<font size=2 face="sans-serif">That's what I was looking for. Thanks!</font>
<br><font size=2 face="sans-serif">Tim</font>
<br>
<br>
<br>
<br><font size=2 face="sans-serif">Tim Strong, CISSP, GSEC, G2700, GSNA<br>
Sr. Security Manager</font>
<br><font size=2 face="sans-serif">Global Operations<br>
SITA Global Services<br>
Montreal - Canada<br>
Tel: +1 514 982 4318 | CVS: 225 4318</font>
<br>
<br>
<br>
<br><font size=1 color=#5f5f5f face="sans-serif">From:
</font><font size=1 face="sans-serif">Ivan Noris <ivan.noris@evolveum.com></font>
<br><font size=1 color=#5f5f5f face="sans-serif">To:
</font><font size=1 face="sans-serif">midpoint@lists.evolveum.com,
</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Date:
</font><font size=1 face="sans-serif">06/18/2015 03:01 PM</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Subject:
</font><font size=1 face="sans-serif">Re: [midPoint]
ldap account attribute filtering</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Sent by:
</font><font size=1 face="sans-serif">"midPoint"
<midpoint-bounces@lists.evolveum.com></font>
<br>
<hr noshade>
<br>
<br>
<br><font size=3>Hi Tim,<br>
<br>
if you mean that in GUI you see the attributes on the right side, then
the behaviour is OK. Mapping define only the rules of how the attribute
value is transformed from midPoint to resource (outbound) or from the resource
to midPoint (inbound). All attributes that are in schema, are displayed
by default.<br>
<br>
You can use <ignore>true</ignore> in the <attribute>
you wish do hide. It will not be displayed in GUI.<br>
</font><font size=3 color=blue><u><br>
</u></font><a href="https://wiki.evolveum.com/display/midPoint/Resource+Schema+Handling#ResourceSchemaHandling-AttributeDefinitions"><font size=3 color=blue><u>https://wiki.evolveum.com/display/midPoint/Resource+Schema+Handling#ResourceSchemaHandling-AttributeDefinitions</u></font></a><font size=3><br>
<br>
There is also a way how to disable attribute editing and display it as
read only using <limitations> (see also the above or our samples).<br>
<br>
And, the user/account form honors the security authorizations, so some
users can see / edit different values as other if the security authorizations
are configured and assigned to user (as roles).<br>
<br>
Regards,<br>
Ivan<br>
</font>
<br><font size=3>On 06/18/2015 06:30 PM, </font><a href=mailto:Tim.Strong@sita.aero><font size=3 color=blue><u>Tim.Strong@sita.aero</u></font></a><font size=3>
wrote:</font>
<br><font size=2 face="sans-serif">Hi Ivan,</font><font size=3> </font><font size=2 face="sans-serif"><br>
That is what I expected, but I have all attributes shown in my resource
accounts. (Still unmatched to users, haven't made it there
yet/one step at a time.)</font><font size=3> <br>
</font><font size=2 face="sans-serif"><br>
I have one inbound mapping expression as per below, so shouldn't that mean
all other attributes should *not* appear in the resource accounts? For
passing the attributes from the resource to the midPoint user, I can see
how that works, no mapping=no attribute for the user.</font><font size=3>
<br>
<br>
<schemaHandling> <br>
<objectType> <br>
<displayName>AD-LDAP Accounts</displayName>
<br>
<default>true</default> <br>
<objectClass>ri:AccountObjectClass</objectClass>
<br>
<attribute> <br>
<c:ref>icfs:uid</c:ref>
<br>
<exclusiveStrong>false</exclusiveStrong>
<br>
<tolerant>true</tolerant>
<br>
<inbound> <br>
<authoritative>true</authoritative>
<br>
<exclusive>false</exclusive>
<br>
<strength>normal</strength>
<br>
<target> <br>
<c:path>$user/employeeNumber</c:path>
<br>
</target>
<br>
</inbound> <br>
</attribute> <br>
<credentials> <br>
<password/> <br>
</credentials> <br>
</objectType> <br>
</schemaHandling> <br>
<br>
</font><font size=2 face="sans-serif"><br>
Thanks</font><font size=3> </font><font size=2 face="sans-serif"><br>
Ts</font><font size=3> <br>
<br>
<br>
<br>
<br>
</font><font size=1 color=#5f5f5f face="sans-serif"><br>
From: </font><font size=1 face="sans-serif">Ivan
Noris </font><a href=mailto:ivan.noris@evolveum.com><font size=1 color=blue face="sans-serif"><u><ivan.noris@evolveum.com></u></font></a><font size=3>
</font><font size=1 color=#5f5f5f face="sans-serif"><br>
To: </font><a href=mailto:midpoint@lists.evolveum.com><font size=1 color=blue face="sans-serif"><u>midpoint@lists.evolveum.com</u></font></a><font size=1 face="sans-serif">,
</font><font size=1 color=#5f5f5f face="sans-serif"><br>
Date: </font><font size=1 face="sans-serif">06/18/2015
11:23 AM</font><font size=3> </font><font size=1 color=#5f5f5f face="sans-serif"><br>
Subject: </font><font size=1 face="sans-serif">Re:
[midPoint] ldap account attribute filtering</font><font size=3> </font><font size=1 color=#5f5f5f face="sans-serif"><br>
Sent by: </font><font size=1 face="sans-serif">"midPoint"
</font><a href="mailto:midpoint-bounces@lists.evolveum.com"><font size=1 color=blue face="sans-serif"><u><midpoint-bounces@lists.evolveum.com></u></font></a><font size=3>
<br>
</font>
<hr noshade><font size=3><br>
<br>
<br>
Hi Tim,<br>
<br>
if an attribute definition has no inbound expression, the value of the
resource attribute will not be synchronized to midPoint.<br>
<br>
Regards,<br>
Ivan<br>
<br>
On 06/18/2015 04:56 PM, </font><a href=mailto:Tim.Strong@sita.aero><font size=3 color=blue><u>Tim.Strong@sita.aero</u></font></a><font size=3>
wrote: </font><font size=2 face="sans-serif"><br>
Hi folks,</font><font size=3> </font><font size=2 face="sans-serif"><br>
How do I restrict which attributes are synchronized from an LDAP resource?</font><font size=3>
</font><font size=2 face="sans-serif"><br>
Is this going to be in schema handling, attributes, fetch strategy=>explicit
for each attribute?</font><font size=3> </font><font size=2 face="sans-serif"><br>
<br>
If so, is there a a way to default explicit for attributes and then only
specify the ones we want to synchronize to midpoint?</font><font size=3>
</font><font size=2 face="sans-serif"><br>
<br>
I suspect this comes up fairly often since, but I haven't been able to
quickly find any references to it.</font><font size=3> </font><font size=2 face="sans-serif"><br>
<br>
Thanks</font><font size=3> </font><font size=2 face="sans-serif"><br>
Tim</font><font size=3> </font>
<p><font size=3>See you at the 2015 Air Transport IT Summit, Brussels,
16-18 June Click here to register your place now.. </font><a href=http://www.sitasummit.aero/><font size=3 color=blue><u>http://www.sitasummit.aero/</u></font></a><font size=3>
This document is strictly confidential and intended only for use by the
addressee unless otherwise stated. If you are not the intended recipient,
please notify the sender immediately and delete it from your system. </font>
<p><font size=3><br>
</font><tt><font size=3><br>
_______________________________________________<br>
midPoint mailing list</font></tt><font size=3 color=blue><u><br>
</u></font><a href=mailto:midPoint@lists.evolveum.com><tt><font size=3 color=blue><u>midPoint@lists.evolveum.com</u></font></tt></a><font size=3 color=blue><u><br>
</u></font><a href=http://lists.evolveum.com/mailman/listinfo/midpoint><tt><font size=3 color=blue><u>http://lists.evolveum.com/mailman/listinfo/midpoint</u></font></tt></a><font size=3><br>
<br>
</font><tt><font size=3><br>
-- <br>
Ing. Ivan Noris<br>
Senior Identity Management Engineer & IDM Architect<br>
evolveum.com
evolveum.com/blog/<br>
___________________________________________________<br>
"Semper Id(e)M Vix."</font></tt><tt><font size=2><br>
_______________________________________________<br>
midPoint mailing list</font></tt><tt><font size=2 color=blue><u><br>
</u></font></tt><a href=mailto:midPoint@lists.evolveum.com><tt><font size=2 color=blue><u>midPoint@lists.evolveum.com</u></font></tt></a><font size=3 color=blue><u><br>
</u></font><a href=http://lists.evolveum.com/mailman/listinfo/midpoint><tt><font size=2 color=blue><u>http://lists.evolveum.com/mailman/listinfo/midpoint</u></font></tt></a><font size=3><br>
<br>
</font>
<p><font size=3>See you at the 2015 Air Transport IT Summit, Brussels,
16-18 June Click here to register your place now.. </font><a href=http://www.sitasummit.aero/><font size=3 color=blue><u>http://www.sitasummit.aero/</u></font></a><font size=3>
This document is strictly confidential and intended only for use by the
addressee unless otherwise stated. If you are not the intended recipient,
please notify the sender immediately and delete it from your system. </font>
<p><font size=3><br>
</font>
<br><tt><font size=3>_______________________________________________<br>
midPoint mailing list<br>
</font></tt><a href=mailto:midPoint@lists.evolveum.com><tt><font size=3 color=blue><u>midPoint@lists.evolveum.com</u></font></tt></a><tt><font size=3><br>
</font></tt><a href=http://lists.evolveum.com/mailman/listinfo/midpoint><tt><font size=3 color=blue><u>http://lists.evolveum.com/mailman/listinfo/midpoint</u></font></tt></a><tt><font size=3><br>
</font></tt>
<br>
<br><tt><font size=3>-- <br>
Ing. Ivan Noris<br>
Senior Identity Management Engineer & IDM Architect<br>
evolveum.com
evolveum.com/blog/<br>
___________________________________________________<br>
"Semper Id(e)M Vix."<br>
</font></tt><tt><font size=2>_______________________________________________<br>
midPoint mailing list<br>
midPoint@lists.evolveum.com<br>
</font></tt><a href=http://lists.evolveum.com/mailman/listinfo/midpoint><tt><font size=2>http://lists.evolveum.com/mailman/listinfo/midpoint</font></tt></a><tt><font size=2><br>
</font></tt>
<br><BR/><p>
See you at the 2015 Air Transport IT Summit, Brussels, 16-18 June
Click here to register your place now.. http://www.sitasummit.aero/
This document is strictly confidential and intended only for use by the
addressee unless otherwise stated. If you are not the intended recipient,
please notify the sender immediately and delete it from your system.
</p>