<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1794135051;
mso-list-type:hybrid;
mso-list-template-ids:2110011992 -106644208 67895299 67895301 67895297 67895299 67895301 67895297 67895299 67895301;}
@list l0:level1
{mso-level-start-at:2;
mso-level-number-format:bullet;
mso-level-text:-;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Calibri",sans-serif;
mso-fareast-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="FR" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hello,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-US">I am testing the management of identities and groups to populate an Active Directory and an openLDAP from a database.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">In Midpoint, users are created and assigned to organizations.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">In the AD resource, I achieve to create them as well and replicate the assignments with association.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">But I need some help to parameter the association in the resource to openLDAP.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Users and groups (with a dummy account in member parameter) are created correctly.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">The relation in openLDAP is not made : the association do not replicate the assignments between users and organizations.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">How can I parameter the association to replicate this link ?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">It seems as the resource is not using the association at all.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">You can see below each objectType minus all the attributes.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><objectType><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <kind>account</kind><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <displayName>Normal Account</displayName><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <default>true</default><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <objectClass>ri:inetOrgPerson</objectClass><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> </span><auxiliaryObjectClass>ri:eduPerson</auxiliaryObjectClass><o:p></o:p></p>
<p class="MsoNormal"> <auxiliaryObjectClass>ri:supannPerson</auxiliaryObjectClass><o:p></o:p></p>
<p class="MsoNormal"> <span lang="EN-US"><auxiliaryObjectClass>ri:posixAccount</auxiliaryObjectClass><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> …<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> …<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> …<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <association><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <ref>ri:group</ref><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <displayName>LDAP Group Membership</displayName><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <kind>entitlement</kind><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <intent>ldapGroup</intent><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> </span><direction>objectToSubject</direction><o:p></o:p></p>
<p class="MsoNormal"> <associationAttribute>ri:member</associationAttribute><o:p></o:p></p>
<p class="MsoNormal"> <valueAttribute>ri:dn</valueAttribute><o:p></o:p></p>
<p class="MsoNormal"> <span lang="EN-US"></association><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> …<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> …<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> …<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><objectType><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><objectType><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <kind>entitlement</kind><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <intent>ldapGroup</intent><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <displayName>LDAP Group</displayName><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <objectClass>ri:groupOfNames</objectClass><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <baseContext><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <objectClass>ri:organizationalUnit</objectClass><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <filter><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <q:equal><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <q:path>attributes/dn</q:path><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <q:value>ou=groups,dc=univ-lyon1,dc=fr</q:value><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> </q:equal><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> </filter><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> </baseContext><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> …<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> …<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> …<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><objectType><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Case 1 : I specify a dummy user into the attribute member of the entitlement objectType. The group is created but with only the dummy member.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><attribute><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <ref>ri:member</ref><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <fetchStrategy>minimal</fetchStrategy><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <outbound><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <strength>weak</strength><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <expression><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <value>cn=fake,dc=evolveum,dc=net</value><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> </expression><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> </outbound><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"></attribute><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Case 2 : no member attribute. The group cannot be created because member is needed for the creation.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:FR">Thanks.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:FR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:FR">Antoine.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:FR"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</body>
</html>