<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:rgb(68,68,68)">Hi guys, I have a working AD LDAP resource. The group association has tolerant flag in false. So when I reconcile the user, it removes the user's group memberships found in AD and not in midPoint. I'd like to apply a filter there because midPoint only sees groups under a specific organization unit. So when the user has groups outside this OU they are also removed.</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:rgb(68,68,68)"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:rgb(68,68,68)">I tried with a baseContext definition under the schemaHandling and protected definition but nothing worked.</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:rgb(68,68,68)"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:rgb(68,68,68)">Here are some examples of protected configurations I have tried:</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:rgb(68,68,68)"><br></div><div class="gmail_default"><div class="gmail_default"><font color="#444444" face="monospace, monospace"><protected></font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"> <filter></font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"> <not></font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"> <q:substring></font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"> <q:matching>stringIgnoreCase</q:matching></font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"> <q:path></font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"> declare namespace icfs="<a href="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3">http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3</a>";</font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"> attributes/icfs:name</font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"> </q:path></font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"> <q:value>OU=Grupos_Seguridad,OU=Uninorte,DC=uninorte,DC=local</q:value></font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"> <q:anchorEnd>true</q:anchorEnd></font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"> </q:substring></font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"> </not></font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"> </filter></font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"></protected></font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"><br></font></div><div class="gmail_default"><font color="#444444" face="arial, helvetica, sans-serif">The above example tries to match any groups not ending with the managed OU.</font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"><br></font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"><protected></font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"> <filter></font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"> <q:equal></font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"> <path>ri:dn</path></font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"> <value>CN=Domain Admins,DC=uninorte,DC=local</value></font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"> </q:equal></font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"> </filter></font></div><div class="gmail_default"><font color="#444444" face="monospace, monospace"></protected></font></div></div><div><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><font face="arial, helvetica, sans-serif"><br></font></div><div dir="ltr"><font face="arial, helvetica, sans-serif"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:rgb(68,68,68);display:inline">This tries to match specific group.</div></font></div><div dir="ltr"><font face="arial, helvetica, sans-serif"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:rgb(68,68,68);display:inline"><br></div></font></div><div dir="ltr"><font face="arial, helvetica, sans-serif"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:rgb(68,68,68);display:inline">Do you have any suggestion ?</div></font></div><div dir="ltr"><font face="arial, helvetica, sans-serif"><font color="#444444"><br></font></font></div><div dir="ltr"><font face="arial, helvetica, sans-serif"><font color="#444444"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:rgb(68,68,68);display:inline">Best regards,</div></font></font></div><div dir="ltr"><font face="arial, helvetica, sans-serif"><font color="#444444"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:rgb(68,68,68);display:inline"></div><br></font><br><font color="#444444">Ing Nicolás Rossi</font><br><font color="#999999">Identicum S.A.</font><br><font color="#999999">Jorge Newbery 3226</font><br><font color="#999999">Tel: +54 (11) 4552-3050</font><br><font color="#999999"><a href="http://www.identicum.com" target="_blank">www.identicum.com</a></font></font><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
</div>