<div dir="ltr">Hey Radovan, <div><br></div><div>Thank you for the quick and lengthy response. </div><div>I'll have a good look at all the information you've provided.</div><div><br></div><div>Regards,</div><div>Sam</div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, May 7, 2014 at 3:36 PM, Radovan Semancik <span dir="ltr"><<a href="mailto:radovan.semancik@evolveum.com" target="_blank">radovan.semancik@evolveum.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<div class=""><br>
<br>
On 05/07/2014 11:55 AM, Sam Verboven wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<attribute><br>
<ref>icfs:groups</ref><br>
</blockquote>
<br></div>
The important thing to remember here is that the "groups" attribute is not a real AD attribute. This is a hack in AD connector that we have inherited from Sun ICF. It is used only with IDM systems that are not able to handle groups in any other ways. However midPoint 3.0 has the ability to natively handle entitlements (which essentially means groups). The mechanisms is described here:<br>
<br>
<a href="https://wiki.evolveum.com/display/midPoint/Entitlements" target="_blank">https://wiki.evolveum.com/<u></u>display/midPoint/Entitlements</a><br>
<br>
MidPoint should be able to work with icfs:groups pseudo-attribute as well. In theory. But there may be limitations and we have no intention to support this kind of connector hack in the future. The entitlements mechanism is the way forward.<div class="">
<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
However, I can't seem to figure out how I can sync back. A couple of questions:<br>
<br>
1) If a user is added to a group in AD, how does one synchronize this information back to Midpoint? I found some information using Entitlements but I can't figure out if this has been fully implemented yet or how to use it. Can this information be stored somewhere in the current Midpoint user/role model?<br>
</blockquote>
<br></div>
Yes, both entitlements and generic synchronization has been fully implemented. However we are still in testing phase and therefore there may be some bugs. Despite that you are more than welcome to try it and report any bugs you might find.<br>
<br>
There is an example how to configure entitlements and generic synchronization together in our "story" test:<br>
<br>
<a href="https://wiki.evolveum.com/display/midPoint/OrgSync+Story+Test" target="_blank">https://wiki.evolveum.com/<u></u>display/midPoint/OrgSync+<u></u>Story+Test</a><br>
<br>
This is "outbound" synchronization and it is in fact quite complex. But you might be able to simplify it and turn it around for inbound sync. The crucial part is the schemaHandling definition in resource configuration. You should be able to adapt the definition from the test for your specific case.<div class="">
<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
2) Is there any method to sync the creation/deletion of the actual groups themselves?<br>
</blockquote>
<br></div>
Yes. If you represent groups as entitlements then they become "first class citizens" in midPoint. And then you can use generic synchronization to pull them to midPoint:<br>
<br>
<a href="https://wiki.evolveum.com/display/midPoint/Generic+Synchronization" target="_blank">https://wiki.evolveum.com/<u></u>display/midPoint/Generic+<u></u>Synchronization</a><br>
<br>
The specific configuration is almost the same as for users/accounts case. You will just use kind=entitlement instead of kind=account. This resource config file has an example of synchronizing LDAP organizationalUnit to midPoint Orgs:<br>
<br>
<a href="https://github.com/Evolveum/midpoint/blob/master/testing/story/src/test/resources/orgsync/resource-opendj.xml" target="_blank">https://github.com/Evolveum/<u></u>midpoint/blob/master/testing/<u></u>story/src/test/resources/<u></u>orgsync/resource-opendj.xml</a><br>
<br>
Look especially for the second <objectSynchronization> section at the end of the file. You should be able to adapt this to group/Role combination.<div class=""><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
3) Is adding users to groups using a role inducement even a good idea?<br>
</blockquote>
<br></div>
Oh yes. We are using that a lot. Just look at a way how to do that with entitlement association instead of this nasty "groups" AD connector pseudo-attribute.<div class=""><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
4) An additional question regarding password synchronization. I found some information about this in the FAQ :<br>
<a href="https://wiki.evolveum.com/display/midPoint/Frequently+Asked+Questions#FrequentlyAskedQuestions-CanmidPointsynchronizepasswordsfromActiveDirectoryorLDAP%3F" target="_blank">https://wiki.evolveum.com/<u></u>display/midPoint/Frequently+<u></u>Asked+Questions#<u></u>FrequentlyAskedQuestions-<u></u>CanmidPointsynchronizepassword<u></u>sfromActiveDirectoryorLDAP%3F</a>. <br>
<br>
But I also found an agent on github:<br>
<a href="https://github.com/Evolveum/midpoint-password-agent-ad" target="_blank">https://github.com/Evolveum/<u></u>midpoint-password-agent-ad</a><br>
<br>
Is it a good idea to use this agent, or is it simply some test code that is not ready for production use?<br>
</blockquote>
<br></div>
It is a contributed code. We haven't tested the code ourselves but we have reports that it works well. However the code is using the midPoint 2.x version of the web service interface. Therefore it will not work with midPoint 3.0 in its current form. It has to be ported to the new 3.x version of the web service interface. However the "porting" should be actually very easy to do. Just fix namespace names and maybe one or two minor details.<span class="HOEnZb"><font color="#888888"><br>
<br>
-- <br>
<br>
Radovan Semancik<br>
Software Architect<br>
<a href="http://evolveum.com" target="_blank">evolveum.com</a><br>
<br>
______________________________<u></u>_________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" target="_blank">http://lists.evolveum.com/<u></u>mailman/listinfo/midpoint</a><br>
</font></span></blockquote></div><br></div>