[midPoint] No such property: iterationToken

Thu Jul 3 18:31:48 CEST 2014

Hi Radovan -

Gotcha. Thanks for the explanation. We have a use case where there could
easily be two people with the same name (this is a common occurrence
here - e.g John Smith) working in the same department. Since our source
system does not deal with resource user account names (which are of
course unique) we need to build and attach these to the user object in
Midpoint. I remember doing this in the Object Template, but nowadays I'm
beginning to forget some of the earlier Midpoint theory when I was
starting off :) - doing this in the OT is quite fine for our requirement.

I'm trying to design a solution for a different issue though - and
perhaps you could give me some guidance here. I'll move my question to a
separate thread!

BR/Deepak

> Radovan Semancik <mailto:radovan.semancik at evolveum.com>
> July 1, 2014 at 8:07 PM
> Hi Deepak,
>
> That's correct. iteration and iterationToken variables are only
> available in outbound expressions and in object template. But these
> are slightly different things. The iterationToken in outbound
> expression applied to accounts (or other resource objects). The
> iterationToken in object template applies to focal objects such as
> users and roles. These are independently used and independently
> incremented. This how it make sense to us: you may want to use
> iterationToken to find unique account name then use the one in
> outbound expressions. If you want to determine a unique name for user
> then use the iterationToken in user template.
>
> IterationToken in inbound expressions does not make much sense to me.
> The target of inbound expressions is focal object (e.g. user).
> Therefore it it just cannot be the same thing as iterationToken in
> outbound expression. The other thing is that midPoint needs to have a
> complete user to determine whether it is unique or not. Currently we
> check only uniqueness of user's name. But that will change in the
> future and you should be able to set uniqueness constraint on any
> property. Therefore we will need a complete user before we check
> uniqueness. And we also need an ability to recompute the expressions
> again and again until we find a unique combination. And this can only
> be done efficiently in the object template. Therefore the
> iterationToken is in the object template and not in inbound
> expressions. Oh yes, we could theoretically recompute all the inbound
> expressions in all the resources ... but that is just too much
> recomputation and it would complicate the code. Especially if resource
> dependencies are used. Therefore we have decided that having
> iterationToken just in object template is OK.
>
> However there are "tricks" how to use the iterationTokens almost
> everywhere. It is mostly passing it as an extension property. Or
> pre-computing some "stem" names in object template and placing these
> in the extension and then use them in outbound expressions. Similarly
> you can pass pass interim values from inbound to user extension and
> the use object template to iterate and find unique combination. There
> are many ways. We haven't found a use case that we could not easily
> implement with this approach. Maybe if you could describe your
> specific use case we can help you with your configuration.
>
> -- 
>
> Radovan Semancik
> Software Architect
> evolveum.com
>
>
> On 07/01/2014 02:46 PM, Deepak Natarajan wrote:
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
> Deepak Natarajan <mailto:dnataraj at trilobytesystems.com>
> July 1, 2014 at 2:46 PM
>
> Hi Ivan -
>
> Thanks - yes, this is the first time I am trying using the script var
> in inbound mappings as well - apparently Midpoint doesn't like it - so
> I will have to do it in a template (like in your previous examples). I
> was already setting the user name in an inbound expression - just
> needed the iteration token to resolve conflicts.
>
> I already have your example - I was just trying to move it into the
> schema handling, rather than the object template, so I'll just do it
> like you did.
>
> Thanks!
>
> BR/Deepak
>
>
> Ivan Noris <mailto:ivan.noris at evolveum.com>
> July 1, 2014 at 1:29 PM
> Hi Deepak,
>
> just a note from a practice: I've never used iterations on inbound.
> But you can use them in object template to generate (for example)
> unique user/name property.
>
> So in a few words, you would not set user/name from inbound
> expressions, but you would compute it from object template.
>
> I believe I've dropped some example to the list before, if not, I can
> drop one later today if you're interested.
>
> Regards
>
> Ivan
>
> On 07/01/2014 12:41 PM, Deepak Natarajan wrote:
>
> -- 
> Ing. Ivan Noris
> Senior Identity Management Engineer
> evolveum.com
> ___________________________________________
> "Idem per idem - semper idem Vix."
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
> Deepak Natarajan <mailto:dnataraj at trilobytesystems.com>
> July 1, 2014 at 12:41 PM
>
> Hmmm. Looking at the documentation again, it seems inbound mappings
> are mentioned nowhere.
>
> Are these iteration tokens only valid for outbound mappings (i.e
> should I move this usage on inbound mappings to a user creation template?)
>
> Why is this so....?
>
>
> Deepak Natarajan <mailto:dnataraj at trilobytesystems.com>
> July 1, 2014 at 12:37 PM
> Hi -
>
> I'm trying to formulate unique uid's for the user on an inbound mapping.
> I am using iterationToken (I am using a snippet from one of Ivan's
> examples).
>
> This is my attribute mapping
>
> <attribute>
> <ref>icfs:name</ref>
> <limitations>
> <minOccurs>0</minOccurs>
> <access>
> <read>true</read>
> <add>true</add>
> <modify>true</modify>
> </access>
> </limitations>
> <inbound>
> <c:expression>
> <c:script>
> <c:code>
> input + '-apos' + iterationToken
> </c:code>
> </c:script>
> </c:expression>
> <target>
> <path>$user/name</path>
> </target>
> </inbound>
> </attribute>
>
> followed by the iteration definition :
>
> <iteration>
> <maxIterations>999</maxIterations>
> <tokenExpression>
> <script>
> <code>
> if (iteration == 0) {
> return "";
> } else {
> return "" + (iteration + 1)
> }
> </code>
> </script>
> </tokenExpression>
> </iteration>
>
> I am getting the following exception, when I import users :
>
> Caused by:
> com.evolveum.midpoint.util.exception.ExpressionEvaluationException:
> groovy.lang.MissingPropertyException: No such property: iterationToken
> for class: Script17 expression in mapping in inbound expression for
> {http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3}name
> in resource:036f0100-2fe8-49e1-a8fd-5548374f8703(APOS CSV Feeder
> Resource Definition)
> at
> com.evolveum.midpoint.model.common.expression.script.jsr223.Jsr223ScriptEvaluator.evaluate(Jsr223ScriptEvaluator.java:124)
> ~[model-common-3.0.jar:na]
> at
> com.evolveum.midpoint.model.common.expression.script.ScriptExpression.evaluate(ScriptExpression.java:108)
> ~[model-common-3.0.jar:na]
> at
> com.evolveum.midpoint.model.common.expression.script.ScriptExpressionEvaluator.transformSingleValue(ScriptExpressionEvaluator.java:58)
> ~[model-common-3.0.jar:na]
> at
> com.evolveum.midpoint.model.common.expression.evaluator.AbstractValueTransformationExpressionEvaluator$1.process(AbstractValueTransformationExpressionEvaluator.java:420)
> ~[model-common-3.0.jar:na]
> ... 50 common frames omitted
> Caused by: javax.script.ScriptException:
> groovy.lang.MissingPropertyException: No such property: iterationToken
> for class: Script17
> at
> org.codehaus.groovy.jsr223.GroovyScriptEngineImpl.eval(GroovyScriptEngineImpl.java:323)
> ~[groovy-1.8.6.jar:1.8.6]
> at
> org.codehaus.groovy.jsr223.GroovyCompiledScript.eval(GroovyCompiledScript.java:41)
> ~[groovy-1.8.6.jar:1.8.6]
> at javax.script.CompiledScript.eval(CompiledScript.java:92)
> ~[na:1.7.0_45]
> at
> com.evolveum.midpoint.model.common.expression.script.jsr223.Jsr223ScriptEvaluator.evaluate(Jsr223ScriptEvaluator.java:122)
> ~[model-common-3.0.jar:na]
> ... 53 common frames omitted
> Caused by: groovy.lang.MissingPropertyException: No such property:
> iterationToken for class: Script17
> at
> org.codehaus.groovy.runtime.ScriptBytecodeAdapter.unwrap(ScriptBytecodeAdapter.java:50)
> ~[groovy-1.8.6.jar:1.8.6]
> at
> org.codehaus.groovy.runtime.callsite.PogoGetPropertySite.getProperty(PogoGetPropertySite.java:49)
> ~[groovy-1.8.6.jar:1.8.6]
> at
> org.codehaus.groovy.runtime.callsite.AbstractCallSite.callGroovyObjectGetProperty(AbstractCallSite.java:231)
> ~[groovy-1.8.6.jar:1.8.6]
> at Script17.run(Script17.groovy:2) ~[na:na]
> at
> org.codehaus.groovy.jsr223.GroovyScriptEngineImpl.eval(GroovyScriptEngineImpl.java:320)
> ~[groovy-1.8.6.jar:1.8.6]
> ... 56 common frames omitted
>
> I seem to be following the general guidelines here :
> https://wiki.evolveum.com/display/midPoint/Unique+Account+Username+HOWTO
>
> Am I missing something?
>
> Thanks in advance -
> BR/Deepak
>
>
>
>

-- 
Deepak Natarajan
Director

Trilobyte Systems ApS

Falkoner Alle 1, 3            Frederikinkatu 61A, 6th Floor
2000 Frederiksberg         Business Center Papula
Denmark                          00100 Helsinki
                                        Finland

Tel : +45 29375068
http://www.trilobytesystems.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20140703/24051c03/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: postbox-contact.jpg
Type: image/jpeg
Size: 1196 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20140703/24051c03/attachment.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: compose-unknown-contact.jpg
Type: image/jpeg
Size: 770 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20140703/24051c03/attachment-0001.jpg>