<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hi,<br>
<br>
It is not only possible. It is something that midPoint was designed
for. Just use MidPoint authorization system:<br>
<br>
<a class="moz-txt-link-freetext" href="https://wiki.evolveum.com/display/midPoint/Authorization+Configuration">https://wiki.evolveum.com/display/midPoint/Authorization+Configuration</a><br>
<br>
You can also find many examples for authorizations in our
integration tests:<br>
<br>
<a class="moz-txt-link-freetext" href="https://github.com/Evolveum/midpoint/tree/master/model/model-intest/src/test/resources/security">https://github.com/Evolveum/midpoint/tree/master/model/model-intest/src/test/resources/security</a><br>
<br>
E.g. this is how you restrict which roles are assignable:<br>
<br>
<a class="moz-txt-link-freetext" href="https://github.com/Evolveum/midpoint/blob/master/model/model-intest/src/test/resources/security/role-assign-application-roles.xml">https://github.com/Evolveum/midpoint/blob/master/model/model-intest/src/test/resources/security/role-assign-application-roles.xml</a><br>
<br>
MidPoint orgs also act as roles. So if you want to allow members of
some org to request some set of roles just put that authorization
directly into the org.<br>
<br>
<pre class="moz-signature" cols="72">--
Radovan Semancik
Software Architect
evolveum.com
</pre>
<br>
<br>
<br>
<div class="moz-cite-prefix">On 08/03/2016 03:06 PM, Grzegorz
Lechowicz wrote:<br>
</div>
<blockquote cite="mid:1470229572.17427.2@mail.enigma.com.pl"
type="cite">Hi everyone,
<div><br>
</div>
<div>I'm just testing MidPoint IDM 3.4 and I try to do some basic
tests to see if it fit in our company requirements.</div>
<div>The one of the requirements is to prevent users from seeing
all the roles available in organization. For example 'role 01'
should only be available to request in organization 'org 01' and
role 'role 02' should only be visible in 'org 02' organization.</div>
<div><br>
</div>
<div>So just to clarify: user that belongs to 'org 01' should only
see role 'role 01' and not 'role 02'.</div>
<div><br>
</div>
<div>Is it possible?</div>
<div><br>
</div>
<div>regards</div>
<div>theGrzeniek</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
midPoint mailing list
<a class="moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a>
<a class="moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
</blockquote>
<br>
</body>
</html>