[midPoint] Refreshing uuids in ldap shadow objects

[Ivan Noris]

Hi Pertti,


are the groups actually created by midPoint, or they are managed externally?
How are you assiociating the LDAP accounts with the groups? Using
associationTargetSearch or associationFromLink?

Ivan


On 30.11.2017 15:11, Pertti Kellomäki wrote:
>
> Hi Ivan,
>
>
> Sorry, I should have provided more details. The objects in question
> are ldap groups, and we are using the pattern where a role assignment
> induces a membership in a group. When I assign a role to a user,
> midPoint tries to make the user a member of a group, say
> cn=mygroup,dc=mydomain. This is a group that midPoint has seen before,
> so it tries to look it up using the uuid stored in the shadow object.
> The problem is that the uuid of the group is not valid any more, and
> the lookup fails.
>
> Pertti
>
>
> ------------------------------------------------------------------------
> *Lähettäjä:* midPoint <midpoint-bounces at lists.evolveum.com> käyttäjän
> puolestaIvan Noris <ivan.noris at evolveum.com>
> *Lähetetty:* 30. marraskuuta 2017 15:59
> *Vastaanottaja:* midpoint at lists.evolveum.com
> *Aihe:* Re: [midPoint] Refreshing uuids in ldap shadow objects
>  
>
> Hi Pertti,
>
> have you tried reconciliation? It should detect the old account as
> DELETED, delete the shadow and linkRef, and also detect the new
> account as UNLINKED, and link it using the correlation expression...
>
>
> (If you have the common synchronization definition, where DELETED has
> unlink reaction and UNLINKED has link reaction.)
>
>
> Running reconciliation with dryRun=true should show you approximately
> the same number of UNLINKED and DELETED accounts... running without
> dryrun should fix it then.
>
> Best regards,
> Ivan
>
> On 30.11.2017 14:43, Pertti Kellomäki wrote:
>>
>> Hi all,
>>
>>
>> I have  a situation where midPoint does not find some entries in an
>> openldap resource because the uuid's of the entries have changed
>> (don't ask...). I know how to fix them manually by editing the shadow
>> object xml, but it is not very practical.
>>
>>
>> Is there a way to refresh the shadow objects from the resource? The
>> dn's of the ldap entries are valid and present in the ldap database,
>> but some entries have been deleted and recreated, so uuids in the
>> shadow objects are not valid any more. Consequently the ldap
>> connector complains about missing entries.
>>
>> -- 
>>
>> Pertti
>>
>>
>>
>>
>> _______________________________________________
>> midPoint mailing list
>> midPoint at lists.evolveum.com
>> http://lists.evolveum.com/mailman/listinfo/midpoint
>
> -- 
> Ivan Noris
> Senior Identity Engineer
> evolveum.com
>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> http://lists.evolveum.com/mailman/listinfo/midpoint

-- 
Ivan Noris
Senior Identity Engineer
evolveum.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20171130/b3daed7c/attachment.htm>