[midPoint] Orphaned accounts report not possible to create?

[Lubomir Odlevak]

Hey,

I saw you were running into that on-resource/off-resource error. That
usually happens when you mix objectClass and ownedBy in the same shadow
query.
A much easier and faster way to find orphaned accounts is to use the
synchronizationSituation attribute. Instead of checking if an account has
no owner, you can just filter for accounts that are not LINKED. It
completely avoids that error.
Here’s what the query looks like in MQL:

resourceRef matches (oid = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx") and
kind = "ACCOUNT" and intent = "Account" and synchronizationSituation
!= LINKED

Or xml way:

<filter>
    <q:and>
        <q:ref>
            <q:path>resourceRef</q:path>
            <q:value oid="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"/>
        </q:ref>
        <q:equal>
            <q:path>kind</q:path>
            <q:value>ACCOUNT</q:value>
        </q:equal>
        <q:equal>
            <q:path>intent</q:path>
            <q:value>Account</q:value>
        </q:equal>
        <q:not>
            <q:equal>
                <q:path>synchronizationSituation</q:path>
                <q:value>linked</q:value>
            </q:equal>
        </q:not>
    </q:and>
</filter>

Kind Regards
Lubo

pi 12. 6. 2026 o 12:42 Robbe Caes via midPoint <midpoint at lists.evolveum.com>
napísal(a):

> Hi,
>
> We are having trouble generating a report of orphaned accounts on our AD
> resource.
> We have tried many different filters and syntaxes to come up with a
> solution for this but nothing has worked.
> The most common error we get is:
> Cannot combine on-resource and off-resource properties in a shadow search
> query. Encountered filter 'AND(REF: resourceRef,
> PRV(oid=572fc2e9-dad8-4b52-955e-50c8d1ff082c, targetType=null),
> targetFilter=null; EQUAL: kind, PPV(ShadowKindType:ACCOUNT); EQUAL: intent,
> PPV(String:Account); EQUAL: objectClass,
> PPV(QName:{...resource/instance-3}user); NOT(OWNED-BY(CTD
> ({.../common/common-3}FocusType),null,null)))'
>
> Our current filter looks like this:
>
> <filter>
>     <q:and>
>         <q:ref>
>             <q:path>resourceRef</q:path>
>             <q:value oid="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"/>
>         </q:ref>
>
>         <q:equal>
>             <q:path>kind</q:path>
>             <q:value>ACCOUNT</q:value>
>         </q:equal>
>
>         <q:equal>
>             <q:path>intent</q:path>
>             <q:value>Account</q:value>
>         </q:equal>
>
>         <q:equal>
>             <q:path>objectClass</q:path>
>             <q:value xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3">ri:user</q:value>
>         </q:equal>
>
>         <q:not>
>             <q:ownedBy>
>                 <q:type>FocusType</q:type>
>             </q:ownedBy>
>         </q:not>
>     </q:and>
> </filter>
>
> We have also tried using marks on accounts without owners to then filter on these marks but this does not work either.
>
> Does anyone have a solution for this? If so, please let me know how we can implement this.
>
> Kind Regards,
>
> Robbe Caes
>
> IGA Specialist
>
> [image: Logo] <https://www.acen.eu/>
>
> +32 496 18 01 60
>
> robbe.caes at acen.eu  <robbe.caes at acen.eu>
>
> www.acen.eu  <http://www.acen.eu/>
>
> Veldkant 7, 2550 Kontich  <https://maps.app.goo.gl/M4nC67m22KWx2XE2A>
>
> Follow us
> <https://www.linkedin.com/company/98341614/admin/feed/posts/?feedType=following>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> https://lists.evolveum.com/mailman/listinfo/midpoint
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20260612/aaea3cc9/attachment-0001.htm>