<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Hi Brad,</p>
<p>good to hear it helped :-)</p>
<p>According to the schema, (PropertyAccessType in
common-core-3.xsd) the correct elements are read, add, modify. The
samples are automatically tested during builds, so there should
not be any invalid elements. So you have found error in our
documentation. Which I have just fixed :) Thank you.<br>
</p>
Best regards,<br>
Ivan<br>
<br>
<div class="moz-cite-prefix">On 03/30/2017 11:27 PM, Brad Firestone
wrote:<br>
</div>
<blockquote cite="mid:58DD7850.9040401@gmail.com" type="cite">
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
Thank you Ivan!<br>
<br>
I'm sorry for my confusing statements. I wasn't very clear.<br>
<br>
The resource is the TARGET. What I meant by "this resource should
not ever be modified" is that the resource will not be modified by
anything OTHER THAN midPoint.<br>
So we are thinking the same here.<br>
<br>
I commented out "<add>false</add>" <br>
and that solved the problem. THANK YOU! <br>
I was just blindly copying in attributes from the samples. <br>
<br>
Now that I'm reading about the Attribute Limitations, I notice
that the documentation shows tags for:<br>
<create> <read> and <update><br>
<br>
Are these more "current" than <read> <add> and
<modify> tags that I found in the samples? If so, I guess I
should be using these instead?<br>
<br>
Thank you again!<br>
Brad<br>
<br>
<span>Ivan Noris wrote:</span><br>
<blockquote
cite="mid:9253d9d3-4397-194f-f8d6-af32c0130df1@evolveum.com"
type="cite">
<pre wrap="">Hi Brad,
I believe you are "mixing" things a little: see below:
On 03/29/2017 11:42 PM, Brad Firestone wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hi, I'm just getting started with my midPoint configuration. I have
setup an OpenLDAP resource that has custom attributes in a custom
object class. This resource should not ever be modified, so I have
removed all inbound settings, since I only want information to go out
to this resource.
</pre>
</blockquote>
<pre wrap=""><!---->
If the resource is TARGET, there must be outbounds. If you don't need to
synchronize anything FROM the resource, you don't need inbounds.
</pre>
<blockquote type="cite">
<pre wrap="">When I try to project a midPoint user to this resource, I get the
following error:
Security violation during processing shadow shadow: null (OID:null):
Attempt to add shadow with non-createable attribute
{<a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3">http://midpoint.evolveum.com/xml/ns/public/resource/instance-3</a>}gnUniqueId
The attribute gnUniqueID exists in a custom schema XSD file and it
does display under the Extension section of the User in the GUI.
Here's the related section from the XSD file:
<xsd:element name="gnUniqueID" type="xsd:string" minOccurs="0"
maxOccurs="1">
<xsd:annotation>
<xsd:appinfo>
<a:indexed>true</a:indexed>
<a:displayName>GN-UniqueID</a:displayName>
<a:displayOrder>120</a:displayOrder>
</xsd:appinfo>
</xsd:annotation>
</xsd:element>
Here is the attribute section of the Resource XML file:
<attribute>
<ref>ri:gnUniqueId</ref>
<displayName>GN Unique ID</displayName>
<limitations>
<access>
<read>true</read>
<add>false</add>
<modify>true</modify>
</access>
</limitations>
<outbound>
<source>
<path>$user/extension/gnUniqueID</path>
</source>
</outbound>
<matchingRule>mr:stringIgnoreCase</matchingRule>
</attribute>
</pre>
</blockquote>
<pre wrap=""><!---->
I believe the "<add>false</add>" is the problem. You can't add the value
of "gnUniqueId" resource attribute because you have prohibited it. (The
attribute is "non-creatable".)
What happens if you remove the "<add>false</add>" restriction?
Regards,
Ivan
</pre>
</blockquote>
<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
midPoint mailing list
<a class="moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a>
<a class="moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Ivan Noris
Senior Identity Engineer
evolveum.com
</pre>
</body>
</html>