[midPoint] ScriptedSQL - add/remove entitlements
Nicolas Rossi
nrossi at identicum.com
Thu Dec 15 13:43:27 CET 2016
Can you share with us the create and update scripts ?
Regards
Ing Nicolás Rossi
Identicum S.A.
Jorge Newbery 3226
Tel: +54 (11) 4552-3050
www.identicum.com
On Thu, Dec 15, 2016 at 5:15 AM, Wojciech Staszewski <
wojciech.staszewski at diagnostyka.pl> wrote:
> I've done it with joins instead "where .. and .. and", and it works, but
> now I my account appears multiple times on the resource (the number of
> accounts = the number of groups). This is definitely not a simple thing
> and the documentation is weak. :(
>
> W dniu 15.12.2016 o 02:34, Nicolas Rossi pisze:
> > The Search script should return the ID, Name and Members of the group.
> > It doesn't matter if you use 1, 2 or more queries but you should return
> > an array with one row for each group where the members attribute is an
> > array too.
> >
> > Can you copy the sql error of the query with the where filter?
> >
> > Regards,
> >
> >
> > Nicolás
> >
> >
> > El El mié, 14 de dic. de 2016 a las 09:12, Wojciech Staszewski
> > <wojciech.staszewski at diagnostyka.pl
> > <mailto:wojciech.staszewski at diagnostyka.pl>> escribió:
> >
> > Just 4 more questions.
> >
> >
> >
> > I have a little trouble with search script.
> >
> >
> >
> > 1. Searching associated groups: can it be in a separate sql query in
> >
> > __ACCOUNT__ case?
> >
> > 2. It must return: "__UID__", "__NAME__" and "groups" attributes,
> right?
> >
> > (the list of groups)
> >
> > 3. Or it must be one single guery returning all attributes including
> >
> > group membership? But then it will return more than one row...
> >
> >
> >
> > 4. How to construct the SQL query using "where" template?
> >
> > I tried to put something like this:
> >
> >
> >
> > "select g.name <http://g.name> as name, u.alias from users_groups
> > ug, usrgrp g, users u"
> >
> > + where + " AND g.usrgrpid = ug.usrgrpid and u.userid = ug.userid"
> >
> >
> >
> > (msg:Search WHERE clause is: WHERE u.userid = 1)
> >
> >
> >
> > But i got SQL syntax error. I log this query, Ctrl+C from log,
> Ctrl+V in
> >
> > SQL console and it works.
> >
> >
> >
> > Thanks,
> >
> > Best regards, WS
> >
> >
> >
> > W dniu 13.12.2016 o 18:30, Wojciech Staszewski pisze:
> >
> > > Thank you very much!
> >
> > > Regards, WS
> >
> > >
> >
> > > Dnia poniedziałek, 12 grudnia 2016 21:45:00 CET Nicolas Rossi
> pisze:
> >
> > >> Hi, you have to add the association between Users and Groups. It's
> >
> > >> something like that:
> >
> > >>
> >
> > >> <association>
> >
> > >> <ref>ri:GroupObjectClass</ref>
> >
> > >> <kind>entitlement</kind>
> >
> > >> <intent>default</intent>
> >
> > >> <tolerant>false</tolerant>
> >
> > >> <direction>subjectToObject</direction>
> >
> > >> <associationAttribute>ri:groups</associationAttribute>
> >
> > >> <valueAttribute>icfs:uid</valueAttribute>
> >
> > >>
> > <shortcutAssociationAttribute>ri:members</
> shortcutAssociationAttribute>
> >
> > >> <shortcutValueAttribute>icfs:uid</shortcutValueAttribute>
> >
> > >> </association>
> >
> > >>
> >
> > >> You can find more information about the association and the
> tolerant
> >
> > >> parameter here:
> >
> > >>
> > https://wiki.evolveum.com/display/midPoint/Entitlements#
> Entitlements-AssociationDefinition
> >
> > >>
> >
> > >> Inside your Update script the operation should be
> > ADD_ATTRIBUTE_VALUE for
> >
> > >> objectClass __ACCOUNT__ and the attribute received should be
> > "groups":
> >
> > >>
> >
> > >> case "ADD_ATTRIBUTE_VALUES":
> >
> > >>
> >
> > >> if(objectClass == "__ACCOUNT__")
> >
> > >> {
> >
> > >> for(String group : attributes.get("groups"))
> >
> > >> {
> >
> > >> def existingEntitlement = sql.rows("SELECT 1 FROM
> >
> > >> UserGroups WHERE user_id=? AND group_id=?",[uid as String, group
> as
> >
> > >> String]);
> >
> > >> if(existingEntitlement.isEmpty())
> >
> > >> {
> >
> > >> log.info <http://log.info>("Sample - Adding
> > entitlement ${group} to user
> >
> > >> ${uid}");
> >
> > >> sql.execute("insert into UserGroups (user_id,
> > group_id)
> >
> > >> values (" + uid + "," + group + ")");
> >
> > >> }
> >
> > >> else
> >
> > >> {
> >
> > >> log.info <http://log.info>("Sample - Skipping
> > assignment because user
> >
> > >> ${uid} already has group ${group}");
> >
> > >> }
> >
> > >> }
> >
> > >> }
> >
> > >>
> >
> > >> You should also handle the REMOVE_ATTRIBUTE_VALUES with the same
> > logic.
> >
> > >> Radovan and Ivan have helped us few weeks ago with the ScriptedSQL
> >
> > >> resource. You can find the conversation in the mailing list. I am
> > sure it
> >
> > >> will help you too.
> >
> > >>
> >
> > >> Regards,
> >
> > >>
> >
> > >>
> >
> > >>
> >
> > >>
> >
> > >>
> >
> > >> Ing Nicolás Rossi
> >
> > >> Identicum S.A.
> >
> > >> Jorge Newbery 3226
> >
> > >> Tel: +54 (11) 4552-3050
> >
> > >> www.identicum.com <http://www.identicum.com>
> >
> > >>
> >
> > >> On Mon, Dec 12, 2016 at 7:11 PM, Wojciech Staszewski <
> >
> > >> wojciech.staszewski at diagnostyka.pl
> > <mailto:wojciech.staszewski at diagnostyka.pl>> wrote:
> >
> > >>
> >
> > >>> Hello,
> >
> > >>>
> >
> > >>> I'm playing with ScriptedSQL resource, based on Evolveum example
> > from
> >
> > >>> Github.
> >
> > >>> I'm able to list/add/remove users/groups and enable/disable
> > accounts.
> >
> > >>> Great.
> >
> > >>> But now I want to apply an assignment (a group) to user.
> > Unfortunately
> >
> > >>> "Update_Script.groovy" is incomplete,
> >
> > >>> ADD_ATTRIBUTE_VALUES and REMOVE_ATTRIBUTE_VALUES cases are empty.
> >
> > >>> Where can I find some examples?
> >
> > >>>
> >
> > >>> Thanks a lot!
> >
> > >>> WS
> >
> > >>> _______________________________________________
> >
> > >>> midPoint mailing list
> >
> > >>> midPoint at lists.evolveum.com <mailto:midPoint at lists.evolveum.com>
> >
> > >>> http://lists.evolveum.com/mailman/listinfo/midpoint
> >
> > >>>
> >
> > >>
> >
> > >
> >
> > >
> >
> > _______________________________________________
> >
> > midPoint mailing list
> >
> > midPoint at lists.evolveum.com <mailto:midPoint at lists.evolveum.com>
> >
> > http://lists.evolveum.com/mailman/listinfo/midpoint
> >
> >
> >
> > _______________________________________________
> > midPoint mailing list
> > midPoint at lists.evolveum.com
> > http://lists.evolveum.com/mailman/listinfo/midpoint
> >
>
> --
> Wojciech Staszewski
> Administrator Systemów Sieciowych
> tel. kom: 663 680 236
> www.diagnostyka.pl
> Diagnostyka Sp. z o. o.
> ul. Prof. M. Życzkowskiego 16, 31-864 Kraków
> Numer KRS: 0000381559 (Sąd Rejonowy dla Krakowa-Śródmieścia w Krakowie,
> XI Wydział Gospodarczy KRS)
> NIP: 675-12-65-009; REGON: 356366975
> Kapitał zakładowy: 33 756 500 zł.
>
> Pomyśl o środowisku zanim wydrukujesz ten e-mail.
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20161215/2607c773/attachment.htm>
More information about the midPoint
mailing list