<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi,<br>
<br>
can you please check/confirm, if the following works:<br>
<br>
1. user has assigned role which puts him to LDAP group<br>
2. role is unassigned from the user => this should delete the
LDAP account and remove it from the group<br>
<br>
If you delete role from midPoint, it will <b>not</b> remove the
accounts from the corresponding LDAP group.<br>
<br>
If you unassign resource inducement from a role, it will <b>not</b>
remove anything from LDAP. It should, however, if you <b>recompute</b>
users having this role assigned as this will re-evaluate role
assignments.<br>
<br>
If you have problems with user delete, i.e. user has account in
LDAP, and is in some group, and then you delete User in midPoint,
this should remove the LDAP account and - based on LDAP system -
remove references to the deleted account from the group as well.
Some directory servers have this referential integrity built-in or
even pluggable. midPoint should work in all cases, even if the
directory system does not have the referential integrity.<br>
<br>
Please try to confirm the case above and please also specify what
directory server are you using.<br>
<br>
Regards,<br>
Ivan<br>
<br>
<div class="moz-cite-prefix">On 01/23/2015 04:08 PM, Anand Kothekar
wrote:<br>
</div>
<blockquote
cite="mid:CAHUT-CR_rwMVFB+qa3aPwkm--1htgz3hGEnQdqtqeg+MY5fFJA@mail.gmail.com"
type="cite">
<div dir="ltr">Hi,
<div><br>
</div>
<div><br>
</div>
<div>I was playing around with the Role Inducement and observed
following things.</div>
<div><br>
</div>
<div><u>Details</u> :- </div>
<div>
<ol>
<li>Created a role having Resource as an Inducement.</li>
<li>And assigned that role to user.</li>
<li>user got stored in the LDAP Group mentioned in Resource.</li>
</ol>
<div><br>
</div>
<div><u>Issue</u> :- While performing various Delete
operations user is not getting removed from the LDAP Group.
</div>
</div>
<div><br>
</div>
<div><br>
</div>
<div> <u>User not getting Deleted from LDAP Group while doing
following things.</u><br>
</div>
<div>
<ol>
<li>Resource inducement unassigned from Role.<br>
</li>
<li>Role unassigned from User.</li>
<li>Role deleted.</li>
<li>User Deleted.</li>
</ol>
<div><br>
</div>
</div>
<div><br>
</div>
<div>Please provide me assistance with the above problem.</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>Regards,</div>
<div>Anand Kothekar</div>
<img moz-do-not-send="true" class="mailtrack-img"
src="https://mailtrack.io/trace/mail/9505e658e3fc8f61754fc745fcf1c3768dbda770.png"
height="0" width="0"></div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
midPoint mailing list
<a class="moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a>
<a class="moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Ing. Ivan Noris
Senior Identity Management Engineer
evolveum.com evolveum.com/blog/
_____________________________________________
"Semper Id(e)M Vix."
</pre>
</body>
</html>