<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hi!</p>
<p>I thought about adding multiple first order inducements for each
account intent with weak strength to the "associationFromLink"
metarole,<br>
but what if the accounts (of one user in multiple intents) must
have different privileges (entilements)?<br>
When I assign a role that gives entitlement X, it will be applied
to every user account on this resource, i think.</p>
<p>Another way I tried is to assign the "associationFromLink"
metarole to the role that provisions account creation,<br>
and the role with linkRef pointing to the entitlement shadow as
separate user assignment, but it don't work.<br>
I think (but I don't know exactly) that "associationFromLink" is
limited to one assignment chain so the linkRef and
associationFromLink<br>
must be in the same chain. But maybe I'm wrong...?<br>
</p>
<p>I'm stuck here and see no good solution for now.</p>
<p>Best regards!<br>
WS<br>
</p>
<br>
<div class="moz-cite-prefix">W dniu 29.12.2017 o 15:08, Alcides
Carlos de Moraes Neto pisze:<br>
</div>
<blockquote type="cite"
cite="mid:CAMLLNmmXVenFEXW4+MJ035zbmx7+0tE5tH_e3iMjOO0edT+W8Q@mail.gmail.com">
<div dir="ltr">
<div>Hi WS,<br>
<br>
</div>
In your role template, have you tried adding multiple
inducements with an association for each entitlement? I don't
see why that wouldn't work.<br>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">2017-12-28 13:54 GMT-02:00 Wojciech
Staszewski <span dir="ltr"><<a
href="mailto:wojciech.staszewski@diagnostyka.pl"
target="_blank" moz-do-not-send="true">wojciech.staszewski@diagnostyka.pl</a>></span>:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">Hello!<br>
<br>
I'm looking for correct way how to correctly import resource
entitlements into midPoint roles.<br>
<br>
For now I'm doing this as follows:<br>
1) create schema handling for entitlement.<br>
2) create synchronization.<br>
3) At the "unmatched->addFocus" synchronization step I
connect a role template. The template assigns metaroles to
the imported roles for:<br>
a) association from link (as the imported roles are just
linkRef only),<br>
b) approval schema,<br>
c) and assigns correct OrgUnit in the role catalog, based
on resource, role type and other "things".<br>
<br>
That works just perfect, but for one account intent only.
The account intent is statically specified in "association
from link" metarole in the first order inducement.<br>
If is not, the metarole works for "default" account intent.<br>
But I have 8 account intents in this resource, and every
account must be associated with the entitlements regardless
of the intent.<br>
<br>
I tried to make more than one "unmatched->addFocus"
synchronization reaction with different role templates<br>
with hope for importing 8 roles from one entitlement for
different account intents but midPoint warns me: "Duplicated
reactions [...]".<br>
I cannot just add multiple "actions" to one reaction because
I can apply only one template to one reaction.<br>
<br>
And I don't know how to do it.<br>
Any ideas?<br>
Beer is on me for the help!<br>
<br>
Happy NY!<br>
WS<br>
______________________________<wbr>_________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com"
moz-do-not-send="true">midPoint@lists.evolveum.com</a><br>
<a
href="http://lists.evolveum.com/mailman/listinfo/midpoint"
rel="noreferrer" target="_blank" moz-do-not-send="true">http://lists.evolveum.com/<wbr>mailman/listinfo/midpoint</a><br>
</blockquote>
</div>
<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
midPoint mailing list
<a class="moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a>
<a class="moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Wojciech Staszewski
Administrator Systemów Sieciowych
tel. kom: 663 680 236
<a class="moz-txt-link-abbreviated" href="http://www.diagnostyka.pl">www.diagnostyka.pl</a>
Diagnostyka Sp. z o. o.
ul. Prof. M. Życzkowskiego 16, 31-864 Kraków
Numer KRS: 0000381559 (Sąd Rejonowy dla Krakowa-Śródmieścia w Krakowie, XI Wydział Gospodarczy KRS)
NIP: 675-12-65-009; REGON: 356366975
Kapitał zakładowy: 33 756 500 zł.
Pomyśl o środowisku zanim wydrukujesz ten e-mail.</pre>
</body>
</html>