[midPoint] Organizational Unit attribute mapping to User attribute

[Vladislavs Filipciks]

Thanks for reply. This sync works fine for inbound mapping from AD resource - organizations in midpoint are being created on demand. 

What I'm trying to achieve is: 
1. Import organization structure from AD resource. Your mapping works fine if the user in AD is placed in any OU in AD. But how can I import OU's from AD to midpoint organization structure if there are no any users in that OU in AD? I got group import from AD, when AD groups being synced to midpoint roles, but I was not able to sync OU's from AD to Organizations in midpoint. Here's my object type (taken from OrgSync Story example): 
<objectType> 
<kind>generic</kind> 
<intent>ou</intent> 
<displayName>Organizational Unit</displayName> 
<objectClass>ri:organizationalUnit</objectClass> 
<attribute> 
<ref>ri:ou</ref> 
<inbound> 
<strength>weak</strength> 
<target> 
<path>$focus/name</path> 
</target> 
</inbound> 
</attribute> 
<attribute> 
<ref>ri:description</ref> 
<inbound>, 
<strength>weak</strength> 
<target> 
<path>$focus/description</path> 
</target> 
</inbound> 
</attribute> 
</objectType> 

With this object type I don't see any record in resource for Generic kind. 

2. I would like to make MidPoint central management system, so I would like to be able to create new Organization in MidPoint, then when user is assigned this organization, this user will be created in AD Resource in Organization's container in AD resource. I've tried to specify DN for Organization in midpoint in description attribute and then construct user's DN: 

<inducement id="10"> 
<construction> 
<strength>weak</strength> 
<resourceRef oid="be74efc9-6df3-470c-bfcf-c6d4f4165772" relation="org:default" type="c:ResourceType"> 
<!-- CS AD User outbound Resource 19.26 --> 
</resourceRef> 
<attribute id="12"> 
<c:ref>ri:dn</c:ref> 
<displayName>Distinguished Name</displayName> 
<outbound> 
<source> 
<c:path>$user/fullName</c:path> 
</source> 
<source> 
<c:path>description</c:path> 
</source> 
<expression> 
<script xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="c:ScriptExpressionEvaluatorType"> 
<code> 
'CN=' + fullName + ',' + description 
</code> 
</script> 
</expression> 
</outbound> 
</attribute> 
</construction> 
</inducement> 

But user is not created in resource. 





From: "Jason Everling" <jeverling at bshp.edu> 
To: "midpoint" <midpoint at lists.evolveum.com> 
Sent: Thursday, 28 March, 2019 20:18:13 
Subject: Re: [midPoint] Organizational Unit attribute mapping to User attribute 

Now when organization is updated with a new value it will re-build the users DN which of course will them in the OU based on the attribute. You can also use org sync to create your AD structure in midpoint then map the organization assignment to the user's attribute so you can use assignment based placement. Just make sure to use a specific org type in the template so it doesn't try to update the attribute with values of orgs that are not really AD ou's. I was using Rdn but it wasn;t working right for AD containers, so a raw script, works great though. 
<attribute> 
<c:ref>ri:dn</c:ref> 
<outbound> 
<source> 
<c:path>$focus/organization</c:path> 
</source> 
<source> 
<c:path>$focus/name</c:path> 
</source> 
<expression> 
<script> 
<code>'CN=' + name + iterationToken + ',' + organization</code> 
</script> 
</expression> 
</outbound> 
<inbound> 
<expression> 
<script> 
<code> 
tmpdn = basic.uc(input); 
cn = tmpdn.substring(tmpdn.indexOf(",CN=") + 1); 
ou = tmpdn.substring(tmpdn.indexOf(",OU=") + 1); 
if (tmpdn.contains(",CN=")) { 
[ http://log.info/ | log.info ] ("-- DN Path " + cn + "is a container") 
return basic.uc(cn); 
} 
if (tmpdn.contains(",OU=") && !tmpdn.contains(",CN=")) { 
[ http://log.info/ | log.info ] ("-- DN Path " + ou + "is a orgunit") 
return basic.uc(ou); 
} 
</code> 
</script> 
</expression> 
<target> 
<c:path>$focus/organization</c:path> 
</target> 
</inbound> 
</attribute> 



On Thu, Mar 28, 2019 at 10:57 AM Vladislavs Filipciks < [ mailto:vladislavs.filipciks at csolutions.lv | vladislavs.filipciks at csolutions.lv ] > wrote: 



Hello. 

Is it possible to take attribute from organizational unit and map it to users attribute? 
For example I would like to create extended attribute for organizational unit - DN (Distinguished Name), then map it to user's "Organization" attribute, so then I'll be able to create user in AD in specific OU container. 


_______________________________________________ 
midPoint mailing list 
[ mailto:midPoint at lists.evolveum.com | midPoint at lists.evolveum.com ] 
[ http://lists.evolveum.com/mailman/listinfo/midpoint | http://lists.evolveum.com/mailman/listinfo/midpoint ] 




_______________________________________________ 
midPoint mailing list 
midPoint at lists.evolveum.com 
http://lists.evolveum.com/mailman/listinfo/midpoint 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20190401/de5d554d/attachment.htm>