[midPoint] HA: HA: Prohibit having particular assignments

Thu May 21 09:50:25 CEST 2015

Hi,

When I think about it then this might be really useful. I have to think 
about it. One of the issues is that we want to keep midPoint mechanisms 
simple, elegant well integrated. As now all the automatic role 
assignments/unsassignment are done through mappings there is no simple 
and elegant place where to define this feature right now. But I'm sure 
we can find the proper place in the future. I have created a jira for it:

https://jira.evolveum.com/browse/MID-2375

However ... it will not fit into current roadmap unless someone sponsors 
this feature (https://wiki.evolveum.com/display/midPoint/I+Need+New+Feature)

Anyway, thanks for the feedback and idea.

-- 
Radovan Semancik
Software Architect
evolveum.com

On 05/19/2015 04:27 PM, Илья Дорофеев wrote:
>
> Hi,
>
> You understood my case correctly as well as the solution you provided 
> seems reasonable. However it would have been nice if you had some sort 
> of prohibiting policy. ))
>
> In any way, thanks for the thorough reply!
>
> Ilya Dorofeev
>
> Software Architect
>
> Solar Security
>
> ------------------------------------------------------------------------
> *От:* midPoint [midpoint-bounces at lists.evolveum.com] от имени Radovan 
> Semancik [radovan.semancik at evolveum.com]
> *Отправлено:* 19 мая 2015 г. 15:57
> *Кому:* midpoint at lists.evolveum.com
> *Тема:* Re: [midPoint] HA: Prohibit having particular assignments
>
> Hi,
>
> I'm not sure that I understand your user case. But if you want to 
> remove all the assignments when a user is fired regardless of how they 
> were assigned then this cannot be done in a purely declarative way. 
> E.g. there can be an assignment that was assigned by IDM admin without 
> any mapping or any other "habeas corpus" in midPoint.
>
> But ... although this cannot be done in a declarative way it can be 
> done in an algorithmic way. Your best option is to use Scripting hooks 
> (https://wiki.evolveum.com/display/midPoint/Scripting+Hooks): Write a 
> piece of groovy code as a scripting hook. It will be executed after 
> every change in midPoint. In this code create a condition ("if" 
> statement) that checks for the attribute change in primary deltas in 
> model context 
> (https://wiki.evolveum.com/display/midPoint/Model+Context). If that 
> condition triggers then use a loop to iterate over all existing user 
> assignments and create a secondary unassign delta for each one. This 
> is not a very straightforward way, but it should work. And it is a 
> reasonably clean way.
>
> If you do not like groovy you can do the same thing in Java. But that 
> will require a custom build of midPoint. Groovy (or Python or 
> JavaScript) scripting hook is probably the right way for you.
>
> -- 
>
>                                             Radovan Semancik
>                                            Software Architect
>                                               evolveum.com
>
>
>
> On 05/19/2015 03:30 PM, Илья Дорофеев wrote:
>>
>> Hi Radovan,
>>
>> I saw the solution exactly as you have specified in your reply. Just 
>> wanted to make sure there's no other option to tackle this issue in 
>> other way. The downside of this approach is the necessity of 
>> specifying the same condition for all the roles created in the 
>> system, whether they are business roles created by users manually or 
>> roles which are being created during the entitlements synchronization 
>> process.
>>
>> Ilya Dorofeev
>>
>> Software Architect
>>
>> Solar Security
>>
>> ------------------------------------------------------------------------
>> *От:* midPoint [midpoint-bounces at lists.evolveum.com] от имени Radovan 
>> Semancik [radovan.semancik at evolveum.com]
>> *Отправлено:* 19 мая 2015 г. 15:01
>> *Кому:* midpoint at lists.evolveum.com
>> *Тема:* Re: [midPoint] Prohibit having particular assignments
>>
>> Hi Ilya,
>>
>> This works a bit differently in midPoint. We do not have separate 
>> policies for automatic assignment and unassignemnt. These are the 
>> same. Therefore simply use mapping in user template that 
>> automatically adds an assignment. And specify a condition when user 
>> should have such an assignment. E.g.
>>
>> <objectTemplate>
>>   ...
>>   <mapping>
>>      <expression> .... assignment here ... </expression>
>> <target><path>assignment</path></target>
>>      <condition>
>>         <script>
>>             <code>employeeType == 'active'</code>
>>         </script>
>>      </condition>
>>   </mapping>
>>
>> Now, this works both for assignment and unassignment. If this user 
>> does not have such assignment and his employeeType changes to 
>> 'active' then the assignment will be added. But if user already has 
>> employeeType='active' and this changes to something else then the 
>> assignment will be removed.
>>
>> MidPoint works with relative changes. This means that after every 
>> change in user attributes midPoint recomputes all the mappings and 
>> figures out what are the resulting (secondary) changes. E.g. if 
>> employeeType attribute changes from 'active' to 'inactive' then 
>> midPoint realizes that the condition in this particular mapping 
>> changes from true to false. Which means that the user should have the 
>> assignment given by this mapping before the change, but this user 
>> should NOT have the assignment after the change. Therefore midPoint 
>> removes the assignment.
>>
>> -- 
>>
>>                                             Radovan Semancik
>>                                            Software Architect
>>                                               evolveum.com
>>
>>
>>
>> On 05/18/2015 01:02 PM, Илья Дорофеев wrote:
>>>
>>> Hi,
>>>
>>> I would like to adjust a policy that will automatically revoke all 
>>> user's assignments (or just some of them selected by a rule) in 
>>> accordance with particular values of some user properties. For 
>>> instance, I would like all the fired users have their assignments 
>>> revoked. I didn't find any mentions in docs of how it is supposed to 
>>> be configured.
>>>
>>> Thanks in advance,
>>>
>>> Ilya Dorofeev
>>>
>>>
>>>
>>> _______________________________________________
>>> midPoint mailing list
>>> midPoint at lists.evolveum.com
>>> http://lists.evolveum.com/mailman/listinfo/midpoint
>>
>>
>>
>>
>> _______________________________________________
>> midPoint mailing list
>> midPoint at lists.evolveum.com
>> http://lists.evolveum.com/mailman/listinfo/midpoint
>
>
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20150521/f0e590c0/attachment.htm>