<html><head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head><body style="color: rgb(0, 0, 0); background-color: rgb(255, 255,
255); color: rgb(0, 0, 0); background-color: rgb(255, 255,
255);" bgcolor="#FFFFFF" text="#000000">
I thought I might add an explanation of why I am doing this. There may
be a better or different way of accomplishing the same thing.<br>
<br>
We are pulling users into midPoint from several different authoritative
resources, both OpenLDAP and Active Directory. Then we need to
provision accounts on various other resources, including OpenLDAP.<br>
<br>
Since it appears there's not any way to get passwords directly from AD,
we're looking for a way to get the AD passwords replicated into an
OpenLDAP resource. I couldn't find a good way to do that, so decided to
try SASL Pass Through.<br>
<br>
If anyone has suggestions on how to get the AD passwords into OpenLDAP,
that would be great and solve my problem. This particular group of
users will NOT need access to midPoint, so I don't really need the
password in midPoint.<br>
<br>
Thanks!<br>
Brad<br>
<blockquote type="cite">Hi All,<br>
<br>
I have one certain group of users that will be provisioned on an
OpenLDAP resource. This group of users needs to use SASL Pass Through
to Active Directory, so the password stored in OpenLDAP userPassword
attribute will be in the format of: <br>
{<a class="moz-txt-link-abbreviated"
href="mailto:SASL%7Duser@example.com">SASL}user@example.com</a><br>
Here's some information about SASL Pass Through:
<a class="moz-txt-link-freetext"
href="https://ltb-project.org/documentation/general/sasl_delegation">https://ltb-project.org/documentation/general/sasl_delegation</a><br>
<br>
I have this configured and working, if I enter the password directly
into OpenLDAP. But I need to have midPoint enter this value
automatically.<br>
<br>
I can easily construct this value using Groovy, but because it's a
"password", I can't seem to work with it in midPoint like other
attributes. Here are the things I've tried:<br>
<br>
1. Tried to generate it using an outbound expression in
<credentials> for the OpenLDAP resource. <br>
<credentials><br>
<password><br>
<outbound><br>
<source><br>
<path>$user/name</path><br>
</source><br>
<expression><br>
<script><br>
<code>'{SASL}' + name</code><br>
</script><br>
</expression><br>
</outbound><br>
</password><br>
</credentials><br>
<br>
This doesn't throw any errors, but I don't know if it's really
generating the right value, because when it stores the password on the
resource, it hashes it, like normal. And the pass through function
doesn't work.<br>
<br>
2. I tried to bypass the password hashing function by generating the
needed value in the User Template, and storing it in midPoint
$user/costCenter. I then tried to use outbound mapping in a Role to map
$user/costCenter to ri:userPassword. That gave an error of: <br>
<span style="color: rgb(51, 51, 51); font-family: "Source Sans
Pro", "Helvetica Neue", Helvetica, Arial, sans-serif;
font-size: 14px; font-style: normal; font-variant-ligatures: normal;
font-variant-caps: normal; font-weight: normal; letter-spacing: normal;
orphans: 2; text-align: start; text-indent: 0px; text-transform: none;
white-space: normal; widows: 2; word-spacing: 0px;
-webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);
display: inline !important; float: none;">Attribute
{<a class="moz-txt-link-freetext"
href="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3">http://midpoint.evolveum.com/xml/ns/public/resource/instance-3</a>}userPassword
not found in schema for account type default, resource: Account Testing
OpenLDAP (OID:d0811790-1d80-11e4-86b2-3c970e467874) as definied in
role: HQ-User (OID:880f1186-2f77-11e7-93c2-bfabd497cae2)</span>.<br>
userPassword is the attribute used in the OpenLDAP resource, but I'm
guessing it's not treated like other attributes.<br>
<br>
Is there anyway to pass a "plain text" value to a resource userPassword
attribute? If so, then I will need to do this for only ONE set of
users. The rest of the user accounts on that resource need to be
handled in a normal way.<br>
<br>
Thanks for any suggestions!<br>
Brad<br>
</blockquote>
<br>
</body></html>