<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Andy,</p>
<p>just a quick shot as I have to go away just now:</p>
<p>
<blockquote type="cite">SECOND METHOD TRIED:
<br>
<br>
Instead of importing accounts, I tried assigning the roles to
the midPoint users to induce the correct resources,
objectclasses, and roles. That actually worked great, but I
don't know how to get 80,000 shadows into midPoint's repository
without importing. I can get 20 shadows created at a time by
browsing the Accounts in the LDAP resource, but I don't know how
to get all of them. If midPoint doesn't have a shadow when I
assign the roles, it tries (and fails) to create a new account.
Then, it makes a bunch of modifications to the existing account
because it thinks it has changes to process. No good.
<br>
</blockquote>
A quick method of account creation is to run import from that
resource with <b>dryRun</b> option set. It should do nothing
except for creating the shadows. :)</p>
<pre class="moz-signature" cols="72">Pavol Mederly
Software developer
evolveum.com
</pre>
<div class="moz-cite-prefix">On 25.08.2018 2:42, Andrew Morgan
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:alpine.DEB.2.11.1808241707020.839@shell.onid.oregonstate.edu">I'm
looking for advice on standing up midPoint with resources that
already have accounts present. I have 1 resource with inbound
mappings (a database table) and 2 resources with outbound mappings
(AD and LDAP). There are approximately 80,000 accounts in AD and
LDAP.
<br>
<br>
<br>
FIRST METHOD TRIED:
<br>
<br>
I attempted to import accounts from LDAP in order to link to
existing midPoint users and then assign the appropriate roles to
match the existing state of the LDAP account.
<br>
<br>
When I import an LDAP account, it is linked to the correct
midPoint user. However, midPoint strips off the extra
objectclasses and attributes that are defined in my roles (not in
the LDAP resource). I have tried setting the
assignmentPolicyEnforcement to "positive" or "none", but it still
happens. No good.
<br>
<br>
<br>
SECOND METHOD TRIED:
<br>
<br>
Instead of importing accounts, I tried assigning the roles to the
midPoint users to induce the correct resources, objectclasses, and
roles. That actually worked great, but I don't know how to get
80,000 shadows into midPoint's repository without importing. I
can get 20 shadows created at a time by browsing the Accounts in
the LDAP resource, but I don't know how to get all of them. If
midPoint doesn't have a shadow when I assign the roles, it tries
(and fails) to create a new account. Then, it makes a bunch of
modifications to the existing account because it thinks it has
changes to process. No good.
<br>
<br>
<br>
NEXT???:
<br>
<br>
Maybe I can define the LDAP resource with no outbound mappings,
import all the accounts in order to link them to users, assign the
correct roles, and then update the LDAP resource to have the
outbound mappings...
<br>
<br>
<br>
Is there a wiki page that covers this? I'm running out of
ideas... Help!
<br>
<br>
Thanks,
<br>
<br>
Andy Morgan
<br>
Systems Administrator, Identity & Access Management
<br>
Information Services | Oregon State University
<br>
541-737-8877 | is.oregonstate.edu
<br>
_______________________________________________
<br>
midPoint mailing list
<br>
<a class="moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a>
<br>
<a class="moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
<br>
</blockquote>
<br>
</body>
</html>