<div dir="ltr"><div>Hi Ivan,</div><div><br></div>At this moment, I dont send pasword to AD for now, I will add password after sync works. This is test system.<div>All log files open in my screen.</div><div><br></div><div>Let me ask a question, what should I do for this scnerio?</div><div><br></div><div>1- Read HR database and create organizations in midpoint --> This is OK</div><div>2- Read HR database and create users in midpoint with organization assignment --> This is OK</div><div>3- Reconcile and send midpoint users to AD with their ou mapping with organization --> I have resource xml with outbound mappings but it doesn't work. What else I have to do? I think I am missing something. For this scenario, what should I do , could you guide me by giving some steps or is there any example? </div><div><br></div><div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Mar 16, 2017 at 8:47 PM, Ivan Noris <span dir="ltr"><<a href="mailto:Ivan.Noris@evolveum.com" target="_blank">Ivan.Noris@evolveum.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div style="font-family:"times new roman","new york",times,serif;font-size:12pt;color:rgb(0,0,0)"><div>Hi,<br></div><div>well, if there is NO error, that's strange.<br></div><div><br></div><div>So what exactly are you doing? You have this resource, and you are adding projection, or assigning account or you also have role and assigning the role?<br></div><div><br></div><div>The first thing which is strange is that you are using port 389, but AFAIK AD will not allow you to set user's password using 389; for this you must use LDAPS/port 636. But I can imagine AD will complain about this very loudly in idm.log.<br></div><div><br></div><div>So please check the log...<br></div><div><br></div><div>Ivan<br></div><div><br></div><hr id="gmail-m_-549049258757750138zwchr"><blockquote style="border-left:2px solid rgb(16,16,255);margin-left:5px;padding-left:5px;color:rgb(0,0,0);font-weight:normal;font-style:normal;text-decoration:none;font-family:helvetica,arial,sans-serif;font-size:12pt"><b>From: </b>"Dilek Gider" <<a href="mailto:dilek.gider@basistek.com" target="_blank">dilek.gider@basistek.com</a>><br><b>To: </b>"midPoint General Discussion" <<a href="mailto:midpoint@lists.evolveum.com" target="_blank">midpoint@lists.evolveum.com</a>><br><b>Sent: </b>Thursday, March 16, 2017 1:08:50 PM<br><b>Subject: </b>Re: [midPoint] Create Users from Midpoint to AD<br><div><br></div><div dir="ltr">Hi Ivan,<div><br></div><div>No need to sorry, I have sent you resource sample as you understand on 14 March because I had changed my first AD resource xml by trying to create users. Lots of changes I did on my resource xml. So, as a result I am sending you my final resource xml. There is no error now, but it does not create users <span style="text-decoration:underline">from midpoint to AD. </span></div><div>Thank you very much for all of your support.</div><div>Dilek.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Mar 15, 2017 at 10:58 PM, Ivan Noris <span dir="ltr"><<a href="mailto:Ivan.Noris@evolveum.com" target="_blank">Ivan.Noris@evolveum.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div style="font-family:"times new roman","new york",times,serif;font-size:12pt;color:rgb(0,0,0)"><div>Hi,<br></div><div>sorry I was maybe referring to another resource sample but I was quite sure it was your example from 14. march. But as I'm currently doing onsite consultations I may have missed something. I try to answer e-mail after full-day of work :)<br></div><div><br></div><div>Please send the resource as it is now, I or someone else will try to understand the problem. Also please paste the error message.<br></div><div><br></div><div>Ivan<br></div><div><br></div><hr id="gmail-m_-549049258757750138m_9177102484429604526zwchr"><blockquote style="border-left:2px solid rgb(16,16,255);margin-left:5px;padding-left:5px;color:rgb(0,0,0);font-weight:normal;font-style:normal;text-decoration:none;font-family:helvetica,arial,sans-serif;font-size:12pt"><b>From: </b>"Dilek Gider" <<a href="mailto:dilek.gider@basistek.com" target="_blank">dilek.gider@basistek.com</a>><br><b>To: </b>"midPoint General Discussion" <<a href="mailto:midpoint@lists.evolveum.com" target="_blank">midpoint@lists.evolveum.com</a>><br><b>Sent: </b>Wednesday, March 15, 2017 1:59:30 PM<br><b>Subject: </b>Re: [midPoint] Create Users from Midpoint to AD<br><div><br></div><div dir="ltr">Hi Ivan,<div><br></div><div>Thank you for your answer. First of all, my correlation rule was based on <span style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:16px">$account/attributes/ri:</span><span style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:16px">sAMA<wbr>ccountName vs. c:name</span></div><div><span style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif"><span style="font-size:16px">and there wasn't #addUser reaction. But I had errors and then I supposed that I am doing wrong, then I tried to change resource xml.</span></span></div><div><span style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif"><span style="font-size:16px"><br></span></span></div><div><span style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif"><span style="font-size:16px">Now I tried what you suggested, there is no error but nothing changed. AD users shadows' are created in midpoint, but no user created in AD.</span></span></div><div><span style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif"><span style="font-size:16px">What should I do to create users on the target systems like AD, SAP etc?</span></span></div><div><span style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif"><span style="font-size:16px"><br></span></span></div><div><span style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif"><span style="font-size:16px"><br></span></span><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Mar 15, 2017 at 2:23 PM, Ivan Noris <span dir="ltr"><<a href="mailto:Ivan.Noris@evolveum.com" target="_blank">Ivan.Noris@evolveum.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div style="font-family:"times new roman","new york",times,serif;font-size:12pt;color:rgb(0,0,0)"><div>Hello Dilek,<br></div><div>please see my answers in the text below:<br></div><div><br></div><hr id="gmail-m_-549049258757750138m_9177102484429604526gmail-m_2628730345631334940zwchr"><blockquote style="border-left:2px solid rgb(16,16,255);margin-left:5px;padding-left:5px;color:rgb(0,0,0);font-weight:normal;font-style:normal;text-decoration:none;font-family:helvetica,arial,sans-serif;font-size:12pt"><b>From: </b>"Dilek Gider" <<a href="mailto:dilek.gider@basistek.com" target="_blank">dilek.gider@basistek.com</a>><br><b>To: </b>"midPoint General Discussion" <<a href="mailto:midpoint@lists.evolveum.com" target="_blank">midpoint@lists.evolveum.com</a>><br><b>Sent: </b>Wednesday, March 15, 2017 9:01:49 AM<br><b>Subject: </b>Re: [midPoint] Create Users from Midpoint to AD<br><div><br></div><div dir="ltr">Hi Ivan, <div><br></div><div>I will reply all of your questions, but it is clear that I want to create users from midpoint to AD.</div><div>I don't know how to do this, I only created users from HR db to midpoint successfully, and then try to add new resource for AD.</div><div><br></div><div>1. I supposed that this reaction goes to AD and it will create user on AD with #addUser</div></div></blockquote><div>Quite the opposite. The reactions in the synchronization part are reactions what midPoint should do if there are new accounts created in the AD. To detect locally created accounts for example.<br></div><div>AddUser action means, midPoint should take the AD account and create new USER in midPoint.<br></div><div>This is completely opposite way of what you want. You want to create AD account from midPoint user. For that you don't need the inbounds and you don't need the addUser reaction.<br></div><div><br></div><div>The quick fix would be to comment out the #addUser reaction.<br></div><div>But I believe your problem lies in the correlation rule. It is completely incorrect. MidPoint creates a new account and tries to lookup the user in midPoint by searching by name which is equal to icfs:uid. AD LDAP connector does not even have such attribute. Your correlation rule should be based on $account/attributes/ri:<wbr>sAMAccountName vs. c:name, because that's exactly how you create the account.<br></div><div><br></div><div>So, you need to fix the correlation rule, because now it's incorrect. And remove the #adduser reaction for unmatched.<br></div><div><br></div><blockquote style="border-left:2px solid rgb(16,16,255);margin-left:5px;padding-left:5px;color:rgb(0,0,0);font-weight:normal;font-style:normal;text-decoration:none;font-family:helvetica,arial,sans-serif;font-size:12pt"><div dir="ltr"><div><br></div><div>2. I didn't add inbounds becaus I don't want to create users in midpoint with this connector. I have another connector scripttedsql and I'm creating users with it.</div><div><br></div><div>3. Which object template? </div></div></blockquote><div><br></div><div>I don't know your setup, but according to the error message I assumed there was some default object template. But the problem (as far as I can see) is in the synchronization part.<br></div><div><br></div><div>Ivan<br></div><div><br></div><blockquote style="border-left:2px solid rgb(16,16,255);margin-left:5px;padding-left:5px;color:rgb(0,0,0);font-weight:normal;font-style:normal;text-decoration:none;font-family:helvetica,arial,sans-serif;font-size:12pt"><div dir="ltr"><div><br></div><div>I am running task to create users from midpoint to AD by setting schema handling outbounds. </div><div><br></div><div>Thank you for your reply, I think I am confused too, and I don't know how to do this sync.<br><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Mar 14, 2017 at 9:10 PM, Ivan Noris <span dir="ltr"><<a href="mailto:ivan.noris@evolveum.com" target="_blank">ivan.noris@evolveum.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><p>Hi,</p>I'm confused.<br> You say you create users in AD from midpoint. For that you only need outbound mappings, which you seem to have.<br> But the screenshot is from "ADSynchronization" task, which is clearly synchronization task. And the task is complaining, because:<br><div><br></div>1. you have this in the synchronization for accounts:<br> <reaction><br> <situation>unmatched</<wbr>situation><br> <synchronize>true</<wbr>synchronize><br> <action><br> <handlerUri><a class="gmail-m_-549049258757750138m_9177102484429604526gmail-m_2628730345631334940m_641292739869619595moz-txt-link-freetext" href="http://midpoint.evolveum.com/xml/ns/public/model/action-3#addUser" target="_blank">http://midpoint.<wbr>evolveum.com/xml/ns/public/<wbr>model/action-3#addUser</a></<wbr>handlerUri><br> </action><br> </reaction><br><div><br></div>So midpoint tries to create new USER from account.<br><div><br></div>2. there are no inbounds<br> So midpoint cannot create user.<br><div><br></div>3. object template does not have any rule how to generate user/name attribute.<br> Poor midpoint does not have anything to do.<br><div><br></div>The question is, why are you running the task with no inbounds but #addUser reaction for unmatched...?<br><div><br></div>Regards,<br> Ivan<br><div><br></div><div class="gmail-m_-549049258757750138m_9177102484429604526gmail-m_2628730345631334940m_641292739869619595moz-cite-prefix">On 03/14/2017 04:27 PM, Dilek Gider wrote:<br></div><blockquote><div dir="ltr">Hi All,<div><br></div><div>I want to create users in AD from Midpoint. I have trusted resource in HR DB, I can take users to Midpoint. I want to send these users to AD. So, I have created new Resource, attached as attachment. I am working on it for two weeks, and couldn't succeded.</div><div><br></div><div>Now, I can take all AD users to midpoint with correlation, but it gives error like below and no users created on AD. I only set outbound attributes in SchemaHandling.</div><div><br></div><div><img src="cid:part1.C19758C8.C7A71998@evolveum.com" alt="Inline image 1" style="margin-right: 0px;" height="242" width="414"><br></div><div><i><span style="font-size:xx-small"><br> </span></i></div><div><div id="gmail-m_-549049258757750138m_9177102484429604526gmail-m_2628730345631334940m_641292739869619595gmail_kxlmdy4ni0iz" style="display:inline-block"><div><i><span style="font-size:xx-small">SystemException: No name in new object null as produced by template null in iteration 0, we cannot process an object without a name</span></i></div><div><br></div></div></div><div><br></div><div>I'm afraid of if there is no syncronization from midpoint to AD?</div><div><br></div><div>Thank you...</div><div><br></div><div>Dilek.</div></div><br><div><br></div><pre>______________________________<wbr>_________________
midPoint mailing list
<a class="gmail-m_-549049258757750138m_9177102484429604526gmail-m_2628730345631334940m_641292739869619595moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><a class="gmail-m_-549049258757750138m_9177102484429604526gmail-m_2628730345631334940m_641292739869619595moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint" target="_blank">htt<wbr>p://lists.evolveum.com/<wbr>mailman/listinfo/midpoint</a><span class="gmail-m_-549049258757750138m_9177102484429604526gmail-m_2628730345631334940HOEnZb"><span style="color:rgb(136,136,136)">
</span></span></pre><span class="gmail-m_-549049258757750138m_9177102484429604526gmail-m_2628730345631334940HOEnZb"><span style="color:rgb(136,136,136)"> </span></span></blockquote><span class="gmail-m_-549049258757750138m_9177102484429604526gmail-m_2628730345631334940HOEnZb"><span class="gmail-m_-549049258757750138m_9177102484429604526gmail-m_2628730345631334940HOEnZb"><span style="color:rgb(136,136,136)"> <br></span></span></span><pre class="gmail-m_-549049258757750138m_9177102484429604526gmail-m_2628730345631334940m_641292739869619595moz-signature">--
Ivan Noris
Senior Identity Engineer
<a href="http://evolveum.com" target="_blank">evolveum.com</a><br></pre></div><br>______________________________<wbr>_________________<br> midPoint mailing list<br><a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br><a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/<wbr>mailman/listinfo/midpoint</a><br><div><br></div></blockquote></div><br></div></div></div><br>______________________________<wbr>_________________<br>midPoint mailing list<br><a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br><a href="http://lists.evolveum.com/mailman/listinfo/midpoint" target="_blank">http://lists.evolveum.com/<wbr>mailman/listinfo/midpoint</a><span class="gmail-m_-549049258757750138m_9177102484429604526gmail-HOEnZb"><span style="color:rgb(136,136,136)"><br></span></span></blockquote><div><br><div><br></div></div><div><br></div><div>-- <br></div><div><span></span>Ivan Noris<br>Senior Identity Engineer<br><a href="http://evolveum.com" target="_blank">evolveum.com</a><span></span><br></div></div></div><br>______________________________<wbr>_________________<br> midPoint mailing list<br> <a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br> <a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/<wbr>mailman/listinfo/midpoint</a><br> <br></blockquote></div><br></div></div></div><br>______________________________<wbr>_________________<br>midPoint mailing list<br><a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br><a href="http://lists.evolveum.com/mailman/listinfo/midpoint" target="_blank">http://lists.evolveum.com/<wbr>mailman/listinfo/midpoint</a><span class="gmail-m_-549049258757750138HOEnZb"><span style="color:rgb(136,136,136)"><br></span></span></blockquote><div><br><div><br></div></div><div><br></div><div>-- <br></div><div><span></span>Ivan Noris<br>Senior Identity Engineer<br><a href="http://evolveum.com" target="_blank">evolveum.com</a><span></span><br></div></div></div><br>______________________________<wbr>_________________<br> midPoint mailing list<br> <a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br> <a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/<wbr>mailman/listinfo/midpoint</a><br> <br></blockquote></div><br></div><br>______________________________<wbr>_________________<br>midPoint mailing list<br><a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br><a href="http://lists.evolveum.com/mailman/listinfo/midpoint" target="_blank">http://lists.evolveum.com/<wbr>mailman/listinfo/midpoint</a><span class="gmail-HOEnZb"><font color="#888888"><br></font></span></blockquote><span class="gmail-HOEnZb"><font color="#888888"><div><br><br></div><div><br></div><div>-- <br></div><div><span name="x"></span>Ivan Noris<br>Senior Identity Engineer<br><a href="http://evolveum.com" target="_blank">evolveum.com</a><span name="x"></span><br></div></font></span></div></div><br>______________________________<wbr>_________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/<wbr>mailman/listinfo/midpoint</a><br>
<br></blockquote></div><br></div></div></div>