<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Hi Tommy,<br>
</p>
<br>
<div class="moz-cite-prefix">On 04/20/2017 09:37 AM, Tommy Montegu
wrote:<br>
</div>
<blockquote cite="mid:04a001d2b9a8$e8e08c00$baa1a400$@exodata.fr"
type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Ivan,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Thank you very much for
your time. I read some LDAP samples to configure
synchronization. I decided to setup the correlation with CN.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">For example, in my
resource AD, I have the CN define like this :<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<attribute><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<c:ref>ri:cn</c:ref><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<limitations><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<minOccurs>0</minOccurs><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
</limitations><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<outbound><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<source><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<c:path>name</c:path><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
</source><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
</outbound><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
</attribute><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">In my Zimbra resource, I
have the CN define like this :<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><attribute><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<c:ref>ri:cn</c:ref><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<displayName>Common Name</displayName><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<limitations><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<minOccurs>0</minOccurs><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<access><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<read>true</read><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<add>true</add><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<modify>true</modify><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
</access><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
</limitations><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<outbound><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<source><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<c:path>fullName</c:path><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
</source><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
</outbound><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
</attribute><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">So I begin to write the
correlation like this :<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><objectSynchronization><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<name>Account sync</name><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<objectClass>ri:zimbraAccount</objectClass><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<kind>account</kind><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<intent>default</intent><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<focusType>UserType</focusType><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<enabled>true</enabled><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<correlation><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<q:equal><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<q:path>c:name</q:path><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<expression><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<path>$user/attributes/cn</path><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
</expression><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
</q:equal><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
</correlation><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
</objectSynchronization><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">It is the good syntax ?
For me, the search query will look for users that have
“name” equal to the “cn” of this account. So after, I need
to configure reaction is that correct ?</span></p>
</div>
</blockquote>
<br>
Almost correct.<br>
First, the <path> should be
<path>$accounts/attributes/cn</path> as this is
resource-side attribute, not user.<br>
<br>
That would search users in midPoint where midPoint user name equals
Zimbra "cn". But in your schema handling you are putting user's
"fullName" to "cn", so you need to fix one or the another. If "cn"
is actually full name of the user, you need probably change the
correlation query to use <q:path>c:fullName</q:path>. Of
course this means that full names in Zimbra are the same as in
midPoint, otherwise the matching will not be 100%. (But dry run
reconciliation will help you to see how many account matched.)<br>
<br>
<blockquote cite="mid:04a001d2b9a8$e8e08c00$baa1a400$@exodata.fr"
type="cite">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I read that we don’t
have to configure a confirmation rule because the search
will always return at most one match.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">So, I think about this
reaction :<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><reaction><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<situation>linked</situation><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<synchronize>true</synchronize><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
</reaction><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<reaction><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<situation>deleted</situation><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <action
ref=<a class="moz-txt-link-rfc2396E" href="http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlink">"http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlink"</a>/><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
</reaction><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<reaction><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
<situation>unlinked</situation><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <action
ref=<a class="moz-txt-link-rfc2396E" href="http://midpoint.evolveum.com/xml/ns/public/model/action-3#link">"http://midpoint.evolveum.com/xml/ns/public/model/action-3#link"</a>/><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">
</reaction><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">But if it’s unmatched,
what should I put in reaction ? </span></p>
</div>
</blockquote>
<br>
What do you want to achieve?<br>
If you want to create new midPoint user if reconciliation with
zimbra detect account which is unmatched, then you need addfocus
reaction action.<br>
If you don't want zimbra to be authoritative for creating new users
in midPoint (which I think is true - Zimbra is target system and not
source), you don't need unmatched reaction at all. In such cases I
use:<br>
<br>
<reaction><br>
<situation>unmatched</situation><br>
</reaction><br>
<br>
Regards,<br>
Ivan<br>
<pre class="moz-signature" cols="72">--
Ivan Noris
Senior Identity Engineer
evolveum.com
</pre>
</body>
</html>