<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Vorformatiert Zchn";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
span.E-MailFormatvorlage17
{mso-style-type:personal-compose;
font-family:"Arial",sans-serif;
color:windowtext;}
span.HTMLVorformatiertZchn
{mso-style-name:"HTML Vorformatiert Zchn";
mso-style-priority:99;
mso-style-link:"HTML Vorformatiert";
font-family:"Courier New";
mso-fareast-language:DE;}
.MsoChpDefault
{mso-style-type:export-only;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif">Hello,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif">we struggled to configure the right authorization with an orgRelation tag. In our scenario, we have many different custom relations to model our different responsibilities
for org units. For example we have the responsibility to set reset passwords of members of a specified org unit. The password resetter is not a part of this org unit. The password resetter has a special relation (managerPWR) which has the kind manager.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif">Relation:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif"> <relation><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif"> <ref xmlns:custom="http://example.com/xml/ns/midpoint/relation"> custom:managerPWR</ref><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif"> <description>resets passwords</description><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif"> <display><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif"> <label>password resetter</label><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif"> </display><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif"> <category>organization</category><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif"> <category>administration</category><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif"> <kind>manager</kind><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif"> </relation><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif">We wanted to build an authorization that allows the person which has the org unit with the relation managerPWR assigned, to read all users in this org unit.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif">Therefore we build the following authorization:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal" style="background:white"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif"><authorization><br>
<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action><br>
<object><br>
<type>UserType</type><br>
<orgRelation><br>
<subjectRelation xmlns:custom="http://example.com/xml/ns/midpoint/relation">custom:managerDSL</subjectRelation><br>
<scope>allDescendants</scope><br>
<includeReferenceOrg>true</includeReferenceOrg><br>
</orgRelation><br>
</object><br>
<c:item>name</c:item><br>
<c:item>fullName</c:item><br>
<c:item>linkRef</c:item><br>
<c:item>personaRef</c:item><br>
</authorization><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span lang="EN-GB" style="font-size:10.0pt;font-family:Consolas;color:black;background:#EFEFEF;mso-fareast-language:DE"><o:p> </o:p></span></p>
<p class="MsoNormal" style="background:white"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif">The problem we encountered was that the
<i>SecurityEnforcerImpl </i>is not looking for every org unit which is assigned to the subject but to all org units which are set as
<i>parentOrgRef</i>. Relations of the kind <i>manager</i> will not be set as <i>parentOrgRef.</i>
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif">We discovered the
<i><storedIntoParentOrgRef>true</storedIntoParentOrgRef></i> option which can be set in the relation definition and this will add the org unit as an
<i>parentOrgRef</i> even if is not of the kind <i>member</i>. But this introduces a lot more problems. Midpoint interprets the
<i>parentOrgRef</i> in a way that a user is part of the organization, for example in
<i>isChildOf(String oid)</i> queries. Therefore the user which has the authorization assigned and is assigned to the org as an password resetter will also have the authorization for all password resetters and for himself.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif">The final question we have: Why does the
<i><subjectRelation></i> only evaluates <i>parentOrgRef</i>s? We have the common use case, that somebody has a specific responsibility for an org unit but is not an actual member. Is there a solution we are missing? Is there any plan to change this behaviour
in the future? I think the <i><subjectRelation></i> would be far more useful if it would work on every kind of relation. In the way it is designed right now it should also not work for approvers, owners etc.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif">I would be really glad if somebody can give us some information or a hint how we could address this problem.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">Thanks in advance<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:10.0pt;font-family:"Arial",sans-serif;mso-fareast-language:DE">Emil Militzer<o:p></o:p></span></p>
</div>
</body>
</html>