<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;" dir="ltr">
<p style="margin-top:0;margin-bottom:0">Hi,</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">Here is our complete ACI. We make our OpenLDAP installation and configuration following this
<a href="https://wiki.evolveum.com/display/midPoint/OpenLDAP+Installation+and+Configuration" class="OWAAutoLink" id="LPlnk807863" previewremoved="true">
wiki article</a>:</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0"></p>
<div>dn: olcDatabase={1}mdb,cn=config</div>
<div>changetype: modify</div>
<div>replace: olcAccess</div>
<div><span style="background-color: rgb(255, 255, 0);">olcAccess: to attrs=userPassword dn.subtree="ou=people,dc=ldap,dc=pisnismiehet,dc=local" filter="(midPointAccountStatus=disabled)" by dn.subtree="ou=unixgroups,dc=ldap,dc=pisnismiehet,dc=local" none by
anonymous none by * break</span></div>
<div>olcAccess: to attrs=userPassword,shadowLastChange by dn="cn=idm,ou=Administrators,dc=ldap,dc=pisnismiehet,dc=local" write by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth write by anonymous auth by self write by * none</div>
<div>olcAccess: to dn.base="" by * read</div>
<div>olcAccess: to dn.subtree="ou=people,dc=ldap,dc=pisnismiehet,dc=local" by dn="cn=idm,ou=Administrators,dc=ldap,dc=pisnismiehet,dc=local" write</div>
<div>olcAccess: to dn.subtree="ou=groups,dc=ldap,dc=pisnismiehet,dc=local" by dn="cn=idm,ou=Administrators,dc=ldap,dc=pisnismiehet,dc=local" write</div>
<div>olcAccess: to dn.subtree="ou=unixgroups,dc=ldap,dc=pisnismiehet,dc=local" by dn="cn=idm,ou=Administrators,dc=ldap,dc=pisnismiehet,dc=local" write</div>
<div>olcAccess: to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth write by dn="cn=idm,ou=Administrators,dc=ldap,dc=pisnismiehet,dc=local" read by self read by * none</div>
<div><br>
</div>
We add the yellow line above according to <a href="https://github.com/Evolveum/midpoint/blob/master/samples/resources/openldap/olcAccess.ldif" class="OWAAutoLink" id="LPlnk145890" previewremoved="true">
this</a> but no luck. Disabled users on MidPoint can still login to Linux Server and Desktop via OpenLDAP. We added midpoint.schema to our OpenLDAP successfully.
<p></p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">Is that yellow line correct? Should I add or modify something else?</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">Best Regards,</p>
<p style="margin-top:0;margin-bottom:0">Jan Parttimaa</p>
<p style="margin-top:0;margin-bottom:0"><br>
<br>
</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<div id="Signature">
<div id="divtagdefaultwrapper" dir="ltr" style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 12pt; background-color: rgb(255, 255, 255);">
<p><span style="color:rgb(0,0,0)"><i><span style="font-family:Calibri,Arial,Helvetica,sans-serif">Jan Parttimaa</span></i></span></p>
<span style="font-family:Calibri,Arial,Helvetica,sans-serif"></span><span style="color:rgb(0,0,0)"><i></i></span><span style="font-family:Calibri,Arial,Helvetica,sans-serif"></span>
<p><span style="color:rgb(0,0,0)"><i><span style="font-family:Calibri,Arial,Helvetica,sans-serif">1602738,</span></i></span></p>
<span style="font-family:Calibri,Arial,Helvetica,sans-serif"></span><span style="color:rgb(0,0,0)"><i></i></span><span style="font-family:Calibri,Arial,Helvetica,sans-serif"></span>
<p><span style="color:rgb(0,0,0)"><i><span style="font-family:Calibri,Arial,Helvetica,sans-serif">Tietojenkäsittelyn koulutusohjelma,</span></i></span></p>
<span style="font-family:Calibri,Arial,Helvetica,sans-serif"></span><span style="color:rgb(0,0,0)"><i></i></span><span style="font-family:Calibri,Arial,Helvetica,sans-serif"></span>
<p><span style="color:rgb(0,0,0)"><i><span style="font-family:Calibri,Arial,Helvetica,sans-serif">Haaga-Helia ammattikorkeakoulu</span><span style="font-family:Calibri,Arial,Helvetica,sans-serif"></span><span style="font-family:Calibri,Arial,Helvetica,sans-serif">,
Pasilan kampus</span></i></span></p>
</div>
</div>
<br>
<br>
<div style="color: rgb(0, 0, 0);">
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>Lähettäjä:</b> midPoint <midpoint-bounces@lists.evolveum.com> käyttäjän Parttimaa Jan <jan.parttimaa@myy.haaga-helia.fi> puolesta<br>
<b>Lähetetty:</b> tiistai 27. marraskuuta 2018 8.45<br>
<b>Vastaanottaja:</b> gustav.palos@evolveum.com; midPoint General Discussion<br>
<b>Aihe:</b> Re: [midPoint] Disable OpenLDAP Users on MidPoint</font>
<div> </div>
</div>
<div lang="FI" link="blue" vlink="purple">
<div class="x_WordSection1">
<p class="x_MsoNormal"><span style="">Hi,</span></p>
<p class="x_MsoNormal"><span style=""> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="">I checked that and I add this to aci.ldif but no luck:</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style=""> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="">olcAccess: to attrs=userPassword dn.subtree="ou=people,dc=ldap,dc=pisnismiehet,dc=local" filter="(midPointAccountStatus=disabled)" by dn.subtree="ou=unixgroups,dc=ldap,dc=pisnismiehet,dc=local" none by anonymous
none by * break</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style=""> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="">Disabled user can still login to Linux via OpenLDAP.</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style=""> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="">We did OpenLDAP installation and configuration following this
<a href="https://wiki.evolveum.com/display/midPoint/OpenLDAP+Installation+and+Configuration" id="LPlnk232975" class="OWAAutoLink" previewremoved="true">
wiki article</a>.</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style=""> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="">Not sure is that ACI row above correct or not.</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style=""> </span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="">Best Regards,</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style="">Jan Parttimaa</span></p>
<p class="x_MsoNormal"><span lang="EN-US" style=""> </span></p>
<p class="x_MsoNormal" style="background:white"><i><span style="font-size:12.0pt; color:black">Jan Parttimaa</span></i><span style="font-size:12.0pt; color:black"></span></p>
<p class="x_MsoNormal" style="background:white"><i><span style="font-size:12.0pt; color:black">1602738,</span></i><span style="font-size:12.0pt; color:black"></span></p>
<p class="x_MsoNormal" style="background:white"><i><span style="font-size:12.0pt; color:black">Tietojenkäsittelyn koulutusohjelma,</span></i><span style="font-size:12.0pt; color:black"></span></p>
<p class="x_MsoNormal" style="background:white"><i><span style="font-size:12.0pt; color:black">Haaga-Helia ammattikorkeakoulu, Pasilan kampus</span></i><span style="font-size:12.0pt; color:black"></span></p>
<p class="x_MsoNormal"><span style=""> </span></p>
<p class="x_MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> midPoint <midpoint-bounces@lists.evolveum.com>
<b>On Behalf Of </b>Pálos Gustáv<br>
<b>Sent:</b> maanantai 26. marraskuuta 2018 22.55<br>
<b>To:</b> midPoint General Discussion <midpoint@lists.evolveum.com><br>
<b>Subject:</b> Re: [midPoint] Disable OpenLDAP Users on MidPoint</span></p>
<p class="x_MsoNormal"> </p>
<div>
<div>
<p class="x_MsoNormal">Hi Jan,</p>
<div>
<p class="x_MsoNormal"> </p>
</div>
<div>
<p class="x_MsoNormal">please see:</p>
</div>
<div>
<p class="x_MsoNormal"><a href="https://wiki.evolveum.com/display/midPoint/Recommended+OpenLDAP+Structure#RecommendedOpenLDAPStructure-AccountDisableMechanism" id="LPlnk734185" class="OWAAutoLink" previewremoved="true">https://wiki.evolveum.com/display/midPoint/Recommended+OpenLDAP+Structure#RecommendedOpenLDAPStructure-AccountDisableMechanism</a></p>
</div>
<div>
<p class="x_MsoNormal"> </p>
</div>
<div>
<p class="x_MsoNormal">Best regards,</p>
</div>
<div>
<p class="x_MsoNormal"> </p>
</div>
<div>
<p class="x_MsoNormal">Gustav</p>
</div>
</div>
</div>
<p class="x_MsoNormal"> </p>
<div>
<div>
<p class="x_MsoNormal">po 26. 11. 2018 o 19:57 Parttimaa Jan <<a href="mailto:jan.parttimaa@myy.haaga-helia.fi" id="LPlnk98612" class="OWAAutoLink" previewremoved="true">jan.parttimaa@myy.haaga-helia.fi</a>> napísal(a):</p>
</div>
<blockquote style="border:none; border-left:solid #CCCCCC 1.0pt; padding:0cm 0cm 0cm 6.0pt; margin-left:4.8pt; margin-right:0cm">
<div>
<div>
<p class="x_MsoNormal" style="">Hi,</p>
<p class="x_MsoNormal" style=""> </p>
<p class="x_MsoNormal" style=""><span lang="EN-US">I read that disable OpenLDAP users in MidPoint can be pain in a ass. How do you disable OpenLDAP users in MidPoint? Any tips and tricks about this?</span></p>
<p class="x_MsoNormal" style=""><span lang="EN-US"> </span></p>
<p class="x_MsoNormal" style=""><span lang="EN-US">Best Regards,</span></p>
<p class="x_MsoNormal" style=""><span lang="EN-US">Jan Parttimaa</span></p>
<p class="x_MsoNormal" style=""><span lang="EN-US"> </span></p>
<p class="x_MsoNormal" style="background:white"><i><span style="font-size:12.0pt; color:black">Jan Parttimaa</span></i></p>
<p class="x_MsoNormal" style="background:white"><i><span style="font-size:12.0pt; color:black">1602738,</span></i></p>
<p class="x_MsoNormal" style="background:white"><i><span style="font-size:12.0pt; color:black">Tietojenkäsittelyn koulutusohjelma,</span></i></p>
<p class="x_MsoNormal" style="background:white"><i><span style="font-size:12.0pt; color:black">Haaga-Helia ammattikorkeakoulu, Pasilan kampus</span></i></p>
<p class="x_MsoNormal" style=""> </p>
</div>
</div>
<p class="x_MsoNormal">_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank" id="LPlnk493832" class="OWAAutoLink" previewremoved="true">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" target="_blank" id="LPlnk395671" class="OWAAutoLink" previewremoved="true">http://lists.evolveum.com/mailman/listinfo/midpoint</a></p>
</blockquote>
</div>
<p class="x_MsoNormal"><br clear="all">
</p>
<div>
<p class="x_MsoNormal"> </p>
</div>
<p class="x_MsoNormal">-- </p>
<div>
<div>
<div>
<p class="x_MsoNormal">Gustáv Pálos</p>
</div>
<div>
<p class="x_MsoNormal">Identity Engineer</p>
</div>
<p class="x_MsoNormal"><a href="http://evolveum.com/" target="_blank" id="LPlnk455883" class="OWAAutoLink" previewremoved="true"><span style="font-size:9.5pt; color:#1155CC">evolveum.com</span></a></p>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>