<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hello Keith,</p>
<p>you are on the right track. But it's not a simple mapping of a
property to group "members" attribute. In fact, midPoint worked
this way in versions before 3.0. But since that, a very flexible
and powerful mechanism was introduced: <a moz-do-not-send="true"
href="https://wiki.evolveum.com/display/midPoint/Generic+Synchronization">generic
synchronization</a>.</p>
<p>To understand it, first you need to get acquainted with the
concept of <a moz-do-not-send="true"
href="https://wiki.evolveum.com/display/midPoint/Entitlements">entitlements</a>
and their associations to user accounts. Then please see something
about <a moz-do-not-send="true"
href="https://wiki.evolveum.com/display/midPoint/Assignment+Configuration#AssignmentConfiguration-EntitlementAssociations">configuring
assignments for entitlements</a>.</p>
<p>Unfortunately I am not sure if there's a description where it's
all collected in a single place. You can have a look at e.g.:</p>
<ul>
<li><a moz-do-not-send="true"
href="https://wiki.evolveum.com/display/midPoint/OrgSync+Story+Test">https://wiki.evolveum.com/display/midPoint/OrgSync+Story+Test</a></li>
<li><a moz-do-not-send="true"
href="https://wiki.evolveum.com/display/midPoint/Active+Directory+Group+Synchronization+HOWTO">https://wiki.evolveum.com/display/midPoint/Active+Directory+Group+Synchronization+HOWTO</a>
(a bit outdated - uses now obsolete AD connector)</li>
</ul>
<p>Or maybe someone other can point you (and me) to more appropriate
sample or description.<br>
</p>
<p>Best regards,<br>
</p>
<pre class="moz-signature" cols="72">Pavol Mederly
Software developer
evolveum.com
</pre>
<div class="moz-cite-prefix">On 29.07.2019 18:44, Keith LeValley
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAAkzTLwL0Z8FmOLManp+BoP6YDLkkAWv_z94oLgiNZdygkDcHQ@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">I am creating a demo to show off Midpoint to some
other IT members and I really would like to show how roles map
to LDAP groups. I am not sure if I'm taking the right approach
(if not please let me know).
<div><br>
</div>
<div>I started by copying much of the live demo site, where it
has a CSV file that is used to import users into Midpoint and
then an ldap server that does a live sync with users. This
works well, but I really want to also live sync groups.</div>
<div><br>
</div>
<div>So I created an org chart with some basic orgs and gave
those orgs inducements to roles. This allows me to group
several roles into an org, for instance (yes I am a big nerd)
my user cbarton ("Hawkeye") has both roles "shield agent" and
"Avenger". This is working well, but the last piece that I
cannot seem to get to work is how to map those roles to ldap
groups.</div>
<div><br>
</div>
<div>So I have created a schema handling that scripts the dn of
the group, but I do not know what attribute to use for the
source when mapping the member field in ldap (what attribute
in Midpoint defines the members in a role). I apologize if
this is a really long email asking for a very simple answer,
but I wanted to explain my approach in-case this is not how I
should be doing this.<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr" class="gmail_signature"
data-smartmail="gmail_signature">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">Keith LeValley<br>
<div><font face="arial, helvetica, sans-serif">Identity
Services Architect</font>, Davenport
University</div>
<div><a href="mailto:klevalley2@davenport.edu"
target="_blank" moz-do-not-send="true">klevalley2@davenport.edu<br>
</a></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
midPoint mailing list
<a class="moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a>
<a class="moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
</blockquote>
</body>
</html>