[midPoint] Application-role priority enforcement (per service)— prune removing org assignments unexpectedly

[Bao Tran]

Hi all,
We're running into an issue with  priority enforcement for
application-roles for single service in MidPoint and would appreciate any
insight.

*Our goal: *A service has multi application-role , a user John can have
multiple org assignments with different relations → only the highest
application-role (E5) wins, application-role F3 is suppressed.

*What we tried (and failed):*

   - Orgs have 2 inducements:
      - → E5 (condition: relation=manager)
      - → F3 (no condition, everyone gets this as base)
   - Service O365 has 2 application-roles:
         - E5
         - F3
   - F3 role has an exclusion policy rule → prune when E5 is present:

<role>
  <name>F3</name>
  <assignment>
    <policyRule>
      <name>m365-f3-excluded-by-e5</name>
      <policyConstraints>
        <exclusion>
          <targetRef oid="E5" type="c:RoleType"/>
        </exclusion>
      </policyConstraints>
      <policyActions>
        <prune/>
      </policyActions>
    </policyRule>
  </assignment>


*Steps to reproduce the failure:      *Create new user John

   1. Assign John → org101 as manager → gets E5

   2. Assign John → org102 as default → *org101 assignment gets removed* ❌
   3. Re-assign John → org101 as manager → *org102 assignment gets removed*
   ❌

*Symptom:*
The F3 and E5 prune fires and removes the upstream direct org assignment
instead of just suppressing the application-role .

*Question:*
How do we configure MidPoint so O365 service (or in application-role) that
E5 > F3 priority is enforced at the O365 service level, without affecting
org assignments?

-- 
Bao Tran
Software developer
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20260617/e4e8cbc6/attachment.htm>