[midPoint] midPoint Digest follow-up question
Lubomir Odlevak
odlevak.lubomir at gmail.com
Fri Jun 12 15:47:41 CEST 2026
I looked into this, and all you really need is to set up an
ObjectCollection. You can define the filter there and then just reference
that collection directly in your report.
Please see attached files.
pi 12. 6. 2026 o 14:43 Robbe Caes via midPoint <midpoint at lists.evolveum.com>
napísal(a):
> Hello Lubomir,
>
> We have tried this approach as well using MQL and XML queries:
>
> <filter>
> <q:and>
> <q:ref>
> <q:path>resourceRef</q:path>
> <q:value oid="572fc2e9-dad8-4b52-955e-50c8d1ff082c" type="ResourceType"/>
> </q:ref>
> <q:equal>
> <q:path>kind</q:path>
> <q:value>ACCOUNT</q:value>
> </q:equal>
> <q:equal>
> <q:path>intent</q:path>
> <q:value>Account</q:value>
> </q:equal>
> <q:not>
> <q:equal>
> <q:path>synchronizationSituation</q:path>
> <q:value>LINKED</q:value>
> </q:equal>
> </q:not>
> </q:and>
> </filter>
>
> <filter>
> <q:text>
> resourceRef matches (oid = "572fc2e9-dad8-4b52-955e-50c8d1ff082c")
> and kind = "ACCOUNT"
> and intent = "Account"
> and synchronizationSituation != LINKED
> </q:text>
> </filter>
>
> We have also tried changing LINKED to lowercase, "LINKED", linked,
> "linked",... but nothing seems to work.
> When using LINKED or Linked we get back:
> *Path LINKED does not reference property*
>
> When using "LINKED" or "Linked" we get back:
> *Cannot combine on-resource and off-resource properties in a shadow search
> query. Encountered filter 'AND(REF: resourceRef,
> PRV(oid=572fc2e9-dad8-4b52-955e-50c8d1ff082c, targetType=null),
> targetFilter=null; EQUAL: kind, PPV(ShadowKindType:ACCOUNT); EQUAL: intent,
> PPV(String:Account); NOT(EQUAL: synchronizationSituation,
> PPV(SynchronizationSituationType:LINKED)))'*
>
> We are wondering if an error In our view parameter could be causing this
> but we don't believe this is the case. I have attached our file just in
> case someone wants to see in detail.
>
> Thanks in advance!
>
> Kind Regards,
>
> Robbe Caes
>
> IGA Specialist
>
> [image: Logo] <https://www.acen.eu/>
>
> +32 496 18 01 60
>
> robbe.caes at acen.eu <robbe.caes at acen.eu>
>
> www.acen.eu <http://www.acen.eu/>
>
> Veldkant 7, 2550 Kontich <https://maps.app.goo.gl/M4nC67m22KWx2XE2A>
>
> Follow us
> <https://www.linkedin.com/company/98341614/admin/feed/posts/?feedType=following>
>
>
>
> ------------------------------
> *From:* midPoint <midpoint-bounces at lists.evolveum.com> on behalf of
> midpoint-request at lists.evolveum.com <midpoint-request at lists.evolveum.com>
> *Sent:* Friday, June 12, 2026 13:47
> *To:* midpoint at lists.evolveum.com <midpoint at lists.evolveum.com>
> *Subject:* midPoint Digest, Vol 170, Issue 11
>
> Send midPoint mailing list submissions to
> midpoint at lists.evolveum.com
>
> To subscribe or unsubscribe via the World Wide Web, visit
> https://lists.evolveum.com/mailman/listinfo/midpoint
> or, via email, send a message with subject or body 'help' to
> midpoint-request at lists.evolveum.com
>
> You can reach the person managing the list at
> midpoint-owner at lists.evolveum.com
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of midPoint digest..."
>
>
> Today's Topics:
>
> 1. Orphaned accounts report not possible to create? (Robbe Caes)
> 2. Re: Orphaned accounts report not possible to create?
> (Lubomir Odlevak)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Fri, 12 Jun 2026 10:07:22 +0000
> From: Robbe Caes <Robbe.Caes at acen.eu>
> To: "midpoint at lists.evolveum.com" <midpoint at lists.evolveum.com>
> Subject: [midPoint] Orphaned accounts report not possible to create?
> Message-ID:
> <
> PAVPR03MB918845C783D7FFEE3B695ECA8F182 at PAVPR03MB9188.eurprd03.prod.outlook.com
> >
>
> Content-Type: text/plain; charset="iso-8859-1"
>
> Hi,
>
> We are having trouble generating a report of orphaned accounts on our AD
> resource.
> We have tried many different filters and syntaxes to come up with a
> solution for this but nothing has worked.
> The most common error we get is:
> Cannot combine on-resource and off-resource properties in a shadow search
> query. Encountered filter 'AND(REF: resourceRef,
> PRV(oid=572fc2e9-dad8-4b52-955e-50c8d1ff082c, targetType=null),
> targetFilter=null; EQUAL: kind, PPV(ShadowKindType:ACCOUNT); EQUAL: intent,
> PPV(String:Account); EQUAL: objectClass,
> PPV(QName:{...resource/instance-3}user); NOT(OWNED-BY(CTD
> ({.../common/common-3}FocusType),null,null)))'
>
> Our current filter looks like this:
>
> <filter>
> <q:and>
> <q:ref>
> <q:path>resourceRef</q:path>
> <q:value oid="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"/>
> </q:ref>
>
> <q:equal>
> <q:path>kind</q:path>
> <q:value>ACCOUNT</q:value>
> </q:equal>
>
> <q:equal>
> <q:path>intent</q:path>
> <q:value>Account</q:value>
> </q:equal>
>
> <q:equal>
> <q:path>objectClass</q:path>
> <q:value xmlns:ri="
> http://midpoint.evolveum.com/xml/ns/public/resource/instance-3">ri:user</q:value
> >
> </q:equal>
>
> <q:not>
> <q:ownedBy>
> <q:type>FocusType</q:type>
> </q:ownedBy>
> </q:not>
> </q:and>
> </filter>
>
> We have also tried using marks on accounts without owners to then filter
> on these marks but this does not work either.
>
> Does anyone have a solution for this? If so, please let me know how we can
> implement this.
>
> Kind Regards,
>
> Robbe Caes
>
> IGA Specialist
>
> [Logo]<https://www.acen.eu/>
>
> [https://img2.gimm.io/a4c6f625-9220-4efe-83d2-48e568599c1a/image.png]
>
> +32 496 18 01 60
>
> [https://img2.gimm.io/10e53e9d-763a-4be6-98fa-eeca2977a790/image.png]
>
> robbe.caes at acen.eu <mailto:robbe.caes at acen.eu <robbe.caes at acen.eu>>
>
> [https://img2.gimm.io/1ae8c26f-8371-4eb1-a439-7868d9a3610d/image.png]
>
> www.acen.eu <http://www.acen.eu/>
>
> [https://img2.gimm.io/32ff85f7-5c98-464f-8114-1fd12ac5e149/image.png]
>
> Veldkant 7, 2550 Kontich <https://maps.app.goo.gl/M4nC67m22KWx2XE2A>
>
> [https://img2.gimm.io/e875ab9e-8ef1-4573-9dd2-d378f95d82ed/image.png]
>
> Follow us <
> https://www.linkedin.com/company/98341614/admin/feed/posts/?feedType=following
> >
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <
> https://lists.evolveum.com/pipermail/midpoint/attachments/20260612/d131d867/attachment-0001.htm
> >
>
> ------------------------------
>
> Message: 2
> Date: Fri, 12 Jun 2026 13:46:54 +0200
> From: Lubomir Odlevak <odlevak.lubomir at gmail.com>
> To: MidPoint General Discussion <midpoint at lists.evolveum.com>
> Cc: Robbe Caes <Robbe.Caes at acen.eu>
> Subject: Re: [midPoint] Orphaned accounts report not possible to
> create?
> Message-ID:
> <
> CABppFo5RPjYv-aDHJpVJhPyw0VhWywzadCwqaoDvMgfN2kzjww at mail.gmail.com>
> Content-Type: text/plain; charset="utf-8"
>
> Hey,
>
> I saw you were running into that on-resource/off-resource error. That
> usually happens when you mix objectClass and ownedBy in the same shadow
> query.
> A much easier and faster way to find orphaned accounts is to use the
> synchronizationSituation attribute. Instead of checking if an account has
> no owner, you can just filter for accounts that are not LINKED. It
> completely avoids that error.
> Here?s what the query looks like in MQL:
>
> resourceRef matches (oid = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx") and
> kind = "ACCOUNT" and intent = "Account" and synchronizationSituation
> != LINKED
>
> Or xml way:
>
> <filter>
> <q:and>
> <q:ref>
> <q:path>resourceRef</q:path>
> <q:value oid="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"/>
> </q:ref>
> <q:equal>
> <q:path>kind</q:path>
> <q:value>ACCOUNT</q:value>
> </q:equal>
> <q:equal>
> <q:path>intent</q:path>
> <q:value>Account</q:value>
> </q:equal>
> <q:not>
> <q:equal>
> <q:path>synchronizationSituation</q:path>
> <q:value>linked</q:value>
> </q:equal>
> </q:not>
> </q:and>
> </filter>
>
> Kind Regards
> Lubo
>
> pi 12. 6. 2026 o 12:42 Robbe Caes via midPoint <
> midpoint at lists.evolveum.com>
> nap?sal(a):
>
> > Hi,
> >
> > We are having trouble generating a report of orphaned accounts on our AD
> > resource.
> > We have tried many different filters and syntaxes to come up with a
> > solution for this but nothing has worked.
> > The most common error we get is:
> > Cannot combine on-resource and off-resource properties in a shadow search
> > query. Encountered filter 'AND(REF: resourceRef,
> > PRV(oid=572fc2e9-dad8-4b52-955e-50c8d1ff082c, targetType=null),
> > targetFilter=null; EQUAL: kind, PPV(ShadowKindType:ACCOUNT); EQUAL:
> intent,
> > PPV(String:Account); EQUAL: objectClass,
> > PPV(QName:{...resource/instance-3}user); NOT(OWNED-BY(CTD
> > ({.../common/common-3}FocusType),null,null)))'
> >
> > Our current filter looks like this:
> >
> > <filter>
> > <q:and>
> > <q:ref>
> > <q:path>resourceRef</q:path>
> > <q:value oid="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"/>
> > </q:ref>
> >
> > <q:equal>
> > <q:path>kind</q:path>
> > <q:value>ACCOUNT</q:value>
> > </q:equal>
> >
> > <q:equal>
> > <q:path>intent</q:path>
> > <q:value>Account</q:value>
> > </q:equal>
> >
> > <q:equal>
> > <q:path>objectClass</q:path>
> > <q:value xmlns:ri="
> http://midpoint.evolveum.com/xml/ns/public/resource/instance-3">ri:user</q:value
> >
> > </q:equal>
> >
> > <q:not>
> > <q:ownedBy>
> > <q:type>FocusType</q:type>
> > </q:ownedBy>
> > </q:not>
> > </q:and>
> > </filter>
> >
> > We have also tried using marks on accounts without owners to then filter
> on these marks but this does not work either.
> >
> > Does anyone have a solution for this? If so, please let me know how we
> can implement this.
> >
> > Kind Regards,
> >
> > Robbe Caes
> >
> > IGA Specialist
> >
> > [image: Logo] <https://www.acen.eu/>
> >
> > +32 496 18 01 60
> >
> > robbe.caes at acen.eu <robbe.caes at acen.eu>
> >
> > www.acen.eu <http://www.acen.eu/>
> >
> > Veldkant 7, 2550 Kontich <https://maps.app.goo.gl/M4nC67m22KWx2XE2A>
> >
> > Follow us
> > <
> https://www.linkedin.com/company/98341614/admin/feed/posts/?feedType=following
> >
> >
> > _______________________________________________
> > midPoint mailing list
> > midPoint at lists.evolveum.com
> > https://lists.evolveum.com/mailman/listinfo/midpoint
> >
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <
> https://lists.evolveum.com/pipermail/midpoint/attachments/20260612/aaea3cc9/attachment.htm
> >
>
> ------------------------------
>
> Subject: Digest Footer
>
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> https://lists.evolveum.com/mailman/listinfo/midpoint
>
>
> ------------------------------
>
> End of midPoint Digest, Vol 170, Issue 11
> *****************************************
> _______________________________________________
> midPoint mailing list
> midPoint at lists.evolveum.com
> https://lists.evolveum.com/mailman/listinfo/midpoint
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20260612/d2950afe/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Orphaned accounts.xml
Type: text/xml
Size: 2571 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20260612/d2950afe/attachment-0002.xml>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Shadow Collection.xml
Type: text/xml
Size: 1566 bytes
Desc: not available
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20260612/d2950afe/attachment-0003.xml>
More information about the midPoint
mailing list