<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-15">
<style type="text/css" style="display:none"><!--P{margin-top:0;margin-bottom:0;} p
{margin-top:0;
margin-bottom:0}--></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Hi,<br>
</p>
<p>I have question about one syncing situation. I import users from CSV-file and use Exchange connector to sync both AD/Exchange user accounts and groups (as roles). I am testing following situation:<br>
</p>
<p></p>
<ol>
<li>I create a new group "testgroup" in AD</li><li>I run reconciliation of AD groups and I see that new midPoint role "testgroup" is created from AD group.</li><li>Now I assign this newly created role to midPoint user "testuser". I see that the same AD user account is now group member of testgroup in AD.</li><li>Now I delete in AD group testgroup. This should be OK as midPoint is able to restore deleted AD group and its members.</li><li>After that I do import of users from CSV file. I understand this is unusual situation and I probably should have done before that reconciliation of AD groups and users but I just wanted to see what happens. What happens is that after CSV file import AD
group is restored in AD but AD user is not member of this group. Another thing what happens is that I see following error:</li></ol>
<p><span style="color: rgb(189, 19, 152);"><span style="color: rgb(189, 19, 152);"><span style="color: rgb(189, 19, 152);">2016-06-06 15:04:01,881 [RESOURCE_OBJECT_CHANGE_LISTENER] [midPointScheduler_Worker-7] ERROR (com.evolveum.midpoint.model.impl.lens.ChangeExecutor):
Error executing changes for (entitlement (group) on resource:c2c5a39d-44ca-4b84-8cba-82e906cf3564(Exchange)): Couldn't add object. Object already exists: Object already exists on the resource: org.identityconnectors.framework.common.exceptions.AlreadyExistsException(The
object already exists.??: when creating LDAP://server.my.domain/CN=testgroup,OU=Service1,OU=Services,OU=TEST2,DC=my,DC=domain)->org.identityconnectors.framework.impl.api.remote.RemoteWrappedException(The object already exists.??: when creating LDAP://server.my.domain/CN=testgroup,OU=Service1,OU=Services,OU=TEST2,DC=my,DC=domain)
</span></span></span><br style="color: rgb(255, 0, 0);">
<span style="color: rgb(255, 0, 0);"></span><br>
When I look at the shadow information of testgroup and testuser then I see that they have now following attributes:
<br>
For testgroup:<br>
<span style="color: rgb(0, 111, 201); font-family: Consolas,monospace; font-size: 11pt;"><dead>true</dead></span><br style="color: rgb(0, 111, 201); font-family: Consolas,monospace; font-size: 11pt;">
<span style="color: rgb(0, 111, 201); font-family: Consolas,monospace; font-size: 11pt;"><synchronizationSituation>deleted</synchronizationSituation></span><br>
<br>
and for testuser:<br>
<span style="color: rgb(0, 111, 201); font-family: Consolas,monospace; font-size: 11pt;"><dead>true</dead></span><br style="color: rgb(0, 111, 201); font-family: Consolas,monospace; font-size: 11pt;">
<span style="color: rgb(0, 111, 201); font-family: Consolas,monospace; font-size: 11pt;"><synchronizationSituation>linked</synchronizationSituation></span><br>
<br>
I have to fix this situation by deleting manually testgroup and testuser shadows and do reconciliation of AD groups and users.<br>
</p>
<p><br>
</p>
<p>Has anybody tested that situation and should midPoint 3.3.1 be able to resolve that situation automatically or is it too complex situation and I just have to avoid it by doing AD groups and users reconciliation every time before importing users fom CSV file?<br>
<br>
Thanks,<br>
Aivo Kuhlberg<br>
</p>
<br>
<hr>
<font face="Arial" color="Gray" size="2">Käesolev e-kiri võib sisaldada asutusesiseseks kasutamiseks tunnistatud teavet.<br>
This e-mail may contain information which is classified for official use.</font>
</body>
</html>