<div dir="ltr"><div dir="ltr"><div>Hi Martin,</div><div>Thank you for your response.</div><div>I have tried runAsRef and in my case, this workaround does not work.</div><div>Also, I have tried turn on security logging but I see the same mesage - User not authorized for operation modify for initialPasswordProtected attribute.</div><div>If I tried to use in expressions focus.get... something in another attribute mapping I will receive the same error message for other attributes.</div><div>I have no idea how to solve this problem.<br></div><div><br></div><div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, 13 Feb 2019 at 11:18, Martin Lízner - AMI Praha a.s. <<a href="mailto:martin.lizner@ami.cz">martin.lizner@ami.cz</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr">Hi, I suggest you turn on security logging. This will tell you exact autz request that mp is evaluating. Before you turn it on I advice that each authorization has its <name>.</div><div dir="ltr"><br></div><div dir="ltr"><span style="color:rgb(0,0,0);font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;font-size:14px;white-space:nowrap">com.evolveum.midpoint.security: TRACE</span> <br><div><br></div><div><a href="https://wiki.evolveum.com/display/midPoint/Troubleshooting+Authorizations" target="_blank">https://wiki.evolveum.com/display/midPoint/Troubleshooting+Authorizations</a></div><div><br></div><div>Also there is a workaround... you can run mapping under superuser using runAsRef. But be careful with it.</div><div><br></div><div>M.<br clear="all"><div><div dir="ltr" class="gmail-m_-5493733631435205831gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:13px"><p><strong>Martin Lízner</strong><br><span style="font-size:11px;color:rgb(128,128,128)">chief solution architect</span></p></div><p style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:11px">gsm: [+420] 737 745 571<br>e‑mail: <a href="mailto:martin.lizner@ami.cz" target="_blank">martin.lizner@ami.cz</a></p><p style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:11px"><strong>AMI Praha a.s.</strong><br>Pláničkova 11, 162 00 Praha 6</p><p style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:11px">tel.: [+420] 274 783 239 | web: <a href="http://www.ami.cz" target="_blank">www.ami.cz</a></p><p style="color:rgb(0,0,0);font-family:Verdana,Arial,Helvetica,sans-serif;font-size:10px;margin-top:20px"><img src="http://www.ami.cz/images/podpis/ami_logo.gif" alt="AMI Praha a.s." style="border: 0px none;"></p><p style="font-family:Arial,sans-serif;font-size:11px;color:rgb(170,170,170)">Textem tohoto e‑mailu podepisující neslibuje uzavřít ani neuzavírá za společnost AMI Praha a.s.<br>jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně písemnou formu.<br><span style="font-size:6px"> </span><br>Tento e‑mail je určen výhradně pro potřeby jeho adresáta/ů a může obsahovat důvěrné nebo osobní<br>informace. Nejste‑li zamýšleným příjemcem, je zakázáno jakékoliv zveřejňování, zprostředkování<br>nebo jiné použití těchto informací. Pokud jste obdrželi e‑mail neoprávněně, informujte o tom prosím<br>odesílatele a vymažte neprodleně všechny kopie tohoto e‑mailu včetně všech jeho příloh. Nakládáním<br>s neoprávněně získanými informacemi se vystavujete riziku právního postihu.</p></div></div></div></div></div></div></div></div></div></div></div></div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">út 5. 2. 2019 v 15:05 odesílatel Oleksandr Nekriach <<a href="mailto:o.nekriach@dynatech.lv" target="_blank">o.nekriach@dynatech.lv</a>> napsal:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div>Hi to all,</div><div>I have faced with authorization problem and can't understand what is wrong.</div><div><br></div><div>I have a mapping in an object template that updates custom field initialPasswordProtected and this field is hidden for a creator. But every time when I create a user (creator has a custom role HelpDesk) I have got an error message</div><div>User not authorized for operation <a href="http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify" target="_blank">http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</a> <br></div><div><br></div><div>There is problem mapping (I have Midpoint version 3.7.2)<br></div><div> <mapping><br> <description>Copy initial password</description><br> <tolerant>false</tolerant><br> <strength>strong</strength><br> <expression><br> <script xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance" target="_blank">http://www.w3.org/2001/XMLSchema-instance</a>"<br> xsi:type="c:ScriptExpressionEvaluatorType"><br> <code><br> if(focus!=null && focus.getCredentials() != null && focus.getCredentials().getPassword() !=null){<br> return focus.getCredentials().getPassword().getValue();<br> }<br> </code><br> </script><br> </expression><br> <target><br> <c:path>extension/initialPasswordProtected</c:path><br> </target><br> </mapping> <br></div><div><br></div><div>When I <span class="gmail-m_-5493733631435205831gmail-m_8451878646676177375gmail-tlid-translation gmail-m_-5493733631435205831gmail-m_8451878646676177375gmail-translation"><span title="" class="gmail-m_-5493733631435205831gmail-m_8451878646676177375gmail-">simplified</span></span> this mapping (see mapping below), everything works fine.</div><br><div> <mapping><br> <description>Copy initial password</description><br> <tolerant>false</tolerant><br> <strength>strong</strength><br> <source> <br> <c:path>credentials/password/value</c:path><br> </source><br> <target><br> <c:path>extension/initialPasswordProtected</c:path><br> </target><br> </mapping><br></div><div><br></div><div>Helpdesk role has no restriction to modify this attribute in both phases for <br></div><div><action><a href="http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read" target="_blank">http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</a></action></div><div><action><a href="http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add" target="_blank">http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add</a></action><br></div><div><action><a href="http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify" target="_blank">http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</a></action></div><div></div><div><br></div><div>Schema of attribute: <br></div><div> <mapping><br> <description>Copy initial password</description><br> <tolerant>false</tolerant><br> <strength>strong</strength><br> <source> <br> <c:path>credentials/password/value</c:path><br> </source><br> <target><br> <c:path>extension/initialPasswordProtected</c:path><br> </target><br> </mapping><br></div><div><br></div><div><br></div><div><div> </div><div>Please help me to understand what is wrong with authorization.</div><div>Thank you in advance<br></div></div><div><br></div><div><br></div><div>-- <br><div dir="ltr" class="gmail-m_-5493733631435205831gmail-m_8451878646676177375gmail_signature"><div dir="ltr"><div><div dir="ltr"><span style="color:rgb(76,76,76)">Best regards, <br><br><img src="cid:o.nekriach@dynatech.lv1520941785292-7770"> <br><br>Oleksandr Nekriach | Identity and access management engineer <br><br>Dynatech, <a href="https://www.google.com/maps/place/DYNATECH/@56.9575205,24.1107235,17z/data=!3m1!4b1!4m5!3m4!1s0x46eecf5753e42351:0x23b120b9745cae62!8m2!3d56.9575205!4d24.1129122" target="_blank">Jeruzalemes iela 1, Rīga, LV-1010, Latvia</a><br><br><div style="display:inline-block"><a href="tel:+371%2025%20314%20685" value="+37125314685" target="_blank">+37125314685</a></div>,<div style="display:inline-block"><a href="mailto:o.nekriach@dynatech.lv" target="_blank">o.nekriach@dynatech.lv</a></div>|<div style="display:inline-block"><a href="http://www.dynatech.lv" target="_blank">www.dynatech.lv</a></div> <br><br>Stay connected: <br><div style="display:inline-block;margin:5px 5px 0px 0px"><a href="https://www.facebook.com/DynatechLatvia/?ref=br_rs" target="_blank"><img src="cid:o.nekriach@dynatech.lv1520941785292-7771"></a></div><div style="display:inline-block;margin:5px 0px 0px"><a href="https://www.linkedin.com/company-beta/17893047/" target="_blank"><img src="cid:o.nekriach@dynatech.lv1520941785292-7772"></a></div><br><br><span style="font-size:11px;color:rgb(161,161,161)">Confidentiality Notice: This message contains confidential information and is intended only for the named recipient(s). If you are not the addressee you may not copy, distribute or perform any other activities with this information. If you have received this transmission in error, please notify us by e-mail immediately. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses.</span></span></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
</blockquote></div>
_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
</blockquote></div><br clear="all"><br>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><span style="color:rgb(76,76,76)">Best regards, <br><br><img src="cid:o.nekriach@dynatech.lv1520941785292-7770"> <br><br>Oleksandr Nekriach | Identity and access management engineer <br><br>Dynatech, <a href="https://www.google.com/maps/place/DYNATECH/@56.9575205,24.1107235,17z/data=!3m1!4b1!4m5!3m4!1s0x46eecf5753e42351:0x23b120b9745cae62!8m2!3d56.9575205!4d24.1129122" target="_blank">Jeruzalemes iela 1, Rīga, LV-1010, Latvia</a><br><br><div style="display:inline-block"><a href="tel:+371%2025%20314%20685" value="+37125314685" target="_blank">+37125314685</a></div>, <div style="display:inline-block"><a href="mailto:o.nekriach@dynatech.lv" target="_blank">o.nekriach@dynatech.lv</a></div> | <div style="display:inline-block"><a href="http://www.dynatech.lv" target="_blank">www.dynatech.lv</a></div> <br><br>Stay connected: <br><div style="display:inline-block;margin:5px 5px 0px 0px"><a href="https://www.facebook.com/DynatechLatvia/?ref=br_rs" target="_blank"><img src="cid:o.nekriach@dynatech.lv1520941785292-7771"></a></div><div style="display:inline-block;margin:5px 0px 0px"><a href="https://www.linkedin.com/company-beta/17893047/" target="_blank"><img src="cid:o.nekriach@dynatech.lv1520941785292-7772"></a></div><br><br><span style="font-size:11px;color:rgb(161,161,161)">Confidentiality
Notice: This message contains confidential information and is intended
only for the named recipient(s). If you are not the addressee you may
not copy, distribute or perform any other activities with this
information. If you have received this transmission in error, please
notify us by e-mail immediately. E-mail transmission cannot be
guaranteed to be secure or error-free as information could be
intercepted, corrupted, lost, destroyed, arrive late or incomplete, or
contain viruses.</span></span></div></div></div></div>