<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Well, the main problem is in the
addSecondaryDelta method. It is a method in LensElementContext, a
superclass of LensFocusContext and LensProjectionContext. And the
focus just ignores secondaryDelta; it uses secondaryDeltas
instead. I understand that this is (at best) misleading - and I'll
fix this (<a href="https://jira.evolveum.com/browse/MID-2381">MID-2381</a>).<br>
<br>
In the meanwhile, I have two options for you; preferring the
second one.<br>
<br>
The first one is to use correct method to set the secondary delta
- along with correctly computing the delta itself.<br>
<br>
<tt>focusClone = focus.clone();</tt><tt><br>
</tt><tt>focusClone.assignment.removeAll(rolesToDelete);</tt><tt><br>
</tt><tt>delta =
focus.asPrismObject().diff(focusClone.asPrismObject());</tt><tt><br>
</tt><tt>log.info("delta = {}", delta.debugDump());</tt><tt><br>
</tt><tt>for (itemDelta in delta.getModifications()) {</tt><tt><br>
</tt><tt>
modelContext.focusContext.swallowToSecondaryDelta(itemDelta);</tt><tt><br>
</tt><tt>}</tt><tt><br>
</tt><br>
<br>
As you can see, I've left out the getObject operation. Because in
your case, you were comparing the computed ObjectNew state with
original object state in repository. They may differ in much more
than the assignments you want to delete. In contrast to that, what
I suggest concentrates only on the role assignment removal. And,
it does not modify objects in the model context; it modifies a
clone instead.<br>
<br>
But there still is the question of (possible) secondary delta
recomputation yielding the loss of your added delta. So I would
not hesitate to put the changes directly into the primary delta,
to be sure they will not be lost during the processing:<br>
<br>
<tt>focusClone = focus.clone();</tt><tt><br>
</tt><tt>focusClone.assignment.</tt><tt>removeAll(rolesToDelete);</tt><tt><br>
</tt><tt>delta =
focus.asPrismObject().diff(focusClone.asPrismObject());</tt><tt><br>
</tt><tt>log.info("delta = {}", delta.debugDump());</tt><tt><br>
</tt><font color="#cc0000"><tt>modelContext.focusContext.addPrimaryDelta(delta);</tt><tt><br>
</tt><tt>modelContext.setFresh(false);</tt><tt><br>
</tt></font><br>
SetFresh(false) causes immediate recomputation of the context.<br>
<br>
I've tested both options in my environment and they seem to work
(tested with removing all assignment, not only selected ones).<br>
<br>
Hope this helps,<br>
Pavol<br>
<br>
<br>
On 26. 5. 2015 16:52, Pavol Mederly wrote:<br>
</div>
<blockquote cite="mid:556488A0.6070408@evolveum.com" type="cite">
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<div class="moz-cite-prefix">Hello Алексей,<br>
<br>
I've studied the logs you've sent here.<br>
<br>
Look at the line 9182, just after the text "2015-05-26
12:46:50,285 TRACE: Evaluating hook 'Example scripting hook'".<br>
<br>
You see that "User old" and "User current" have all the
assignments, namely:<br>
<br>
<tt> assignment: </tt><tt><br>
</tt><tt> id=2</tt><tt><br>
</tt><tt> targetRef:
oid=5e8b8660-a788-4b7c-8a6c-f08f3ff3d4a1(RoleType)</tt><tt><br>
</tt><tt> id=3</tt><tt><br>
</tt><tt> targetRef:
oid=7faa8e52-d8d8-487f-8a25-987a0eaf4521(RoleType)</tt><tt><br>
</tt><tt> id=4</tt><tt><br>
</tt><tt> targetRef:
oid=cdb06bb4-c134-4ce5-b0f9-483b32832114(RoleType)</tt><tt><br>
</tt><tt> id=5</tt><tt><br>
</tt><tt> targetRef:
oid=3427d715-52a1-4806-9f81-0304f57ffb90(RoleType)</tt><tt><br>
</tt><tt> id=1</tt><tt><br>
</tt><tt> targetRef:
oid=aa1de21f-33a9-46c9-a3fb-f92e88b71377(OrgType)</tt><tt><br>
</tt><tt><br>
</tt>and "User new" does not have them. So far so good.<br>
<br>
BUT.<br>
<br>
The secondary delta(s) do not contain the delta that caused that
removal:<br>
<tt><br>
</tt><tt> User secondary delta:</tt><tt><br>
</tt><tt> ObjectDeltaWaves:2 waves</tt><tt><br>
</tt><tt> wave 0:</tt><tt><br>
</tt><tt>
ObjectDelta<UserType>(UserType:1e0a1255-9a03-415f-9bef-1ea5d4d4bbd8,MODIFY):</tt><tt><br>
</tt><tt> extension/hrStatus</tt><tt><br>
</tt><tt> REPLACE: REJ</tt><tt><br>
</tt><tt> assignment</tt><tt><br>
</tt><tt> ADD:</tt><tt><br>
</tt><tt> id=null</tt><tt><br>
</tt><tt> targetRef:
oid=c2af1367-9ebd-4806-a7fa-05c0914083e0(OrgType)</tt><tt><br>
</tt><tt> DELETE:</tt><tt><br>
</tt><tt> id=null</tt><tt><br>
</tt><tt> targetRef:
oid=aa1de21f-33a9-46c9-a3fb-f92e88b71377(OrgType)</tt><tt><br>
</tt><tt> activation/administrativeStatus</tt><tt><br>
</tt><tt> REPLACE: DISABLED</tt><tt><br>
</tt><tt> parentOrgRef</tt><tt><br>
</tt><tt> ADD:
oid=c2af1367-9ebd-4806-a7fa-05c0914083e0(OrgType)</tt><tt><br>
</tt><tt> DELETE:
oid=aa1de21f-33a9-46c9-a3fb-f92e88b71377(OrgType)</tt><tt><br>
</tt><tt> wave 1:</tt><tt><br>
</tt><tt>
ObjectDelta<UserType>(UserType:1e0a1255-9a03-415f-9bef-1ea5d4d4bbd8,MODIFY):</tt><tt><br>
</tt><tt> extension/hrStatus</tt><tt><br>
</tt><tt> REPLACE: REJ</tt><tt><br>
</tt><tt> activation/effectiveStatus</tt><tt><br>
</tt><tt> REPLACE: DISABLED</tt><tt><br>
</tt><tt> activation/disableTimestamp</tt><tt><br>
</tt><tt> REPLACE: 2015-05-26T12:46:45.745+03:00</tt><tt><br>
</tt><tt> parentOrgRef</tt><tt><br>
</tt><tt> ADD:
oid=c2af1367-9ebd-4806-a7fa-05c0914083e0(OrgType)</tt><tt><br>
</tt><tt> DELETE:
oid=aa1de21f-33a9-46c9-a3fb-f92e88b71377(OrgType)</tt><br>
<br>
And the deltas are what counts. ChangeExecutor executes deltas,
not the "User new" state. The "User new" state is dynamically
recomputed (using deltas), at many places.<br>
<br>
I'm refering to this code:<br>
<br>
<tt>result = new OperationResult("get_object_by_oid");</tt><tt><br>
</tt><tt> task =
taskManager.createTaskInstance("get_user_by_oid");</tt><tt><br>
</tt><tt> focus.assignment.removeAll(rolesToDelete);</tt><tt><br>
</tt><tt> current = modelController.getObject(UserType.class,
focus.oid, null, task, result);</tt><tt><br>
</tt><tt> delta = current.diff(focus.asPrismObject(), true,
true);</tt><tt><br>
</tt><tt>
context.engineScope.get("modelContext").focusContext.addSecondaryDelta(delta)</tt><tt><br>
</tt><tt> </tt><br>
So, I have two recommendation:<br>
1) Do not call removeAll(rolesToDelete) on live object from the
model context. Use a clone instead.<br>
2) Try to find why the computed deltas are not incorporated in
the context.<br>
<br>
As for 2, I would recommend putting some kind of logging to make
sure the delta is computed well.<br>
In particular, I would replace <tt>current.diff(focus.asPrismObject(),
true, true)</tt> by <tt><br>
</tt><tt>current.diff(focus.asPrismObject())</tt>.<tt> </tt>But
that does not seem like the cause.<tt><br>
</tt><br>
There's probably one more caveat - not showing in your
particular case, but still present.<br>
If you put something into secondary delta, there's a risk that
these deltas will get recomputed<br>
if clockwork would think that the context is not fresh - around
lines 236-241 of Clockwork:<br>
<meta http-equiv="content-type" content="text/html;
charset=utf-8">
<pre style="background-color:#ffffff;color:#000000;font-family:'Courier New';font-size:9,0pt;"><small><small><span style="color:#000080;font-weight:bold;">if </span>(!context.isFresh()) {
context.cleanup();
<span style="color:#660e7a;font-weight:bold;">projector</span>.project(context, <span style="color:#008000;font-weight:bold;">"PROJECTOR ("</span>+state+<span style="color:#008000;font-weight:bold;">")"</span>, task, result);
} <span style="color:#000080;font-weight:bold;">else </span>{
<span style="color:#660e7a;font-weight:bold;font-style:italic;">LOGGER</span>.trace(<span style="color:#008000;font-weight:bold;">"Skipping projection because the context is fresh"</span>);
}
</small></small></pre>
Note that the projector.project simply re-computes secondary
deltas from the beginning (i.e. from the primary delta). I'm not
sure how to work around this. (Rado? Have you any idea?) Maybe
modifying the primary delta instead of secondary one? Or just
hoping this situation would not occur? :)<br>
<br>
Anyway, if I find a little bit more time, I could play for a
while with this. Until that, you could consider modifying your
code according to the recommendations above.<br>
<br>
Regards,<br>
Pavol<br>
<br>
On 26. 5. 2015 11:59, Алексей Ващенков wrote:<br>
</div>
<blockquote
cite="mid:23F96C83E30B7E4DA253EBD07C550836014D0BA3@EX-MB2.solar.local"
type="cite">
<pre wrap="">Send the log in attachment
________________________________________
От: midPoint [<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:midpoint-bounces@lists.evolveum.com">midpoint-bounces@lists.evolveum.com</a>] от имени Pavol Mederly [<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:pavol.mederly@gmail.com">pavol.mederly@gmail.com</a>]
Отправлено: 26 мая 2015 г. 12:38
Кому: <a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:midpoint@lists.evolveum.com">midpoint@lists.evolveum.com</a>
Тема: Re: [midPoint] HA: HA: Prohibit having particular assignments
I think this thread <a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://lists.evolveum.com/pipermail/midpoint/2015-May/000995.html">https://lists.evolveum.com/pipermail/midpoint/2015-May/000995.html</a> would be a better place to discuss this issue because the initial problem is rooted there.
OK, so continuing here.
System configuration is in attachments. How properly setup logs? If I enable model logger to debug, then each time hook is fired logs increase by 6MB
Yes, model diagnostic is quite verbose. Anyway, I suggest the following:
<classLogger>
<level>TRACE</level>
<package>com.evolveum.midpoint.model.impl.lens.Clockwork</package>
</classLogger>
<classLogger>
<level>TRACE</level>
<package>com.evolveum.midpoint.model.impl.lens.projector.Projector</package>
</classLogger>
...and remove the DEBUG placed at the level of model, i.e. this one:
<classLogger>
<level>DEBUG</level>
<package>com.evolveum.midpoint.model</package>
<appender>IDM-PROFILE_LOG</appender>
</classLogger>
I really suspect that the secondary deltas get recomputed during the process.
Pavol
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
midPoint mailing list
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a>
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
</blockquote>
<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
midPoint mailing list
<a class="moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a>
<a class="moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
</blockquote>
<br>
</body>
</html>