<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hi Pertti,</p>
<p><br>
</p>
<p>if I understand that correctly, the groups are not linked to any
focus objects (Orgs or Roles) in midPoint. (The Shadows Details
page should display no owners for that shadows).<br>
</p>
<p><br>
</p>
<p>So reconciliation of the groups should fix it (with
unmatched->no reaction). But this requires you to have at least
simple objectType and objectSynchronization defined for the groups
(without mappings) in that resource.<br>
</p>
<p><br>
</p>
<p>I'm thinking... As an alternative you may also just delete all
shadows corresponding to the groups where entryuuid changed, and
then going to Resource->your resource->Entitlements -
selecting object class and clicking Resource tab should display
groups from the resource and re-create shadow objects for them...</p>
<p><br>
</p>
<p>Also getting rid of that incorrect shadow objects and then
editing some user-projections-associations should display
correctly (and it will recreate the group shadow).</p>
<p><br>
</p>
<p>No other ideas now.</p>
<p><br>
</p>
<p>Best regards,</p>
<p>Ivan<br>
</p>
<br>
<div class="moz-cite-prefix">On 01.12.2017 11:00, Pertti Kellomäki
wrote:<br>
</div>
<blockquote type="cite" cite="mid:1512122423193.10684@datactica.fi">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none"><!--P{margin-top:0;margin-bottom:0;} --></style>
<p>Hi,<br>
</p>
<p><br>
</p>
<p>The groups are managed externally, though with hindsight it
would have been better to let midPoint create them. Association
is done using associationTargetSearch with a bit of groovy code
that constructs the name of the appropriate ldap group.</p>
<p><br>
</p>
<p>Pertti<br>
</p>
<div style="color: rgb(33, 33, 33);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt"
face="Calibri, sans-serif" color="#000000"><b>Lähettäjä:</b>
midPoint <a class="moz-txt-link-rfc2396E" href="mailto:midpoint-bounces@lists.evolveum.com"><midpoint-bounces@lists.evolveum.com></a>
käyttäjän puolestaIvan Noris <a class="moz-txt-link-rfc2396E" href="mailto:ivan.noris@evolveum.com"><ivan.noris@evolveum.com></a><br>
<b>Lähetetty:</b> 30. marraskuuta 2017 16:25<br>
<b>Vastaanottaja:</b> <a class="moz-txt-link-abbreviated" href="mailto:midpoint@lists.evolveum.com">midpoint@lists.evolveum.com</a><br>
<b>Aihe:</b> Re: [midPoint] Refreshing uuids in ldap shadow
objects</font>
<div> </div>
</div>
<div>
<p>Hi Pertti,</p>
<p><br>
</p>
are the groups actually created by midPoint, or they are
managed externally?<br>
How are you assiociating the LDAP accounts with the groups?
Using associationTargetSearch or associationFromLink?<br>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
midPoint mailing list
<a class="moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a>
<a class="moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Ivan Noris
Senior Identity Engineer
evolveum.com
</pre>
</body>
</html>