<html><body><div style="font-family: times new roman, new york, times, serif; font-size: 12pt; color: #000000"><div>Hi Jason,<br></div><div><br></div><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;" data-mce-style="border-left: 2px solid #1010FF; margin-left: 5px; padding-left: 5px; color: #000; font-weight: normal; font-style: normal; text-decoration: none; font-family: Helvetica,Arial,sans-serif; font-size: 12pt;"><div><br></div><div dir="ltr"><div>Back to AD Resource, Just thinking about our production AD Farm:</div><div><br></div>Can I have midpoint ignore certain OUs from the resource xml? There are some OUs in AD I would really not like for Midpoint to see or manage, maybe a filter?<div><br></div><div>JASON</div></div><br> <br></blockquote><div><br><div>There are multiple ways of configuring this:<br></div><div><br></div><div>1) you can have your permissions in AD restricted to be able to see only what you want to see<br></div><div>2) configuration property Container might be (never tested for AD) multivalue and you can specify multiple subtrees (for OpenDJ and LDAP connector this works)<br></div><div>3) you can configure Protected Accounts<br></div><div><br></div><div><a href="https://wiki.evolveum.com/display/midPoint/Protected+Accounts">https://wiki.evolveum.com/display/midPoint/Protected+Accounts</a></div><div><a href="https://jira.evolveum.com/browse/MID-859">https://jira.evolveum.com/browse/MID-859</a></div><div><br></div><div>Some examples for Protected Accounts:<br></div><div><br></div><div>- to ignore all (account) objects with carLicense=ignoreme<br></div><div><br></div><div> <protected><br> <filter><br> <q:equal><br> <q:matching>stringIgnoreCase</q:matching><br> <q:path><br>declare namespace ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3";<br>attributes/ri:carLicense<br> </q:path><br> <q:value>ignoreme</q:value><br> </q:equal><br> </filter><br> </protected><br><br></div><div>- to ignore all (account) objects under ou=supersecret:<br></div><div> <protected><br> <filter><br> <q:substring><br> <q:matching>stringIgnoreCase</q:matching><br> <q:path><br>declare namespace icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3";<br>attributes/icfs:name<br> </q:path><br> <q:value>ou=supersecret,ou=Users,ou=BA,ou=CUSTOMER,dc=example,dc=com</q:value><br> <strong><q:anchorEnd>true</q:anchorEnd></strong><br> </q:substring><br> </filter><br> </protected><br><br></div><div>midPoint will "see" the protected accounts, but it will mark each such account in the Shadow object as protected and will not allow its modification.<br></div><div><br></div></div><div>Regards,<br></div><div>Ivan<br></div><div><br></div><div>-- <br></div><div><span name="x"></span> Ing. Ivan Noris<br> Senior Identity Management Engineer<br> evolveum.com<br> ___________________________________________<br> "Idem per idem - semper idem Vix."<span name="x"></span><br></div></div></body></html>