<html><head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head><body style="color: rgb(0, 0, 0); background-color: rgb(255, 255,
255);" bgcolor="#FFFFFF" text="#000000">
Hi All,<br>
<br>
I have one certain group of users that will be provisioned on an
OpenLDAP resource. This group of users needs to use SASL Pass Through
to Active Directory, so the password stored in OpenLDAP userPassword
attribute will be in the format of: <br>
{<a class="moz-txt-link-abbreviated" href="mailto:SASL}user@example.com">SASL}user@example.com</a><br>
Here's some information about SASL Pass Through:
<a class="moz-txt-link-freetext" href="https://ltb-project.org/documentation/general/sasl_delegation">https://ltb-project.org/documentation/general/sasl_delegation</a><br>
<br>
I have this configured and working, if I enter the password directly
into OpenLDAP. But I need to have midPoint enter this value
automatically.<br>
<br>
I can easily construct this value using Groovy, but because it's a
"password", I can't seem to work with it in midPoint like other
attributes. Here are the things I've tried:<br>
<br>
1. Tried to generate it using an outbound expression in
<credentials> for the OpenLDAP resource. <br>
<credentials><br>
<password><br>
<outbound><br>
<source><br>
<path>$user/name</path><br>
</source><br>
<expression><br>
<script><br>
<code>'{SASL}' + name</code><br>
</script><br>
</expression><br>
</outbound><br>
</password><br>
</credentials><br>
<br>
This doesn't throw any errors, but I don't know if it's really
generating the right value, because when it stores the password on the
resource, it hashes it, like normal. And the pass through function
doesn't work.<br>
<br>
2. I tried to bypass the password hashing function by generating the
needed value in the User Template, and storing it in midPoint
$user/costCenter. I then tried to use outbound mapping in a Role to map
$user/costCenter to ri:userPassword. That gave an error of: <br>
<span style="color: rgb(51, 51, 51); font-family: "Source Sans
Pro", "Helvetica Neue", Helvetica, Arial, sans-serif;
font-size: 14px; font-style: normal; font-variant-ligatures: normal;
font-variant-caps: normal; font-weight: normal; letter-spacing: normal;
orphans: 2; text-align: start; text-indent: 0px; text-transform: none;
white-space: normal; widows: 2; word-spacing: 0px;
-webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);
display: inline !important; float: none;">Attribute
{<a class="moz-txt-link-freetext" href="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3">http://midpoint.evolveum.com/xml/ns/public/resource/instance-3</a>}userPassword
not found in schema for account type default, resource: Account Testing
OpenLDAP (OID:d0811790-1d80-11e4-86b2-3c970e467874) as definied in
role: HQ-User (OID:880f1186-2f77-11e7-93c2-bfabd497cae2)</span>.<br>
userPassword is the attribute used in the OpenLDAP resource, but I'm
guessing it's not treated like other attributes.<br>
<br>
Is there anyway to pass a "plain text" value to a resource userPassword
attribute? If so, then I will need to do this for only ONE set of
users. The rest of the user accounts on that resource need to be
handled in a normal way.<br>
<br>
Thanks for any suggestions!<br>
Brad<br>
</body></html>