[midPoint] Refreshing uuids in ldap shadow objects

[Pertti Kellomäki]

Hi Ivan,

Sorry, I should have provided more details. The objects in question are ldap groups, and we are using the pattern where a role assignment induces a membership in a group. When I assign a role to a user, midPoint tries to make the user a member of a group, say cn=mygroup,dc=mydomain. This is a group that midPoint has seen before, so it tries to look it up using the uuid stored in the shadow object. The problem is that the uuid of the group is not valid any more, and the lookup fails.

Pertti



________________________________
Lähettäjä: midPoint <midpoint-bounces at lists.evolveum.com> käyttäjän puolestaIvan Noris <ivan.noris at evolveum.com>
Lähetetty: 30. marraskuuta 2017 15:59
Vastaanottaja: midpoint at lists.evolveum.com
Aihe: Re: [midPoint] Refreshing uuids in ldap shadow objects


Hi Pertti,

have you tried reconciliation? It should detect the old account as DELETED, delete the shadow and linkRef, and also detect the new account as UNLINKED, and link it using the correlation expression...


(If you have the common synchronization definition, where DELETED has unlink reaction and UNLINKED has link reaction.)

Running reconciliation with dryRun=true should show you approximately the same number of UNLINKED and DELETED accounts... running without dryrun should fix it then.

Best regards,
Ivan

On 30.11.2017 14:43, Pertti Kellomäki wrote:

Hi all,


I have  a situation where midPoint does not find some entries in an openldap resource because the uuid's of the entries have changed (don't ask...). I know how to fix them manually by editing the shadow object xml, but it is not very practical.


Is there a way to refresh the shadow objects from the resource? The dn's of the ldap entries are valid and present in the ldap database, but some entries have been deleted and recreated, so uuids in the shadow objects are not valid any more. Consequently the ldap connector complains about missing entries.

--

Pertti




_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com<mailto:midPoint at lists.evolveum.com>
http://lists.evolveum.com/mailman/listinfo/midpoint



--
Ivan Noris
Senior Identity Engineer
evolveum.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20171130/2fe35f3c/attachment.htm>