<div dir="ltr">Another note if you want those roles populated with current members from AD, you would need to create an inbound sync for groups from AD which then gets assigned the correct role in midpoint. This is not currently supported in midpoint but I do have a work around, might not be the best way to do it but it does work.<div><br></div><div>See my post, <a href="http://lists.evolveum.com/pipermail/midpoint/2016-September/002503.html">http://lists.evolveum.com/pipermail/midpoint/2016-September/002503.html</a> , using AD .NET connector but even with the new AD LDAP connector it should work the same, just different attribute, maybe ri:memberOf ? Haven't used the connector yet so not sure. One caveat, it only works on reconcile, not live sync. I have within the default objectTemplate to assign a role based on the group name.</div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">JASON</div></div></div>
<br><div class="gmail_quote">On Tue, Dec 13, 2016 at 1:58 AM, Ivan Noris <span dir="ltr"><<a href="mailto:ivan.noris@evolveum.com" target="_blank">ivan.noris@evolveum.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<p>Hi,</p>
<p>if you open your role in midPoint, you can see its members in
"Members" tab. Both direct and indirect members should be
displayable. So you can see who has the role assigned.<br>
</p>
<p>It's not possible yet to make a report which uses resource data,
i.e. "show all users in midPoint, which have account in AD with
attribute XY". As we do not store resource account attributes, the
data would need to be fetche during such report. This is not
implemented yet.<br>
</p>
Regards,<br>
Ivan<div><div class="h5"><br>
<br>
<div class="m_-6044116893359156654moz-cite-prefix">On 12/12/2016 04:57 PM, m.benucci
wrote:<br>
</div>
</div></div><blockquote type="cite"><div><div class="h5">
<div style="font:normal 13px Arial;color:rgb(0,0,0)"><font face="DejaVu Sans">Hi,<br>
I have imported users from an Active Directory and <br>
I have successfully synchronized AD groups with midPoint roles
using a metarole.<br>
Provisioning and Synchronization seems to works well.<br>
<br>
Now, given a midPoint Role (an AD entitlement), </font><font face="DejaVu Sans"><font face="DejaVu Sans"> I would like to
know </font>if is possible to know who is assigned to this
role (e.g. I would like to know from midPoint who is assigned
to the role/entitlement "Domain Admin").<br>
<br>
I suppose I necessarily need to assign the role to an user to
see if he is a member of it, is there a way to automate this
assignment process?<br>
<br>
<br>
Thank you.<br>
</font></div>
<br>
<fieldset class="m_-6044116893359156654mimeAttachmentHeader"></fieldset>
<br>
</div></div><pre>______________________________<wbr>_________________
midPoint mailing list
<a class="m_-6044116893359156654moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a>
<a class="m_-6044116893359156654moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint" target="_blank">http://lists.evolveum.com/<wbr>mailman/listinfo/midpoint</a><span class="HOEnZb"><font color="#888888">
</font></span></pre><span class="HOEnZb"><font color="#888888">
</font></span></blockquote><span class="HOEnZb"><font color="#888888">
<br>
<pre class="m_-6044116893359156654moz-signature" cols="72">--
Ivan Noris
Senior Identity Engineer
<a href="http://evolveum.com" target="_blank">evolveum.com</a>
</pre>
</font></span></div>
<br>______________________________<wbr>_________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/<wbr>mailman/listinfo/midpoint</a><br>
<br></blockquote></div><br></div>
<br>
<font size="2"><br><br>CONFIDENTIALITY NOTICE:<br>This e-mail together with any attachments is proprietary and confidential; intended for only the recipient(s) named above and may contain information that is privileged. You should not retain, copy or use this e-mail or any attachments for any purpose, or disclose all or any part of the contents to any person. Any views or opinions expressed in this e-mail are those of the author and do not represent those of the Baptist School of Health Professions. If you have received this e-mail in error, or are not the named recipient(s), you are hereby notified that any review, dissemination, distribution or copying of this communication is prohibited by the sender and to do so might constitute a violation of the Electronic Communications Privacy Act, 18 U.S.C. section 2510-2521. Please immediately notify the sender and delete this e-mail and any attachments from your computer. </font><br>