<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:rgb(68,68,68)">Hi, you have to add the association between Users and Groups. It's something like that:</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:rgb(68,68,68)"><br></div><div class="gmail_default"><div class="gmail_default"><div class="gmail_default"><font face="monospace, monospace"><association></font></div><div class="gmail_default"><font face="monospace, monospace"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><ref>ri:GroupObjectClass</ref></font></div><div class="gmail_default"><font face="monospace, monospace"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><kind>entitlement</kind></font></div><div class="gmail_default"><font face="monospace, monospace"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><intent>default</intent></font></div><div class="gmail_default"><font face="monospace, monospace"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><tolerant>false</tolerant></font></div><div class="gmail_default"><font face="monospace, monospace"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><direction>subjectToObject</direction></font></div><div class="gmail_default"><font face="monospace, monospace"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><associationAttribute>ri:groups</associationAttribute></font></div><div class="gmail_default"><font face="monospace, monospace"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><valueAttribute>icfs:uid</valueAttribute></font></div><div class="gmail_default"><font face="monospace, monospace"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><shortcutAssociationAttribute>ri:members</shortcutAssociationAttribute></font></div><div class="gmail_default"><font face="monospace, monospace"><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><shortcutValueAttribute>icfs:uid</shortcutValueAttribute></font></div><div class="gmail_default"><font face="monospace, monospace"></association></font></div><div class="gmail_default"><br></div><div class="gmail_default">You can find more information about the association and the tolerant parameter here: <a href="https://wiki.evolveum.com/display/midPoint/Entitlements#Entitlements-AssociationDefinition">https://wiki.evolveum.com/display/midPoint/Entitlements#Entitlements-AssociationDefinition</a></div><div class="gmail_default"><br></div><div class="gmail_default">Inside your Update script the operation should be ADD_ATTRIBUTE_VALUE for objectClass __ACCOUNT__ and the attribute received should be "groups":</div><div class="gmail_default"><br></div><div class="gmail_default"><div class="gmail_default"><font face="monospace, monospace"> case "ADD_ATTRIBUTE_VALUES":</font></div><div class="gmail_default"><font face="monospace, monospace"><br></font></div><div class="gmail_default"><span style="font-family:monospace,monospace"> if(objectClass == "__ACCOUNT__")</span><br></div><div class="gmail_default"><font face="monospace, monospace"> {</font></div><div class="gmail_default"><font face="monospace, monospace"> for(String group : attributes.get("groups"))</font></div><div class="gmail_default"><font face="monospace, monospace"> {</font></div><div class="gmail_default"><font face="monospace, monospace"> def existingEntitlement = sql.rows("SELECT 1 FROM UserGroups WHERE user_id=? AND group_id=?",[uid as String, group as String]);</font></div><div class="gmail_default"><font face="monospace, monospace"> if(existingEntitlement.isEmpty())</font></div><div class="gmail_default"><font face="monospace, monospace"> {</font></div><div class="gmail_default"><font face="monospace, monospace"> <a href="http://log.info">log.info</a>("Sample - Adding entitlement ${group} to user ${uid}");</font></div><div class="gmail_default"><font face="monospace, monospace"> sql.execute("insert into UserGroups (user_id, group_id) values (" + uid + "," + group + ")");</font></div><div class="gmail_default"><font face="monospace, monospace"> }</font></div><div class="gmail_default"><font face="monospace, monospace"> else</font></div><div class="gmail_default"><font face="monospace, monospace"> {</font></div><div class="gmail_default"><font face="monospace, monospace"> <a href="http://log.info">log.info</a>("Sample - Skipping assignment because user ${uid} already has group ${group}");</font></div><div class="gmail_default"><font face="monospace, monospace"> }</font></div><div class="gmail_default"><font face="monospace, monospace"> } </font></div><div class="gmail_default"><font face="monospace, monospace"> }</font></div></div><div class="gmail_default"><br></div><div class="gmail_default">You should also handle the REMOVE_ATTRIBUTE_VALUES with the same logic. Radovan and Ivan have helped us few weeks ago with the ScriptedSQL resource. You can find the conversation in the mailing list. I am sure it will help you too. </div><div class="gmail_default"><br></div><div class="gmail_default">Regards,</div></div></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:rgb(68,68,68)"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:rgb(68,68,68)"> </div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><font face="arial, helvetica, sans-serif"><br><br><font color="#444444">Ing Nicolás Rossi</font><br><font color="#999999">Identicum S.A.</font><br><font color="#999999">Jorge Newbery 3226</font><br><font color="#999999">Tel: +54 (11) 4552-3050</font><br><font color="#999999"><a href="http://www.identicum.com" target="_blank">www.identicum.com</a></font></font><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On Mon, Dec 12, 2016 at 7:11 PM, Wojciech Staszewski <span dir="ltr"><<a href="mailto:wojciech.staszewski@diagnostyka.pl" target="_blank">wojciech.staszewski@diagnostyka.pl</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello,<br>
<br>
I'm playing with ScriptedSQL resource, based on Evolveum example from Github.<br>
I'm able to list/add/remove users/groups and enable/disable accounts. Great.<br>
But now I want to apply an assignment (a group) to user. Unfortunately "Update_Script.groovy" is incomplete,<br>
ADD_ATTRIBUTE_VALUES and REMOVE_ATTRIBUTE_VALUES cases are empty.<br>
Where can I find some examples?<br>
<br>
Thanks a lot!<br>
WS<br>
______________________________<wbr>_________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/<wbr>mailman/listinfo/midpoint</a><br>
</blockquote></div><br></div>