[midPoint] Condition for Role and MetaRole

[Joshua Williams]

Thank you Mark.  This helped me resolve a couple other issues in midPoint.  

Unfortunately, it didn’t work in an assignment within a Role.  It would work within an Inducement, but changing from an assignment to an Inducement broke the functionality of my Role.  

For example, my Role assigns a Metarole that creates LDAP Posix Groups and adds users to the LDAP group, then Induces the writing of the user to LDAP.  If the Metarole is Induced, it doesn’t create the LDAP Posix group.  If the Metarole is Assigned, the Role won’t import and I get “organization has no definition” error.

Thank you again for your time!

Josh

> On Sep 23, 2021, at 4:21 PM, Marc Fueller via midPoint <midpoint at lists.evolveum.com> wrote:
> 
> Hi Joshua,
> 
> it seem to be an error in your XML structure. <condition> should look like this:
> 
> <condition>
>     <expression>
>         <script>
>             <code>...</code>
>         </script>
>     </expression>
> </condition>
> 
> Hope that helps.
> 
> Marc
> 
> 
> 
> Am 23.09.21 um 11:35 schrieb Joshua Williams via midPoint:
>> Good morning!
>> We have some users who are standard midpoint users and we have some users pulled from Active Directory.  When I want to give a Role to a user, I have to use one MetaRole to write standard users to LDAP and I have to use another MetaRole to write the AD users to LDAP.  The reason is the AD users require SASL Passthrough on the LDAP server, so the password data written is different between the two user groups.
>> 
>> Right now I have two Roles - Role_Standard.xml and Role_AD.xml.  It would be nice to have one Role with a condition that uses the proper MetaRole to write to LDAP.  
>> 
>> All AD users have “ad-user” in the organization attribute in midPoint, so it should be fairly straightforward (I would think).  But it isn’t working.
>> 
>> I am trying to use an assignment to call the proper MetaRole.  Here is what I have:
>> 
>> <!-- If user is AD, then this role is used to put them in the proper groups and 
>> configure SASL Passthrough -->
>>       <assignment>
>>          <targetRef oid="68e686f4-df63-11eb-a318-00ff83f6b50b" type="RoleType"/>
>>            <condition>
>>             <script>
>>               <code>basic.stringify(organization) == “ad-user"</code>
>>             </script>
>>            </condition>
>>    	</assignment> 
>> </role>
>> </objects>
>> 
>> I am fairly new to MidPoint.  I have googled and searched, but haven’t been able to find a solution.  The Role will not import.  Trying to import this particular version, I get “script has no definition.” 
>> 
>> Do you have any suggestions for how to do the condition properly in a Role?
>> 
>> Thank you for your time.
>> 
>> Josh
>> _______________________________________________
>> midPoint mailing list
>> midPoint at lists.evolveum.com <mailto:midPoint at lists.evolveum.com>
>> https://lists.evolveum.com/mailman/listinfo/midpoint <https://lists.evolveum.com/mailman/listinfo/midpoint>
> -- 
> Marc Füller
> Consultant
> 
> DAASI International GmbH
> Europaplatz 3
> D-72072 Tübingen
> Germany
> 
> phone: +49 7071 407109-0
> fax:   +49 7071 407109-9
> email: marc.fueller at daasi.de <mailto:marc.fueller at daasi.de>
> web:   www.daasi.de <http://www.daasi.de/>
> Sitz der Gesellschaft: Tübingen
> Registergericht: Amtsgericht Stuttgart, HRB 382175
> Geschäftsleitung: Peter Gietz
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> https://lists.evolveum.com/mailman/listinfo/midpoint

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20210927/ae481705/attachment.htm>