<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
HI MiSo,<br>
<br>
yes, it's possible, but be advised that the number of the groups
will be at least the number of your users...<br>
<br>
If it's really what you want, the concept is quite simple:<br>
<br>
1. synchronization from AD will create User in midPoint<br>
2. (default) user template will assign a role e.g. "Basic LDAP" to
each User in midPoint (or whatever conditions you specify)<br>
3. "Basic LDAP" role will have <b>two inducements/construction to
create </b><b>two</b><b> objects in LDAP</b>:<br>
- kind: account, intent: default: to create user account in LDAP<br>
- kind: entitlement, intent: usergroup: to create a group for each
account in LDAP (the intent value can be anything you wish)<br>
4. the LDAP resource needs two <objectType> parts in
<schemaHandling> (and probably also two
<objectSynchronization> parts in <synchronization>) to
define rules for:<br>
- kind: account, intent: default, objectClass:
ri:AccountObjectClass (you should have this already if you are
creating any accounts)<br>
- kind: entitlement, intent: usergroup, objectClass:
ri:GroupObjectClass<br>
<br>
In the entitlement/usergroup part of schema handling, you need to
define mappings for at least all mandatory LDAP attributes, so at
least DN (icfs:name for pre-3.2 midPoint LDAP connector) and CN.
There you can define any suffix you want and use e.g.:<br>
<br>
<attribute><br>
<ref>icfs:name</ref><br>
<matchingRule>mr:stringIgnoreCase</matchingRule><br>
<outbound><br>
<source><br>
<path>$focus/name</path><br>
</source><br>
<expression><br>
<script><br>
<code> <!-- for user <b>jsmith</b>,
the group DN is <b>CN=usergroup-jsmith,OU=groups,dc=example,dc=com</b>
--><br>
tmpSuffix = 'OU=groups,dc=example,dc=com'<br>
return 'CN=usergroup-' + name' + ',' + tmpSuffix<br>
</code><br>
</script><br>
</expression><br>
</outbound><br>
</attribute><br>
<br>
<attribute><br>
<ref>ri:cn</ref><br>
<matchingRule>mr:stringIgnoreCase</matchingRule><br>
<outbound><br>
<strength>weak</strength><br>
<source><br>
<path>$focus/name</path><br>
</source><br>
<expression><br>
<script><br>
<code> <!-- for user <b>jsmith</b>,
the group CN is <b>usergroup-jsmith</b> --><br>
return 'usergroup-' + name'<br>
</code><br>
</script><br>
</expression><br>
</outbound><br>
</attribute><br>
<br>
(You don't need the "usergroup-" concatenation if you wish to have
the group name equal to username in midPoint. This is just a
modified example from one of my mappings.)<br>
<br>
As new user is created in midPoint and user template mapping which
assigns the "Basic LDAP" role is evaluated, two objects will be
created in LDAP.<br>
<br>
Regards,<br>
Ivan<br>
<br>
<div class="moz-cite-prefix">On 07/28/2015 07:54 PM, Steklac Michal
wrote:<br>
</div>
<blockquote cite="mid:1438106072.3612.2.camel@steky" type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="GENERATOR" content="GtkHTML/4.6.6">
Hi,<br>
<br>
I have configuration where AD is authoritative source for users.
When is user create in AD then is create user in LDAP (in midpoint
terminology account). It is possible create group in different
ldap subtree with same name? What is best way?<br>
Example:<br>
AD - cn=Janko Hrasko,ou=midpoint,dc=sk with sAMAccountName=jhrasko<br>
LDAP user - uid=jhrasko,ou=people,ou=midpoint,dc=sk<br>
LDAP group - cn=jhrasko,ou=group,ou=midpoint,dc=sk<br>
<br>
Thanks & Best regards<br>
MiSo
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
midPoint mailing list
<a class="moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a>
<a class="moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Ing. Ivan Noris
Senior Identity Management Engineer & IDM Architect
evolveum.com evolveum.com/blog/
___________________________________________________
"Semper Id(e)M Vix."
</pre>
</body>
</html>