<div dir="ltr"><div><div dir="ltr" class="gmail_signature"><div dir="ltr">at the resource level config do you have each objectclass defined for each intent that these accounts fall under?</div><div dir="ltr"><br></div><div dir="ltr"><div dir="ltr"> <objectType></div><div dir="ltr"> <displayName>Person Registry Account</displayName></div><div dir="ltr"> <default>true</default></div><div dir="ltr"> <objectClass>ri:inetOrgPerson</objectClass></div><div dir="ltr"> <auxiliaryObjectClass>ri:yourClass1</auxiliaryObjectClass></div><div dir="ltr"> <auxiliaryObjectClass>ri:yourClass2</auxiliaryObjectClass></div><div dir="ltr"> <auxiliaryObjectClass>ri:yourClass3</auxiliaryObjectClass></div><div dir="ltr"><span style="white-space:pre"> </span> </div><div dir="ltr"> <objectType></div><div dir="ltr"> <kind>entitlement</kind></div><div dir="ltr"> <intent>registryGroup</intent></div><div dir="ltr"> <displayName>Person Registry Group</displayName></div><div dir="ltr"> <default>true</default></div><div dir="ltr"> <objectClass>ri:groupOfNames</objectClass></div><div dir="ltr"> <auxiliaryObjectClass>ri:customGrpClass1</auxiliaryObjectClass></div><div dir="ltr"> <auxiliaryObjectClass>ri:customGrpClass2</auxiliaryObjectClass></div></div><div dir="ltr"><br></div><div dir="ltr"><br></div></div></div><br><br></div><br><div class="gmail_quote"><div dir="ltr">On Mon, Aug 27, 2018 at 3:24 PM Andrew Morgan <<a href="mailto:morgan@oregonstate.edu">morgan@oregonstate.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I conducted a further test, and I'm confused by what I'm seeing.<br>
<br>
I set the global Projection Policy to "none". I assigned my 3 roles (Base <br>
ONID, Unix, and Google) to a user. No changes were made to any accounts. <br>
The assignments were present on the user, but no projections were added. <br>
This is what I expected to see. Great!<br>
<br>
Then, I imported the account from the ONIDLDAPDEV resource so that I could <br>
establish the link between the user and the account. The import removed <br>
the role-assigned (from the Unix and Google roles) objectclasses and <br>
attributes! Out of curiosity, I ran a reconciliation on that user - no <br>
changes. Why did the import make any changes to the account??<br>
<br>
Andy Morgan<br>
Systems Administrator, Identity & Access Management<br>
Information Services | Oregon State University<br>
541-737-8877 | <a href="http://is.oregonstate.edu" rel="noreferrer" target="_blank">is.oregonstate.edu</a><br>
<br>
On Mon, 27 Aug 2018, Morgan, Andrew Jason wrote:<br>
<br>
> Yes, you are reading between the lines correctly.<br>
><br>
><br>
> I have 3 resources:<br>
><br>
> 1. GYBONID<br>
><br>
> This is a DatabaseTable resource with only inbound mappings. The table <br>
> is from our Banner system, a system of record that is our single (for now) <br>
> source of identities. I imported these accounts to create approximately <br>
> 113,000 users in midPoint. I have a LiveSync task that processes updates.<br>
><br>
> 2. ONIDLDAPDEV<br>
><br>
> This is an LDAP resource with only outbound mappings.It has approximately <br>
> 80,000 accounts all in the same OU. There are 2 different types of <br>
> accounts: Regular and Retiree. All accounts have the inetOrgPerson <br>
> objectclass plus eduPerson, osuPerson, and lpSghePerson auxiliary <br>
> objectclasses. Regular accounts also have posixAccount, shadowAccount, <br>
> and googlePerson auxiliary objectclasses (Retirees don't get Unix or <br>
> Google).<br>
><br>
> 3. ADDEV<br>
><br>
> This is an LDAP resource with only outbound mappings. It has the same <br>
> number of accounts as ONIDLDAPDEV because our existing provisioning <br>
> scripts create both LDAP and AD accounts at the same time. AD accounts <br>
> all have the same objectclasses. For simplicity, let's ignore this <br>
> resource for now.<br>
><br>
><br>
><br>
> I have 3 roles:<br>
><br>
> 1. Base ONID<br>
><br>
> This role induces the ONIDLDAPDEV and ADDEV resources.<br>
><br>
> 2. Unix<br>
><br>
> This role induces the posixAccount and shadowAccount objectclasses on the <br>
> ONIDLDAPDEV resource and has outbound mappings for their attributes.<br>
><br>
> 3. Google<br>
><br>
> This role induces the googlePerson objectclass on the ONIDLDAPDEV <br>
> resource and has outbound mappings for its attributes.<br>
><br>
><br>
><br>
> When I import an account from ONIDLDAPDEV, the existing user has no roles <br>
> assigned. Midpoint links the account to the user, but it also modifies <br>
> the ONIDLDAPDEV account. Let me summarize what the audit log shows:<br>
><br>
> Deltas:<br>
> LensObjectDeltaOperation<br>
> Delta:<br>
> ObjectDelta<UserType>(UserType:73121f33-ee86-4d09-9769-72acecedea6e,MODIFY):<br>
> metadata/modifyChannel<br>
> REPLACE: <a href="http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import" rel="noreferrer" target="_blank">http://midpoint.evolveum.com/xml/ns/public/provisioning/channels-3#import</a><br>
><br>
> LensObjectDeltaOperation<br>
> Delta:<br>
> ObjectDelta<UserType>(UserType:73121f33-ee86-4d09-9769-72acecedea6e,MODIFY):<br>
> linkRef<br>
> ADD: oid=5ad37e7e-c783-462e-9c1f-8b9eab5816b8(ShadowType)('osuuid=88313159795,ou=people,o=midpointdev')<br>
><br>
> Object name:<br>
> PolyString(88313159795,88313159795)<br>
> Resource: ONID LDAP DEV (ef2bc95b-76e0-48e2-86d6-3d4f02d3e1aa)<br>
><br>
> LensObjectDeltaOperation<br>
> Delta:<br>
> ObjectDelta<ShadowType>(ShadowType:5ad37e7e-c783-462e-9c1f-8b9eab5816b8,MODIFY):<br>
> auxiliaryObjectClass<br>
> DELETE: {...resource/instance-3}posixAccount, {...resource/instance-3}shadowAccount, {...resource/instance-3}googlePerson<br>
> OLD: {...resource/instance-3}posixAccount, {...resource/instance-3}shadowAccount, {...resource/instance-3}osuPerson, {...resource/instance-3}lpSghePerson, {...resource/instance-3}googlePerson, {...resource/instance-3}eduPerson<br>
> attributes/googlePrincipalName<br>
> DELETE: <username>@<a href="http://oregonstate.edu" rel="noreferrer" target="_blank">oregonstate.edu</a><br>
> OLD: <username>@<a href="http://oregonstate.edu" rel="noreferrer" target="_blank">oregonstate.edu</a><br>
> attributes/googleMailEnabled<br>
> DELETE: 1<br>
> OLD: 1<br>
> attributes/gecos<br>
> DELETE: <redacted>,,,<br>
> OLD: <redacted>,,,<br>
> attributes/gidNumber<br>
> DELETE: 300<br>
> OLD: 300<br>
> attributes/loginShell<br>
> DELETE: /bin/bash<br>
> OLD: /bin/bash<br>
> attributes/homeDirectory<br>
> DELETE: /users/u2/a/<username><br>
> OLD: /users/u2/a/<username><br>
> attributes/uidNumber<br>
> DELETE: 7225<br>
> OLD: 7225<br>
><br>
><br>
> It does this even when I have:<br>
><br>
> <globalAccountSynchronizationSettings><br>
> <assignmentPolicyEnforcement>none</assignmentPolicyEnforcement> <br>
> </globalAccountSynchronizationSettings><br>
><br>
><br>
> You can see my resource and role definitions here:<br>
><br>
> <a href="http://people.oregonstate.edu/~morgan/midpoint/" rel="noreferrer" target="_blank">http://people.oregonstate.edu/~morgan/midpoint/</a><br>
><br>
><br>
> How can I import these accounts without midPoint trying to modify them?<br>
><br>
> Thanks,<br>
><br>
> Andy Morgan<br>
> Systems Administrator, Identity & Access Management<br>
> Information Services | Oregon State University<br>
> 541-737-8877 | <a href="http://is.oregonstate.edu" rel="noreferrer" target="_blank">is.oregonstate.edu</a><br>
><br>
> On Sun, 26 Aug 2018, Keith Hazelton wrote:<br>
><br>
>> Not sure I have a full picture of the setup, but I'd suggest looking at this: <a href="https://wiki.evolveum.com/display/midPoint/Mapping+Evaluation+Examples" rel="noreferrer" target="_blank">https://wiki.evolveum.com/display/midPoint/Mapping+Evaluation+Examples</a><br>
>><br>
>><br>
>> The notion of strong and weak attribute mapping seems promising here.<br>
>><br>
>><br>
>> Please correct my picture of how things are set up there. Reading between the lines, I get the sense that before you do anything with the LDAP or AD resources you somehow already have 80,000 user objects in midPoint. Is that correct? If so, how were they created?<br>
>><br>
>> Mapping Evaluation Examples - midPoint - Evolveum Confluence<<a href="https://wiki.evolveum.com/display/midPoint/Mapping+Evaluation+Examples" rel="noreferrer" target="_blank">https://wiki.evolveum.com/display/midPoint/Mapping+Evaluation+Examples</a>><br>
>> <a href="http://wiki.evolveum.com" rel="noreferrer" target="_blank">wiki.evolveum.com</a><br>
>> Resource and Role Attribute Mappings. Resource attribute can be set by several means: manually specified in midPoint user interface, produced by a mapping in a role or in resource schema handling.<br>
>><br>
>><br>
>><br>
>> __________<br>
>><br>
>> email & jabber: <a href="mailto:keith.hazelton@wisc.edu" target="_blank">keith.hazelton@wisc.edu</a> Sr. IT Architect<br>
>><br>
>> calendar: <a href="http://go.wisc.edu/i6zxx0" rel="noreferrer" target="_blank">http://go.wisc.edu/i6zxx0</a><br>
>><br>
>> ________________________________<br>
>> From: midPoint <<a href="mailto:midpoint-bounces@lists.evolveum.com" target="_blank">midpoint-bounces@lists.evolveum.com</a>> on behalf of Andrew Morgan <<a href="mailto:morgan@oregonstate.edu" target="_blank">morgan@oregonstate.edu</a>><br>
>> Sent: Friday, August 24, 2018 7:42:26 PM<br>
>> To: <a href="mailto:midpoint@lists.evolveum.com" target="_blank">midpoint@lists.evolveum.com</a><br>
>> Subject: [midPoint] Standing up midPoint with existing accounts<br>
>><br>
>> I'm looking for advice on standing up midPoint with resources that already<br>
>> have accounts present. I have 1 resource with inbound mappings (a<br>
>> database table) and 2 resources with outbound mappings (AD and LDAP).<br>
>> There are approximately 80,000 accounts in AD and LDAP.<br>
>><br>
>><br>
>> FIRST METHOD TRIED:<br>
>><br>
>> I attempted to import accounts from LDAP in order to link to existing<br>
>> midPoint users and then assign the appropriate roles to match the existing<br>
>> state of the LDAP account.<br>
>><br>
>> When I import an LDAP account, it is linked to the correct midPoint user.<br>
>> However, midPoint strips off the extra objectclasses and attributes that<br>
>> are defined in my roles (not in the LDAP resource). I have tried setting<br>
>> the assignmentPolicyEnforcement to "positive" or "none", but it still<br>
>> happens. No good.<br>
>><br>
>><br>
>> SECOND METHOD TRIED:<br>
>><br>
>> Instead of importing accounts, I tried assigning the roles to the midPoint<br>
>> users to induce the correct resources, objectclasses, and roles. That<br>
>> actually worked great, but I don't know how to get 80,000 shadows into<br>
>> midPoint's repository without importing. I can get 20 shadows created at<br>
>> a time by browsing the Accounts in the LDAP resource, but I don't know how<br>
>> to get all of them. If midPoint doesn't have a shadow when I assign the<br>
>> roles, it tries (and fails) to create a new account. Then, it makes a<br>
>> bunch of modifications to the existing account because it thinks it has<br>
>> changes to process. No good.<br>
>><br>
>><br>
>> NEXT???:<br>
>><br>
>> Maybe I can define the LDAP resource with no outbound mappings, import all<br>
>> the accounts in order to link them to users, assign the correct roles, and<br>
>> then update the LDAP resource to have the outbound mappings...<br>
>><br>
>><br>
>> Is there a wiki page that covers this? I'm running out of ideas... Help!<br>
>><br>
>> Thanks,<br>
>><br>
>> Andy Morgan<br>
>> Systems Administrator, Identity & Access Management<br>
>> Information Services | Oregon State University<br>
>> 541-737-8877 | <a href="http://is.oregonstate.edu" rel="noreferrer" target="_blank">is.oregonstate.edu</a><br>
>> _______________________________________________<br>
>> midPoint mailing list<br>
>> <a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
>> <a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
>><br>
> _______________________________________________<br>
> midPoint mailing list<br>
> <a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
> <a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
</blockquote></div>