midpoint.util.exception.ExpressionEvaluationException
        (http://com.evolveum.midpoint.util.exception.expressionevaluationexception/)
        : java.lang.NullPointerException
        (http://java.lang.nullpointerexception/): Cannot invoke method 
        getOid() on null object in expression in mapping 'User - AD Role 
        mapping' in template mapping 'User - AD Role mapping' in 
        objectTemplate:84769304-7776-11e2-b582-001e8c717e5b(Default User 
        Template)(ADGroup=Schema Admins; ) in expression in mapping 'User - 
        AD Role mapping' in template mapping 'User - AD Role mapping' in 
        objectTemplate:84769304-7776-11e2-b582-001e8c717e5b(Default User 
        Template)
        
        
        
        
        
        So basicaly i need condition to check if coresponding role exist... 
        
        
        
        
        Jan
        
        
        
        




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180120/5a49383c/attachment.htm>

From oskar.butovic at ami.cz  Mon Jan 22 11:15:59 2018
From: oskar.butovic at ami.cz (=?UTF-8?Q?Oskar_Butovi=C4=8D_=2D_AMI_Praha_a=2Es=2E?=)
Date: Mon, 22 Jan 2018 11:15:59 +0100
Subject: [midPoint] Template modification
In-Reply-To: <3eA.vRv.1QmTpD}yTN9.1QOv3i@seznam.cz>
References: <3eA.vRv.1QmTpD}yTN9.1QOv3i@seznam.cz>
Message-ID: <CAE8MtZA3LWPUdb8xc-HH6uc_njsQ4udS63E6vw5m86G4yGC97Q@mail.gmail.com>

Hi Jan

Basically, your script does not find "org" and then you call getOid() on
null object. I think that surrounding that assignment creation code with
if(org != null) should suffice.

Best Regards
Oskar Butovič

2018-01-20 19:56 GMT+01:00 Jan Kaspar <Caspi at seznam.cz>:

> Hi all,
>
> I need help with modification of template. I have following mapping in
> template:
>
>    <mapping id="13">
>       <name>User - AD Role mapping</name>
>       <authoritative>true</authoritative>
>       <strength>strong</strength>
>       <source>
>          <name>ADGroup</name>
>          <c:path>extension/ADGroups</c:path>
>       </source>
>       <expression>
>          <script xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
>                  xsi:type="c:ScriptExpressionEvaluatorType">
>             <code>
>    import com.evolveum.midpoint.xml.ns._public.common.common_
> 3.AssignmentType
> <http://com.evolveum.midpoint.xml.ns._public.common.common_3.assignmenttype/>
> ;
>    import com.evolveum.midpoint.xml.ns._public.common.common_
> 3.ObjectReferenceType
> <http://com.evolveum.midpoint.xml.ns._public.common.common_3.objectreferencetype/>
> ;
>    import com.evolveum.midpoint.xml.ns._public.common.common_3.RoleType
> <http://com.evolveum.midpoint.xml.ns._public.common.common_3.roletype/>;
>    import com.evolveum.midpoint.xml.ns._public.common.common_3.OrgType
> <http://com.evolveum.midpoint.xml.ns._public.common.common_3.orgtype/>;
>    import java.util.*;
>
>    log.warn("AD Role mapping {}" , ADGroup)
>    if (ADGroup != null){
> orgName = ADGroup;
>
>                 org = midpoint.searchObjectByName(RoleType.class,
> orgName);
>                     log.info("org {}" , org)
>                     orgOrt = new ObjectReferenceType();
>          orgOrt.setOid(org.getOid());
>                orgOrt.setType(RoleType.COMPLEX_TYPE);
>         AssignmentType assignment = new AssignmentType();
>         assignment.asPrismContainerValue()
>         assignment.setTargetRef(orgOrt);
>         return assignment
>
>    }
>    </code>
>          </script>
>       </expression>
>       <target>
>          <c:path>assignment</c:path>
>       </target>
>       <condition>
>          <script xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
>                  xsi:type="c:ScriptExpressionEvaluatorType">
>             <code>
>         log.info("AD Role mapping {}, ADGroup {}" , (ADGroup != null),
> ADGroup)
>              return ADGroup != null
>             </code>
>          </script>
>       </condition>
>    </mapping>
>
>
> It works fine, users are imported with attribute ADGroups and all is OK.
> But some users have in thei attributes groups,
> that are not managed and imported to IDM. Typicaly protected admins group.
> (Schema Admins, SQL Admins etc.)
>
> How can I update this template to skip those groups? Now i am getting
> error:
>
> Couldn't reconcile user user:f4f60447-77d9-4a9e-a5f7-
> 6f43b34c834f(jan.kaspar).Errorjava.lang.NullPointerException
> <http://java.lang.nullpointerexception/>: Cannot invoke method getOid()
> on null object in expression in mapping 'User - AD Role mapping' in
> template mapping 'User - AD Role mapping' in objectTemplate:84769304-7776-11e2-b582-001e8c717e5b(Default
> User Template)(ADGroup=Schema Admins; ) in expression in mapping 'User - AD
> Role mapping' in template mapping 'User - AD Role mapping' in
> objectTemplate:84769304-7776-11e2-b582-001e8c717e5b(Default User Template)
> showcom.evolveum.midpoint.util.exception.ExpressionEvaluationException
> <http://com.evolveum.midpoint.util.exception.expressionevaluationexception/>:
> java.lang.NullPointerException <http://java.lang.nullpointerexception/>:
> Cannot invoke method getOid() on null object in expression in mapping 'User
> - AD Role mapping' in template mapping 'User - AD Role mapping' in
> objectTemplate:84769304-7776-11e2-b582-001e8c717e5b(Default User
> Template)(ADGroup=Schema Admins; ) in expression in mapping 'User - AD Role
> mapping' in template mapping 'User - AD Role mapping' in
> objectTemplate:84769304-7776-11e2-b582-001e8c717e5b(Default User Template)
>
> So basicaly i need condition to check if coresponding role exist...
>
> Jan
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>


-- 

Oskar Butovič
solution architect

gsm: [+420] 774 480 101
e-mail: oskar.butovic at ami.cz


AMI Praha a.s.
Pláničkova 11
162 00 Praha 6
tel.: [+420] 274 783 239
web: www.ami.cz


[image: AMI Praha a.s.]

[image: AMI Praha a.s.]
<http://www.ami.cz/reseni-a-sluzby/bezpecnost-dat/identity-management>

Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za
společnost AMI Praha a.s.
jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně
písemnou formu.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180122/4af253fb/attachment.htm>

From ramon.cahenzli at zhdk.ch  Mon Jan 22 12:19:39 2018
From: ramon.cahenzli at zhdk.ch (=?UTF-8?B?UmFtw7Nu?= Cahenzli)
Date: Mon, 22 Jan 2018 12:19:39 +0100
Subject: [midPoint] Upgrade from 3.6 to 3.7 (standalone) leaves ownerref
 empty on tasks, can't start midPoint
Message-ID: <20180122121939.28d237cf@castle>

Hello everyone,

We run midPoint on Debian with PostgreSQL. I've upgraded one of our dev
instances successfully to 3.7 with no issues, apart for the problem
that the following index from postgresql-upgrade-3.6-3.7.sql already
exists:

CREATE INDEX iOpExecOwnerOid
  ON m_operation_execution (owner_oid);

If you check the previous schema that was
included with midPoint 3.6 (postgresql-upgrade-3.5-3.6.sql) you'll
notice that this index was defined there.

But this isn't even the real problem. The issue is that some tasks
defined in midPoint 3.6 don't seem to have an owner reference, and
midPoint 3.7 does not start with such a database.

The relevant log lines, truncated:

ERROR
(com.evolveum.midpoint.task.quartzimpl.execution.TaskSynchronizer):
Task Manager cannot synchronize task
00000000-0000-0000-0000-000000000007 due to schema exception..

com.evolveum.midpoint.util.exception.SchemaException: Task
00000000-0000-0000-0000-000000000007 does not have an owner (missing
ownerRef)


The database confirms this:


midpoint=# select name_norm, ownerref_targetoid from m_task;
    name_norm     |          ownerref_targetoid
------------------+--------------------------------------
 cleanup          | 00000000-0000-0000-0000-000000000002
 trigger scanner  |
 validity scanner |
(3 rows)


What I've tried so far:

I did the terrible hack of just setting the ownerref_ fields to the
same as in the "cleanup" task. However, when restarting midPoint, the
data is overwritten, the records are missing ownerrefs again. This
leads me to believe that midPoint deletes and recreates these records
on its own during startup.

How could I fix this? I am happy to supply more information.

Cheers,

-- 
—
—
Zürcher Hochschule der Künste
Zurich University of the Arts
—
Ramón Cahenzli, MSc.
IT Architect
—
Pfingstweidstrasse 96, Postfach, 8031 Zürich
Tel. +41 43 446 31 63, Fax +41 43 446 45 21
ramon.cahenzli at zhdk.ch
—
http://www.zhdk.ch
http://itz.zhdk.ch


From mederly at evolveum.com  Mon Jan 22 13:37:51 2018
From: mederly at evolveum.com (Pavol Mederly)
Date: Mon, 22 Jan 2018 13:37:51 +0100
Subject: [midPoint] Upgrade from 3.6 to 3.7 (standalone) leaves ownerref
 empty on tasks, can't start midPoint
In-Reply-To: <20180122121939.28d237cf@castle>
References: <20180122121939.28d237cf@castle>
Message-ID: <7ec6ef7a-b317-a904-60ce-4c34813ad3a5@evolveum.com>

Hello Ramón,

As for the iOpExecOwnerOid being already present, I do apologize. When 
finalizing SQL update scripts I have checked against "3.6-all" scripts, 
and the index is not there. It somehow got into upgrade scripts without 
modifying the "full" ones.

---

As for the missing ownerRef, it should not prevent midPoint from starting.

It should only cause the initial task synchronization procedure to 
report some problems,  but midPoint as such should continue to load (and 
eventually start successfully). I have now tested it on code almost 
identical to 3.7, both in "tomcat" and standalone mode. The issue 
manifests itself as the exception you mentioned, plus a summarizing message:

/2018-01-22 13:28:42,632 [] [RMI TCP Connection(3)-127.0.0.1] INFO 
(com.evolveum.midpoint.task.quartzimpl.execution.TaskSynchronizer): 
Synchronization of midpoint and Quartz task store finished. 4 task(s) 
existing in midPoint repository successfully processed, resulting in 2 
updated Quartz job(s). 0 task(s) removed from Quartz job store. 
//*Processing of 1 task(s) failed*//./

(More tasks, in your case.) And the midPoint starts well.

---

As far as I know, the issue is not related to version change from 3.6 to 
3.7. The code that checks ownerRef is there since 2012. And the tasks 
themselves contain the ownerRef also since they were created (in 
04/2015). It looks like the data got wrong (somehow) in your 
installation only. But, nevertheless, it should not be a cause of 
midPoint not starting.

How does your log file continue? Could you post here more of it?

The easiest way to repair the state is to start midPoint somehow, and 
then to add ownerRef directly into XML representation of the particular 
tasks; via Repository Objects, like this:

It is because this XML (stored in fullObject db column) is used as the 
authoritative information on each midPoint object. All other db columns 
are derived from it; in fact, they are present only to facilitate 
searching for objects according to specified criteria.

Best regards,

Pavol Mederly
Software developer
evolveum.com

On 22.01.2018 12:19, Ramón Cahenzli wrote:
> Hello everyone,
>
> We run midPoint on Debian with PostgreSQL. I've upgraded one of our dev
> instances successfully to 3.7 with no issues, apart for the problem
> that the following index from postgresql-upgrade-3.6-3.7.sql already
> exists:
>
> CREATE INDEX iOpExecOwnerOid
>    ON m_operation_execution (owner_oid);
>
> If you check the previous schema that was
> included with midPoint 3.6 (postgresql-upgrade-3.5-3.6.sql) you'll
> notice that this index was defined there.
>
> But this isn't even the real problem. The issue is that some tasks
> defined in midPoint 3.6 don't seem to have an owner reference, and
> midPoint 3.7 does not start with such a database.
>
> The relevant log lines, truncated:
>
> ERROR
> (com.evolveum.midpoint.task.quartzimpl.execution.TaskSynchronizer):
> Task Manager cannot synchronize task
> 00000000-0000-0000-0000-000000000007 due to schema exception..
>
> com.evolveum.midpoint.util.exception.SchemaException: Task
> 00000000-0000-0000-0000-000000000007 does not have an owner (missing
> ownerRef)
>
>
> The database confirms this:
>
>
> midpoint=# select name_norm, ownerref_targetoid from m_task;
>      name_norm     |          ownerref_targetoid
> ------------------+--------------------------------------
>   cleanup          | 00000000-0000-0000-0000-000000000002
>   trigger scanner  |
>   validity scanner |
> (3 rows)
>
>
> What I've tried so far:
>
> I did the terrible hack of just setting the ownerref_ fields to the
> same as in the "cleanup" task. However, when restarting midPoint, the
> data is overwritten, the records are missing ownerrefs again. This
> leads me to believe that midPoint deletes and recreates these records
> on its own during startup.
>
> How could I fix this? I am happy to supply more information.
>
> Cheers,
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180122/76f85854/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: hfjiigeeoggealoc.png
Type: image/png
Size: 32303 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180122/76f85854/attachment.png>

From ramon.cahenzli at zhdk.ch  Mon Jan 22 14:23:03 2018
From: ramon.cahenzli at zhdk.ch (=?UTF-8?B?UmFtw7Nu?= Cahenzli)
Date: Mon, 22 Jan 2018 14:23:03 +0100
Subject: [midPoint] Upgrade from 3.6 to 3.7 (standalone) leaves ownerref
 empty on tasks, can't start midPoint
In-Reply-To: <7ec6ef7a-b317-a904-60ce-4c34813ad3a5@evolveum.com>
References: <20180122121939.28d237cf@castle>
 <7ec6ef7a-b317-a904-60ce-4c34813ad3a5@evolveum.com>
Message-ID: <20180122142303.5c60f288@castle>

Hi Pavol,

Thanks a lot for your explanation.

> As for the iOpExecOwnerOid being already present, I do apologize.
> When finalizing SQL update scripts I have checked against "3.6-all"
> scripts, and the index is not there. It somehow got into upgrade
> scripts without modifying the "full" ones.

No problem, I'm glad it's a real issue and not something we
messed up here :)

In the meantime I have:

  1. Gone back to 3.6 through Tomcat so I can get to the admin
     interface.
  2. Sifted manually through the initial object XML files and found the
     owner references there.
  3. Added the owner references to the task objects under "Repository
     objects" like you also suggested.

This makes the "Tasks" view work again. Previously, task details for
the two ownerless tasks couldn't be displayed and errors were shown. So
even if this was harmless, I guess it's good to have fixed it. I wonder
how this was even possible, but I'll leave that for later.

Now I will try the 3.7 upgrade again. If it doesn't start I will supply
the end of a fresh logfile.

Thanks again!

Cheers,

-- 
—
—
Zürcher Hochschule der Künste
Zurich University of the Arts
—
Ramón Cahenzli, MSc.
IT Architect
—
Pfingstweidstrasse 96, Postfach, 8031 Zürich
Tel. +41 43 446 31 63, Fax +41 43 446 45 21
ramon.cahenzli at zhdk.ch
—
http://www.zhdk.ch
http://itz.zhdk.ch


From seth at sourceclear.com  Tue Jan 23 01:01:15 2018
From: seth at sourceclear.com (Seth McCombs)
Date: Mon, 22 Jan 2018 16:01:15 -0800
Subject: [midPoint] SuperUser Persistence
Message-ID: <CADJZ1sZ5_afXcuuedvJQ5RuYfrmQUfh7H8VZDmR+zt-P1ekbTw@mail.gmail.com>

Hey All,

I inherited a running MidPoint install, and while all is working well, I am
trying to learn as much about the system as I can. One thing I have found
is that when I provide my account with SuperUser access (after logging in
as root account), I then log back in a day or two later, and my super user
access is gone. I've only just started digging through configs and logs,
but I have little idea where to start, one thing I have found is this XML
file - (See output below)


<role oid=“00000000-0000-0000-0000-000000000004”
xmlns=“http://midpoint.evolveum.com/xml/ns/public/common/common-3">
<name>Superuser</name>
<description>Role that gives user full authorization in
MidPoint.</description>
<authorization>
<action>http://midpoint.evolveum.com/xml/ns/public/
security/authorization-3#all</action>
</authorization>
<roleType>system</roleType>
</role>

It seems to me that the superuser is possibly hard coded, but I don't know
where that above link leads nore how to fix this,

Any advice is MUCH appreciated!

Cheers!

Seth McCombs
IT Operations Engineer
+1 510.514.5855
seth at sourceclear.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180122/1122ccac/attachment.htm>

From mederly at evolveum.com  Tue Jan 23 01:16:43 2018
From: mederly at evolveum.com (Pavol Mederly)
Date: Tue, 23 Jan 2018 01:16:43 +0100
Subject: [midPoint] SuperUser Persistence
In-Reply-To: <CADJZ1sZ5_afXcuuedvJQ5RuYfrmQUfh7H8VZDmR+zt-P1ekbTw@mail.gmail.com>
References: <CADJZ1sZ5_afXcuuedvJQ5RuYfrmQUfh7H8VZDmR+zt-P1ekbTw@mail.gmail.com>
Message-ID: <b2d62fa1-8139-778c-bd8d-35f28f3dca4c@evolveum.com>

Hello Seth,

what you see is Superuser role. It can be assigned to any account, 
effectively providing that account with "root" privileges.

In fact, there's nothing hardcoded. The role can have any name, any OID. 
What is important, is

<authorization>
     
<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-3#all 
<http://midpoint.evolveum.com/xml/ns/public/security/authorization-3#all></action>
</authorization>

(The URI ...#all is a predefined constant in midPoint, giving all access 
within the system.)

------------------------------------------------------------------------
Anyway, midPoint is far too complex to be understood by exploring its 
GUI. I would strongly recommend reading this e-book that will provide 
you with solid understanding of basic concepts: 
https://evolveum.com/midpoint/midpoint-guide-about-practical-identity-management/. 
And, as midPoint in latest version (3.7) is really easy to install, it 
is the best to install a "playground" midPoint instance and explore it 
without fear of breaking anything.

Pavol Mederly
Software developer
evolveum.com

On 23.01.2018 1:01, Seth McCombs wrote:
> Hey All,
>
> I inherited a running MidPoint install, and while all is working well, 
> I am trying to learn as much about the system as I can. One thing I 
> have found is that when I provide my account with SuperUser access 
> (after logging in as root account), I then log back in a day or two 
> later, and my super user access is gone. I've only just started 
> digging through configs and logs, but I have little idea where to 
> start, one thing I have found is this XML file - (See output below)
>
>
> <role oid=“00000000-0000-0000-0000-000000000004”
> xmlns=“http://midpoint.evolveum.com/xml/ns/public/common/common-3 
> <http://midpoint.evolveum.com/xml/ns/public/common/common-3>">
> <name>Superuser</name>
> <description>Role that gives user full authorization in 
> MidPoint.</description>
> <authorization>
> <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-3#all 
> <http://midpoint.evolveum.com/xml/ns/public/security/authorization-3#all></action>
> </authorization>
> <roleType>system</roleType>
> </role>
>
> It seems to me that the superuser is possibly hard coded, but I don't 
> know where that above link leads nore how to fix this,
>
> Any advice is MUCH appreciated!
>
> Cheers!
>
> Seth McCombs
> IT Operations Engineer
> +1 510.514.5855
> seth at sourceclear.com <mailto:seth at sourceclear.com>
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180123/84c8201a/attachment.htm>

From seth at sourceclear.com  Tue Jan 23 01:27:50 2018
From: seth at sourceclear.com (Seth McCombs)
Date: Mon, 22 Jan 2018 16:27:50 -0800
Subject: [midPoint] SuperUser Persistence
In-Reply-To: <b2d62fa1-8139-778c-bd8d-35f28f3dca4c@evolveum.com>
References: <CADJZ1sZ5_afXcuuedvJQ5RuYfrmQUfh7H8VZDmR+zt-P1ekbTw@mail.gmail.com>
 <b2d62fa1-8139-778c-bd8d-35f28f3dca4c@evolveum.com>
Message-ID: <CADJZ1sYmNKQgnd+cnByUDstsrbUc8NHyL2YREwLc+-aFt6EpAg@mail.gmail.com>

Thanks Pavol!

I actually just finished that book today, and am re-reading through the XML
syntax parts. My MidPoint is 3.4.1, and I need to figure out what my next
steps are for updating, (our instance is Kubernetes based, so I'll be
rolling an update). My issue, unless I'm missing it, is that any user
besides the initially configured super-user (set up at install), all other
users given the super user role, lose that role after 1-2 days.

Thanks!



Seth McCombs
IT Operations Engineer
+1 510.514.5855
seth at sourceclear.com

On Mon, Jan 22, 2018 at 4:16 PM, Pavol Mederly <mederly at evolveum.com> wrote:

> Hello Seth,
>
> what you see is Superuser role. It can be assigned to any account,
> effectively providing that account with "root" privileges.
>
> In fact, there's nothing hardcoded. The role can have any name, any OID.
> What is important, is
>
> <authorization>
>     <action>http://midpoint.evolveum.com/xml/ns/public/security/
> authorization-3#all</action>
> </authorization>
>
> (The URI ...#all is a predefined constant in midPoint, giving all access
> within the system.)
> ------------------------------
> Anyway, midPoint is far too complex to be understood by exploring its GUI.
> I would strongly recommend reading this e-book that will provide you with
> solid understanding of basic concepts: https://evolveum.com/midpoint/
> midpoint-guide-about-practical-identity-management/. And, as midPoint in
> latest version (3.7) is really easy to install, it is the best to install a
> "playground" midPoint instance and explore it without fear of breaking
> anything.
>
> Pavol Mederly
> Software developerevolveum.com
>
> On 23.01.2018 1:01, Seth McCombs wrote:
>
> Hey All,
>
> I inherited a running MidPoint install, and while all is working well, I
> am trying to learn as much about the system as I can. One thing I have
> found is that when I provide my account with SuperUser access (after
> logging in as root account), I then log back in a day or two later, and my
> super user access is gone. I've only just started digging through configs
> and logs, but I have little idea where to start, one thing I have found is
> this XML file - (See output below)
>
>
> <role oid=“00000000-0000-0000-0000-000000000004”
> xmlns=“http://midpoint.evolveum.com/xml/ns/public/common/common-3">
> <name>Superuser</name>
> <description>Role that gives user full authorization in
> MidPoint.</description>
> <authorization>
> <action>http://midpoint.evolveum.com/xml/ns/public/security/
> authorization-3#all</action>
> </authorization>
> <roleType>system</roleType>
> </role>
>
> It seems to me that the superuser is possibly hard coded, but I don't know
> where that above link leads nore how to fix this,
>
> Any advice is MUCH appreciated!
>
> Cheers!
>
> Seth McCombs
> IT Operations Engineer
> +1 510.514.5855 <(510)%20514-5855>
> seth at sourceclear.com
>
>
> _______________________________________________
> midPoint mailing listmidPoint at lists.evolveum.comhttp://lists.evolveum.com/mailman/listinfo/midpoint
>
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180122/b773f158/attachment.htm>

From Caspi at seznam.cz  Tue Jan 23 07:32:00 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Tue, 23 Jan 2018 07:32:00 +0100 (CET)
Subject: [midPoint] Template modification
Message-ID: <71X.vQU.4puiiecPnT3.1QPjRW@seznam.cz>

Hi Oskar, all,



Yes i tryed this, but it didnt work. with that code:





            <code>

   import com.evolveum.midpoint.xml.ns._public.common.common_3.
AssignmentType;

   import com.evolveum.midpoint.xml.ns._public.common.common_3.
ObjectReferenceType;

   import com.evolveum.midpoint.xml.ns._public.common.common_3.RoleType;

   import com.evolveum.midpoint.xml.ns._public.common.common_3.OrgType;

   import java.util.*;

   

    log.warn("XXX assigning from SAP role {}" , ADGroup)

   if (ADGroup != null){

orgName = ADGroup;

    

                org = midpoint.searchObjectByName(RoleType.class, orgName);

                if (org != null)

                {

                    log.info("org {}" , org)

                    orgOrt = new ObjectReferenceType();

        orgOrt.setOid(org.getOid());

        orgOrt.setType(RoleType.COMPLEX_TYPE);




        AssignmentType assignment = new AssignmentType();

        assignment.asPrismContainerValue()

        assignment.setTargetRef(orgOrt);

        return assignment

    }

   }

    </code>





I got error:








Operation
Reconcile user (Gui): {0}
Message
Couldn't reconcile user user:08c284d4-8bc8-4b1a-a598-785773c51d62(ales.
levinsky).






Error
groovy.lang.MissingMethodException: No signature of method: org.codehaus.
groovy.jsr223.GroovyScriptEngineImpl.If() is applicable for argument types: 
(java.lang.Boolean, Script31$_run_closure1) values: [true, Script31$_run_
closure1 at 2eb5683] Possible solutions: find(), any(), is(java.lang.Object), 
wait(), dump(), grep() in expression in mapping in inbound expression for 
{http://midpoint.evolveum.com/xml/ns/public/resource/instance-3}memberOf in 
resource:746ecf5e-3e8c-11e6-b2f9-3c970e44b9e2(BLUED (LDAP))({.../common/
common-3}input=CN=POS_AX_ADMINS,OU=Groups,OU=CZ,DC=domain,DC=local; ) in 
expression in mapping in inbound expression for {http://midpoint.evolveum.
com/xml/ns/public/resource/instance-3}memberOf in resource:746ecf5e-3e8c-11e
6-b2f9-3c970e44b9e2(BLUED (LDAP))






Any idea? I fouind some things on internet about bug in groovy. But without 
solution for now.




Jan









-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180123/74e7594a/attachment.htm>

From mederly at evolveum.com  Tue Jan 23 09:55:33 2018
From: mederly at evolveum.com (Pavol Mederly)
Date: Tue, 23 Jan 2018 09:55:33 +0100
Subject: [midPoint] SuperUser Persistence
In-Reply-To: <CADJZ1sYmNKQgnd+cnByUDstsrbUc8NHyL2YREwLc+-aFt6EpAg@mail.gmail.com>
References: <CADJZ1sZ5_afXcuuedvJQ5RuYfrmQUfh7H8VZDmR+zt-P1ekbTw@mail.gmail.com>
 <b2d62fa1-8139-778c-bd8d-35f28f3dca4c@evolveum.com>
 <CADJZ1sYmNKQgnd+cnByUDstsrbUc8NHyL2YREwLc+-aFt6EpAg@mail.gmail.com>
Message-ID: <e6f868b2-5e37-7227-1b6d-2235fe36fbcc@evolveum.com>

Seth,

the "role loss" you experience is really strange. It can be caused by 
various factors; although I never heard of something like that :) For 
example, are there any scripting hooks 
<https://wiki.evolveum.com/display/midPoint/Scripting+Hooks> defined? 
Or, are you sure the assignment is really deleted? Isn't it only 
disabled? (Either explicitly or via validTo time?)

Maybe you could have a look into audit log: after the role disappears, 
just look at all changes related to the given user. Maybe there would be 
some hint what has happened.

Best regards,

Pavol Mederly
Software developer
evolveum.com

On 23.01.2018 1:27, Seth McCombs wrote:
> Thanks Pavol!
>
> I actually just finished that book today, and am re-reading through 
> the XML syntax parts. My MidPoint is 3.4.1, and I need to figure out 
> what my next steps are for updating, (our instance is Kubernetes 
> based, so I'll be rolling an update). My issue, unless I'm missing it, 
> is that any user besides the initially configured super-user (set up 
> at install), all other users given the super user role, lose that role 
> after 1-2 days.
>
> Thanks!
>
>
>
> Seth McCombs
> IT Operations Engineer
> +1 510.514.5855
> seth at sourceclear.com <mailto:seth at sourceclear.com>
>
> On Mon, Jan 22, 2018 at 4:16 PM, Pavol Mederly <mederly at evolveum.com 
> <mailto:mederly at evolveum.com>> wrote:
>
>     Hello Seth,
>
>     what you see is Superuser role. It can be assigned to any account,
>     effectively providing that account with "root" privileges.
>
>     In fact, there's nothing hardcoded. The role can have any name,
>     any OID. What is important, is
>
>     <authorization>
>        
>     <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-3#all
>     <http://midpoint.evolveum.com/xml/ns/public/security/authorization-3#all></action>
>     </authorization>
>
>     (The URI ...#all is a predefined constant in midPoint, giving all
>     access within the system.)
>
>     ------------------------------------------------------------------------
>     Anyway, midPoint is far too complex to be understood by exploring
>     its GUI. I would strongly recommend reading this e-book that will
>     provide you with solid understanding of basic concepts:
>     https://evolveum.com/midpoint/midpoint-guide-about-practical-identity-management/
>     <https://evolveum.com/midpoint/midpoint-guide-about-practical-identity-management/>.
>     And, as midPoint in latest version (3.7) is really easy to
>     install, it is the best to install a "playground" midPoint
>     instance and explore it without fear of breaking anything.
>
>     Pavol Mederly
>     Software developer
>     evolveum.com <http://evolveum.com>
>
>     On 23.01.2018 1:01, Seth McCombs wrote:
>>     Hey All,
>>
>>     I inherited a running MidPoint install, and while all is working
>>     well, I am trying to learn as much about the system as I can. One
>>     thing I have found is that when I provide my account with
>>     SuperUser access (after logging in as root account), I then log
>>     back in a day or two later, and my super user access is gone.
>>     I've only just started digging through configs and logs, but I
>>     have little idea where to start, one thing I have found is this
>>     XML file - (See output below)
>>
>>
>>     <role oid=“00000000-0000-0000-0000-000000000004”
>>     xmlns=“http://midpoint.evolveum.com/xml/ns/public/common/common-3
>>     <http://midpoint.evolveum.com/xml/ns/public/common/common-3>">
>>     <name>Superuser</name>
>>     <description>Role that gives user full authorization in
>>     MidPoint.</description>
>>     <authorization>
>>     <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-3#all
>>     <http://midpoint.evolveum.com/xml/ns/public/security/authorization-3#all></action>
>>     </authorization>
>>     <roleType>system</roleType>
>>     </role>
>>
>>     It seems to me that the superuser is possibly hard coded, but I
>>     don't know where that above link leads nore how to fix this,
>>
>>     Any advice is MUCH appreciated!
>>
>>     Cheers!
>>
>>     Seth McCombs
>>     IT Operations Engineer
>>     +1 510.514.5855 <tel:%28510%29%20514-5855>
>>     seth at sourceclear.com <mailto:seth at sourceclear.com>
>>
>>
>>     _______________________________________________
>>     midPoint mailing list
>>     midPoint at lists.evolveum.com <mailto:midPoint at lists.evolveum.com>
>>     http://lists.evolveum.com/mailman/listinfo/midpoint
>>     <http://lists.evolveum.com/mailman/listinfo/midpoint>
>
>
>     _______________________________________________
>     midPoint mailing list
>     midPoint at lists.evolveum.com <mailto:midPoint at lists.evolveum.com>
>     http://lists.evolveum.com/mailman/listinfo/midpoint
>     <http://lists.evolveum.com/mailman/listinfo/midpoint>
>
>
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180123/0d14e28d/attachment.htm>

From seth at sourceclear.com  Tue Jan 23 17:57:45 2018
From: seth at sourceclear.com (Seth McCombs)
Date: Tue, 23 Jan 2018 08:57:45 -0800
Subject: [midPoint] SuperUser Persistence
In-Reply-To: <e6f868b2-5e37-7227-1b6d-2235fe36fbcc@evolveum.com>
References: <CADJZ1sZ5_afXcuuedvJQ5RuYfrmQUfh7H8VZDmR+zt-P1ekbTw@mail.gmail.com>
 <b2d62fa1-8139-778c-bd8d-35f28f3dca4c@evolveum.com>
 <CADJZ1sYmNKQgnd+cnByUDstsrbUc8NHyL2YREwLc+-aFt6EpAg@mail.gmail.com>
 <e6f868b2-5e37-7227-1b6d-2235fe36fbcc@evolveum.com>
Message-ID: <CADJZ1sY2Fob49EkO_++cRsXTbTrm0iFF1xTLqCNWmT4QMAwB_g@mail.gmail.com>

Thanks again Paval!

I'm sure there's something weird configured script wise or something, this
is a setup I've inherited, I've only been here for a month, and still
coming up to speed. I'll definitely check audit logs and see!



Seth McCombs
IT Operations Engineer
+1 510.514.5855
seth at sourceclear.com

On Tue, Jan 23, 2018 at 12:55 AM, Pavol Mederly <mederly at evolveum.com>
wrote:

> Seth,
>
> the "role loss" you experience is really strange. It can be caused by
> various factors; although I never heard of something like that :) For
> example, are there any scripting hooks
> <https://wiki.evolveum.com/display/midPoint/Scripting+Hooks> defined? Or,
> are you sure the assignment is really deleted? Isn't it only disabled?
> (Either explicitly or via validTo time?)
>
> Maybe you could have a look into audit log: after the role disappears,
> just look at all changes related to the given user. Maybe there would be
> some hint what has happened.
>
> Best regards,
>
> Pavol Mederly
> Software developerevolveum.com
>
> On 23.01.2018 1:27, Seth McCombs wrote:
>
> Thanks Pavol!
>
> I actually just finished that book today, and am re-reading through the
> XML syntax parts. My MidPoint is 3.4.1, and I need to figure out what my
> next steps are for updating, (our instance is Kubernetes based, so I'll be
> rolling an update). My issue, unless I'm missing it, is that any user
> besides the initially configured super-user (set up at install), all other
> users given the super user role, lose that role after 1-2 days.
>
> Thanks!
>
>
>
> Seth McCombs
> IT Operations Engineer
> +1 510.514.5855 <(510)%20514-5855>
> seth at sourceclear.com
>
> On Mon, Jan 22, 2018 at 4:16 PM, Pavol Mederly <mederly at evolveum.com>
> wrote:
>
>> Hello Seth,
>>
>> what you see is Superuser role. It can be assigned to any account,
>> effectively providing that account with "root" privileges.
>>
>> In fact, there's nothing hardcoded. The role can have any name, any OID.
>> What is important, is
>>
>> <authorization>
>>     <action>http://midpoint.evolveum.com/xml/ns/public/security/
>> authorization-3#all</action>
>> </authorization>
>>
>> (The URI ...#all is a predefined constant in midPoint, giving all access
>> within the system.)
>> ------------------------------
>> Anyway, midPoint is far too complex to be understood by exploring its
>> GUI. I would strongly recommend reading this e-book that will provide you
>> with solid understanding of basic concepts:
>> https://evolveum.com/midpoint/midpoint-guide-about-practical
>> -identity-management/. And, as midPoint in latest version (3.7) is
>> really easy to install, it is the best to install a "playground" midPoint
>> instance and explore it without fear of breaking anything.
>>
>> Pavol Mederly
>> Software developerevolveum.com
>>
>> On 23.01.2018 1:01, Seth McCombs wrote:
>>
>> Hey All,
>>
>> I inherited a running MidPoint install, and while all is working well, I
>> am trying to learn as much about the system as I can. One thing I have
>> found is that when I provide my account with SuperUser access (after
>> logging in as root account), I then log back in a day or two later, and my
>> super user access is gone. I've only just started digging through configs
>> and logs, but I have little idea where to start, one thing I have found is
>> this XML file - (See output below)
>>
>>
>> <role oid=“00000000-0000-0000-0000-000000000004”
>> xmlns=“http://midpoint.evolveum.com/xml/ns/public/common/common-3">
>> <name>Superuser</name>
>> <description>Role that gives user full authorization in
>> MidPoint.</description>
>> <authorization>
>> <action>http://midpoint.evolveum.com/xml/ns/public/security/
>> authorization-3#all</action>
>> </authorization>
>> <roleType>system</roleType>
>> </role>
>>
>> It seems to me that the superuser is possibly hard coded, but I don't
>> know where that above link leads nore how to fix this,
>>
>> Any advice is MUCH appreciated!
>>
>> Cheers!
>>
>> Seth McCombs
>> IT Operations Engineer
>> +1 510.514.5855 <%28510%29%20514-5855>
>> seth at sourceclear.com
>>
>>
>> _______________________________________________
>> midPoint mailing listmidPoint at lists.evolveum.comhttp://lists.evolveum.com/mailman/listinfo/midpoint
>>
>>
>>
>> _______________________________________________
>> midPoint mailing list
>> midPoint at lists.evolveum.com
>> http://lists.evolveum.com/mailman/listinfo/midpoint
>>
>>
>
>
> _______________________________________________
> midPoint mailing listmidPoint at lists.evolveum.comhttp://lists.evolveum.com/mailman/listinfo/midpoint
>
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180123/9c35789c/attachment.htm>

From seth at sourceclear.com  Tue Jan 23 21:37:20 2018
From: seth at sourceclear.com (Seth McCombs)
Date: Tue, 23 Jan 2018 12:37:20 -0800
Subject: [midPoint] Typo Updates for Wiki
Message-ID: <CADJZ1sZFNfMExHozfiEOx4nGeiMY3wnhk=C9KxnoWfoOFOZoig@mail.gmail.com>

Hey team,

What's the best way to let people know about some typos on the wiki?
Nothing serious, missing or flipped letters here and there! I'm diving into
the wiki as I try to wrangle my existing MidPoint instance, and I'd like to
let people know as I go along if I find things, I've already got a few
jotted down (not trying to be a grammar snob)

Thanks!


Seth McCombs
IT Operations Engineer
+1 510.514.5855
seth at sourceclear.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180123/a485d216/attachment.htm>

From davy.priem at vives.be  Wed Jan 24 09:17:17 2018
From: davy.priem at vives.be (Davy Priem)
Date: Wed, 24 Jan 2018 08:17:17 +0000
Subject: [midPoint] inducement issue after upgrade to 3.7
Message-ID: <0001EAE3-377F-44A0-BAA5-CFF1C6008A6D@vives.be>

Hi,

This is a probably a version stupid question, but since I upgraded to version 3.7, the inducements on a role aren’t processed anymore when a role is assigned to a user. I have a template that assigns a role on a new user. That role has several inducements. When a new users is imported, midpoint succesfully assigns the role to the user (as with 3.6). However, there it stops. When I go to the user and do a recon, then the projections are made. Am I overlooking something? I didn’t found any behaviour change in 3.7 release notes.

Best regards,
Davy Priem

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180124/63a4f897/attachment.htm>

From ivan.noris at evolveum.com  Wed Jan 24 09:42:46 2018
From: ivan.noris at evolveum.com (Ivan Noris)
Date: Wed, 24 Jan 2018 09:42:46 +0100
Subject: [midPoint] inducement issue after upgrade to 3.7
In-Reply-To: <0001EAE3-377F-44A0-BAA5-CFF1C6008A6D@vives.be>
References: <0001EAE3-377F-44A0-BAA5-CFF1C6008A6D@vives.be>
Message-ID: <d4770d02-e538-2f1c-53dd-327d185cd481@evolveum.com>

Hi Davy,

I have just tried our training environment installed from scratch, where
we assign a role using object template, to each newly imported person
from HR source. And it works. The projections are created after role is
assigned.

I have not clean 3.7 but 3.7-support branch to be honest.

Are there any errors in midpoint.log? Can you share the role?

Best regards,

Ivan


On 24.01.2018 09:17, Davy Priem wrote:
>
> Hi,
>
>
> This is a probably a version stupid question, but since I upgraded to
> version 3.7, the inducements on a role aren’t processed anymore when a
> role is assigned to a user. I have a template that assigns a role on a
> new user. That role has several inducements. When a new users is
> imported, midpoint succesfully assigns the role to the user (as with
> 3.6). However, there it stops. When I go to the user and do a recon,
> then the projections are made. Am I overlooking something? I didn’t
> found any behaviour change in 3.7 release notes. 
>
>
> Best regards,
>
> Davy Priem 
>
>
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-- 
Ivan Noris
Senior Identity Engineer
evolveum.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180124/7626df50/attachment.htm>

From radovan.semancik at evolveum.com  Wed Jan 24 10:44:16 2018
From: radovan.semancik at evolveum.com (Radovan Semancik)
Date: Wed, 24 Jan 2018 10:44:16 +0100
Subject: [midPoint] Meet us at FOSDEM and TIIME
Message-ID: <3c0ada43-3bc4-8612-caa6-f20ffbd8fb6b@evolveum.com>

Dear community,

Few members of our team plan to attend two interesting events. This may 
an opportunity to meet with the community and discuss midPoint.

First event is FOSDEM conference in Brussels. There will be a talk about 
midPoint in the IAM devroom:

https://fosdem.org/2018/schedule/event/idm_midpoint/

and another talk about GDPR and IDM in the legal&policy devroom:

https://fosdem.org/2018/schedule/event/gdpr_identity_management/

FOSDEM is a very interesting event. But it is also quite a big event. 
For those that prefer smaller events there is an ideal opportunity: 
TIIME workshop in Vienna:

http://tiimeworkshop.eu/

There will be a talk and a dedicated midPoint workshop on Tuesday 
afternoon. Also, it might be interesting to discuss midPoint during the 
TIIME unconference that follows the workshop.

-- 
Radovan Semancik
Software Architect
evolveum.com



From alcides.neto at gmail.com  Wed Jan 24 23:08:23 2018
From: alcides.neto at gmail.com (Alcides Carlos de Moraes Neto)
Date: Wed, 24 Jan 2018 20:08:23 -0200
Subject: [midPoint] How to make Entitlement association strong / enforced ?
Message-ID: <CAMLLNm=pXsBtxgs3HCciTNsSZNEFwA_qYCVTnq9fb+ATgLSEnQ@mail.gmail.com>

Hello list,

I have a OrgType -> AD Group projection, with construction and entitlement
association all done in a single Meta Role. This works, the groups are
created and the Org Members are added to the group.

However, if the AD user account already is a member of any other group, its
not added to the Org AD Group. And if I remove a user account from the AD
group from within Windows Server, Midpoint does not create the association
again. It's behaving like a weak mapping.
How do I make Midpoint enforce the group membership? The association
definition has tolerant attribute set to FALSE . I've tried setting
assignmentPolicyEnforcement to FULL for the resource, it does not work
either.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180124/d1a2f0d4/attachment.htm>

From ivan.noris at evolveum.com  Thu Jan 25 09:29:33 2018
From: ivan.noris at evolveum.com (Ivan Noris)
Date: Thu, 25 Jan 2018 09:29:33 +0100
Subject: [midPoint] How to make Entitlement association strong /
 enforced ?
In-Reply-To: <CAMLLNm=pXsBtxgs3HCciTNsSZNEFwA_qYCVTnq9fb+ATgLSEnQ@mail.gmail.com>
References: <CAMLLNm=pXsBtxgs3HCciTNsSZNEFwA_qYCVTnq9fb+ATgLSEnQ@mail.gmail.com>
Message-ID: <594304ff-d32e-fbd7-08d2-4f7ae89b19a4@evolveum.com>

Hi,

can you share the role (in your case probably the metarole)? I think you
might be missing strong in the outbound mapping for association for
order=2 mapping.

Ivan


On 24.01.2018 23:08, Alcides Carlos de Moraes Neto wrote:
> Hello list,
>
> I have a OrgType -> AD Group projection, with construction and
> entitlement association all done in a single Meta Role. This works,
> the groups are created and the Org Members are added to the group.
>
> However, if the AD user account already is a member of any other
> group, its not added to the Org AD Group. And if I remove a user
> account from the AD group from within Windows Server, Midpoint does
> not create the association again. It's behaving like a weak mapping.
> How do I make Midpoint enforce the group membership? The association
> definition has tolerant attribute set to FALSE . I've tried setting
> assignmentPolicyEnforcement to FULL for the resource, it does not work
> either.
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-- 
Ivan Noris
Senior Identity Engineer
evolveum.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180125/3cbbc9ae/attachment.htm>

From alcides.neto at gmail.com  Thu Jan 25 14:16:52 2018
From: alcides.neto at gmail.com (Alcides Carlos de Moraes Neto)
Date: Thu, 25 Jan 2018 11:16:52 -0200
Subject: [midPoint] How to make Entitlement association strong /
	enforced ?
In-Reply-To: <594304ff-d32e-fbd7-08d2-4f7ae89b19a4@evolveum.com>
References: <CAMLLNm=pXsBtxgs3HCciTNsSZNEFwA_qYCVTnq9fb+ATgLSEnQ@mail.gmail.com>
 <594304ff-d32e-fbd7-08d2-4f7ae89b19a4@evolveum.com>
Message-ID: <CAMLLNmmyZsbNmnZZV0coF-yEb5vNE=Au==myKoiLkEkd8wyp+w@mail.gmail.com>

Thanks Ivan, that was it. I didn't notice I could set strenght in the
association mapping.
I have a weak construction with a strong mapping, that's a bit crazy, but
it works. :)

My metarole is thus:

<inducement id="1">
      <description>Group construction</description>
      <construction>
         <resourceRef oid="3341f1ce-f96f-43fe-8bc9-7a9ec051b71b"
                      relation="org:default"
                      type="c:ResourceType"><!-- AD --></resourceRef>
         <kind>entitlement</kind>
         <intent>org-group</intent>
      </construction>
   </inducement>
   <inducement id="2">
      <description>Add users to group</description>
      <construction>
         <strength>weak</strength>
         <resourceRef oid="3341f1ce-f96f-43fe-8bc9-7a9ec051b71b"
                      relation="org:default"
                      type="c:ResourceType"><!-- AD --></resourceRef>
         <kind>account</kind>
         <intent>default</intent>
         <association>
            <c:ref>ri:group</c:ref>
            <tolerant>false</tolerant>
            <outbound>
              * <strength>strong</strength>*
               <expression>
                  <associationFromLink xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"

xsi:type="c:AssociationFromLinkExpressionEvaluatorType">
                     <projectionDiscriminator>
                        <kind>entitlement</kind>
                        <intent>org-group</intent>
                     </projectionDiscriminator>
                  </associationFromLink>
               </expression>
            </outbound>
         </association>
      </construction>
      <order>2</order>
      <condition>
         <expression>
            <script xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                    xsi:type="c:ScriptExpressionEvaluatorType">
               <code>focus.getClass() ==
com.evolveum.midpoint.xml.ns._public.common.common_3.UserType.class
&amp;&amp; (focus.getEmployeeType().contains("TYPE1") ||
focus.getEmployeeType().contains("TYPE2"))</code>
            </script>
         </expression>
      </condition>
   </inducement>

2018-01-25 6:29 GMT-02:00 Ivan Noris <ivan.noris at evolveum.com>:

> Hi,
>
> can you share the role (in your case probably the metarole)? I think you
> might be missing strong in the outbound mapping for association for order=2
> mapping.
>
> Ivan
>
> On 24.01.2018 23:08, Alcides Carlos de Moraes Neto wrote:
>
> Hello list,
>
> I have a OrgType -> AD Group projection, with construction and entitlement
> association all done in a single Meta Role. This works, the groups are
> created and the Org Members are added to the group.
>
> However, if the AD user account already is a member of any other group,
> its not added to the Org AD Group. And if I remove a user account from the
> AD group from within Windows Server, Midpoint does not create the
> association again. It's behaving like a weak mapping.
> How do I make Midpoint enforce the group membership? The association
> definition has tolerant attribute set to FALSE . I've tried setting
> assignmentPolicyEnforcement to FULL for the resource, it does not work
> either.
>
>
> _______________________________________________
> midPoint mailing listmidPoint at lists.evolveum.comhttp://lists.evolveum.com/mailman/listinfo/midpoint
>
>
> --
> Ivan Noris
> Senior Identity Engineerevolveum.com
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180125/e3e1ebeb/attachment.htm>

From ivan.noris at evolveum.com  Thu Jan 25 14:24:48 2018
From: ivan.noris at evolveum.com (Ivan Noris)
Date: Thu, 25 Jan 2018 14:24:48 +0100
Subject: [midPoint] How to make Entitlement association strong /
 enforced ?
In-Reply-To: <CAMLLNmmyZsbNmnZZV0coF-yEb5vNE=Au==myKoiLkEkd8wyp+w@mail.gmail.com>
References: <CAMLLNm=pXsBtxgs3HCciTNsSZNEFwA_qYCVTnq9fb+ATgLSEnQ@mail.gmail.com>
 <594304ff-d32e-fbd7-08d2-4f7ae89b19a4@evolveum.com>
 <CAMLLNmmyZsbNmnZZV0coF-yEb5vNE=Au==myKoiLkEkd8wyp+w@mail.gmail.com>
Message-ID: <64a120fb-8bc3-7f6a-0a35-af149660cfa5@evolveum.com>

Hi,

yes, as "strength" element is used both in construction and also in
mapping, it always looks confusing. But the two strengths are for
completely different things :)

To allow midpoint to always apply the "group membership" (by
association), the strong outbound mapping for association does the trick.

To force midpoint to remove group membership from groups that are not
assigned by midpoint, tolerant=false might be set in resource
association definition (not in role!)

And finally, weak strength set in construction means that even if this
role constructs (creates) an account and adds the account to a role,
unless other role for the same projection is assigned with strong
strength in construction, the account will not be created. The use case
behind it is: if organization structure is replicated to target system
(AD for example), and user is assigned to organization in midPoint,
which is replicated to target system, the account would be created
immediately, even if the user has no other roles. Strength=weak in
construction prohibits this, and the user must be assigned different
role e.g. Employee and only then the account is created the the groups
assigned.

Let's hope I will be able to put it this way during our training next
week :)

Best regards,

Ivan


On 25.01.2018 14:16, Alcides Carlos de Moraes Neto wrote:
> Thanks Ivan, that was it. I didn't notice I could set strenght in the
> association mapping.
> I have a weak construction with a strong mapping, that's a bit crazy,
> but it works. :)
>
> My metarole is thus:
>
> <inducement id="1">
>       <description>Group construction</description>
>       <construction>
>          <resourceRef oid="3341f1ce-f96f-43fe-8bc9-7a9ec051b71b"
>                       relation="org:default"
>                       type="c:ResourceType"><!-- AD --></resourceRef>
>          <kind>entitlement</kind>
>          <intent>org-group</intent>
>       </construction>
>    </inducement>
>    <inducement id="2">
>       <description>Add users to group</description>
>       <construction>
>          <strength>weak</strength>
>          <resourceRef oid="3341f1ce-f96f-43fe-8bc9-7a9ec051b71b"
>                       relation="org:default"
>                       type="c:ResourceType"><!-- AD --></resourceRef>
>          <kind>account</kind>
>          <intent>default</intent>
>          <association>
>             <c:ref>ri:group</c:ref>
>             <tolerant>false</tolerant>
>             <outbound>
>               *<strength>strong</strength>*
>                <expression>
>                   <associationFromLink
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
>                                       
> xsi:type="c:AssociationFromLinkExpressionEvaluatorType">
>                      <projectionDiscriminator>
>                         <kind>entitlement</kind>
>                         <intent>org-group</intent>
>                      </projectionDiscriminator>
>                   </associationFromLink>
>                </expression>
>             </outbound>
>          </association>
>       </construction>
>       <order>2</order>
>       <condition>
>          <expression>
>             <script xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
>                     xsi:type="c:ScriptExpressionEvaluatorType">
>                <code>focus.getClass() ==
> com.evolveum.midpoint.xml.ns._public.common.common_3.UserType.class
> &amp;&amp; (focus.getEmployeeType().contains("TYPE1") ||
> focus.getEmployeeType().contains("TYPE2"))</code>
>             </script>
>          </expression>
>       </condition>
>    </inducement>
>
> 2018-01-25 6:29 GMT-02:00 Ivan Noris <ivan.noris at evolveum.com
> <mailto:ivan.noris at evolveum.com>>:
>
>     Hi,
>
>     can you share the role (in your case probably the metarole)? I
>     think you might be missing strong in the outbound mapping for
>     association for order=2 mapping.
>
>     Ivan
>
>
>     On 24.01.2018 23:08, Alcides Carlos de Moraes Neto wrote:
>>     Hello list,
>>
>>     I have a OrgType -> AD Group projection, with construction and
>>     entitlement association all done in a single Meta Role. This
>>     works, the groups are created and the Org Members are added to
>>     the group.
>>
>>     However, if the AD user account already is a member of any other
>>     group, its not added to the Org AD Group. And if I remove a user
>>     account from the AD group from within Windows Server, Midpoint
>>     does not create the association again. It's behaving like a weak
>>     mapping.
>>     How do I make Midpoint enforce the group membership? The
>>     association definition has tolerant attribute set to FALSE . I've
>>     tried setting assignmentPolicyEnforcement to FULL for the
>>     resource, it does not work either.
>>
>>
>>     _______________________________________________
>>     midPoint mailing list
>>     midPoint at lists.evolveum.com <mailto:midPoint at lists.evolveum.com>
>>     http://lists.evolveum.com/mailman/listinfo/midpoint
>>     <http://lists.evolveum.com/mailman/listinfo/midpoint>
>
>     -- 
>     Ivan Noris
>     Senior Identity Engineer
>     evolveum.com <http://evolveum.com>
>
>
>     _______________________________________________
>     midPoint mailing list
>     midPoint at lists.evolveum.com <mailto:midPoint at lists.evolveum.com>
>     http://lists.evolveum.com/mailman/listinfo/midpoint
>     <http://lists.evolveum.com/mailman/listinfo/midpoint>
>
>
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-- 
Ivan Noris
Senior Identity Engineer
evolveum.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180125/e807d8ea/attachment.htm>

From ramon.cahenzli at zhdk.ch  Thu Jan 25 15:49:00 2018
From: ramon.cahenzli at zhdk.ch (=?UTF-8?B?UmFtw7Nu?= Cahenzli)
Date: Thu, 25 Jan 2018 15:49:00 +0100
Subject: [midPoint] Upgrade from 3.6 to 3.7 (standalone) leaves ownerref
 empty on tasks, can't start midPoint
In-Reply-To: <7ec6ef7a-b317-a904-60ce-4c34813ad3a5@evolveum.com>
References: <20180122121939.28d237cf@castle>
 <7ec6ef7a-b317-a904-60ce-4c34813ad3a5@evolveum.com>
Message-ID: <20180125154900.700eea30@castle>

Hi again Pavol and everyone,

Unfortunately, the issue does not stay fixed even when I manually
assign owners to the tasks. Sooner or later they appear to lose their
owners.

I tried an upgrade to 3.7 based on this supposedly fixed data, but
midPoint never really starts. It attempts to start and then throws
exceptions, see attached log file.

If I read things correctly, it tries to create an administrator user
even though there is one already. I'm happy to supply logs that are more
interesting.

Cheers and thanks,


-- 
—
—
Zürcher Hochschule der Künste
Zurich University of the Arts
—
Ramón Cahenzli, MSc.
IT Architect
—
Pfingstweidstrasse 96, Postfach, 8031 Zürich
Tel. +41 43 446 31 63, Fax +41 43 446 45 21
ramon.cahenzli at zhdk.ch
—
http://www.zhdk.ch
http://itz.zhdk.ch
-------------- next part --------------
A non-text attachment was scrubbed...
Name: idm.log
Type: text/x-log
Size: 134684 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180125/96dc072b/attachment.bin>

From mederly at evolveum.com  Fri Jan 26 12:35:12 2018
From: mederly at evolveum.com (Pavol Mederly)
Date: Fri, 26 Jan 2018 12:35:12 +0100
Subject: [midPoint] Template modification
In-Reply-To: <71X.vQU.4puiiecPnT3.1QPjRW@seznam.cz>
References: <71X.vQU.4puiiecPnT3.1QPjRW@seznam.cz>
Message-ID: <932158f1-d000-5b8d-8d17-79682f61caec@evolveum.com>

Hello Jan,

it is interesting but in my case the script works (invoking it as a bulk 
action, just to test it):

<s:pipeline 
xmlns:s="http://midpoint.evolveum.com/xml/ns/public/model/scripting-3">
     <s:expression xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="s:SearchExpressionType">
         <s:type>ObjectType</s:type>
         <s:searchFilter>
             <q:inOid 
xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3">
<q:value>00000000-0000-0000-0000-000000000002</q:value>
                 <!-- administrator -->
             </q:inOid>
         </s:searchFilter>
     </s:expression>
     <s:expression xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="s:ActionExpressionType">
         <s:type>execute-script</s:type>
         <s:parameter>
             <s:name>script</s:name>
             <c:value xsi:type="c:ScriptExpressionEvaluatorType" 
xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3">
                 <c:code>
                      import 
com.evolveum.midpoint.xml.ns._public.common.common_3.AssignmentType;
            import 
com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectReferenceType;
            import 
com.evolveum.midpoint.xml.ns._public.common.common_3.RoleType;
            import 
com.evolveum.midpoint.xml.ns._public.common.common_3.OrgType;
            import java.util.*;

            ADGroup = "End user"
            log.warn("XXX assigning from SAP role {}", ADGroup)
            if (ADGroup != null) {
                 orgName = ADGroup;

                 org = midpoint.searchObjectByName(RoleType.class, orgName);
                 if (org != null)
                 {
                     log.info("org {}" , org)
                     orgOrt = new ObjectReferenceType();
                     orgOrt.setOid(org.getOid());
orgOrt.setType(RoleType.COMPLEX_TYPE);

                     AssignmentType assignment = new AssignmentType();
                     assignment.asPrismContainerValue()
                     assignment.setTargetRef(orgOrt);
                     return assignment
                 }
            }
                 </c:code>
             </c:value>
         </s:parameter>
    </s:expression>
</s:pipeline>

Just a few notes (but these have no impact on the exception you experience):

 1. You use orgName/org but you search for RoleType.class - it probably
    should be OrgType.class.
 2. assignment.asPrismContainerValue() can be probably eliminated; it
    does nothing.

Maybe you could rewrite your groovy code in a bit different way... I 
really don't know.

Pavol Mederly
Software developer
evolveum.com

On 23.01.2018 7:32, Jan Kaspar wrote:
> Hi Oskar, all,
>
> Yes i tryed this, but it didnt work. with that code:
>
>             <code>
>    import 
> com.evolveum.midpoint.xml.ns._public.common.common_3.AssignmentType;
>    import 
> com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectReferenceType;
>    import com.evolveum.midpoint.xml.ns._public.common.common_3.RoleType;
>    import com.evolveum.midpoint.xml.ns._public.common.common_3.OrgType;
>    import java.util.*;
>    log.warn("XXX assigning from SAP role {}" , ADGroup)
>    if (ADGroup != null){
> orgName = ADGroup;
>                 org = midpoint.searchObjectByName(RoleType.class, 
> orgName);
>                 if (org != null)
>                 {
>                     log.info("org {}" , org)
>                     orgOrt = new ObjectReferenceType();
> orgOrt.setOid(org.getOid());
> orgOrt.setType(RoleType.COMPLEX_TYPE);
>
> AssignmentType assignment = new AssignmentType();
> assignment.asPrismContainerValue()
> assignment.setTargetRef(orgOrt);
>         return assignment
>     }
>    }
>    </code>
>
> I got error:
>
>
> Operation
>     Reconcile user (Gui): {0}
> Message
>     Couldn't reconcile user
>     user:08c284d4-8bc8-4b1a-a598-785773c51d62(ales.levinsky).
>
> Error
>     groovy.lang.MissingMethodException: No signature of method:
>     org.codehaus.groovy.jsr223.GroovyScriptEngineImpl.If() is
>     applicable for argument types: (java.lang.Boolean,
>     Script31$_run_closure1) values: [true,
>     Script31$_run_closure1 at 2eb5683] Possible solutions: find(), any(),
>     is(java.lang.Object), wait(), dump(), grep() in expression in
>     mapping in inbound expression for
>     {http://midpoint.evolveum.com/xml/ns/public/resource/instance-3}memberOf
>     in resource:746ecf5e-3e8c-11e6-b2f9-3c970e44b9e2(BLUED
>     (LDAP))({.../common/common-3}input=CN=POS_AX_ADMINS,OU=Groups,OU=CZ,DC=domain,DC=local;
>     ) in expression in mapping in inbound expression for
>     {http://midpoint.evolveum.com/xml/ns/public/resource/instance-3}memberOf
>     in resource:746ecf5e-3e8c-11e6-b2f9-3c970e44b9e2(BLUED (LDAP))
>
> Any idea? I fouind some things on internet about bug in groovy. But 
> without solution for now.
>
> Jan
>
>
>
>
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180126/103bf3c9/attachment.htm>

From mederly at evolveum.com  Fri Jan 26 12:52:11 2018
From: mederly at evolveum.com (Pavol Mederly)
Date: Fri, 26 Jan 2018 12:52:11 +0100
Subject: [midPoint] Template modification
In-Reply-To: <932158f1-d000-5b8d-8d17-79682f61caec@evolveum.com>
References: <71X.vQU.4puiiecPnT3.1QPjRW@seznam.cz>
 <932158f1-d000-5b8d-8d17-79682f61caec@evolveum.com>
Message-ID: <c86df3b9-df44-b595-0910-71b0173932a6@evolveum.com>

Please try adding "return null" at the end of the script. If it would 
not help, you can also rewrite it like

if (ADGroup == null) {
   return null
}

etc.

Pavol Mederly
Software developer
evolveum.com

On 26.01.2018 12:35, Pavol Mederly wrote:
>
> Hello Jan,
>
> it is interesting but in my case the script works (invoking it as a 
> bulk action, just to test it):
>
> <s:pipeline 
> xmlns:s="http://midpoint.evolveum.com/xml/ns/public/model/scripting-3">
>     <s:expression 
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
> xsi:type="s:SearchExpressionType">
>         <s:type>ObjectType</s:type>
>         <s:searchFilter>
>             <q:inOid 
> xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3">
> <q:value>00000000-0000-0000-0000-000000000002</q:value>
>                 <!-- administrator -->
>             </q:inOid>
>         </s:searchFilter>
>     </s:expression>
>     <s:expression 
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
> xsi:type="s:ActionExpressionType">
>         <s:type>execute-script</s:type>
>         <s:parameter>
>             <s:name>script</s:name>
>             <c:value xsi:type="c:ScriptExpressionEvaluatorType" 
> xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3">
>                 <c:code>
>                      import 
> com.evolveum.midpoint.xml.ns._public.common.common_3.AssignmentType;
>            import 
> com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectReferenceType;
>            import 
> com.evolveum.midpoint.xml.ns._public.common.common_3.RoleType;
>            import 
> com.evolveum.midpoint.xml.ns._public.common.common_3.OrgType;
>            import java.util.*;
>
>            ADGroup = "End user"
>            log.warn("XXX assigning from SAP role {}", ADGroup)
>            if (ADGroup != null) {
>                 orgName = ADGroup;
>
>                 org = midpoint.searchObjectByName(RoleType.class, 
> orgName);
>                 if (org != null)
>                 {
>                     log.info("org {}" , org)
>                     orgOrt = new ObjectReferenceType();
>                     orgOrt.setOid(org.getOid());
> orgOrt.setType(RoleType.COMPLEX_TYPE);
>
>                     AssignmentType assignment = new AssignmentType();
>                     assignment.asPrismContainerValue()
>                     assignment.setTargetRef(orgOrt);
>                     return assignment
>                 }
>            }
>                 </c:code>
>             </c:value>
>         </s:parameter>
>    </s:expression>
> </s:pipeline>
>
> Just a few notes (but these have no impact on the exception you 
> experience):
>
>  1. You use orgName/org but you search for RoleType.class - it
>     probably should be OrgType.class.
>  2. assignment.asPrismContainerValue() can be probably eliminated; it
>     does nothing.
>
> Maybe you could rewrite your groovy code in a bit different way... I 
> really don't know.
>
> Pavol Mederly
> Software developer
> evolveum.com
> On 23.01.2018 7:32, Jan Kaspar wrote:
>> Hi Oskar, all,
>>
>> Yes i tryed this, but it didnt work. with that code:
>>
>>             <code>
>>    import 
>> com.evolveum.midpoint.xml.ns._public.common.common_3.AssignmentType;
>>    import 
>> com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectReferenceType;
>>    import com.evolveum.midpoint.xml.ns._public.common.common_3.RoleType;
>>    import com.evolveum.midpoint.xml.ns._public.common.common_3.OrgType;
>>    import java.util.*;
>>    log.warn("XXX assigning from SAP role {}" , ADGroup)
>>    if (ADGroup != null){
>> orgName = ADGroup;
>>                 org = midpoint.searchObjectByName(RoleType.class, 
>> orgName);
>>                 if (org != null)
>>                 {
>>                     log.info("org {}" , org)
>>                     orgOrt = new ObjectReferenceType();
>> orgOrt.setOid(org.getOid());
>> orgOrt.setType(RoleType.COMPLEX_TYPE);
>>
>> AssignmentType assignment = new AssignmentType();
>> assignment.asPrismContainerValue()
>> assignment.setTargetRef(orgOrt);
>>         return assignment
>>     }
>>    }
>>    </code>
>>
>> I got error:
>>
>>
>> Operation
>>     Reconcile user (Gui): {0}
>> Message
>>     Couldn't reconcile user
>>     user:08c284d4-8bc8-4b1a-a598-785773c51d62(ales.levinsky).
>>
>> Error
>>     groovy.lang.MissingMethodException: No signature of method:
>>     org.codehaus.groovy.jsr223.GroovyScriptEngineImpl.If() is
>>     applicable for argument types: (java.lang.Boolean,
>>     Script31$_run_closure1) values: [true,
>>     Script31$_run_closure1 at 2eb5683] Possible solutions: find(),
>>     any(), is(java.lang.Object), wait(), dump(), grep() in expression
>>     in mapping in inbound expression for
>>     {http://midpoint.evolveum.com/xml/ns/public/resource/instance-3}memberOf
>>     in resource:746ecf5e-3e8c-11e6-b2f9-3c970e44b9e2(BLUED
>>     (LDAP))({.../common/common-3}input=CN=POS_AX_ADMINS,OU=Groups,OU=CZ,DC=domain,DC=local;
>>     ) in expression in mapping in inbound expression for
>>     {http://midpoint.evolveum.com/xml/ns/public/resource/instance-3}memberOf
>>     in resource:746ecf5e-3e8c-11e6-b2f9-3c970e44b9e2(BLUED (LDAP))
>>
>> Any idea? I fouind some things on internet about bug in groovy. But 
>> without solution for now.
>>
>> Jan
>>
>>
>>
>>
>>
>>
>> _______________________________________________
>> midPoint mailing list
>> midPoint at lists.evolveum.com
>> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180126/46adaf7a/attachment.htm>

From mederly at evolveum.com  Fri Jan 26 14:38:55 2018
From: mederly at evolveum.com (Pavol Mederly)
Date: Fri, 26 Jan 2018 14:38:55 +0100
Subject: [midPoint] Fw: Null parent for value PCV(1) Exception during
 reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1
In-Reply-To: <OFFBEB74ED.7B7172FA-ONC1258219.002C6CCD-C1258219.002D2D9A@ibacz.eu>
References: <OFAACD6EB0.6563B937-ONC1258218.003F879F-C1258218.003F9C9B@ibacz.eu>
 <248efbb6-ffb6-dd87-5bb0-d2cccdf0d56f@evolveum.com>
 <OFA87C0D87.0CB4F554-ONC1258218.00563B9D-C1258218.0058DCE4@ibacz.eu>
 <0ddd3193-f6b7-bc58-e7f6-7329384c77a1@evolveum.com>
 <OFD057A993.87E1A850-ONC1258218.005C473B-C1258218.005C8575@ibacz.eu>
 <e4a4ad20-eb72-2273-26ce-d1413042f9bf@evolveum.com>
 <OF4784ACD6.6B6ED882-ONC1258218.0064E885-C1258218.00669D46@ibacz.eu>
 <OFFBEB74ED.7B7172FA-ONC1258219.002C6CCD-C1258219.002D2D9A@ibacz.eu>
Message-ID: <fea3cdf2-b77a-f824-6e80-06c01301c21e@evolveum.com>

Just for the record:

After some diagnostics the problem was resolved by switching from 
deprecated range/isInSetExpression to fully supported 
target/set/condition. Moreover, the issue is fixed in midPoint 3.7. 
Please see MID-4409 <https://jira.evolveum.com/browse/MID-4409>.

Pavol Mederly
Software developer
evolveum.com

On 18.01.2018 9:13, petr.kulheim at ibacz.eu wrote:
> hi Pavol,
> with Peter Holes we have tried to change the role mapping on your 
> suggesting but unfortunately it hasn't helped.
>
> One more thing I have noticed: the user, which suffers the issue from 
> GUI, the exception I have provided at the begging, is not in a list of 
> users with the error from reconsiliation task.
> We are going to check these users.
>
> --pk
>
>
>
>
>
>
> From: petr.kulheim at ibacz.eu
> To: midPoint General Discussion <midpoint at lists.evolveum.com>
> Date: 17/01/2018 19:44
> Subject: Re: [midPoint] Fw: Null parent for value PCV(1) Exception 
> during reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1
> Sent by: "midPoint" <midpoint-bounces at lists.evolveum.com>
> ------------------------------------------------------------------------
>
>
>
> we will try yesterday as I do not have direct access to the system, 
> but colleagues have.
> thx
> Petr
>
>
>
>
>
> From: Pavol Mederly <mederly at evolveum.com>
> To: midpoint at lists.evolveum.com
> Date: 17/01/2018 19:03
> Subject: Re: [midPoint] Fw: Null parent for value PCV(1) Exception 
> during reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1
> Sent by: "midPoint" <midpoint-bounces at lists.evolveum.com>
> ------------------------------------------------------------------------
>
>
>
> ...and one more idea to try:
>
> instead of <assignmentTargetSearch> element, could you try something 
> like this and tell us if it helped?
>
> <expression>
>    <value>
>        <targetRef oid="feed0000-0000-0000-0003-000000000001" 
> type="c:RoleType"/>
>    </value>
> </expression>
>
> It might behave differently from assignmentTargetSearch in some cases 
> (I am not sure now), but at least it would provide us with a hint on 
> where the problem could be.
>
> (BTW, I was not able to replicate the problem with your configuration 
> on my machine.)
>
> Pavol Mederly
> Software developer
> evolveum.com
>
> On 17.01.2018 17:50, _petr.kulheim at ibacz.eu_ 
> <mailto:petr.kulheim at ibacz.eu>wrote:
> Pavol,
> I guess it was assigned by User's object template mapping, pls see here:
>
> <mapping>
>      <name>Zamestnanec role assignment</name>
>      <strength>strong</strength>
>      <source>
>         <c:path>$user/employeeType</c:path>
>      </source>
>      <expression>
>         <assignmentTargetSearch 
> xmlns:xsi="_http://www.w3.org/2001/XMLSchema-instance_"
> xsi:type="c:SearchObjectRefExpressionEvaluatorType">
>            <targetType>c:RoleType</targetType>
>  <oid>feed0000-0000-0000-0003-000000000001</oid>
>         </assignmentTargetSearch>
>      </expression>
>      <target>
>         <c:path>assignment</c:path>
>      </target>
>      <condition>
>         <script xmlns:xsi="_http://www.w3.org/2001/XMLSchema-instance_"
>                 xsi:type="c:ScriptExpressionEvaluatorType">
>            <code>
>                    employeeType != null &amp;&amp; employeeType == 'Z'
>                </code>
>         </script>
>      </condition>
>   </mapping>
>
> and also I attaching the Role definition.
>
>
> Thx
> Petr
>
>
>
>
>
>
> From: Pavol Mederly _<mederly at evolveum.com>_ <mailto:mederly at evolveum.com>
> To: _midpoint at lists.evolveum.com_ <mailto:midpoint at lists.evolveum.com>
> Date: 17/01/2018 17:26
> Subject: Re: [midPoint] Fw: Null parent for value PCV(1) Exception 
> during reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1
> Sent by: "midPoint" _<midpoint-bounces at lists.evolveum.com>_ 
> <mailto:midpoint-bounces at lists.evolveum.com>
>
> ------------------------------------------------------------------------
>
>
>
> Petr,
>
> thanks for the information. I think I understood. So, let's have a 
> look at it:
>
> The problem is related to the assignment of a role with OID 
> feed0000-0000-0000-0003-000000000001.
>
> How was that assignment created? Manually through a GUI? I assume it 
> was created via some mapping. Can you post here the mapping?
>
> Pavol Mederly
> Software developer
> evolveum.com
>
> On 17.01.2018 17:10, _petr.kulheim at ibacz.eu_ 
> <mailto:petr.kulheim at ibacz.eu>wrote:
> Hi Pavol,
> provided exception bellow is from GUI action SAVE, with reconsiliation 
> checkbox checked, no changed done. It is replicable.
>
> If we run recosiliation task, there are about  30 errors in
>      <partialResults>
> <operation>com.evolveum.midpoint.common.operation.reconciliation.errors</operation>
>         <status>not_applicable</status>
>         <token>1000000000000030110</token>
>         <message>Last 30 failures:
>      <partialResults>
> <operation>com.evolveum.midpoint.common.operation.reconciliation.errors</operation>
>         <status>not_applicable</status>
>         <token>1000000000000030110</token>
>         <message>Last 30 failures:
> CN=Jan novak,OU=BRC,DC=wintest,DC=bbb,DC=sk: 
> java.lang.IllegalStateException: Null parent for value 
> PCV(1):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import_)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
> in item 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}assignment):[PCV(1):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import_)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]], 
> PCV(2):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:22.972+01:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-03T12:11:23.027+01:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import_)]]], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}construction):[PCV(null):[PrismReference({.../common/common-3}resourceRef):[PRV(oid=feed0000-0000-0000-0000-000000000001, 
> targetType={.../common/common-3}ResourceType, 
> relation={.../common/org-3}default)]]], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
> (assignment in user:f259bab2-48eb-4e0f-b426-6b58445fdbae(jnovak)); in 
> current user in 
> LensFocusContext(UserType:f259bab2-48eb-4e0f-b426-6b58445fdbae)
> .....
>
>
> Looks like the same error as from GUI action, but no stack trace.
> thx a lot
>
> Petr
>
>
>
>
>
>
> From: Pavol Mederly _<mederly at evolveum.com>_ <mailto:mederly at evolveum.com>
> To: _midpoint at lists.evolveum.com_ <mailto:midpoint at lists.evolveum.com>
> Date: 17/01/2018 16:05
> Subject: Re: [midPoint] Fw: Null parent for value PCV(1) Exception 
> during reconciliation after upgrade of midpoint from 3.5.1 to 3.6.1
> Sent by: "midPoint" _<midpoint-bounces at lists.evolveum.com>_ 
> <mailto:midpoint-bounces at lists.evolveum.com>
>
> ------------------------------------------------------------------------
>
>
>
> Hello Petr,
>
> just to make sure: You wrote that the exception occurs during 
> reconciliation. I assume you mean reconciliation task.
>
> But the stack trace corresponds to a GUI operation.
>
> So, what's the case? Does it occur within a task or in GUI? If in GUI, 
> is it replicable?
>
> Pavol Mederly
> Software developer
> evolveum.com
>
> On 17.01.2018 12:34, _petr.kulheim at ibacz.eu_ 
> <mailto:petr.kulheim at ibacz.eu>wrote:
> hi guys,
>
> we have customer's test environment where we have upgraded midpoint 
> from 3.5.1 to 3.6.1
> After this upgrade we have some users, about 30, having following 
> Exception during reconsiliation:
>
> 2018-01-15 17:33:30,325 [] [Thread-77] ERROR 
> (com.evolveum.midpoint.web.component.progress.ProgressReporter): Error 
> executing changes.
> java.lang.IllegalStateException: Null parent for value 
> PCV(1):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation_)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
> in item 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}assignment):[PCV(1):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation_)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
> (assignment in user:09cff951-c031-4033-95a9-de85812ccc46(testovic)); 
> in current user in 
> LensFocusContext(UserType:09cff951-c031-4033-95a9-de85812ccc46)
>        at 
> com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:495)~[model-impl-3.6.1.jar:na]
>        at 
> com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:461)~[model-impl-3.6.1.jar:na]
>        at 
> com.evolveum.midpoint.model.impl.lens.LensFocusContext.checkConsistence(LensFocusContext.java:459)~[model-impl-3.6.1.jar:na]
>        at 
> com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:453)~[model-impl-3.6.1.jar:na]
>        at 
> com.evolveum.midpoint.model.impl.lens.LensContext.checkConsistence(LensContext.java:678)~[model-impl-3.6.1.jar:na]
>        at 
> com.evolveum.midpoint.model.impl.lens.projector.FocusProcessor.processFocusFocus(FocusProcessor.java:398)~[model-impl-3.6.1.jar:na]
>        at 
> com.evolveum.midpoint.model.impl.lens.projector.FocusProcessor.processFocus(FocusProcessor.java:173)~[model-impl-3.6.1.jar:na]
>        at 
> com.evolveum.midpoint.model.impl.lens.projector.Projector.lambda$projectInternal$1(Projector.java:227)~[model-impl-3.6.1.jar:na]
>        at 
> com.evolveum.midpoint.model.impl.lens.LensUtil.partialExecute(LensUtil.java:1254)~[model-impl-3.6.1.jar:na]
>        at 
> com.evolveum.midpoint.model.impl.lens.projector.Projector.projectInternal(Projector.java:225)~[model-impl-3.6.1.jar:na]
>        at 
> com.evolveum.midpoint.model.impl.lens.projector.Projector.project(Projector.java:114)~[model-impl-3.6.1.jar:na]
>        at 
> com.evolveum.midpoint.model.impl.lens.Clockwork.click(Clockwork.java:440)~[model-impl-3.6.1.jar:na]
>        at 
> com.evolveum.midpoint.model.impl.lens.Clockwork.run(Clockwork.java:197) 
> ~[model-impl-3.6.1.jar:na]
>        at 
> com.evolveum.midpoint.model.impl.controller.ModelController.executeChanges(ModelController.java:572)~[model-impl-3.6.1.jar:na]
>        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
> ~[na:1.8.0_111]
>        at 
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)~[na:1.8.0_111]
>        at 
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)~[na:1.8.0_111]
>        at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_111]
>        at 
> org.apache.wicket.proxy.LazyInitProxyFactory$JdkHandler.invoke(LazyInitProxyFactory.java:507)~[wicket-ioc-7.6.0.jar:7.6.0]
>        at com.sun.proxy.$Proxy164.executeChanges(Unknown Source) ~[na:na]
>        at 
> com.evolveum.midpoint.web.component.progress.ProgressReporter.lambda$executeChangesAsync$0(ProgressReporter.java:187)~[classes/:na]
>        at java.lang.Thread.run(Thread.java:745) ~[na:1.8.0_111]
> Caused by: java.lang.IllegalStateException: Null parent for value 
> PCV(1):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation_)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]] 
> in item 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}assignment):[PCV(1):[PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}metadata):[PCV(null):[PP({.../common/common-3}requestTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:13.965+02:00)], 
> PrismReference({.../common/common-3}requestorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createTimestamp):[PPV(XMLGregorianCalendarImpl:2017-03-29T11:17:14.092+02:00)], 
> PrismReference({.../common/common-3}creatorRef):[PRV(oid=00000000-0000-0000-0000-000000000002, 
> targetType={.../common/common-3}UserType, 
> relation={.../common/org-3}default)], 
> PP({.../common/common-3}createChannel):[PPV(String:_http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#reconciliation_)]]], 
> PrismReference({.../common/common-3}targetRef):[PRV(oid=feed0000-0000-0000-0003-000000000001, 
> targetType={.../common/common-3}RoleType, 
> relation={.../common/org-3}default)], 
> PC({_http://midpoint.evolveum.com/xml/ns/public/common/common-3_}activation):[PCV(null):[PP({.../common/common-3}effectiveStatus):[PPV(ActivationStatusType:ENABLED)]]]]] 
> (assignment in user:09cff951-c031-4033-95a9-de85812ccc46(testovic))
>        at 
> com.evolveum.midpoint.prism.Item.checkConsistenceInternal(Item.java:748) 
> ~[prism-3.6.1.jar:na]
>        at 
> com.evolveum.midpoint.prism.PrismContainer.checkConsistenceInternal(PrismContainer.java:688)~[prism-3.6.1.jar:na]
>        at 
> com.evolveum.midpoint.prism.PrismContainerValue.checkConsistenceInternal(PrismContainerValue.java:1271)~[prism-3.6.1.jar:na]
>        at 
> com.evolveum.midpoint.prism.Item.checkConsistenceInternal(Item.java:754) 
> ~[prism-3.6.1.jar:na]
>        at 
> com.evolveum.midpoint.prism.PrismContainer.checkConsistenceInternal(PrismContainer.java:688)~[prism-3.6.1.jar:na]
>        at 
> com.evolveum.midpoint.prism.PrismObject.checkConsistenceInternal(PrismObject.java:409)~[prism-3.6.1.jar:na]
>        at 
> com.evolveum.midpoint.prism.Item.checkConsistence(Item.java:709) 
> ~[prism-3.6.1.jar:na]
>        at 
> com.evolveum.midpoint.model.impl.lens.LensElementContext.checkConsistence(LensElementContext.java:491)~[model-impl-3.6.1.jar:na]
>        ... 21 common frames omitted
>
>
> I have found it comes from
> com.evolveum.midpoint.prism.Item radek 748,
>
>    if (val.getParent() == null) {
>            throw new IllegalStateException("Null parent for value 
> "+val+" in item "+this+" ("+path+" in "+rootItem+")");
>    }
>
>
> So far we haven't found any suspicious Users/Accounts metadata.
> Likely it is related to AD resource.
> Any hint or advice would be appreciated.
>
> Thx
>
> Petr Kulheim
> JEE Developer
>
> IBA CZ, s.r.o.
> Office: Petržílkova 2565/23, 158 00 Praha, CZ
> Phone: +420 603 272826
> E-mail: _petr.kulheim at ibacz.eu_ <mailto:petr.kulheim at ibacz.eu>
>
> IBACZ email signature <http://www.ibacz.eu/email-signature/index.html>
>
> ------------------------------------------------------------------------
> Disclaimer:
>
> The information contained in this communication is intended solely for 
> the use of the individual or entity to whom it is addressed and others 
> authorized to receive it.
> It may contain confidential or legally privileged information.
> If you are not the intended recipient you are hereby notified that any 
> disclosure, copying, distribution or taking any action in reliance on 
> the contents of this information is strictly prohibited and may be 
> unlawful.
> If you have received this communication in error, please notify us 
> immediately by forwarding this email to _ict at ibacz.eu_ 
> <mailto:ict at ibacz.eu>and then delete it from your system.
> IBA Group is neither liable for the proper and complete transmission 
> of the information contained in this communication nor for any delay 
> in its receipt.
>
>
> _______________________________________________
> midPoint mailing list_
> __midPoint at lists.evolveum.com_ <mailto:midPoint at lists.evolveum.com>_
> __http://lists.evolveum.com/mailman/listinfo/midpoint_
>
> _______________________________________________
> midPoint mailing list_
> __midPoint at lists.evolveum.com_ <mailto:midPoint at lists.evolveum.com>_
> __http://lists.evolveum.com/mailman/listinfo/midpoint_
>
>
>
> ------------------------------------------------------------------------
> Disclaimer:
>
> The information contained in this communication is intended solely for 
> the use of the individual or entity to whom it is addressed and others 
> authorized to receive it.
> It may contain confidential or legally privileged information.
> If you are not the intended recipient you are hereby notified that any 
> disclosure, copying, distribution or taking any action in reliance on 
> the contents of this information is strictly prohibited and may be 
> unlawful.
> If you have received this communication in error, please notify us 
> immediately by forwarding this email to _ict at ibacz.eu_ 
> <mailto:ict at ibacz.eu>and then delete it from your system.
> IBA Group is neither liable for the proper and complete transmission 
> of the information contained in this communication nor for any delay 
> in its receipt.
>
>
> _______________________________________________
> midPoint mailing list_
> __midPoint at lists.evolveum.com_ <mailto:midPoint at lists.evolveum.com>_
> __http://lists.evolveum.com/mailman/listinfo/midpoint_
>
> _______________________________________________
> midPoint mailing list_
> __midPoint at lists.evolveum.com_ <mailto:midPoint at lists.evolveum.com>_
> __http://lists.evolveum.com/mailman/listinfo/midpoint_
>
>
>
> ------------------------------------------------------------------------
> Disclaimer:
>
> The information contained in this communication is intended solely for 
> the use of the individual or entity to whom it is addressed and others 
> authorized to receive it.
> It may contain confidential or legally privileged information.
> If you are not the intended recipient you are hereby notified that any 
> disclosure, copying, distribution or taking any action in reliance on 
> the contents of this information is strictly prohibited and may be 
> unlawful.
> If you have received this communication in error, please notify us 
> immediately by forwarding this email to _ict at ibacz.eu_ 
> <mailto:ict at ibacz.eu>and then delete it from your system.
> IBA Group is neither liable for the proper and complete transmission 
> of the information contained in this communication nor for any delay 
> in its receipt.
>
>
> _______________________________________________
> midPoint mailing list_
> __midPoint at lists.evolveum.com_ <mailto:midPoint at lists.evolveum.com>_
> __http://lists.evolveum.com/mailman/listinfo/midpoint_
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com_
> __http://lists.evolveum.com/mailman/listinfo/midpoint_
>
>
>
> ------------------------------------------------------------------------
> Disclaimer:
>
> The information contained in this communication is intended solely for 
> the use of the individual or entity to whom it is addressed and others 
> authorized to receive it.
> It may contain confidential or legally privileged information.
> If you are not the intended recipient you are hereby notified that any 
> disclosure, copying, distribution or taking any action in reliance on 
> the contents of this information is strictly prohibited and may be 
> unlawful.
> If you have received this communication in error, please notify us 
> immediately by forwarding this email to ict at ibacz.eu and then delete 
> it from your system.
> IBA Group is neither liable for the proper and complete transmission 
> of the information contained in this communication nor for any delay 
> in its receipt._______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>
>
> ------------------------------------------------------------------------
> Disclaimer:
>
> The information contained in this communication is intended solely for 
> the use of the individual or entity to whom it is addressed and others 
> authorized to receive it.
> It may contain confidential or legally privileged information.
> If you are not the intended recipient you are hereby notified that any 
> disclosure, copying, distribution or taking any action in reliance on 
> the contents of this information is strictly prohibited and may be 
> unlawful.
> If you have received this communication in error, please notify us 
> immediately by forwarding this email to ict at ibacz.eu and then delete 
> it from your system.
> IBA Group is neither liable for the proper and complete transmission 
> of the information contained in this communication nor for any delay 
> in its receipt.
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180126/e6879bfc/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: fmjgnmbmldmpmiie.png
Type: image/png
Size: 48578 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180126/e6879bfc/attachment.png>

From Caspi at seznam.cz  Fri Jan 26 15:55:02 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Fri, 26 Jan 2018 15:55:02 +0100 (CET)
Subject: [midPoint] Template modification
Message-ID: <3uH.vP8.6qPHzfCb4nO.1QQq56@seznam.cz>

Hi Pavol,



thank you for reply. I found this code posted by Ivan in 2016.




http://lists.evolveum.com/pipermail/midpoint/2016-May/001884.html





I used user template and change orgType to RoleType. It worked for me. 
Imported users

had assigned correct roles in midpoint. Thats the reason why I used 
RoleType.




The problem I have is in case that role (AD group) is not imported to 
midpoint. That it fails.

We have a lot of AD groups managed by applications and those shoudl not be 
in midpoint.




so that was the reason why i add condition




 if (org != null)




With that condition i tryed to solve situation when role is not found in 
Midpoint.




Jan








-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180126/49eb8d2d/attachment.htm>

From mederly at evolveum.com  Fri Jan 26 16:17:21 2018
From: mederly at evolveum.com (Pavol Mederly)
Date: Fri, 26 Jan 2018 16:17:21 +0100
Subject: [midPoint] Template modification
In-Reply-To: <3uH.vP8.6qPHzfCb4nO.1QQq56@seznam.cz>
References: <3uH.vP8.6qPHzfCb4nO.1QQq56@seznam.cz>
Message-ID: <fb17544d-69b7-b7f3-22fb-f3b14e03a7e5@evolveum.com>

Jan,

hmmm. I see. Anyway, please try to add "return null" and, if that would 
not help, invert "if" conditions. I am afraid I have no other idea at 
this moment ...

Pavol Mederly
Software developer
evolveum.com

On 26.01.2018 15:55, Jan Kaspar wrote:
> Hi Pavol,
>
> thank you for reply. I found this code posted by Ivan in 2016.
>
> http://lists.evolveum.com/pipermail/midpoint/2016-May/001884.html
>
> I used user template and change orgType to RoleType. It worked for me. 
> Imported users
> had assigned correct roles in midpoint. Thats the reason why I used 
> RoleType.
>
> The problem I have is in case that role (AD group) is not imported to 
> midpoint. That it fails.
> We have a lot of AD groups managed by applications and those shoudl 
> not be in midpoint.
>
> so that was the reason why i add condition
>
>  if (org != null)
>
> With that condition i tryed to solve situation when role is not found 
> in Midpoint.
>
> Jan
>
>
>
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180126/0eab1c39/attachment.htm>

From wojciech.staszewski at diagnostyka.pl  Fri Jan 26 16:40:16 2018
From: wojciech.staszewski at diagnostyka.pl (Wojciech Staszewski)
Date: Fri, 26 Jan 2018 16:40:16 +0100
Subject: [midPoint]  Role approval escalations
Message-ID: <ceb24111-76e3-0f6c-b418-8b3b46107c3e@diagnostyka.pl>

Hi!

Does MidPoint have the ability to define escalations for role approval workflow?

Thanks!
Wojciech Staszewski


From mederly at evolveum.com  Fri Jan 26 16:45:28 2018
From: mederly at evolveum.com (Pavol Mederly)
Date: Fri, 26 Jan 2018 16:45:28 +0100
Subject: [midPoint] Role approval escalations
In-Reply-To: <ceb24111-76e3-0f6c-b418-8b3b46107c3e@diagnostyka.pl>
References: <ceb24111-76e3-0f6c-b418-8b3b46107c3e@diagnostyka.pl>
Message-ID: <1c48d848-1ec6-4a26-7c72-00371928a437@evolveum.com>

Wojciech,

of course! Spent a lot of (wonderful) days implementing it quite 
recently. It was for 3.6. See 
https://wiki.evolveum.com/display/midPoint/Escalation+in+workflows+HOWTO.

Pavol Mederly
Software developer
evolveum.com

On 26.01.2018 16:40, Wojciech Staszewski wrote:
> Hi!
>
> Does MidPoint have the ability to define escalations for role approval workflow?
>
> Thanks!
> Wojciech Staszewski
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint



From Caspi at seznam.cz  Sat Jan 27 12:18:39 2018
From: Caspi at seznam.cz (Jan Kaspar)
Date: Sat, 27 Jan 2018 12:18:39 +0100 (CET)
Subject: [midPoint] Template modification
Message-ID: <4lT.vPO.5o3qQXylidr.1QR60F@seznam.cz>

Hi,



I got it. In the end i changed inbound mapping to store memberOf attribute 
as it is (DinstinguishedName).

In prevouis attempt i tryed to normalize to CommonName.




Not normalize is done in user template and it works as expected.




Thanks all,




Jan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180127/0a68be61/attachment.htm>

From arnost.starosta at ami.cz  Mon Jan 29 13:22:12 2018
From: arnost.starosta at ami.cz (=?UTF-8?Q?Arno=C5=A1t_Starosta_=2D_AMI_Praha_a=2Es=2E?=)
Date: Mon, 29 Jan 2018 13:22:12 +0100
Subject: [midPoint] Updates can get lost during a running recomputation task
	(SOLVED)
Message-ID: <CAGPA3FJMBddCsmZH0e4u9uiuJ7P4==cCKHaF9L2CqxN4MFiKTA@mail.gmail.com>

*Problem : *

Midpoint in default configuration recomputes objects by first retrieving
them ALL from repository, then passing each object to a worker thread. If
the object was updated meanwhile (e.g. live-synced or updated from gui)
before it is recomputed by the worker thread, this update can be
overwritten by the object version retrieved when the recompute task
started. It happened on my deployment several times.

*Is your deployment affected? :*

Hard to say, i don't see any relevant log message to check. I had to check
by debugging the running recompute task and verifying that
SqlRepositoryServiceImpl.searchObjectsIterative calls
ObjectRetriever.searchObjectsIterativeByPaging (ok) and not
ObjectRetriever.searchObjectsIterativeAttempt (can loose updates).

Deployments with MySQL or H2 backend should be ok with default
configuration (check sources
SqlRepositoryConfiguration.computeDefaultIterativeSearchParameters). Did
not verify the runtime.

*Solution:*

Configure iterativeSearchByPaging and iterativeSearchByPagingBatchSize in
config.xml midpoint/repository element. Don't know if all backends support
this setting but postgres (which i use) does.

<configuration>

   <midpoint>

       <repository>

           …

           <iterativeSearchByPaging>true</iterativeSearchByPaging>


<iterativeSearchByPagingBatchSize>17</iterativeSearchByPagingBatchSize>

           …

       </repository>

   </midpoint>

</configuration>

After setting these parameters the objects to recompute are read in 'pages'
and fed to worker threads until the request queue between the reader thread
and worker threads is full, then the reader is blocked. The size of the
queue is hardcoded as 2 * number-of-worker-threads.

By setting the iterativeSearchByPagingBatchSize you can still loose
updates, but the time window when this can happen shrinks from
number-of-objects to max(page size, 2*num-of-worker-threads). Without much
thought i set the page size to (2 * number-of-worker-threads) + 1.

good luck
arnost

-- 

Arnošt Starosta
solution architect

gsm: [+420] 603 794 932
e-mail: arnost.starosta at ami.cz


AMI Praha a.s.
Pláničkova 11
162 00 Praha 6
tel.: [+420] 274 783 239
web: www.ami.cz


[image: AMI Praha a.s.]

[image: AMI Praha a.s.]
<http://www.ami.cz/reseni-a-sluzby/bezpecnost-dat/identity-management>

Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za
společnost AMI Praha a.s.
jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně
písemnou formu.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180129/d4f0b8c5/attachment.htm>

From davy.priem at vives.be  Mon Jan 29 13:54:15 2018
From: davy.priem at vives.be (Davy Priem)
Date: Mon, 29 Jan 2018 12:54:15 +0000
Subject: [midPoint] inducement issue after upgrade to 3.7
In-Reply-To: <d4770d02-e538-2f1c-53dd-327d185cd481@evolveum.com>
References: <0001EAE3-377F-44A0-BAA5-CFF1C6008A6D@vives.be>
 <d4770d02-e538-2f1c-53dd-327d185cd481@evolveum.com>
Message-ID: <1c000956db6140b79242555d972d7b88@vives.be>

Hi Ivan,

Thank for your response. The role has an inducement for AD. I don’t see any errors in the log, but when a new account is created, I do see the normal AD LDAP warning stuff, so midpoint is definitely doing something. User is not created though. I’ll try some more debugging. I also included the role as attachement.

AD LDAP warnings:
2018-01-29 13:30:39,000 [] [midPointScheduler_Worker-1] WARN (com.evolveum.polygon.connector.ldap.schema.AbstractSchemaTranslator): method: null msg:Uknown attribute 1.3.6.1.4.1.1466.115.121.1.15, cannot determine if it is binary
2018-01-29 13:30:39,000 [] [midPointScheduler_Worker-1] WARN (com.evolveum.polygon.connector.ldap.schema.AbstractSchemaTranslator): method: null msg:Uknown attribute 1.3.6.1.4.1.1466.115.121.1.12, cannot determine if it is binary
2018-01-29 13:30:39,000 [] [midPointScheduler_Worker-1] WARN (com.evolveum.polygon.connector.ldap.schema.AbstractSchemaTranslator): method: null msg:Uknown attribute 1.3.6.1.4.1.1466.115.121.1.15, cannot determine if it is binary
2018-01-29 13:30:39,001 [] [midPointScheduler_Worker-1] WARN (com.evolveum.polygon.connector.ldap.schema.AbstractSchemaTranslator): method: null msg:Uknown attribute 1.3.6.1.4.1.1466.115.121.1.15, cannot determine if it is binary
2018-01-29 13:30:39,001 [] [midPointScheduler_Worker-1] WARN (com.evolveum.polygon.connector.ldap.schema.AbstractSchemaTranslator): method: null msg:Uknown attribute 1.3.6.1.4.1.1466.115.121.1.15, cannot determine if it is binary
2018-01-29 13:30:39,001 [] [midPointScheduler_Worker-1] WARN (com.evolveum.polygon.connector.ldap.schema.AbstractSchemaTranslator): method: null msg:Uknown attribute 1.3.6.1.4.1.1466.115.121.1.15, cannot determine if it is binary
2018-01-29 13:30:39,001 [] [midPointScheduler_Worker-1] WARN (com.evolveum.polygon.connector.ldap.schema.AbstractSchemaTranslator): method: null msg:Uknown attribute 1.2.840.113556.1.4.906, cannot determine if it is binary
2018-01-29 13:30:39,001 [] [midPointScheduler_Worker-1] WARN (com.evolveum.polygon.connector.ldap.schema.AbstractSchemaTranslator): method: null msg:Uknown attribute 1.3.6.1.4.1.1466.115.121.1.15, cannot determine if it is binary
2018-01-29 13:30:39,001 [] [midPointScheduler_Worker-1] WARN (com.evolveum.polygon.connector.ldap.schema.AbstractSchemaTranslator): method: null msg:Uknown attribute 1.3.6.1.4.1.1466.115.121.1.15, cannot determine if it is binary
2018-01-29 13:30:39,001 [] [midPointScheduler_Worker-1] WARN (com.evolveum.polygon.connector.ldap.schema.AbstractSchemaTranslator): method: null msg:Uknown attribute 1.3.6.1.4.1.1466.115.121.1.27, cannot determine if it is binary
2018-01-29 13:30:39,040 [] [midPointScheduler_Worker-1] INFO (org.apache.cxf.wsdl.service.factory.ReflectionServiceFactoryBean): Creating Service {http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd}WinRmService from WSDL: jar:file:/var/cache/tomcat/temp/bundle-1680891419/lib/winrm4j-client-0.4.0.e4.jar!/wsdl/WinRmService.wsdl



Van: midPoint [mailto:midpoint-bounces at lists.evolveum.com] Namens Ivan Noris
Verzonden: Wednesday, 24 January 2018 09:43
Aan: midpoint at lists.evolveum.com
Onderwerp: Re: [midPoint] inducement issue after upgrade to 3.7


Hi Davy,

I have just tried our training environment installed from scratch, where we assign a role using object template, to each newly imported person from HR source. And it works. The projections are created after role is assigned.

I have not clean 3.7 but 3.7-support branch to be honest.

Are there any errors in midpoint.log? Can you share the role?

Best regards,

Ivan

On 24.01.2018 09:17, Davy Priem wrote:
Hi,

This is a probably a version stupid question, but since I upgraded to version 3.7, the inducements on a role aren’t processed anymore when a role is assigned to a user. I have a template that assigns a role on a new user. That role has several inducements. When a new users is imported, midpoint succesfully assigns the role to the user (as with 3.6). However, there it stops. When I go to the user and do a recon, then the projections are made. Am I overlooking something? I didn’t found any behaviour change in 3.7 release notes.


Best regards,
Davy Priem





_______________________________________________

midPoint mailing list

midPoint at lists.evolveum.com<mailto:midPoint at lists.evolveum.com>

http://lists.evolveum.com/mailman/listinfo/midpoint



--

Ivan Noris

Senior Identity Engineer

evolveum.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180129/87bfa942/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: student.xml
Type: application/xml
Size: 6335 bytes
Desc: student.xml
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20180129/87bfa942/attachment.xml>