<div dir="ltr">Hi Patrick,<div><br></div><div>is there a workaround for this. </div><div>You can import the list of LDAP role names to the new multi-valued extension user attribute, and create user object template to read this value, search for the role by name and create the user-role assignment in the script.</div><div><br></div><div>Similar but for orgs you can see here:</div><div><a href="http://lists.evolveum.com/pipermail/midpoint/2016-June/002013.html">http://lists.evolveum.com/pipermail/midpoint/2016-June/002013.html</a></div><div>In this sample, the user extension name is <span style="color:rgb(0,0,0);white-space:pre-wrap">extension/namesOfOrgs where are orgs names imported.</span></div><div><font color="#000000"><span style="white-space:pre-wrap">You need to change </span></font><span style="color:rgb(0,0,0);white-space:pre-wrap">OrgType* to RoleType* in your case.</span></div><div><font color="#000000"><span style="white-space:pre-wrap"><br></span></font></div><div><font color="#000000"><span style="white-space:pre-wrap">Best regards,</span></font></div><div><font color="#000000"><span style="white-space:pre-wrap"><br></span></font></div><div><font color="#000000"><span style="white-space:pre-wrap">Gustav</span></font></div><div><font color="#000000"><span style="white-space:pre-wrap"><br></span></font><div class="gmail_extra"><br><div class="gmail_quote">2016-08-30 16:19 GMT+02:00 Radovan Semancik <span dir="ltr"><<a href="mailto:radovan.semancik@evolveum.com" target="_blank">radovan.semancik@evolveum.com</a><wbr>></span>:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
Hi,<br>
<br>
There is currently no easy way how to do this. This is one of the
issues that are waiting for funding or contribution. Please see:<br>
<a href="https://jira.evolveum.com/browse/MID-2104" target="_blank">https://jira.evolveum.com/brow<wbr>se/MID-2104</a><br>
<a href="https://jira.evolveum.com/browse/MID-2103" target="_blank">https://jira.evolveum.com/brow<wbr>se/MID-2103</a><br>
<br>
What you can do about it is described here:
<a href="https://wiki.evolveum.com/display/midPoint/I+Need+New+Feature" target="_blank">https://wiki.evolveum.com/disp<wbr>lay/midPoint/I+Need+New+Featur<wbr>e</a><br>
<br>
These features would be really useful and they are waiting for some
time already ...<br>
In the meantime you can probably do some magic with scripting hooks
(<a href="https://wiki.evolveum.com/display/midPoint/Scripting+Hooks" target="_blank">https://wiki.evolveum.com/dis<wbr>play/midPoint/Scripting+Hooks</a>) but
that is not an easy approach and it definitely is not the right one.
The correct approach would be to develop the necessary features.<span><font color="#888888"><br>
<br>
<pre cols="72">--
Radovan Semancik
Software Architect
<a href="http://evolveum.com" target="_blank">evolveum.com</a>
</pre></font></span><span>
<br>
<br>
<div>On 08/30/2016 01:09 AM,
<a href="mailto:pdbogen@cernu.us" target="_blank">pdbogen@cernu.us</a> wrote:<br>
</div>
</span><blockquote type="cite"><span>
<pre>Howdy!
I have MidPoint set up to create users and roles from the inetOrgPersons and
groupOfMembers in OpenLDAP, respectively.
GroupOfMembers are created using a template that assigns a meta-role that
induces a 2nd order assignment of the correct entitlement- so in other words,
assigning the role in midpoint correctly associates the entitlement, and
changes LDAP properly.
My concern right now is the other direction- maybe just for initial import,
maybe ongoing; I'd like new associations from LDAP to add the role to the
affected account.
I.e., if cn=patrick is added to role cn=midpoint.admin in LDAP, the
corresponding 'patrick' user in MidPoint should be assigned the
'midpoint.admin' role.
I think they may be a concept I'm missing to implement this, so I'm not sure
if anything is 'wrong' at this stage.
Thoughts? What information can I provide to help figure this out?
Thanks!
</pre>
<br>
<fieldset></fieldset>
<br>
</span><span><pre>______________________________<wbr>_________________
midPoint mailing list
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" target="_blank">http://lists.evolveum.com/mail<wbr>man/listinfo/midpoint</a>
</pre>
</span></blockquote>
<br>
</div>
<br>______________________________<wbr>_________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/mail<wbr>man/listinfo/midpoint</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div data-smartmail="gmail_signature"><div dir="ltr"><div>Gustáv Pálos</div><div>Identity Engineer</div><a href="http://evolveum.com/" rel="noreferrer" style="color:rgb(17,85,204);font-size:12.8px" target="_blank">evolveum.com</a><br></div></div>
</div></div></div>