[midPoint] Application-role priority enforcement (per service)— prune removing org assignments unexpectedly

[Bao Tran]

Hi Yakiv,

Thanks for the response,
Would you be able to point us to any documentation or examples on how to
implement that abstraction layer in the user archetype? Even a hint or a
starting point would be very helpful.

On Wed, Jun 17, 2026 at 9:18 PM Yakiv Revyakin <yrevyakin at issp.com> wrote:

> Hello Bau,
>
> My assumption is that the policy doesn’t affect indirect assignments
> induced by an org. Till you have certain org assigned it will induce.
>
> To implement the behavior, you need more complicated approach adding
> additional layer of abstraction in user archetype.
>
>
>
> *From:* midPoint <midpoint-bounces at lists.evolveum.com> *On Behalf Of *Bao
> Tran via midPoint
> *Sent:* Wednesday, June 17, 2026 11:33 AM
> *To:* midpoint at lists.evolveum.com
> *Cc:* Bao Tran <bao.tran at csit.fi>
> *Subject:* [midPoint] Application-role priority enforcement (per
> service)— prune removing org assignments unexpectedly
>
>
>
> Hi all,
> We're running into an issue with  priority enforcement for
> application-roles for single service in MidPoint and would appreciate any
> insight.
>
> *Our goal: *A service has multi application-role , a user John can have
> multiple org assignments with different relations → only the highest
> application-role (E5) wins, application-role F3 is suppressed.
>
> *What we tried (and failed):*
>
>    - Orgs have 2 inducements:
>
>
>    - → E5 (condition: relation=manager)
>       - → F3 (no condition, everyone gets this as base)
>
>
>    - Service O365 has 2 application-roles:
>          - E5
>          - F3
>    - F3 role has an exclusion policy rule → prune when E5 is present:
>
> <role>
>
>   <name>F3</name>
>
>   <assignment>
>
>     <policyRule>
>
>       <name>m365-f3-excluded-by-e5</name>
>
>       <policyConstraints>
>
>         <exclusion>
>
>           <targetRef oid="E5" type="c:RoleType"/>
>
>         </exclusion>
>
>       </policyConstraints>
>
>       <policyActions>
>
>         <prune/>
>
>       </policyActions>
>
>     </policyRule>
>
>   </assignment>
>
>
>
> *Steps to reproduce the failure:*
>       Create new user John
>
>    1. Assign John → org101 as manager → gets E5
>
>    2. Assign John → org102 as default → *org101 assignment gets removed* ❌
>    3. Re-assign John → org101 as manager → *org102 assignment gets
>    removed* ❌
>
> *Symptom:*
> The F3 and E5 prune fires and removes the upstream direct org assignment
> instead of just suppressing the application-role .
>
> *Question:*
> How do we configure MidPoint so O365 service (or in application-role) that
> E5 > F3 priority is enforced at the O365 service level, without affecting
> org assignments?
>
>
>
> --
>
> Bao Tran
>
> Software developer
>
> Attention! This email came from outside the ISSP company. If you do not
> trust this sender, do not click on the link or open the attachments, as
> this could be a phishing message.
>
>
>


-- 
Bao Tran
Software developer
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20260618/f11d0e6f/attachment.htm>