<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Hello Aivo,</p>
<p><br>
</p>
<p>it's probably possible. <br>
</p>
<p><br>
</p>
<p>If there would not be point #4 (hierarchical aspect), your
configuration could be implemented by inducements defined at
various points in the org tree.</p>
<p><br>
</p>
<p>But point #4 requires more elaborate solution. I would suggest
trying something like this:</p>
<p><br>
</p>
<p>- create a user template containing the following mapping:</p>
<p> - source: parentOrgRef<br>
</p>
<p> - target: assignment</p>
<p> - code: something like: <br>
</p>
<p> - take all parentOrgRefs</p>
<p> - iteratively compute a transitive closure, adding their
parents, grand-parents, etc, up to the root(s) of the hierarchy</p>
<p> - collect all inducements of these orgs, and use them as the
result of this mapping</p>
<p> (mapping should be declared as 'absolute', not 'relative' one)</p>
<p><br>
</p>
<p>Actually I'm not convinced it will work, but ... it's worth a
try, maybe (giving it ~ 60% chance...)<br>
</p>
<p><br>
</p>
<p>Inherent limitation of this solution is that it's not able to
distinguish which assignments are 'manual' and which are
'automatic'. I.e. in case that something goes really wrong, we are
not able to run something like 'total recomputation' which would
delete all automatic asssignments that are no longer appropriate.
This would need to be hacked by running a bulk action that would
first eliminate all 'automatic' assignments from a given user, and
then run a recomputation to provide valid ones.<br>
</p>
<p><br>
</p>
<p>Another caveat is the order of evaluation of these mappings and
existing assignments. This would need to be experimented as well.</p>
<p><br>
</p>
<p>And, as for #3, in both scenarios (hierarchical or
non-hierarchical), user recomputation would be needed.</p>
<p><br>
</p>
<p>Maybe someone could propose a better solution...<br>
</p>
<p><br>
</p>
<p>Best regards,<br>
</p>
<p>Pavol<br>
</p>
<br>
<div class="moz-cite-prefix">On 14.06.2016 13:36, Aivo Kuhlberg
wrote:<br>
</div>
<blockquote cite="mid:1465904177477.66673@rmit.ee" type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none"><!--P{margin-top:0;margin-bottom:0;} --></style>
<p>Hi,<br>
I would like to create automatic role assignments for users
based on the organization unit where each user belongs to. The
mechanism should have following functionality:<br>
</p>
<ol>
<li>When user is added to midPoint s/he will get automatic roles
assigned based on the org unit where s/he belongs.<br>
</li>
<li>When user moves to another organization unit then the
automatic roles should be reassigned (old org unit automatic
roles removed and new org unit automatic roles assigned).</li>
<li>When existing automatic role is added/changed/deleted the
change should be reflected in all users' automatic roles.</li>
<li>Automatic role assignments should be related with
organization hierarchy - eg. top-level org automatic role A
will be assigned to all users who belong to top-level and its
child organizations. Child org automatic role B should be
assigned to only child org users.<br>
</li>
</ol>
<p>Is it possible to implement this setup or at last part of it in
midPoint 3.3.1 (or 3.4)? What is the suggested way to implement
this?</p>
<p><br>
Thanks,<br>
</p>
<p>Aivo Kuhlberg<br>
</p>
<br>
<hr>
<font face="Arial" color="Gray" size="2">Käesolev e-kiri võib
sisaldada asutusesiseseks kasutamiseks tunnistatud teavet.<br>
This e-mail may contain information which is classified for
official use.</font>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
midPoint mailing list
<a class="moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a>
<a class="moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
</blockquote>
<br>
</body>
</html>