<html><body><div style="font-family: times new roman, new york, times, serif; font-size: 12pt; color: #000000"><div>Hi Carlos,<br></div><div>I may be completely wrong, but for a different (custom) connector, we needed to do something like this:<br></div><div><br></div><div> <attribute><br> <description>We want the connector have ALL values, not only delta</description><br> <ref>ri:roles</ref><br> <readReplaceMode>true</readReplaceMode><br> </attribute><br><br></div><div>(It was maybe half year ago, I don't remember the particular details now, except that the "ri:roles" was a multi-valued attribute, not association).<br></div><div>Maybe this helps or brings new answers from the other members of this list.<br></div><div><br></div><div>Regards,<br></div><div>Ivan<br></div><div><br></div><hr id="zwchr"><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;" data-mce-style="border-left: 2px solid #1010FF; margin-left: 5px; padding-left: 5px; color: #000; font-weight: normal; font-style: normal; text-decoration: none; font-family: Helvetica,Arial,sans-serif; font-size: 12pt;"><b>From: </b>"Carlos Ferreira" <carlos18619@gmail.com><br><b>To: </b>"midPoint General Discussion" <midpoint@lists.evolveum.com><br><b>Sent: </b>Saturday, October 8, 2016 12:46:59 AM<br><b>Subject: </b>Re: [midPoint] DatabaseTable Multi-Value Fields<br><div><br></div><div dir="ltr">HI,<br><div><br>This is exactly the same behavior I've been seeing im my case.<br><div><br></div></div><div>First of all,<br><div><br></div></div><div>1. I'm using SCRIPTEDSQL connector and an ORACLE DB;<br></div><div>2. I've configured a multi-valued extension attribute - says 'roles' - to receive the roles applied to an user;<br></div><div>3. Configured a metarole to deal with an association. Something like this:<br><div><br></div> <inducement id="3"><br> <construction><br> <resourceRef xmlns:tns="<a href="http://midpoint.evolveum.com/xml/ns/public/common/common-3" target="_blank" data-mce-href="http://midpoint.evolveum.com/xml/ns/public/common/common-3">http://midpoint.evolveum.com/xml/ns/public/common/common-3</a>"<br> oid="ef2bc95b-76e0-48e3-86db-3d4f02d42fff"<br> type="tns:ResourceType"><!-- Localhost ScriptedSQL - Oracle --></resourceRef><br> <kind>account</kind><br> <intent>default</intent><br> <association><br> <c:ref>ri:priv</c:ref><br> <outbound><br> <expression><br> <associationFromLink><br> <projectionDiscriminator><br> <kind>entitlement</kind><br> <intent>privilege</intent><br> </projectionDiscriminator><br> </associationFromLink><br> </expression><br> </outbound><br> </association><br> </construction><br> <order>2</order><br> </inducement><br><div><br></div></div><div>4. Made the necessary adjustments on the resource to cope with the association. Like this:<br><div><br></div> <association><br> <c:ref>ri:priv</c:ref><br> <kind>entitlement</kind><br> <intent>privilege</intent><br> <direction>subjectToObject</direction><br> <associationAttribute>ri:roles</associationAttribute><br> <valueAttribute>icfs:name</valueAttribute><br> </association><br><div><br></div></div><div>As to help me understand what goes through the connector, I added some lines in the beginning of 'UpdateScript.groovy' script:<br><div><br></div><br></div><div>def now = new Date()<br><div><br></div>def file1 = new File('/var/opt/midpoint/icf-connectors/oracle/update.log');<br>if (file1.exists()) {<br> file1.delete()<br>}<br>file1 << "Update test" << "\n"<br>file1 << "Date = $now" << "\n"<br>file1 << "objectClass = ${objectClass}"<< "\n"<br>file1 << "action = $action" << "\n"<br>file1 << "attributes = ${attributes}" << "\n"<br>file1 << "options = $options" << "\n"<br>file1 << "uid = $uid" << "\n"<br><div><br></div></div><div>No matter if I update the current role applied to an user or add another one (as the attribute is multivalued), the result comes like this:<br><div><br></div>Update test<br>Date = Fri Oct 07 19:28:07 BRT 2016<br>objectClass = __ACCOUNT__<br>action = UPDATE<br>attributes = [roles:[role1]]<br>options = [:]<br>uid = 161<br><div><br></div></div><div>or<br><div><br></div>Update test<br>Date = Fri Oct 07 19:29:07 BRT 2016<br>objectClass = __ACCOUNT__<br>action = UPDATE<br>attributes = [roles:[role2]]<br>options = [:]<br>uid = 161<br><div><br></div></div><div>when, in my opinion, it should be, for example,<br><div><br></div>Update test<br>Date = Fri Oct 07 19:29:07 BRT 2016<br>objectClass = __ACCOUNT__<br>action = UPDATE<br>attributes = [roles:[role1,role2]]<br>options = [:]<br>uid = 161<br></div><div><br></div><div><br></div><div>It seems as the connector treats the "roles" attribute as a single-valued one.<br><div><br></div><br></div><div>Carlos A. Ferreira<br></div><div>TRT/MG<br></div><div>Brasil<br></div><div class="gmail_extra"><br></div></div><br>_______________________________________________<br>midPoint mailing list<br>midPoint@lists.evolveum.com<br>http://lists.evolveum.com/mailman/listinfo/midpoint<br></blockquote><div><br><br></div><div><br></div><div>-- <br></div><div><span name="x"></span>Ivan Noris<br>Senior Identity Engineer<br>evolveum.com<span name="x"></span><br></div></div></body></html>