[midPoint] AD semi-manual ressource provisioning

[Pilar von Pilchau Wenzel - AKDB]

Hi,

I built an ITSM-Plugin for Jira, and this works so far, as I can create tickets and sync ticket status to midpoint.

I have a semi-manual connector with manual jira connector as primary connector and a read-only AD connector as second one.

I encountered a problem when I try to create a new account on AD. A ticket is created and also a shadow in the resource.
Problem is now that the new shadow does not have an objectGUID (primary identifier set by the AD schema - and as far as I know generated for AD on account creation).
When I finish the ticket (pending operation: Success) and have an account in the AD that matches the secondary identifier (ri:dn) a new shadow is created, and I have two shadows with the same dn but one without objectGUID.
I have setup correlation and this synchronization:


<synchronization>
    <reaction>
        <situation>unlinked</situation>
        <actions>
            <link/>
        </actions>
    </reaction>
    <reaction>
        <situation>linked</situation>
        <actions>
            <synchronize/>
        </actions>
    </reaction>
</synchronization>

Which works fine when the account in the AD exists (not linked yet) and I trigger the construction.

When I import the new shadow (with objectGUID), synchronization of the first shadow is triggered and ends with an error as the objectGUID is missing.

My question is, how can I ensure that the newly created account in the AD is matched to my midpoint user? Or how can I merge the two shadows?

Best regards and thanks for any help


Dr. Wenzel Pilar von Pilchau
Prozessanalyst
Process Management & Digitalisation
[Mobile]  +49 162 2530060
[Email]  Pilar-von-Pilchau.Wenzel at akdb.de<mailto:Pilar-von-Pilchau.Wenzel at akdb.de>
AKDB · Anstalt des öffentlichen Rechts
Hansastraße 12-16 · 80686 München
www.akdb.de<https://www.akdb.de/>
[AKDB Logo]
[Great Place to Work Certified]

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20260611/ce26af76/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Outlook-Mobile.png
Type: image/png
Size: 404 bytes
Desc: Outlook-Mobile.png
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20260611/ce26af76/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Outlook-Email.png
Type: image/png
Size: 924 bytes
Desc: Outlook-Email.png
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20260611/ce26af76/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Outlook-AKDB Logo.png
Type: image/png
Size: 3456 bytes
Desc: Outlook-AKDB Logo.png
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20260611/ce26af76/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Outlook-Great Plac.png
Type: image/png
Size: 72182 bytes
Desc: Outlook-Great Plac.png
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20260611/ce26af76/attachment-0007.png>