<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none"><!--P{margin-top:0;margin-bottom:0;} p
{margin-top:0;
margin-bottom:0}p
{margin-top:0;
margin-bottom:0}--></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Hi, I deleted the shadows and did a user recompute, and that did the trick. Thanks!</p>
<p><br>
</p>
<p>Pertti<br>
</p>
<div dir="ltr" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" color="#000000" face="Calibri, sans-serif"><b>Lähettäjä:</b> midPoint <midpoint-bounces@lists.evolveum.com> käyttäjän puolestaPertti Kellomäki <pertti.kellomaki@datactica.fi><br>
<b>Lähetetty:</b> 1. joulukuuta 2017 13:03<br>
<b>Vastaanottaja:</b> midpoint@lists.evolveum.com<br>
<b>Aihe:</b> Re: [midPoint] Refreshing uuids in ldap shadow objects</font>
<div> </div>
</div>
<div>
<p>Hi Ivan,</p>
<p><br>
</p>
<p>I cannot test right now, but deleting the shadows and recreating them sounds about right, and exactly what I was looking for. I'll report later how it went.</p>
<p><br>
</p>
<p>Pertti<br>
</p>
<div style="color:rgb(33,33,33)">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" color="#000000" face="Calibri, sans-serif"><b>Lähettäjä:</b> midPoint <midpoint-bounces@lists.evolveum.com> käyttäjän puolestaIvan Noris <ivan.noris@evolveum.com><br>
<b>Lähetetty:</b> 1. joulukuuta 2017 12:16<br>
<b>Vastaanottaja:</b> midpoint@lists.evolveum.com<br>
<b>Aihe:</b> Re: [midPoint] Refreshing uuids in ldap shadow objects</font>
<div> </div>
</div>
<div>
<p>Hi Pertti,</p>
<p><br>
</p>
<p>if I understand that correctly, the groups are not linked to any focus objects (Orgs or Roles) in midPoint. (The Shadows Details page should display no owners for that shadows).<br>
</p>
<p><br>
</p>
<p>So reconciliation of the groups should fix it (with unmatched->no reaction). But this requires you to have at least simple objectType and objectSynchronization defined for the groups (without mappings) in that resource.<br>
</p>
<p><br>
</p>
<p>I'm thinking... As an alternative you may also just delete all shadows corresponding to the groups where entryuuid changed, and then going to Resource->your resource->Entitlements - selecting object class and clicking Resource tab should display groups from
the resource and re-create shadow objects for them...</p>
<p><br>
</p>
<p>Also getting rid of that incorrect shadow objects and then editing some user-projections-associations should display correctly (and it will recreate the group shadow).</p>
<p><br>
</p>
<p>No other ideas now.</p>
<p><br>
</p>
<p>Best regards,</p>
<p>Ivan<br>
</p>
<br>
<div class="moz-cite-prefix">On 01.12.2017 11:00, Pertti Kellomäki wrote:<br>
</div>
<blockquote type="cite"><style type="text/css" style="">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<p>Hi,<br>
</p>
<p><br>
</p>
<p>The groups are managed externally, though with hindsight it would have been better to let midPoint create them. Association is done using associationTargetSearch with a bit of groovy code that constructs the name of the appropriate ldap group.</p>
<p><br>
</p>
<p>Pertti<br>
</p>
<div style="color:rgb(33,33,33)">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" color="#000000" face="Calibri, sans-serif"><b>Lähettäjä:</b> midPoint
<a class="moz-txt-link-rfc2396E" href="mailto:midpoint-bounces@lists.evolveum.com">
<midpoint-bounces@lists.evolveum.com></a> käyttäjän puolestaIvan Noris <a class="moz-txt-link-rfc2396E" href="mailto:ivan.noris@evolveum.com">
<ivan.noris@evolveum.com></a><br>
<b>Lähetetty:</b> 30. marraskuuta 2017 16:25<br>
<b>Vastaanottaja:</b> <a class="moz-txt-link-abbreviated" href="mailto:midpoint@lists.evolveum.com">
midpoint@lists.evolveum.com</a><br>
<b>Aihe:</b> Re: [midPoint] Refreshing uuids in ldap shadow objects</font>
<div> </div>
</div>
<div>
<p>Hi Pertti,</p>
<p><br>
</p>
are the groups actually created by midPoint, or they are managed externally?<br>
How are you assiociating the LDAP accounts with the groups? Using associationTargetSearch or associationFromLink?<br>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset> <br>
<pre>_______________________________________________
midPoint mailing list
<a class="moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a>
<a class="moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Ivan Noris
Senior Identity Engineer
evolveum.com
</pre>
</div>
</div>
</div>
</div>
</body>
</html>