[midPoint] Orphaned accounts report not possible to create?

[Robbe Caes]

Hi,

We are having trouble generating a report of orphaned accounts on our AD resource.
We have tried many different filters and syntaxes to come up with a solution for this but nothing has worked.
The most common error we get is:
Cannot combine on-resource and off-resource properties in a shadow search query. Encountered filter 'AND(REF: resourceRef, PRV(oid=572fc2e9-dad8-4b52-955e-50c8d1ff082c, targetType=null), targetFilter=null; EQUAL: kind, PPV(ShadowKindType:ACCOUNT); EQUAL: intent, PPV(String:Account); EQUAL: objectClass, PPV(QName:{...resource/instance-3}user); NOT(OWNED-BY(CTD ({.../common/common-3}FocusType),null,null)))'

Our current filter looks like this:

<filter>
    <q:and>
        <q:ref>
            <q:path>resourceRef</q:path>
            <q:value oid="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"/>
        </q:ref>

        <q:equal>
            <q:path>kind</q:path>
            <q:value>ACCOUNT</q:value>
        </q:equal>

        <q:equal>
            <q:path>intent</q:path>
            <q:value>Account</q:value>
        </q:equal>

        <q:equal>
            <q:path>objectClass</q:path>
            <q:value xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3">ri:user</q:value>
        </q:equal>

        <q:not>
            <q:ownedBy>
                <q:type>FocusType</q:type>
            </q:ownedBy>
        </q:not>
    </q:and>
</filter>

We have also tried using marks on accounts without owners to then filter on these marks but this does not work either.

Does anyone have a solution for this? If so, please let me know how we can implement this.

Kind Regards,

Robbe Caes

IGA Specialist

[Logo]<https://www.acen.eu/>

[https://img2.gimm.io/a4c6f625-9220-4efe-83d2-48e568599c1a/image.png]

+32 496 18 01 60

[https://img2.gimm.io/10e53e9d-763a-4be6-98fa-eeca2977a790/image.png]

robbe.caes at acen.eu <mailto:robbe.caes at acen.eu>

[https://img2.gimm.io/1ae8c26f-8371-4eb1-a439-7868d9a3610d/image.png]

www.acen.eu <http://www.acen.eu/>

[https://img2.gimm.io/32ff85f7-5c98-464f-8114-1fd12ac5e149/image.png]

Veldkant 7, 2550 Kontich <https://maps.app.goo.gl/M4nC67m22KWx2XE2A>

[https://img2.gimm.io/e875ab9e-8ef1-4573-9dd2-d378f95d82ed/image.png]

Follow us <https://www.linkedin.com/company/98341614/admin/feed/posts/?feedType=following>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20260612/d131d867/attachment.htm>