<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:rgb(0,0,0); font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols">
<p style="margin-top:0; margin-bottom:0">Not sure I have a full picture of the setup, but I'd suggest looking at this: <a href="https://wiki.evolveum.com/display/midPoint/Mapping+Evaluation+Examples" class="OWAAutoLink" id="LPlnk621580" previewremoved="true">https://wiki.evolveum.com/display/midPoint/Mapping+Evaluation+Examples</a> </p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0; margin-bottom:0">The notion of strong and weak attribute mapping seems promising here.</p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0; margin-bottom:0">Please correct my picture of how things are set up there. Reading between the lines, I get the sense that before you do anything with the LDAP or AD resources you somehow already have 80,000 user objects in midPoint.
Is that correct? If so, how were they created?</p>
<div id="LPBorder_GT_15353248220160.4665470635322746" style="margin-bottom:20px; overflow:auto; width:100%; text-indent:0px">
<table id="LPContainer_15353248220020.7359490625597847" cellspacing="0" style="width:90%; background-color:rgb(255,255,255); overflow:auto; padding-top:20px; padding-bottom:20px; margin-top:20px; border-top:1px dotted rgb(200,200,200); border-bottom:1px dotted rgb(200,200,200)">
<tbody>
<tr valign="top" style="border-spacing:0px">
<td id="TextCell_15353248220080.8959699036960589" colspan="2" style="vertical-align: top; padding: 0px; display: table-cell; position: relative;">
<div id="LPRemovePreviewContainer_15353248220080.349693665650576"></div>
<div id="LPTitle_15353248220080.3400475824635296" style="top:0px; color:rgb(153,0,0); font-weight:400; font-size:21px; font-family:wf_segoe-ui_light,"Segoe UI Light","Segoe WP Light","Segoe UI","Segoe WP",Tahoma,Arial,sans-serif; line-height:21px">
<a id="LPUrlAnchor_15353248220110.2858552233637517" href="https://wiki.evolveum.com/display/midPoint/Mapping+Evaluation+Examples" target="_blank" style="text-decoration:none">Mapping Evaluation Examples - midPoint - Evolveum Confluence</a></div>
<div id="LPMetadata_15353248220120.6625676983735787" style="margin:10px 0px 16px; color:rgb(102,102,102); font-weight:400; font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif; font-size:14px; line-height:14px">
wiki.evolveum.com</div>
<div id="LPDescription_15353248220140.7077227885518427" style="display:block; color:rgb(102,102,102); font-weight:400; font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif; font-size:14px; line-height:20px; max-height:100px; overflow:hidden">
Resource and Role Attribute Mappings. Resource attribute can be set by several means: manually specified in midPoint user interface, produced by a mapping in a role or in resource schema handling.</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<p style="margin-top:0; margin-bottom:0"><span style="font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols; font-size:12pt">__________</span></p>
<div id="Signature">
<div id="divtagdefaultwrapper" style="font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255); font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols">
<p>email & jabber: keith.hazelton@wisc.edu Sr. IT Architect</p>
<p>calendar: <a href="http://go.wisc.edu/i6zxx0" id="LPNoLP">http://go.wisc.edu/i6zxx0</a></p>
</div>
</div>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> midPoint <midpoint-bounces@lists.evolveum.com> on behalf of Andrew Morgan <morgan@oregonstate.edu><br>
<b>Sent:</b> Friday, August 24, 2018 7:42:26 PM<br>
<b>To:</b> midpoint@lists.evolveum.com<br>
<b>Subject:</b> [midPoint] Standing up midPoint with existing accounts</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">I'm looking for advice on standing up midPoint with resources that already
<br>
have accounts present. I have 1 resource with inbound mappings (a <br>
database table) and 2 resources with outbound mappings (AD and LDAP). <br>
There are approximately 80,000 accounts in AD and LDAP.<br>
<br>
<br>
FIRST METHOD TRIED:<br>
<br>
I attempted to import accounts from LDAP in order to link to existing <br>
midPoint users and then assign the appropriate roles to match the existing <br>
state of the LDAP account.<br>
<br>
When I import an LDAP account, it is linked to the correct midPoint user. <br>
However, midPoint strips off the extra objectclasses and attributes that <br>
are defined in my roles (not in the LDAP resource). I have tried setting <br>
the assignmentPolicyEnforcement to "positive" or "none", but it still <br>
happens. No good.<br>
<br>
<br>
SECOND METHOD TRIED:<br>
<br>
Instead of importing accounts, I tried assigning the roles to the midPoint <br>
users to induce the correct resources, objectclasses, and roles. That <br>
actually worked great, but I don't know how to get 80,000 shadows into <br>
midPoint's repository without importing. I can get 20 shadows created at <br>
a time by browsing the Accounts in the LDAP resource, but I don't know how <br>
to get all of them. If midPoint doesn't have a shadow when I assign the <br>
roles, it tries (and fails) to create a new account. Then, it makes a <br>
bunch of modifications to the existing account because it thinks it has <br>
changes to process. No good.<br>
<br>
<br>
NEXT???:<br>
<br>
Maybe I can define the LDAP resource with no outbound mappings, import all <br>
the accounts in order to link them to users, assign the correct roles, and <br>
then update the LDAP resource to have the outbound mappings...<br>
<br>
<br>
Is there a wiki page that covers this? I'm running out of ideas... Help!<br>
<br>
Thanks,<br>
<br>
Andy Morgan<br>
Systems Administrator, Identity & Access Management<br>
Information Services | Oregon State University<br>
541-737-8877 | is.oregonstate.edu<br>
_______________________________________________<br>
midPoint mailing list<br>
midPoint@lists.evolveum.com<br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" id="LPlnk813426" class="OWAAutoLink" previewremoved="true">http://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
</div>
</span></font></div>
</div>
</body>
</html>