<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Just one more:</p>
<p>Do you have</p>
<p><tolerant>false</tolerant></p>
<p>in association definition?<br>
<br>
The assignment policy enforcement if I understand correctly
removes unassigned accounts from resource.<br>
<br>
</p>
<br>
<div class="moz-cite-prefix">W dniu 20.12.2017 o 19:45, Wojciech
Staszewski pisze:<br>
</div>
<blockquote type="cite"
cite="mid:ddcb25a9-44ca-5bbf-9b6b-757f1893285e@diagnostyka.pl">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<p>Hello!</p>
<p>If I understand this example: <a class="moz-txt-link-freetext"
href="https://wiki.evolveum.com/display/midPoint/Projection+Policy"
moz-do-not-send="true">https://wiki.evolveum.com/display/midPoint/Projection+Policy</a><br>
the enforcement policy should be outside "schemaHandling" as a
separate section:</p>
<p><projection><br>
<assignmentPolicyEnforcement>full</assignmentPolicyEnforcement><br>
</projection><br>
</p>
I have it configured this way and it works - it removes not
assigned entitlements.<br>
<br>
Good luck!<br>
WS<br>
<br>
<div class="moz-cite-prefix">W dniu 20.12.2017 o 18:52, Alcides
Carlos de Moraes Neto pisze:<br>
</div>
<blockquote type="cite"
cite="mid:CAMLLNmk3CoiWGjK+6cT-aEtRXQv_PDwVsFNWTdzRA-d_W7U7oQ@mail.gmail.com">
<div dir="ltr">
<div>
<div>
<div>
<div>
<div>Hello list,<br>
<br>
</div>
I have a working Org. Unit -> AD group mapping,
with an AssociationFromLink inducement for members.<br>
<br>
</div>
However, I would like Midpoint to also remove members of
the AD group that are added manually, that don't match
members of the Org. Unit. <br>
I tried using <br>
<assignmentPolicyEnforcement>full</assignmentPolicyEnforcement><br>
</div>
inside the Schema Handling for the entitlement, but it
didn't work.<br>
<br>
</div>
Any leads?<br>
</div>
Thanks in advance.<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
midPoint mailing list
<a class="moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com" moz-do-not-send="true">midPoint@lists.evolveum.com</a>
<a class="moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint" moz-do-not-send="true">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
</blockquote>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
midPoint mailing list
<a class="moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a>
<a class="moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Wojciech Staszewski
Administrator Systemów Sieciowych
tel. kom: 663 680 236
<a class="moz-txt-link-abbreviated" href="http://www.diagnostyka.pl">www.diagnostyka.pl</a>
Diagnostyka Sp. z o. o.
ul. Prof. M. Życzkowskiego 16, 31-864 Kraków
Numer KRS: 0000381559 (Sąd Rejonowy dla Krakowa-Śródmieścia w Krakowie, XI Wydział Gospodarczy KRS)
NIP: 675-12-65-009; REGON: 356366975
Kapitał zakładowy: 33 756 500 zł.
Pomyśl o środowisku zanim wydrukujesz ten e-mail.</pre>
</body>
</html>