<div dir="ltr">Yes, that was also an issue within the same email thread, <div><br></div><div><a href="https://jira.evolveum.com/browse/MID-2149">https://jira.evolveum.com/browse/MID-2149</a><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">JASON</div></div></div>
<br><div class="gmail_quote">On Mon, Jan 23, 2017 at 4:58 PM, Nicolas Rossi <span dir="ltr"><<a href="mailto:nrossi@identicum.com" target="_blank">nrossi@identicum.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_default"><font color="#444444" face="arial, helvetica, sans-serif">Hi Jason, we tried with your suggestion but it didn't work. We also tried the recommendation of @Martin setting the evaluationPhase with the same result. </font></div><div class="gmail_default"><font color="#444444" face="arial, helvetica, sans-serif"><br></font></div><div class="gmail_default"><font color="#444444" face="arial, helvetica, sans-serif">But doing this tests we found something interesting: if the role is assigned directly by OID it works fine, but if we use a filter based on an attributed calculated by the same user template it doesn't work.</font></div><div class="gmail_default"><font color="#444444" face="arial, helvetica, sans-serif"><br></font></div><div class="gmail_default"><font color="#444444" face="arial, helvetica, sans-serif">Working assignment:</font></div><div class="gmail_default"><font color="#444444" face="arial, helvetica, sans-serif"><br></font></div><div class="gmail_default"><div class="gmail_default" style="color:rgb(68,68,68)"><font face="monospace, monospace"> <mapping></font></div><div class="gmail_default" style="color:rgb(68,68,68)"><font face="monospace, monospace"> <strength>strong</strength></font></div><div class="gmail_default" style="color:rgb(68,68,68)"><font face="monospace, monospace"> <expression></font></div><div class="gmail_default" style="color:rgb(68,68,68)"><font face="monospace, monospace"> <assignmentTargetSearch></font></div><div class="gmail_default" style="color:rgb(68,68,68)"><font face="monospace, monospace"> <targetType>c:RoleType</<wbr>targetType></font></div><div class="gmail_default" style="color:rgb(68,68,68)"><font face="monospace, monospace"> <b><oid>00000000-0000-1de4-0004-<wbr>000000000003</oid></b></font></div><div class="gmail_default" style="color:rgb(68,68,68)"><font face="monospace, monospace"> </assignmentTargetSearch></font></div><div class="gmail_default" style="color:rgb(68,68,68)"><font face="monospace, monospace"> </expression></font></div><div class="gmail_default" style="color:rgb(68,68,68)"><font face="monospace, monospace"> <target></font></div><div class="gmail_default" style="color:rgb(68,68,68)"><font face="monospace, monospace"> <c:path>assignment</c:path></font></div><div class="gmail_default" style="color:rgb(68,68,68)"><font face="monospace, monospace"> </target></font></div><div class="gmail_default" style="color:rgb(68,68,68)"><font face="monospace, monospace"> </mapping></font></div><div class="gmail_default" style="color:rgb(68,68,68);font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="color:rgb(68,68,68);font-family:arial,helvetica,sans-serif">Assignment not propagated to the resource:</div><div class="gmail_default" style="color:rgb(68,68,68)"><font face="monospace, monospace"><br></font></div><div class="gmail_default"><font face="monospace, monospace"><font color="#444444"> </font><font color="#38761d"><!-- Calculate the employeeType value --></font></font></div><div class="gmail_default" style="color:rgb(68,68,68)"><font face="monospace, monospace"><div class="gmail_default"> <mapping></div><div class="gmail_default"> <strength>strong</strength></div><div class="gmail_default"> <expression></div><div class="gmail_default"> <value>FUNCIONARIO</value></div><div class="gmail_default"> </expression></div><div class="gmail_default"> <target></div><div class="gmail_default"> <c:path><b>employeeType</b></c:path></div><div class="gmail_default"> </target></div><div class="gmail_default"> </mapping></div><div class="gmail_default"><br></div><div class="gmail_default"> <span style="color:rgb(56,118,29)"><!-- Use the employeeType value to find the role --></span></div></font></div><div class="gmail_default" style="color:rgb(68,68,68)"><div class="gmail_default"><div class="gmail_default"><font face="monospace, monospace"> <mapping></font></div><div class="gmail_default"><font face="monospace, monospace"> <strength>strong</strength></font></div><div class="gmail_default"><font face="monospace, monospace"> <source></font></div><div class="gmail_default"><font face="monospace, monospace"> <c:path><b>employeeType</b></c:path></font></div><div class="gmail_default"><font face="monospace, monospace"> </source></font></div><div class="gmail_default"><font face="monospace, monospace"> <expression></font></div><div class="gmail_default"><font face="monospace, monospace"> <assignmentTargetSearch></font></div><div class="gmail_default"><font face="monospace, monospace"> <targetType>c:RoleType</<wbr>targetType></font></div><div class="gmail_default"><font face="monospace, monospace"> <b><filter></b></font></div><div class="gmail_default"><font face="monospace, monospace"><b> <q:equal></b></font></div><div class="gmail_default"><font face="monospace, monospace"><b> <q:path>c:identifier</q:path></b></font></div><div class="gmail_default"><font face="monospace, monospace"><b> <expression></b></font></div><div class="gmail_default"><font face="monospace, monospace"><b> <c:path>$employeeType</c:<wbr>path></b></font></div><div class="gmail_default"><font face="monospace, monospace"><b> </expression></b></font></div><div class="gmail_default"><font face="monospace, monospace"><b> </q:equal></b></font></div><div class="gmail_default"><font face="monospace, monospace"><b> </filter></b></font></div><div class="gmail_default"><font face="monospace, monospace"> </assignmentTargetSearch></font></div><div class="gmail_default"><font face="monospace, monospace"> </expression></font></div><div class="gmail_default"><font face="monospace, monospace"> <target></font></div><div class="gmail_default"><font face="monospace, monospace"> <c:path>assignment</c:path></font></div><div class="gmail_default"><font face="monospace, monospace"> </target></font></div><div class="gmail_default"><font face="monospace, monospace"> </mapping></font></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">If I remove the first mapping (to get the employeeType value) and create a new user with "FUNCIONARIO" as employeeType, it works fine. So I guess there is an issue when the user templates assign a value to a target attribute used by the role assignment rule. Any suggestions ?</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Regards,</div></div></div></div></div><div class="gmail_extra"><span class=""><br clear="all"><div><div class="m_-2237503311268770607gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><font face="arial, helvetica, sans-serif"><br><br><font color="#444444">Ing Nicolás Rossi</font><br><font color="#999999">Identicum S.A.</font><br><font color="#999999">Jorge Newbery 3226</font><br><font color="#999999">Tel: <a href="tel:+54%2011%204552-3050" value="+541145523050" target="_blank">+54 (11) 4552-3050</a></font><br><font color="#999999"><a href="http://www.identicum.com" target="_blank">www.identicum.com</a></font></font><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
<br></span><div><div class="h5"><div class="gmail_quote">On Mon, Jan 23, 2017 at 6:51 PM, Jason Everling <span dir="ltr"><<a href="mailto:jeverling@bshp.edu" target="_blank">jeverling@bshp.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><a href="http://lists.evolveum.com/pipermail/midpoint/2015-February/000883.html" target="_blank">http://lists.evolveum.com/pipe<wbr>rmail/midpoint/2015-February/<wbr>000883.html</a><span class="m_-2237503311268770607HOEnZb"><font color="#888888"><br></font></span></div><div class="gmail_extra"><span class="m_-2237503311268770607HOEnZb"><font color="#888888"><br clear="all"><div><div class="m_-2237503311268770607m_7286578353689553574gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">JASON</div></div></div></font></span><div><div class="m_-2237503311268770607h5">
<br><div class="gmail_quote">On Mon, Jan 23, 2017 at 3:44 PM, Jason Everling <span dir="ltr"><<a href="mailto:jeverling@bshp.edu" target="_blank">jeverling@bshp.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Yes, that is what the wording says BUT... in our case, we would assign the role automatically from template and the user would never be created on the resource until a recon was run. After changing to 'Positive' it pushes to the resource once the role is assigned.</div><div class="gmail_extra"><span class="m_-2237503311268770607m_7286578353689553574HOEnZb"><font color="#888888"><br clear="all"><div><div class="m_-2237503311268770607m_7286578353689553574m_7183375861711467014gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">JASON</div></div></div></font></span><div><div class="m_-2237503311268770607m_7286578353689553574h5">
<br><div class="gmail_quote">On Mon, Jan 23, 2017 at 3:38 PM, Nicolas Rossi <span dir="ltr"><<a href="mailto:nrossi@identicum.com" target="_blank">nrossi@identicum.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:#444444">Hi Jason, it seems that the difference between the 'relative' and 'positive' applies only when deleting accounts. On our example we are assigning new roles to users not removing. On the user's xml we can see the assignments but it doesn't have the roleMemebershipRef until we run a reconcile on the user.</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:#444444"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:#444444">Is that the expected behaviour ?</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:#444444"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:#444444">Regards,</div></div><div class="gmail_extra"><span><br clear="all"><div><div class="m_-2237503311268770607m_7286578353689553574m_7183375861711467014m_-6910420820083935388gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><font face="arial, helvetica, sans-serif"><br><br><font color="#444444">Ing Nicolás Rossi</font><br><font color="#999999">Identicum S.A.</font><br><font color="#999999">Jorge Newbery 3226</font><br><font color="#999999">Tel: <a href="tel:+54%2011%204552-3050" value="+541145523050" target="_blank">+54 (11) 4552-3050</a></font><br><font color="#999999"><a href="http://www.identicum.com" target="_blank">www.identicum.com</a></font></font><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
<br></span><div><div class="m_-2237503311268770607m_7286578353689553574m_7183375861711467014h5"><div class="gmail_quote">On Mon, Jan 23, 2017 at 2:09 PM, Jason Everling <span dir="ltr"><<a href="mailto:jeverling@bshp.edu" target="_blank">jeverling@bshp.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">You can also check the 'Assignment Policy Enforcement' , The default is 'relative' and that was our issue, changing it to 'Positive' fixed it,<div><br></div><div><a href="https://wiki.evolveum.com/display/midPoint/Projection+Policy" target="_blank">https://wiki.evolveum.com/disp<wbr>lay/midPoint/Projection+Policy</a><span class="m_-2237503311268770607m_7286578353689553574m_7183375861711467014m_-6910420820083935388HOEnZb"><font color="#888888"><br></font></span></div></div><div class="gmail_extra"><span class="m_-2237503311268770607m_7286578353689553574m_7183375861711467014m_-6910420820083935388HOEnZb"><font color="#888888"><br clear="all"><div><div class="m_-2237503311268770607m_7286578353689553574m_7183375861711467014m_-6910420820083935388m_-1902627461052368826gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">JASON</div></div></div></font></span><div><div class="m_-2237503311268770607m_7286578353689553574m_7183375861711467014m_-6910420820083935388h5">
<br><div class="gmail_quote">On Mon, Jan 23, 2017 at 10:26 AM, Martin Lízner - AMI Praha a.s. <span dir="ltr"><<a href="mailto:martin.lizner@ami.cz" target="_blank">martin.lizner@ami.cz</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Try to adjust:<div><br></div><div><evaluationPhase>beforeAssignm<wbr>ents</evaluationPhase><br></div></div><div class="gmail_extra"><br clear="all"><div><div class="m_-2237503311268770607m_7286578353689553574m_7183375861711467014m_-6910420820083935388m_-1902627461052368826m_667170867148896445gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><table style="font-family:Verdana,Arial,Helvetica,sans-serif;border-collapse:collapse;padding:0px;margin:0px;border-width:0px!important;border-style:solid!important;width:482px!important"><tbody><tr style="padding:0px;margin:0px;border:0px solid gray!important"><td colspan="2" style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:11px;vertical-align:bottom;padding:0px;border:0px solid gray!important"><p><span style="font-size:14px;font-weight:bold">Martin Lízner</span><br>solution architect<br><br>gsm: <a href="tel:+420%20737%20745%20571" value="+420737745571" target="_blank">[+420] 737 745 571</a><br>e-mail: <a href="mailto:martin.lizner@ami.cz" target="_blank">martin.lizner@ami.cz</a></p></td><td style="color:rgb(0,0,0);font-family:Verdana,Arial,Helvetica,sans-serif;font-size:10px;border-right-width:1px;border-right-style:solid;border-right-color:rgb(204,204,204);padding:0px;border-top-width:0px!important;border-bottom-width:0px!important;border-left-width:0px!important;border-top-style:solid!important;border-bottom-style:solid!important;border-left-style:solid!important;border-top-color:gray!important;border-bottom-color:gray!important;border-left-color:gray!important"> </td><td style="color:rgb(0,0,0);font-family:Verdana,Arial,Helvetica,sans-serif;font-size:10px;padding:0px;border:0px solid gray!important"> </td><td style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:11px;vertical-align:bottom;padding:0px;border:0px solid gray!important"><p>AMI Praha a.s.<br>Pláničkova 11<br>162 00 Praha 6<br>tel.: <a href="tel:+420%20274%20783%20239" value="+420274783239" target="_blank">[+420] 274 783 239</a><br>web: <a href="http://www.ami.cz/" target="_blank">www.ami.cz</a></p></td><td style="color:rgb(0,0,0);font-family:Verdana,Arial,Helvetica,sans-serif;font-size:10px;border-right-width:1px;border-right-style:solid;border-right-color:rgb(204,204,204);padding:0px;border-top-width:0px!important;border-bottom-width:0px!important;border-left-width:0px!important;border-top-style:solid!important;border-bottom-style:solid!important;border-left-style:solid!important;border-top-color:gray!important;border-bottom-color:gray!important;border-left-color:gray!important"> </td><td style="color:rgb(0,0,0);font-family:Verdana,Arial,Helvetica,sans-serif;font-size:10px;padding:0px;border:0px solid gray!important"> </td><td style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:11px;margin:8px;border:0px solid gray!important"><p><img src="http://www.ami.cz/images/podpis/ami_logo.gif" alt="" style="border:0px"></p></td></tr><tr style="padding:0px;margin:0px;border:0px solid gray!important"><td colspan="8" style="color:rgb(0,0,0);font-family:Verdana,Arial,Helvetica,sans-serif;font-size:10px;padding:0px;border:0px solid gray!important"></td></tr><tr style="padding:0px;margin:0px;border:0px solid gray!important"><td colspan="8" style="color:rgb(128,128,128);font-family:Arial,sans-serif;font-size:11px;padding:0px;border:0px solid gray!important"><table style="font-family:Verdana,Arial,Helvetica,sans-serif;border-collapse:collapse;padding:0px;margin:0px;border-width:0px!important;border-style:solid!important;width:482px!important"><tbody><tr style="padding:0px;margin:0px;border:0px solid gray!important"><td colspan="7" style="color:rgb(0,0,0);font-family:Verdana,Arial,Helvetica,sans-serif;font-size:10px;padding:0px;width:480px;border:0px solid gray!important"><br><a href="http://www.skyidentity.com/" target="_blank"><img src="http://www.ami.cz/images/podpis/AMI-podpis-Sky.png" alt="AMI Praha a.s." style="border:0px;width:480px!important;height:82px!important"></a></td></tr><tr style="padding:0px;margin:0px;border:0px solid gray!important"><td colspan="7" style="font-family:Arial,sans-serif;padding:0px;border:0px solid gray!important"><br></td></tr></tbody></table>Textem tohoto e-mailu podepisující neslibuje uzavřít ani neuzavírá za společnost AMI Praha a.s.<br>jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně písemnou formu.</td></tr></tbody></table></div><br></div></div></div></div></div></div></div></div></div>
<br><div class="gmail_quote"><div><div class="m_-2237503311268770607m_7286578353689553574m_7183375861711467014m_-6910420820083935388m_-1902627461052368826h5">2017-01-23 17:06 GMT+01:00 Nicolas Rossi <span dir="ltr"><<a href="mailto:nrossi@identicum.com" target="_blank">nrossi@identicum.com</a>></span>:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="m_-2237503311268770607m_7286578353689553574m_7183375861711467014m_-6910420820083935388m_-1902627461052368826h5"><div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:#444444">Hi guys, we have a User Template with few mappings that assigns Roles to Users based on their attributes. It's a simple model copied from <a href="https://github.com/Evolveum/midpoint/blob/master/samples/objects/object-template-user.xml" target="_blank">here</a>.</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:#444444"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:#444444">The User Template is applied and the user receives the assignments but it is not propagated to the resources until I run a reconcile process on it. </div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:#444444"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:#444444">Is there any way to configure the User Template to force a reconcile after running all mappings ? Or that's the expected behavior ?</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:#444444"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small;color:#444444">Regards,</div><div><div class="m_-2237503311268770607m_7286578353689553574m_7183375861711467014m_-6910420820083935388m_-1902627461052368826m_667170867148896445m_41071623734096448gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><font face="arial, helvetica, sans-serif"><br><br><font color="#444444">Ing Nicolás Rossi</font><br><font color="#999999">Identicum S.A.</font><br><font color="#999999">Jorge Newbery 3226</font><br><font color="#999999">Tel: <a href="tel:+54%2011%204552-3050" value="+541145523050" target="_blank">+54 (11) 4552-3050</a></font><br><font color="#999999"><a href="http://www.identicum.com" target="_blank">www.identicum.com</a></font></font><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
</div>
<br></div></div>______________________________<wbr>_________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/mail<wbr>man/listinfo/midpoint</a><br>
<br></blockquote></div><br></div>
<br>______________________________<wbr>_________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/mail<wbr>man/listinfo/midpoint</a><br>
<br></blockquote></div><br></div></div></div>
<br>______________________________<wbr>_________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/mail<wbr>man/listinfo/midpoint</a><br>
<br></blockquote></div><br></div></div></div>
<br>______________________________<wbr>_________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/mail<wbr>man/listinfo/midpoint</a><br>
<br></blockquote></div><br></div></div></div>
</blockquote></div><br></div></div></div>
<br>______________________________<wbr>_________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/mail<wbr>man/listinfo/midpoint</a><br>
<br></blockquote></div><br></div></div></div>
<br>______________________________<wbr>_________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/<wbr>mailman/listinfo/midpoint</a><br>
<br></blockquote></div><br></div>