From sergio.tosti at unipg.it  Wed Oct  1 12:59:45 2025
From: sergio.tosti at unipg.it (Sergio Tosti)
Date: Wed, 1 Oct 2025 10:59:45 +0000
Subject: [midPoint] Service/role expiration
In-Reply-To: <AM9PR08MB712053C9FD0BCE22BDB2909EF2E6A@AM9PR08MB7120.eurprd08.prod.outlook.com>
References: <AM9PR08MB712049414C3C3071C979E4EEF2E6A@AM9PR08MB7120.eurprd08.prod.outlook.com>
 <AM9PR08MB712053C9FD0BCE22BDB2909EF2E6A@AM9PR08MB7120.eurprd08.prod.outlook.com>
Message-ID: <AM9PR08MB7120F1D958D08288D8E694C8F2E6A@AM9PR08MB7120.eurprd08.prod.outlook.com>

Hello,
I am new to Midpoint, we are deploying version 4.9, have configured some resources and have some accounts correctly synced. Our requirement is to assign services to users based on their role, with expiration dates set after the role?s expiration, following a grace period defined by both the service and the role. Could anyone share best practices for implementing this?
Thanks
--
Sergio
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20251001/69dbe218/attachment.htm>

From jkruth at aip.de  Tue Oct  7 13:00:23 2025
From: jkruth at aip.de (Joachim Kruth)
Date: Tue, 7 Oct 2025 13:00:23 +0200
Subject: [midPoint] Autounassign not applied
Message-ID: <znggjlhgqbd26zxc7fpr5spjqembnvenhbnnul5tpmulq2o4zb@cdf6qej7ev2h>

Hello

We are currently facing a problem with the role autoassign feature.
We tried to find a solution for a while now, but to no avail.
We hope someone already solved this or can spot the mistake in our 
current implementation.


Problem:

We want to automatically assign a role to users, if and only if they 
have an account on a certain resource and the user is activated.


Situation:

Autoassign feature is enabled in midpoint.
When an account of that certain resource gets linked to an active user, 
the role is automatically assigned.
When the user gets deactivated, the role is automatically unassigned.
However, if the account gets unlinked the role is not unassigned.
Also, deactivating the user after unlinking does not unassign as well.


Expected behavior:

When unlinking the account from the user, the role should be unassigned.


Current implementation:

The "focus" tag of the "autoassign" role tag contains the following 
code:

<mapping id="1">
     <authoritative>true</authoritative>
     <strength>strong</strength>
     <source>
         <path>activation/effectiveStatus</path>
     </source>
     <source>
         <path>linkRef</path>
     </source>
     <condition>
         <script>
             <code>
                import com.evolveum.midpoint.xml.ns._public.common.common_3.UserType
                import com.evolveum.midpoint.xml.ns._public.common.common_3.*
                
                // unassign if user is deactivated
                if (!midpoint.isEffectivelyEnabled(focus)) {
                    return false;
                }
                
                // tried to do the same as above
                // the condition is always true, don't know why yet
                /*if (effectiveStatus != "enabled") {
                    return false;
                }*/
                
                UserType ut = focus as UserType;
                
                linkRefs = ut.getLinkRef();
                containsAccount = false;
                // iterate over linked references
                for (linkRef in linkRefs) {
                   try {
                      shadow = midpoint.resolveReference(linkRef)
                      // check account for specific resource
                      if (shadow != null &amp;&amp; shadow.getResourceRef() != null &amp;&amp; "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa".equals(shadow.getResourceRef().getOid())) {
                         containsAccount = true;
                      }
                   } catch (Exception e) {
                   }
                }
                return containsAccount;
             </code>
         </script>
     </condition>
</mapping>
<selector>
     <type>UserType</type>
</selector>

-- 
Mit freundlichen Gr??en,
Joachim Kruth
IT-Support
--
Leibniz-Institut f?r Astrophysik Potsdam (AIP),
An der Sternwarte 16, 14482 Potsdam
Tel:0331-7499534 - Fax:0331-7499309 - Mail: jkruth at aip.de
-----------------------------------------------------------
Vorstand: Prof. Dr. Matthias Steinmetz, Wolfram Rosenbach
Stiftung b?rgerlichen Rechts
Stiftungsverzeichnis Brandenburg: 26 742-00/7026
-----------------------------------------------------------
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5937 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20251007/5a7172fd/attachment.bin>