[midPoint] midPoint Digest follow-up question
Robbe Caes
Robbe.Caes at acen.eu
Fri Jun 12 14:43:23 CEST 2026
Hello Lubomir,
We have tried this approach as well using MQL and XML queries:
<filter>
<q:and>
<q:ref>
<q:path>resourceRef</q:path>
<q:value oid="572fc2e9-dad8-4b52-955e-50c8d1ff082c" type="ResourceType"/>
</q:ref>
<q:equal>
<q:path>kind</q:path>
<q:value>ACCOUNT</q:value>
</q:equal>
<q:equal>
<q:path>intent</q:path>
<q:value>Account</q:value>
</q:equal>
<q:not>
<q:equal>
<q:path>synchronizationSituation</q:path>
<q:value>LINKED</q:value>
</q:equal>
</q:not>
</q:and>
</filter>
<filter>
<q:text>
resourceRef matches (oid = "572fc2e9-dad8-4b52-955e-50c8d1ff082c")
and kind = "ACCOUNT"
and intent = "Account"
and synchronizationSituation != LINKED
</q:text>
</filter>
We have also tried changing LINKED to lowercase, "LINKED", linked, "linked",... but nothing seems to work.
When using LINKED or Linked we get back:
Path LINKED does not reference property
When using "LINKED" or "Linked" we get back:
Cannot combine on-resource and off-resource properties in a shadow search query. Encountered filter 'AND(REF: resourceRef, PRV(oid=572fc2e9-dad8-4b52-955e-50c8d1ff082c, targetType=null), targetFilter=null; EQUAL: kind, PPV(ShadowKindType:ACCOUNT); EQUAL: intent, PPV(String:Account); NOT(EQUAL: synchronizationSituation, PPV(SynchronizationSituationType:LINKED)))'
We are wondering if an error In our view parameter could be causing this but we don't believe this is the case. I have attached our file just in case someone wants to see in detail.
Thanks in advance!
Kind Regards,
Robbe Caes
IGA Specialist
[Logo]<https://www.acen.eu/>
[https://img2.gimm.io/a4c6f625-9220-4efe-83d2-48e568599c1a/image.png]
+32 496 18 01 60
[https://img2.gimm.io/10e53e9d-763a-4be6-98fa-eeca2977a790/image.png]
robbe.caes at acen.eu <mailto:robbe.caes at acen.eu>
[https://img2.gimm.io/1ae8c26f-8371-4eb1-a439-7868d9a3610d/image.png]
www.acen.eu <http://www.acen.eu/>
[https://img2.gimm.io/32ff85f7-5c98-464f-8114-1fd12ac5e149/image.png]
Veldkant 7, 2550 Kontich <https://maps.app.goo.gl/M4nC67m22KWx2XE2A>
[https://img2.gimm.io/e875ab9e-8ef1-4573-9dd2-d378f95d82ed/image.png]
Follow us <https://www.linkedin.com/company/98341614/admin/feed/posts/?feedType=following>
________________________________
From: midPoint <midpoint-bounces at lists.evolveum.com> on behalf of midpoint-request at lists.evolveum.com <midpoint-request at lists.evolveum.com>
Sent: Friday, June 12, 2026 13:47
To: midpoint at lists.evolveum.com <midpoint at lists.evolveum.com>
Subject: midPoint Digest, Vol 170, Issue 11
Send midPoint mailing list submissions to
midpoint at lists.evolveum.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.evolveum.com/mailman/listinfo/midpoint
or, via email, send a message with subject or body 'help' to
midpoint-request at lists.evolveum.com
You can reach the person managing the list at
midpoint-owner at lists.evolveum.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of midPoint digest..."
Today's Topics:
1. Orphaned accounts report not possible to create? (Robbe Caes)
2. Re: Orphaned accounts report not possible to create?
(Lubomir Odlevak)
----------------------------------------------------------------------
Message: 1
Date: Fri, 12 Jun 2026 10:07:22 +0000
From: Robbe Caes <Robbe.Caes at acen.eu>
To: "midpoint at lists.evolveum.com" <midpoint at lists.evolveum.com>
Subject: [midPoint] Orphaned accounts report not possible to create?
Message-ID:
<PAVPR03MB918845C783D7FFEE3B695ECA8F182 at PAVPR03MB9188.eurprd03.prod.outlook.com>
Content-Type: text/plain; charset="iso-8859-1"
Hi,
We are having trouble generating a report of orphaned accounts on our AD resource.
We have tried many different filters and syntaxes to come up with a solution for this but nothing has worked.
The most common error we get is:
Cannot combine on-resource and off-resource properties in a shadow search query. Encountered filter 'AND(REF: resourceRef, PRV(oid=572fc2e9-dad8-4b52-955e-50c8d1ff082c, targetType=null), targetFilter=null; EQUAL: kind, PPV(ShadowKindType:ACCOUNT); EQUAL: intent, PPV(String:Account); EQUAL: objectClass, PPV(QName:{...resource/instance-3}user); NOT(OWNED-BY(CTD ({.../common/common-3}FocusType),null,null)))'
Our current filter looks like this:
<filter>
<q:and>
<q:ref>
<q:path>resourceRef</q:path>
<q:value oid="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"/>
</q:ref>
<q:equal>
<q:path>kind</q:path>
<q:value>ACCOUNT</q:value>
</q:equal>
<q:equal>
<q:path>intent</q:path>
<q:value>Account</q:value>
</q:equal>
<q:equal>
<q:path>objectClass</q:path>
<q:value xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3">ri:user</q:value>
</q:equal>
<q:not>
<q:ownedBy>
<q:type>FocusType</q:type>
</q:ownedBy>
</q:not>
</q:and>
</filter>
We have also tried using marks on accounts without owners to then filter on these marks but this does not work either.
Does anyone have a solution for this? If so, please let me know how we can implement this.
Kind Regards,
Robbe Caes
IGA Specialist
[Logo]<https://www.acen.eu/>
[https://img2.gimm.io/a4c6f625-9220-4efe-83d2-48e568599c1a/image.png]
+32 496 18 01 60
[https://img2.gimm.io/10e53e9d-763a-4be6-98fa-eeca2977a790/image.png]
robbe.caes at acen.eu <mailto:robbe.caes at acen.eu>
[https://img2.gimm.io/1ae8c26f-8371-4eb1-a439-7868d9a3610d/image.png]
www.acen.eu<http://www.acen.eu> <http://www.acen.eu/>
[https://img2.gimm.io/32ff85f7-5c98-464f-8114-1fd12ac5e149/image.png]
Veldkant 7, 2550 Kontich <https://maps.app.goo.gl/M4nC67m22KWx2XE2A>
[https://img2.gimm.io/e875ab9e-8ef1-4573-9dd2-d378f95d82ed/image.png]
Follow us <https://www.linkedin.com/company/98341614/admin/feed/posts/?feedType=following>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20260612/d131d867/attachment-0001.htm>
------------------------------
Message: 2
Date: Fri, 12 Jun 2026 13:46:54 +0200
From: Lubomir Odlevak <odlevak.lubomir at gmail.com>
To: MidPoint General Discussion <midpoint at lists.evolveum.com>
Cc: Robbe Caes <Robbe.Caes at acen.eu>
Subject: Re: [midPoint] Orphaned accounts report not possible to
create?
Message-ID:
<CABppFo5RPjYv-aDHJpVJhPyw0VhWywzadCwqaoDvMgfN2kzjww at mail.gmail.com>
Content-Type: text/plain; charset="utf-8"
Hey,
I saw you were running into that on-resource/off-resource error. That
usually happens when you mix objectClass and ownedBy in the same shadow
query.
A much easier and faster way to find orphaned accounts is to use the
synchronizationSituation attribute. Instead of checking if an account has
no owner, you can just filter for accounts that are not LINKED. It
completely avoids that error.
Here?s what the query looks like in MQL:
resourceRef matches (oid = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx") and
kind = "ACCOUNT" and intent = "Account" and synchronizationSituation
!= LINKED
Or xml way:
<filter>
<q:and>
<q:ref>
<q:path>resourceRef</q:path>
<q:value oid="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"/>
</q:ref>
<q:equal>
<q:path>kind</q:path>
<q:value>ACCOUNT</q:value>
</q:equal>
<q:equal>
<q:path>intent</q:path>
<q:value>Account</q:value>
</q:equal>
<q:not>
<q:equal>
<q:path>synchronizationSituation</q:path>
<q:value>linked</q:value>
</q:equal>
</q:not>
</q:and>
</filter>
Kind Regards
Lubo
pi 12. 6. 2026 o 12:42 Robbe Caes via midPoint <midpoint at lists.evolveum.com>
nap?sal(a):
> Hi,
>
> We are having trouble generating a report of orphaned accounts on our AD
> resource.
> We have tried many different filters and syntaxes to come up with a
> solution for this but nothing has worked.
> The most common error we get is:
> Cannot combine on-resource and off-resource properties in a shadow search
> query. Encountered filter 'AND(REF: resourceRef,
> PRV(oid=572fc2e9-dad8-4b52-955e-50c8d1ff082c, targetType=null),
> targetFilter=null; EQUAL: kind, PPV(ShadowKindType:ACCOUNT); EQUAL: intent,
> PPV(String:Account); EQUAL: objectClass,
> PPV(QName:{...resource/instance-3}user); NOT(OWNED-BY(CTD
> ({.../common/common-3}FocusType),null,null)))'
>
> Our current filter looks like this:
>
> <filter>
> <q:and>
> <q:ref>
> <q:path>resourceRef</q:path>
> <q:value oid="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"/>
> </q:ref>
>
> <q:equal>
> <q:path>kind</q:path>
> <q:value>ACCOUNT</q:value>
> </q:equal>
>
> <q:equal>
> <q:path>intent</q:path>
> <q:value>Account</q:value>
> </q:equal>
>
> <q:equal>
> <q:path>objectClass</q:path>
> <q:value xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3">ri:user</q:value>
> </q:equal>
>
> <q:not>
> <q:ownedBy>
> <q:type>FocusType</q:type>
> </q:ownedBy>
> </q:not>
> </q:and>
> </filter>
>
> We have also tried using marks on accounts without owners to then filter on these marks but this does not work either.
>
> Does anyone have a solution for this? If so, please let me know how we can implement this.
>
> Kind Regards,
>
> Robbe Caes
>
> IGA Specialist
>
> [image: Logo] <https://www.acen.eu/>
>
> +32 496 18 01 60
>
> robbe.caes at acen.eu <robbe.caes at acen.eu>
>
> www.acen.eu<http://www.acen.eu> <http://www.acen.eu/>
>
> Veldkant 7, 2550 Kontich <https://maps.app.goo.gl/M4nC67m22KWx2XE2A>
>
> Follow us
> <https://www.linkedin.com/company/98341614/admin/feed/posts/?feedType=following>
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> https://lists.evolveum.com/mailman/listinfo/midpoint
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20260612/aaea3cc9/attachment.htm>
------------------------------
Subject: Digest Footer
_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
https://lists.evolveum.com/mailman/listinfo/midpoint
------------------------------
End of midPoint Digest, Vol 170, Issue 11
*****************************************
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20260612/a7c3e5a8/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Orphaned accounts.xml
Type: text/xml
Size: 2350 bytes
Desc: Orphaned accounts.xml
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20260612/a7c3e5a8/attachment-0001.xml>
More information about the midPoint
mailing list