<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi Jan,</p>
<p>I have briefly checked your configuration and have two notes:</p>
<p>1. associations should work flawlessly to add/remove group
membership even with tolerant=true. We are using it in trainings,
I did the last training 2 weeks ago with OpenLDAP instead of
OpenDJ. Tolerant=false is to allow midPoint to remove the account
from associations not given by midPoint, which may or may not be
the "correct" behaviour for particular projects</p>
<p>2. I have seen your configuration of OpenDJ and am a little
confused how you are using "icfs:name" and "icfs:uid" attributes.
This was the way how we used them in the older LDAP connector (or
legacy ICF/OpenICF connectors). Instead we use ri:dn and whatever
is the native "uid" attribute (e.g. ri:entryuuid).</p>
<p>(I'm also confused that the schema is statically included in the
examples.)</p>
<p>See
<a class="moz-txt-link-freetext" href="https://github.com/Evolveum/midpoint-samples/blob/master/samples/resources/opendj/opendj-resource-genericsync.xml">https://github.com/Evolveum/midpoint-samples/blob/master/samples/resources/opendj/opendj-resource-genericsync.xml</a>
for an example please.</p>
<p>Best regards,</p>
<p>Ivan<br>
</p>
<div class="moz-cite-prefix">On 15. 1. 2020 16:19, Jan Lievens
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CALKj1oZCvscGEB2jKrv9Me0=nutLxefwB1taq+w8ysgq2E8G-w@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">Hi,
<div><br>
</div>
<div>I have a question related to inducement construction on a
role toward an LDAP resource.</div>
<div>I have the following situation in midPoint (see the
attachment for all the xml files)</div>
<div>- Accounts and Entitlements (intent: privileges) are
imported from a ScriptedSQL connector.</div>
<div>- These imported entitlements have multiple privileges
which are created as roles with an "assignmentTargetSearch"
(post-initial-objects/210-entitlement-object-template.xml)</div>
<div>- I also have these privilege/roles defined with an
assignment to (multiple) fixed technical roles
(kind:entitlement/intent:group).</div>
<div>- Lastly I would like for these technical roles (groups)
and the associated accounts to get synced to LDAP in an
objectToSubject fashion. I do this with inducements and
construction tags in
post-initial-objects/100-profiles-webidm.xml.</div>
<div>- The result I get in LDAP is that accounts are synced
correctly but the group names are not what I expect (I expect
technical role names eg. JiraUser) but get the names of the
Entitlements (intent:privileges) defined in the DB.</div>
<div>- Additionally the associations are not synced (no
uniqueMember refs are synced on the LDAP groups).</div>
<div><br>
</div>
<div>Surely I am missing something here. I think this use case
is quiet standard (a hierarchy of roles and only the leafs get
synced to LDAP).</div>
<div>I have experimented with the order of the inducement but
these came out even more negative (no accounts or groups were
created).</div>
<div>I also have experimented with the tolerant setting on the
association (since I find a lot of answers in this mailing
list suggesting this) but to no avail.</div>
<div>It is quiet frustrating to be so close to having this
use-case implemented DB->mP->LDAP but failing in the
sync to LDAP.</div>
<div><br clear="all">
<div>Kind regards,</div>
-- <br>
<div dir="ltr" class="gmail_signature"
data-smartmail="gmail_signature">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr"><span>
<div dir="ltr">
<div dir="ltr">Jan Lievens
<div dir="ltr"><span>
<div dir="ltr">
<div dir="ltr">
<div
style="font-size:12.8px;letter-spacing:0.2px">IT
Consultant</div>
<div style="letter-spacing:0.2px"><br>
</div>
</div>
</div>
</span></div>
</div>
</div>
</span></div>
</div>
</div>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
midPoint mailing list
<a class="moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a>
<a class="moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
</blockquote>
<pre class="moz-signature" cols="72">--
Ivan Noris
Senior Identity Engineer
evolveum.com
</pre>
</body>
</html>