<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head><body text="#000000" bgcolor="#FFFFFF">Thanks for all the 
suggestions.  I did finally get it working.<br>
Just to document the solution:<br>
<br>
My problem was having the baseContext in the connectorConfiguration set 
too far down the tree.  I had set it for ou=users, and the groups branch
 was above that in the tree.  Once I made that change, it all worked as 
expected.<br>
<br>
Brad<br>
<br>
<span>Brad Firestone wrote on 5/17/19 11:08 AM:</span><br>
<blockquote type="cite" 
cite="mid:c48b6d7b-5291-3ec7-0fef-5b7f0d5617d8@gmail.com">
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">

Hi Oleksandr,<br>

Thanks for the response!!<br>

I guess I should have posted the connectorConfiguration section too.  
I've already included memberOf.  Here's that section of the LDAP 
Resource:<br>

  <br>

 <connectorConfiguration <br>

            
xmlns:icfc=<a class="moz-txt-link-rfc2396E" 
href="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/connector-schema-3"
 moz-do-not-send="true">"http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/connector-schema-3"</a><br>

            
xmlns:icfcldap=<a class="moz-txt-link-rfc2396E" 
href="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/bundle/com.evolveum.polygon.connector-ldap/com.evolveum.polygon.connector.ldap.LdapConnector"
 moz-do-not-send="true">"http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/bundle/com.evolveum.polygon.connector-ldap/com.evolveum.polygon.connector.ldap.LdapConnector"</a>><br>

        <icfc:configurationProperties><br>

            <icfcldap:port>636</icfcldap:port><br>

            
<icfcldap:host>ldap02.example.com</icfcldap:host><br>

            
<icfcldap:baseContext>ou=users,ou=accounts,dc=example,dc=com</icfcldap:baseContext><br>

            
<icfcldap:bindDn>cn=admin,dc=example,dc=com</icfcldap:bindDn><br>

            
<icfcldap:bindPassword><t:clearValue>secret</t:clearValue></icfcldap:bindPassword><br>

            
<icfcldap:connectionSecurity>ssl</icfcldap:connectionSecurity><br>

            
<icfcldap:usePermissiveModify>always</icfcldap:usePermissiveModify><br>

            
<icfcldap:pagingStrategy>auto</icfcldap:pagingStrategy><br>

            
<icfcldap:passwordHashAlgorithm>SSHA</icfcldap:passwordHashAlgorithm><br>

            
<icfcldap:vlvSortAttribute>cn</icfcldap:vlvSortAttribute><br>

            
<icfcldap:vlvSortOrderingRule>2.5.13.3</icfcldap:vlvSortOrderingRule><br>

            
<icfcldap:operationalAttributes>memberOf</icfcldap:operationalAttributes><br>

            
<icfcldap:operationalAttributes>createTimestamp</icfcldap:operationalAttributes><br>

        </icfc:configurationProperties><br>

        <icfc:resultsHandlerConfiguration><br>

            
<icfc:enableNormalizingResultsHandler>false</icfc:enableNormalizingResultsHandler><br>

            
<icfc:enableFilteredResultsHandler>false</icfc:enableFilteredResultsHandler><br>

            
<icfc:enableAttributesToGetSearchResultsHandler>false</icfc:enableAttributesToGetSearchResultsHandler><br>

        </icfc:resultsHandlerConfiguration><br>

    </connectorConfiguration><br>

  <br>

Do you see anything else that I might be missing?<br>

Thanks again!<br>

  <span><br>
Oleksandr Nekriach wrote on 5/17/19 10:53 AM:</span><br>

  <blockquote type="cite" 
cite="mid:CANb693QdPwkwW97aXNyW_0wnQOXa7Vkzv3nrXwffJmSp1mE-5A@mail.gmail.com"><meta
 http-equiv="content-type" content="text/html; charset=utf-8">
  <div dir="ltr"><div dir="ltr"><div>Hi Brad,</div><div>Try to add value
 "memberOf" into configuration settings operationalAttributes on your 
LDAP resource  in IDM</div><div><br></div><div>Best regards,</div><div>Oleksandr<br></div></div></div>
  <br>
  <div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, 17 
May 2019 at 18:34, Brad Firestone <<a 
href="mailto:bhotrock@gmail.com" moz-do-not-send="true">bhotrock@gmail.com</a>>
 wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 
0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div 
style="color:rgb(0,0,0);background-color:rgb(255,255,255)" 
bgcolor="#FFFFFF">
I'm running midPoint 3.9 with LDAP connector 2.0  Connecting to OpenLDAP
 version 2.4.45+dfsg-1ubuntu1  memberOf, refInt, lastBind, and sssvlv 
overlays are installed.<br>

  <br>

I've been trying to setup LDAP group management according to the Wiki 
and other docs I've found.  Automatic groupOfNames creation in 
"ou=roles,ou=accounts,dc=example,dc=com" is working fine when I create a
 Role with an Assignment of the LDAP Group Metarole.  So that seems like
 most of the connection is working correctly.<br>

  <br>

But I'm getting the following error message when I try to add a user to a
 Role that should put them in the LDAP Group.<br>

-------<br>

Operation:  
operation.org.identityconnectors.framework.api.ConnectorFacade.updateDelta<br>

  <br>

Message:  Unknown UID: LDAP entry for UID Attribute: {Name=__UID__, 
Value=[caed9d00-0c8c-1039-98e5-a53942dc29e0], NameHint=Attribute: 
{Name=__NAME__, Value=[cn=test 
role,ou=roles,ou=accounts,dc=example,dc=com]}}
 was not found<br>

  <br>

Parameters:  uid    [caed9d00-0c8c-1039-98e5-a53942dc29e0]<br>

attributesDelta:    [[Attribute: {Name=member, 
ValuesToAdd=[cn=testuser,ou=users,ou=accounts,dc=example,dc=com], 
ValuesToRemove=null,                                     
ValuesToReplace=null}]]<br>

objectClass:    [crOCD 
({<a class="gmail-m_2343431558516907905moz-txt-link-freetext" 
href="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3" 
target="_blank" moz-do-not-send="true">http://midpoint.evolveum.com/xml/ns/public/resource/instance-3</a>}groupOfNames)]<br>

options:    [OperationOptions: {}]<br>

  <br>

Context:  connector    [class 
org.identityconnectors.framework.impl.api.local.LocalConnectorFacadeImpl]<br>

  <br>

Error:  
org.identityconnectors.framework.common.exceptions.UnknownUidException(LDAP
 entry for UID Attribute: {Name=__UID__, 
Value=[caed9d00-0c8c-1039-98e5-a53942dc29e0], NameHint=Attribute: 
{Name=__NAME__, Value=[cn=test 
role,ou=roles,ou=accounts,dc=example,dc=com]}}
 was not found)<br>

-------<br>

  <br>

Here is the Association section from the LDAP Resource:<br>

        <association><br>

                <ref>ri:ldapGroup</ref><br>

                <tolerant>false</tolerant><br>

                <displayName>LDAP Group 
Membership</displayName><br>

                <kind>entitlement</kind><br>

                <intent>ldapGroup</intent><br>

                <direction>objectToSubject</direction><br>

                
<associationAttribute>ri:member</associationAttribute><br>

                <valueAttribute>ri:dn</valueAttribute><br>

                
<shortcutAssociationAttribute>ri:memberOf</shortcutAssociationAttribute>
 <br>

                
<explicitReferentialIntegrity>false</explicitReferentialIntegrity><br>

          </association><br>

  <br>

And the Entitlement Object section from the LDAP Resource:<br>

        <objectType><br>

            <kind>entitlement</kind><br>

            <intent>ldapGroup</intent><br>

            <displayName>LDAP Group</displayName><br>

            <objectClass>ri:groupOfNames</objectClass><br>

  <br>

            <attribute><br>

                <ref>ri:dn</ref><br>

                
<matchingRule>mr:distinguishedName</matchingRule><br>

                <outbound><br>

                    <!-- Name cannot be weak. Changes in name trigger
 object rename. --><br>

                    <source><br>

                        <path>$focus/name</path><br>

                    </source><br>

                        <expression><br>

                            <script><br>

                            <code><br>

                                import javax.naming.ldap.Rdn<br>

                                import javax.naming.ldap.LdapName<br>

                                <br>

                                dn = new 
LdapName('ou=roles,ou=accounts,dc=example,dc=org')<br>

                                dn.add(new Rdn('cn', name.toString()))<br>

                                return dn.toString()<br>

                            </code><br>

                        </script><br>

                        </expression><br>

                </outbound><br>

            </attribute><br>

            <attribute><br>

                <ref>ri:member</ref><br>

                
<matchingRule>mr:distinguishedName</matchingRule><br>

                <fetchStrategy>minimal</fetchStrategy><br>

                <outbound><br>

                    <strength>strong</strength><br>

                    <!-- Workaround - groupOfNames MUST have at least
 one member. Even non-existent DN. --><br>

                    <expression><br>

                        <value>cn=dummy,o=whatever</value><br>

                    </expression><br>

                </outbound><br>

            </attribute>            <br>

            <attribute><br>

                <ref>ri:cn</ref><br>

                
<matchingRule>mr:stringIgnoreCase</matchingRule><br>

                <outbound><br>

                    <strength>weak</strength><br>

                    <source><br>

                        <path>$focus/name</path><br>

                    </source><br>

                </outbound><br>

            </attribute><br>

            <attribute><br>

                <ref>ri:description</ref><br>

                <outbound><br>

                    <source><br>

                        <path>description</path><br>

                    </source><br>

                </outbound><br>

            </attribute><br>

            <configuredCapabilities><br>

                <cap:pagedSearch><br>

                    
<cap:defaultSortField>ri:cn</cap:defaultSortField><br>

                </cap:pagedSearch><br>

            </configuredCapabilities><br>

        </objectType><br>

  <br>

I'm not sure if there are other important configs that would be helpful 
to see.  I'll be happy to post anything that's helpful.<br>

  <br>

This may be a related issue that might help locate the issue:  When I 
look at the Accounts tab of the Resource in the GUI, Search In: Resource
 gives a list of Accounts on the server.  However, doing the same in the
 Entitlements tab, with the Intent set to ldapGroup, does not display 
any entries, even though there are groups on the server.<br>

  <br>

One last thing that might help diagnose this:  If I try to remove the 
LDAP Group Metarole assignment from the Role, (hoping it would delete 
the groupOfNames from the server, I get the following error:<br>

--------<br>

  <span>Can't delete object 
shadow:7a74941f-a6cb-4af4-b012-d75cd4c57af7(cn=test 
role,ou=roles,ou=accounts,dc=example,dc=com). Reason: 
org.identityconnectors.framework.common.exceptions.UnknownUidException(LDAP
 entry for UID Attribute: {Name=__UID__, 
Value=[caed9d00-0c8c-1039-98e5-a53942dc29e0], NameHint=Attribute: 
{Name=__NAME__, Value=[cn=test 
role,ou=roles,ou=accounts,dc=example,dc=com]}} was not found): Can't 
delete object shadow:7a74941f-a6cb-4af4-b012-d75cd4c57af7(cn=Test 
Role,ou=roles,ou=accounts,dc=example,dc=com). Reason: 
org.identityconnectors.framework.common.exceptions.UnknownUidException(LDAP
 entry for UID Attribute: {Name=__UID__, 
Value=[caed9d00-0c8c-1039-98e5-a53942dc29e0], NameHint=Attribute: 
{Name=__NAME__, Value=[cn=test 
role,ou=roles,ou=accounts,dc=example,dc=com]}}
 was not found)</span><br>

  <br>

-------<br>

I'm reasonably sure I just have something out of place somewhere.  
Hopefully someone can spot what I've done wrong.<br>

Thank you!<br>

Brad <br>




</div>
_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank" 
moz-do-not-send="true">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" 
rel="noreferrer" target="_blank" moz-do-not-send="true">http://lists.evolveum.com/mailman/listinfo/midpoint</a><br></blockquote></div>
  <br clear="all">
  <br>
-- <br>
  <div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div 
dir="ltr"><span style="color:rgb(76,76,76)">Best regards, <br><br><img 
src="cid:part7.30EEAAE6.FF7E16E8@gmail.com" name="image.png"> <br><br>Oleksandr
 Nekriach | Identity and access management engineer <br><br>Dynatech, <a
 
href="https://www.google.com/maps/place/DYNATECH/@56.9575205,24.1107235,17z/data=%213m1%214b1%214m5%213m4%211s0x46eecf5753e42351:0x23b120b9745cae62%218m2%213d56.9575205%214d24.1129122"
 target="_blank" moz-do-not-send="true">Jeruzalemes iela 1, Rīga, 
LV-1010, Latvia</a><br><br><div style="display:inline-block"><a 
href="tel:+371%2025%20314%20685" value="+37125314685" target="_blank" 
moz-do-not-send="true">+37125314685</a></div>, <div 
style="display:inline-block"><a href="mailto:o.nekriach@dynatech.lv" 
target="_blank" moz-do-not-send="true">o.nekriach@dynatech.lv</a></div> |
 <div style="display:inline-block"><a href="http://www.dynatech.lv" 
target="_blank" moz-do-not-send="true">www.dynatech.lv</a></div> <br><br>Stay
 connected: <br><div style="display:inline-block;margin:5px 5px 0px 0px"><a
 href="https://www.facebook.com/DynatechLatvia/?ref=br_rs" 
target="_blank" moz-do-not-send="true"><img 
src="cid:part12.B9FBF7FC.7EF8C5AA@gmail.com" name="image.png"></a></div><div
 style="display:inline-block;margin:5px 0px 0px"><a 
href="https://www.linkedin.com/company-beta/17893047/" target="_blank" 
moz-do-not-send="true"><img src="cid:part14.5B0441EF.417A8CBB@gmail.com"
 name="image.png"></a></div><br><br><span 
style="font-size:11px;color:rgb(161,161,161)">Confidentiality
 Notice: This message contains confidential information and is intended 
only for the named recipient(s). If you are not the addressee you may 
not copy, distribute or perform any other activities with this 
information. If you have received this transmission in error, please 
notify us by e-mail immediately. E-mail transmission cannot be 
guaranteed to be secure or error-free as information could be 
intercepted, corrupted, lost, destroyed, arrive late or incomplete, or 
contain viruses.</span></span></div></div></div></div>


  <br>
  <fieldset class="mimeAttachmentHeader"></fieldset>
  <br>
  <pre wrap="">_______________________________________________
midPoint mailing list
<a class="moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com" moz-do-not-send="true">midPoint@lists.evolveum.com</a>
<a class="moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint" moz-do-not-send="true">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre></blockquote>

  <br>
</blockquote>
<br>
</body></html>