<div dir="ltr">Awesome, it works just by using either of these values in the roleType field, 2, 4, 8, -2147483646, -2147483644, or -2147483640<div><br></div><div><div>                <attribute></div><div>                    <ref>ri:groupType</ref></div><div>                    <outbound></div><div>                        <strength>strong</strength></div><div>                        <source></div><div>                            <path>roleType</path></div><div>                        </source></div><div>                    </outbound></div><div>                    <inbound></div><div>                        <strength>strong</strength></div><div>                        <target></div><div>                            <path>$focus/roleType</path></div><div>                        </target></div><div>                    </inbound></div><div>                </attribute></div></div><div><br></div><div>So now I am going to do some mappings and auto input those fields when creating a role based on conditions!</div><div><br></div><div>This is great that it works!</div><div><br></div><div>JASON</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Dec 1, 2014 at 11:11 AM, Pavol Mederly <span dir="ltr"><<a href="mailto:mederly@evolveum.com" target="_blank">mederly@evolveum.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
  
    
  
  <div bgcolor="#FFFFFF" text="#000000">
    <div>Hello Jason,<br>
      <br>
      I would suggest looking at <a href="http://msdn.microsoft.com/en-us/library/cc223142.aspx" target="_blank">http://msdn.microsoft.com/en-us/library/cc223142.aspx</a>.<br>
      <br>
      Then e.g. Security + Global group would be 0x80000002, i.e.
      decimally either <a href="tel:2147483650" value="+12147483650" target="_blank">2147483650</a> or -<a href="tel:2147483646" value="+12147483646" target="_blank">2147483646</a>, depending on whether
      the connector expects the value as unsigned int32/64 or signed
      int32. I have not used that yet; so please try them both and see
      what works for you.<br>
      <br>
      Best regards,<br>
      Pavol<div><div class="h5"><br>
      <br>
      On 1. 12. 2014 17:58, Jason Everling wrote:<br>
    </div></div></div><div><div class="h5">
    <blockquote type="cite">
      <div dir="ltr">Yeah I was going to try to set the grouptType
        attribute which controls what group type it is but it is a
        integer and not a string, if not then no big deal, was just
        wondering.
        <div><br>
        </div>
        <div>JASON</div>
      </div>
      <div class="gmail_extra"><br>
        <div class="gmail_quote">On Mon, Dec 1, 2014 at 10:22 AM, Ivan
          Noris <span dir="ltr"><<a href="mailto:ivan.noris@evolveum.com" target="_blank">ivan.noris@evolveum.com</a>></span>
          wrote:<br>
          <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div bgcolor="#FFFFFF" text="#000000"> Hi Jason,<br>
              <br>
              I don't have AD right now handy, so this one is a
              meta-answer:<br>
              <br>
              - Try to lookup some other-than-global/security groups in
              your AD, and see their attributes right in AD.<br>
              - Then try to see if those attributes are managable by the
              connector (in schema, CustomGroupObjectClass AFAIK).<br>
              - Then you can try to set corresponding values.<br>
              <br>
              In my projects, I've only needed Security and standard
              groups, I didn't set the other attribute/values, so they
              were pretty much filled by AD or the connector itself.<br>
              <br>
              I'm sure Pavol can give you more precise answer regarding
              the support of this; and I may have some time later today
              or tomorrow to explore this myself.<br>
              <br>
              Regards,<br>
              Ivan
              <div>
                <div><br>
                  <br>
                  <div>On 12/01/2014 05:12 PM, Jason Everling wrote:<br>
                  </div>
                  <blockquote type="cite">
                    <div dir="ltr">I think that would be a bit much,
                      more than likely, I will move all groups that
                      would be sync'd to Midpoint into its own container
                      in AD and move all our other groups to another
                      container and use the <protected> to filter
                      them out so they are not sync'd.
                      <div><br>
                      </div>
                      <div>Is there a way to build a specific group type
                        instead of just Global | Security, maybe Domain
                        Local or Universal or is it hard coded to Global
                        Security?<br>
                        <div><br>
                        </div>
                        <div>Thanks!</div>
                        <div>JASON</div>
                      </div>
                    </div>
                    <div class="gmail_extra"><br>
                      <div class="gmail_quote">On Mon, Dec 1, 2014 at
                        4:12 AM, Radovan Semancik <span dir="ltr"><<a href="mailto:radovan.semancik@evolveum.com" target="_blank">radovan.semancik@evolveum.com</a>></span>
                        wrote:<br>
                        <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
                          <div text="#000000" bgcolor="#FFFFFF">
                            <div>Hi Jason,<br>
                              <br>
                              This is slightly different. The condition
                              tells whether to apply the specific
                              <objectSynchronization> block or on.
                              The primary use of the condition is to
                              sort objects of the same object class to
                              "intents" (see <a href="https://wiki.evolveum.com/display/midPoint/Kind%2C+Intent+and+ObjectClass" target="_blank">https://wiki.evolveum.com/display/midPoint/Kind%2C+Intent+and+ObjectClass</a>).


                              The primary meaning of this is to
                              synchronize group object with a role
                              object (or org object). But it does not
                              synchronize account-group association
                              (i.e. group membership) with a user-role
                              assignment.<br>
                              <br>
                              With a bit of trickery it could
                              theoretically work for your case. But I
                              doubt that it will be practical. You will
                              need one <objectSynchronization>
                              block for each group that you are trying
                              to synchronize.<span><font color="#888888"><br>
                                  <br>
                                  <pre cols="72">-- 

                                           Radovan Semancik
                                          Software Architect
                                             <a href="http://evolveum.com" target="_blank">evolveum.com</a>
</pre>
                                </font></span>
                              <div>
                                <div> <br>
                                  <br>
                                  On 11/29/2014 05:21 PM, Jason Everling
                                  wrote:<br>
                                </div>
                              </div>
                            </div>
                            <div>
                              <div>
                                <blockquote type="cite">
                                  <div dir="ltr">Is what I was asking,
                                    in the wiki it says you can add a
                                    condition to the synchronization
                                    policy, under <a href="https://wiki.evolveum.com/display/midPoint/Synchronization+Configuration" target="_blank">https://wiki.evolveum.com/display/midPoint/Synchronization+Configuration</a>
                                    <div><br>
                                    </div>
                                    <ul style="margin:10px 0px 0px;color:rgb(51,51,51);font-family:Arial,sans-serif;font-size:14px;line-height:20px">
                                      <li><strong>condition</strong> is
                                        an expression which has to
                                        evaluate to true for the policy
                                        to be used. It can be used for a
                                        very fine-grain selection of
                                        applicable policies.</li>
                                    </ul>
                                    <div><font color="#333333" face="Arial, sans-serif"><span style="font-size:14px;line-height:20px"><br>
                                        </span></font></div>
                                    <div><font color="#333333" face="Arial, sans-serif"><span style="font-size:14px;line-height:20px">I
                                          found a sample, kind of here, <a href="https://github.com/Evolveum/midpoint/blob/a6c023945dbea34db69a8ff17c9a61b7184c42cc/testing/consistency-mechanism/src/test/resources/request/resource-modify-synchronization.xml" target="_blank">https://github.com/Evolveum/midpoint/blob/a6c023945dbea34db69a8ff17c9a61b7184c42cc/testing/consistency-mechanism/src/test/resources/request/resource-modify-synchronization.xml</a></span></font></div>
                                    <div><font color="#333333" face="Arial, sans-serif"><span style="font-size:14px;line-height:20px"><br>
                                        </span></font></div>
                                    <div><font color="#333333" face="Arial, sans-serif"><span style="font-size:14px;line-height:20px">I
                                          am just a little confused on
                                          the condition statement, I was
                                          thinking it would look
                                          something like,</span></font></div>
                                    <div><font color="#333333" face="Arial, sans-serif"><span style="font-size:14px;line-height:20px"><br>
                                        </span></font></div>
                                    <div><font color="#333333" face="Arial, sans-serif"><span style="font-size:14px;line-height:20px">
                                          <div><condition></div>
                                          <div>   <script></div>
                                          <div>     <code></div>
                                          <div>        declare default
                                            namespace "<a href="http://midpoint.evolveum.com/xml/ns/public/common/common-3" target="_blank">http://midpoint.evolveum.com/xml/ns/public/common/common-3</a>";</div>
                                          <div>       
                                            basic.getAttributeValue(account,
                                            '<a href="http://midpoint.evolveum.com/xml/ns/public/common/common-3" target="_blank">http://midpoint.evolveum.com/xml/ns/public/common/common-3</a>',


                                            'info') = replicated</div>
                                          <div>     </code></div>
                                          <div>  </script></div>
                                          <div></condition></div>
                                        </span></font></div>
                                    <div><br>
                                    </div>
                                    <div><br>
                                    </div>
                                    <div>JASON</div>
                                    <div><font color="#333333" face="Arial, sans-serif"><span style="font-size:14px;line-height:20px"><br>
                                        </span></font></div>
                                  </div>
                                  <div class="gmail_extra"><br>
                                    <div class="gmail_quote">On Sat, Nov
                                      29, 2014 at 2:47 AM, Pavol Mederly
                                      <span dir="ltr"><<a href="mailto:mederly@evolveum.com" target="_blank">mederly@evolveum.com</a>></span>
                                      wrote:<br>
                                      <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
                                        <div bgcolor="#FFFFFF" text="#000000">
                                          <div>Hello Jason,<br>
                                            <br>
                                            although I don't understand
                                            what you would like to
                                            achieve, a quick answer
                                            though:<br>
                                            <br>
                                            If you would apply a
                                            condition to a mapping
                                            (incoming or outgoing, it
                                            does not matter), you can
                                            use <condition>
                                            subelement directly under
                                            <incoming> or
                                            <outgoing> one.<br>
                                            However, take this only as a
                                            quick hint. I haven't done
                                            that, nor I'm sure it's
                                            implemented. Please try it.<br>
                                            <br>
                                            Best regards,<br>
                                            Pavol
                                            <div>
                                              <div><br>
                                                <br>
                                                On 28. 11. 2014 22:46,
                                                Jason Everling wrote:<br>
                                              </div>
                                            </div>
                                          </div>
                                          <blockquote type="cite">
                                            <div>
                                              <div>
                                                <div dir="ltr">So I have
                                                  the roleType syncing
                                                  to the AD attribute,
                                                  info, the info or
                                                  roleType. I want any
                                                  group that contains
                                                  this roleType or info
                                                  attribute sync'd, any
                                                  other s will not be
                                                  sync'd.
                                                  <div><br>
                                                  </div>
                                                  <div>I know how to do
                                                    this in
                                                    objectTemplate but
                                                    how in the resource
                                                    so that it only
                                                    syncs those groups
                                                    and not all groups.</div>
                                                  <div><br>
                                                  </div>
                                                  <div>Where do I put in
                                                    the condition
                                                    statement in the
                                                    resource definition?
                                                    I searched through
                                                    what I could in the
                                                    samples but couldn't
                                                    find anything like
                                                    this.</div>
                                                  <div><br>
                                                  </div>
                                                  <div>JASON</div>
                                                </div>
                                                <br>
                                              </div>
                                            </div>
                                            <font><br>
                                              <br>
                                              CONFIDENTIALITY NOTICE:<br>
                                              This e-mail together with
                                              any attachments is
                                              proprietary and
                                              confidential; intended for
                                              only the recipient(s)
                                              named above and may
                                              contain information that
                                              is privileged. You should
                                              not retain, copy or use
                                              this e-mail or any
                                              attachments for any
                                              purpose, or disclose all
                                              or any part of the
                                              contents to any person.
                                              Any views or opinions
                                              expressed in this e-mail
                                              are those of the author
                                              and do not represent those
                                              of the Baptist School of
                                              Health Professions. If you
                                              have received this e-mail
                                              in error, or are not the
                                              named recipient(s), you
                                              are hereby notified that
                                              any review, dissemination,
                                              distribution or copying of
                                              this communication is
                                              prohibited by the sender
                                              and to do so might
                                              constitute a violation of
                                              the Electronic
                                              Communications Privacy
                                              Act, 18 U.S.C. section
                                              2510-2521. Please
                                              immediately notify the
                                              sender and delete this
                                              e-mail and any attachments
                                              from your computer. </font><br>
                                            <br>
                                            <fieldset></fieldset>
                                            <br>
                                            <pre>_______________________________________________
midPoint mailing list
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" target="_blank">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
                                          </blockquote>
                                          <br>
                                        </div>
                                        <br>
_______________________________________________<br>
                                        midPoint mailing list<br>
                                        <a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
                                        <a href="http://lists.evolveum.com/mailman/listinfo/midpoint" target="_blank">http://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
                                        <br>
                                      </blockquote>
                                    </div>
                                    <br>
                                  </div>
                                  <br>
                                  <font><br>
                                    <br>
                                    CONFIDENTIALITY NOTICE:<br>
                                    This e-mail together with any
                                    attachments is proprietary and
                                    confidential; intended for only the
                                    recipient(s) named above and may
                                    contain information that is
                                    privileged. You should not retain,
                                    copy or use this e-mail or any
                                    attachments for any purpose, or
                                    disclose all or any part of the
                                    contents to any person. Any views or
                                    opinions expressed in this e-mail
                                    are those of the author and do not
                                    represent those of the Baptist
                                    School of Health Professions. If you
                                    have received this e-mail in error,
                                    or are not the named recipient(s),
                                    you are hereby notified that any
                                    review, dissemination, distribution
                                    or copying of this communication is
                                    prohibited by the sender and to do
                                    so might constitute a violation of
                                    the Electronic Communications
                                    Privacy Act, 18 U.S.C. section
                                    2510-2521. Please immediately notify
                                    the sender and delete this e-mail
                                    and any attachments from your
                                    computer. </font><br>
                                  <br>
                                  <fieldset></fieldset>
                                  <br>
                                  <pre>_______________________________________________
midPoint mailing list
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" target="_blank">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
                                </blockquote>
                                <br>
                                <br>
                              </div>
                            </div>
                          </div>
                          <br>
_______________________________________________<br>
                          midPoint mailing list<br>
                          <a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
                          <a href="http://lists.evolveum.com/mailman/listinfo/midpoint" target="_blank">http://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
                          <br>
                        </blockquote>
                      </div>
                      <br>
                    </div>
                    <br>
                    <font><br>
                      <br>
                      CONFIDENTIALITY NOTICE:<br>
                      This e-mail together with any attachments is
                      proprietary and confidential; intended for only
                      the recipient(s) named above and may contain
                      information that is privileged. You should not
                      retain, copy or use this e-mail or any attachments
                      for any purpose, or disclose all or any part of
                      the contents to any person. Any views or opinions
                      expressed in this e-mail are those of the author
                      and do not represent those of the Baptist School
                      of Health Professions. If you have received this
                      e-mail in error, or are not the named
                      recipient(s), you are hereby notified that any
                      review, dissemination, distribution or copying of
                      this communication is prohibited by the sender and
                      to do so might constitute a violation of the
                      Electronic Communications Privacy Act, 18 U.S.C.
                      section 2510-2521. Please immediately notify the
                      sender and delete this e-mail and any attachments
                      from your computer. </font><br>
                    <br>
                    <fieldset></fieldset>
                    <br>
                    <pre>_______________________________________________
midPoint mailing list
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" target="_blank">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
                  </blockquote>
                  <br>
                </div>
              </div>
              <span><font color="#888888">
                  <pre cols="72">-- 
  Ing. Ivan Noris
  Senior Identity Management Engineer
  <a href="http://evolveum.com" target="_blank">evolveum.com</a>     <a href="http://evolveum.com/blog/" target="_blank">evolveum.com/blog/</a>
  _____________________________________________
  "Semper Id(e)M Vix."
</pre>
                </font></span></div>
            <br>
            _______________________________________________<br>
            midPoint mailing list<br>
            <a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
            <a href="http://lists.evolveum.com/mailman/listinfo/midpoint" target="_blank">http://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
            <br>
          </blockquote>
        </div>
        <br>
      </div>
      <br>
      <font><br>
        <br>
        CONFIDENTIALITY NOTICE:<br>
        This e-mail together with any attachments is proprietary and
        confidential; intended for only the recipient(s) named above and
        may contain information that is privileged. You should not
        retain, copy or use this e-mail or any attachments for any
        purpose, or disclose all or any part of the contents to any
        person. Any views or opinions expressed in this e-mail are those
        of the author and do not represent those of the Baptist School
        of Health Professions. If you have received this e-mail in
        error, or are not the named recipient(s), you are hereby
        notified that any review, dissemination, distribution or copying
        of this communication is prohibited by the sender and to do so
        might constitute a violation of the Electronic Communications
        Privacy Act, 18 U.S.C. section 2510-2521. Please immediately
        notify the sender and delete this e-mail and any attachments
        from your computer. </font><br>
      <br>
      <fieldset></fieldset>
      <br>
      <pre>_______________________________________________
midPoint mailing list
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" target="_blank">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
    </blockquote>
    <br>
  </div></div></div>

<br>_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" target="_blank">http://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
<br></blockquote></div><br></div>

<br>
<font size="2"><br><br>CONFIDENTIALITY NOTICE:<br>This e-mail together with any attachments is proprietary and confidential; intended for only the recipient(s) named above and may contain information that is privileged. You should not retain, copy or use this e-mail or any attachments for any purpose, or disclose all or any part of the contents to any person. Any views or opinions expressed in this e-mail are those of the author and do not represent those of the Baptist School of Health Professions. If you have received this e-mail in error, or are not the named recipient(s), you are hereby notified that any review, dissemination, distribution or copying of this communication is prohibited by the sender and to do so might constitute a violation of the Electronic Communications Privacy Act, 18 U.S.C. section 2510-2521. Please immediately notify the sender and delete this e-mail and any attachments from your computer. </font><br>