<html><head>
<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type">
</head><body bgcolor="#FFFFFF" text="#000000">I'm replying to my own
question since I finally figured it out. In case this might help
someone else.<br>
<br>
The main thing was to use: basic.getAttributeValues (not Value) to work
with a multi-valued attribute. I added some other lines to handle
accounts that don't have a 'memberOf' attribute, and to also handle
those that don't have this particular 'memberOf' attribute. So this
completes without any null pointer exceptions.<br>
<br>
<condition><br>
<script><br>
<code><br>
mem = basic.getAttributeValues(shadow, "memberOf")<br>
if (mem == null){<br>
return false<br>
}<br>
else if (!mem.contains("CN=Test
Group,OU=Distribution Groups,OU=Groups,DC=example,DC=com")){<br>
return false<br>
}<br>
else if (mem.contains("CN=Test
Group,OU=Distribution Groups,OU=Groups,DC=example,DC=com")){<br>
return true<br>
}<br>
</code><br>
<script><br>
<condition><br>
<br>
<span>Brad Firestone wrote:</span><br>
<blockquote cite="mid:591214DD.3020706@gmail.com" type="cite">
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
I changed the subject line
since I THINK I've learned more about how to do this. I don't need to
sync the actual "groups", but want to sync only the accounts that are
members of a certain group. After lots of reading and searching, I
realized that I probably need to do this using a condition script in the
<synchronization> section.<br>
<br>
I have it working correctly if I'm looking for an single-valued
attribute value using the following code:<br>
<br>
<condition><br>
<script><br>
<code><br>
surname = basic.getAttributeValue(shadow, 'sn');<br>
return (surname == 'Testuser')<br>
</code><br>
</script><br>
</condition><br>
<br>
The problem is trying to get this to work for all members of a
Distribution Group. Many of the things I've tried to do give an error
of:<br>
<span style="color: rgb(51, 51, 51); font-family: "Source Sans
Pro", "Helvetica Neue", Helvetica, Arial, sans-serif;
font-size: 14px; font-style: normal; font-variant-ligatures: normal;
font-variant-caps: normal; font-weight: normal; letter-spacing: normal;
orphans: 2; text-align: start; text-indent: 0px; text-transform: none;
white-space: normal; widows: 2; word-spacing: 0px;
-webkit-text-stroke-width: 0px; background-color: rgb(249, 249, 249);
display: inline !important; float: none;">com.evolveum.midpoint.util.exception.ExpressionEvaluationException:
com.evolveum.midpoint.util.exception.SchemaException: Attempt to get
single value from multi-valued attribute
{<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3">http://midpoint.evolveum.com/xml/ns/public/resource/instance-3</a>}memberOf
(new) condition in object synchronization Account sync</span><br>
<br>
Does anyone have any ideas of how to sync only accounts that are members
of a Distribution Group?<br>
Thanks!<br>
<br>
<span>Brad Firestone wrote:</span><br>
<blockquote cite="mid:5907E301.5000106@gmail.com" type="cite"><meta
http-equiv="content-type" content="text/html; charset=ISO-8859-1">
Hi All,<br>
<br>
I am setting up Active Directory as an authoritative source resource.
But I only want to sync in users who are members of a certain
Distribution Group:<br>
CN=Primary Users,OU=Distribution Groups,OU=Groups,DC=example,DC=com<br>
<br>
I'm guessing that I can put this filter into the resource, probably in
the <span style="color: rgb(0, 0, 0); font-family: Consolas,
"Bitstream Vera Sans Mono", "Courier New", Courier,
monospace; font-size: 14px; font-style: normal; font-variant-ligatures:
normal; font-variant-caps: normal; font-weight: normal; letter-spacing:
normal; orphans: 2; text-align: left; text-indent: 0px; text-transform:
none; white-space: nowrap; widows: 2; word-spacing: 0px;
-webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);
display: inline !important; float: none;">resultsHandlerConfiguration</span>
section, using the <span style="color: rgb(0, 0, 0); font-family:
Consolas, "Bitstream Vera Sans Mono", "Courier New",
Courier, monospace; font-size: 14px; font-style: normal;
font-variant-ligatures: normal; font-variant-caps: normal; font-weight:
normal; letter-spacing: normal; orphans: 2; text-align: left;
text-indent: 0px; text-transform: none; white-space: nowrap; widows: 2;
word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color:
rgb(255, 255, 255); display: inline !important; float: none;">enableFilteredResultsHandler</span>.
I found this page in the Wiki, but it's still a work To Do:<br>
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://wiki.evolveum.com/display/midPoint/ICF+Configuration+Tips+and+Tricks">https://wiki.evolveum.com/display/midPoint/ICF+Configuration+Tips+and+Tricks</a><br>
<br>
Does anyone have any examples of how I might filter my results to just
include users in this Distribution Group?<br>
<br>
Thanks!<br>
Brad<br></blockquote>
<br>
</blockquote>
<br>
</body></html>