<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-15">
<style type="text/css" style="display:none"><!--P{margin-top:0;margin-bottom:0;} p
{margin-top:0;
margin-bottom:0}p
{margin-top:0;
margin-bottom:0}--></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Hi Pavol,<br>
I am actually not sure should it be user template selection or GUI itselt which needs improvements. My aim was actually to limit somehow user creation attributes, like when organization X user creates new user then s/he can create new users only for organization
X (or some list of organizations if user has more rights). That means the created user should have organization attribute set to value X.
<br>
</p>
<p>I actually tried to implement this with authorization roles and succeeded to create role with following authorizations:<br>
<span style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"> <authorization></span></span></span><br style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);">
<span style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"> <description>Allows adding users - request phase</description></span></span></span><br style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);">
<span style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"> <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add</action></span></span></span><br style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);">
<span style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"> <phase>request</phase></span></span></span><br style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);">
<span style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"> <object></span></span></span><br style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);">
<span style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"> <type>UserType</type></span></span></span><br style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);">
<span style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"> </object></span></span></span><br style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);">
<span style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"> </authorization></span></span></span><br style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);">
<span style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"> <authorization></span></span></span><br style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);">
<span style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"> <description>Allows adding users - execution phase</description></span></span></span><br style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);">
<span style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"> <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add</action></span></span></span><br style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);">
<span style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"> <phase>execution</phase></span></span></span><br style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);">
<span style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"> <object></span></span></span><br style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);">
<span style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"> <type>UserType</type></span></span></span><br style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);">
<span style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"> <filter></span></span></span><br style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);">
<span style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"> <q:equal></span></span></span><br style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);">
<span style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"> <q:path>organization</q:path></span></span></span><br style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);">
<span style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"> <q:value>X</q:value></span></span></span><br style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);">
<span style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"> </q:equal></span></span></span><br style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);">
<span style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"> </filter></span></span></span><br style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);">
<span style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"> </object></span></span></span><br style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);">
<span style="font-family: Consolas,monospace; font-size: 10pt; color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"><span style="color: rgb(0, 111, 201);"> </authorization></span></span></span><br>
<br>
This seems to work. If I want to widen it to other organizations then I just have to create different authorization roles for each organization which would not be a problem.<br>
What I don't like here is that when user "accountmanagerorgX" who has role with these authorizations creates new user "newtestuser" and forgets to fill in the organization field then midPoint just reports error message:
<br>
<br>
<span style="color: rgb(255, 0, 0);">User ''accountmanagerorgX'' not authorized for operation http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add on user:null(newtestuser)</span><br>
<br>
There is no information for creator that s/he did not fill in the organization field. So my point is that there should be some kind of policy or GUI check which controls user creation form and either pre-fills the required organization value (and makes it read-only)
or informs the creator during filling in the user form that organization field value is missing or wrong or is not in accepted range.<br>
</p>
<p><br>
</p>
<p>Regards,</p>
<p>Aivo Kuhlberg</p>
<div style="color:rgb(33,33,33)">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" color="#000000" face="Calibri, sans-serif"><b>Saatja:</b> midPoint <midpoint-bounces@lists.evolveum.com> nimelPavol Mederly <mederly@evolveum.com><br>
<b>Saadetud:</b> 21. september 2016 11:40<br>
<b>Adressaat:</b> midpoint@lists.evolveum.com<br>
<b>Teema:</b> Re: [midPoint] Object templates</font>
<div> </div>
</div>
<div>
<p>Hello Aivo,</p>
<p><br>
</p>
<p>I'm afraid we can select user templates based on employeeType attribute only. (I don't have experiences with property constraints. Having looked at the code, it is used to set OID for newly created objects based on a value of selected property. Looks like
it is of no use for you in your scenario.)</p>
<p><br>
</p>
<p>But I think your requirement is very reasonable; maybe you could implement it yourself by changing ModelUtils.determineObjectPolicyConfiguration methods (beware, there are more of them) or you could log a JIRA for this.</p>
<p><br>
</p>
<p>Best regards,<br>
</p>
<pre class="moz-signature" cols="72">Pavol Mederly
Software developer
evolveum.com
</pre>
<div class="moz-cite-prefix">On 20.09.2016 16:29, Aivo Kuhlberg wrote:<br>
</div>
<blockquote type="cite"><style type="text/css" style="">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<p>When I set defaultObjectPolicyConfiguration for UserType in midPoint 3.4.1 then it is set for all users. Is it possible somehow make it more flexible, eg use several user templates depending on some user parameter. I wanted to test if I can configure different
user attribute limitations when creating users in different organizations.<br>
</p>
<p><br>
</p>
<p>I noticed also that there is a parameter "Property constraint" in "Edit Object Policy" dialog but I did not find much information what is it used for.<br>
</p>
<p><br>
</p>
<p>Thanks,</p>
<p>Aivo Kuhlberg<br>
</p>
<br>
<hr>
<font size="2" color="Gray" face="Arial">Käesolev e-kiri võib sisaldada asutusesiseseks kasutamiseks tunnistatud teavet.<br>
This e-mail may contain information which is classified for official use.</font> <br>
<fieldset class="mimeAttachmentHeader"></fieldset> <br>
<pre>_______________________________________________
midPoint mailing list
<a class="moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a>
<a class="moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
</blockquote>
<br>
</div>
</div>
<br>
<hr>
<font face="Arial" color="Gray" size="2">Käesolev e-kiri võib sisaldada asutusesiseseks kasutamiseks tunnistatud teavet.<br>
This e-mail may contain information which is classified for official use.</font>
</body>
</html>