<div dir="ltr">Hi Javier,<div><br></div><div>can't help you with <association> for csv connector, don't know if that works.</div><div><br></div><div>But if your goal is to have users with ad roles as assignments in midpoint, you can always import the memberOf values to the identity in idm and create role assignments via object template.</div><div><br></div><div>arnost</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">po 17. 8. 2020 v 12:18 odesílatel Laza, Javier <<a href="mailto:Javier.Laza@ingrammicro.com">Javier.Laza@ingrammicro.com</a>> napsal:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-2168608425733434767WordSection1">
<p class="MsoNormal">Hello, for certain reasons I cannot use the LDAP/AD connector so I have to import Active Directory accounts (and users) and groups from a CSV. I create this CSV via Powershell script getting the information from the AD. Each row has empty
columns depending if the row represents an account or a group.<u></u><u></u></p>
<p class="MsoNormal">FYI my CSV headers are: dn;sAMAccountName;cn;sn;objectCategory;givenName;mail;title;employeeID;l;department;telephoneNumber;c;manager;userAccountControl;memberOf;employeeType;description;member<u></u><u></u></p>
<p class="MsoNormal">If the row is a user, the memberOf column will contain the list of groups. And if the row is a user, the column member contains the members of the groups<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">This CSV is going to act as an authoritative resource, so what I want to do:<u></u><u></u></p>
<ul style="margin-top:0cm" type="disc">
<li class="gmail-m_-2168608425733434767MsoListParagraph" style="margin-left:0cm">Create users in Midpoint -> done<u></u><u></u></li><li class="gmail-m_-2168608425733434767MsoListParagraph" style="margin-left:0cm">Import accounts -> done<u></u><u></u></li><li class="gmail-m_-2168608425733434767MsoListParagraph" style="margin-left:0cm">Import groups -> I tried to use the GroupObjectClass but couldn’t make it work. In this threat (<a href="https://lists.evolveum.com/pipermail/midpoint/2016-May/001876.html" target="_blank">https://lists.evolveum.com/pipermail/midpoint/2016-May/001876.html</a>)
it is explained that the CSV connector only supports accounts, is this still working the same way?. At the end I managed to import the groups as an Account of intent group, and then in the synchronization part, import it as RoleType<u></u><u></u></li><li class="gmail-m_-2168608425733434767MsoListParagraph" style="margin-left:0cm">Create the entitlement/association among each user and its groups -> FAILS<u></u><u></u></li></ul>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I have created a synchronization sorter that check the objectCategory column to know if the row is a user or a group. So at this point I am able to create the users/accounts and import the groups as roles. Then configured the association
as follows, also tried the opposite approach using objectoToSubject<u></u><u></u></p>
<p class="MsoNormal"> <association><u></u><u></u></p>
<p class="MsoNormal"> <c:ref xmlns:ri="<a href="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3" target="_blank">http://midpoint.evolveum.com/xml/ns/public/resource/instance-3</a>">ri:AccountObjectClass</c:ref><u></u><u></u></p>
<p class="MsoNormal"> <displayName>AD Group Membership</displayName><u></u><u></u></p>
<p class="MsoNormal"> <kind>account</kind><u></u><u></u></p>
<p class="MsoNormal"> <intent>group</intent><u></u><u></u></p>
<p class="MsoNormal"> <direction>subjectToObject</direction><u></u><u></u></p>
<p class="MsoNormal"> <associationAttribute>ri:memberOf</associationAttribute><u></u><u></u></p>
<p class="MsoNormal"> <valueAttribute>ri:dn</valueAttribute><u></u><u></u></p>
<p class="MsoNormal"> <shortcutAssociationAttribute>ri:member</shortcutAssociationAttribute><u></u><u></u></p>
<p class="MsoNormal"> <shortcutValueAttribute>ri:dn</shortcutValueAttribute><u></u><u></u></p>
<p class="MsoNormal"> </association><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">But if I import a user, and then want to get the account details, it shows a 500 error, and the log shows (I have removed some information from the DN):<u></u><u></u></p>
<ul style="margin-top:0cm" type="disc">
<li class="gmail-m_-2168608425733434767MsoListParagraph" style="margin-left:0cm"><b>WARN (com.evolveum.midpoint.provisioning.impl.ShadowCache): The entitlement identified by PCV(null):[PP({.../common/common-3}name):[PPV(ItemName:AccountObjectClass)], RAC(identifiers):[PCV(null):[RA({.../resource/instance-3}dn):[PPV(String:CN=Product
Management,OU=Security Groups,DC=,DC=,DC=)]]]] referenced from shadow:null(null) violates the schema. Skipping. Original error: No secondary identifier defined, cannot search-{}<u></u><u></u></b></li><li class="gmail-m_-2168608425733434767MsoListParagraph" style="margin-left:0cm"><b>ERROR (com.evolveum.midpoint.gui.impl.factory.ShadowAssociationWrapperFactoryImpl): Couldn't create container for associations. java.lang.NullPointerException: null<u></u><u></u></b></li><li class="gmail-m_-2168608425733434767MsoListParagraph" style="margin-left:0cm"><b>ERROR (com.evolveum.midpoint.web.security.LoggingRequestCycleListener): Error occurred during page rendering. java.lang.NullPointerException: null<u></u><u></u></b></li><li class="gmail-m_-2168608425733434767MsoListParagraph" style="margin-left:0cm"><b>WARN (com.evolveum.midpoint.web.page.error.PageError): Creating error page for code java.lang.NullPointerException, exception null: {} java.lang.NullPointerException: null<u></u><u></u></b></li></ul>
<p class="MsoNormal"><b><u></u> <u></u></b></p>
<p class="MsoNormal">Hope you can help me, thanks in advance <u></u><u></u></p>
</div>
<p><span style="font-family:Calibri;font-size:xx-small"><br>
La información contenida en este mensaje es confidencial. En caso de que reciba este mensaje por error le rogamos lo comunique a la mayor brevedad al emisor y proceda a su eliminación definitiva, absteniéndose de copiar, almacenar o difundir su contenido. De
acuerdo con lo establecido en la Ley Orgánica 15/1999, de Protección de Datos de Carácter Personal y en el Reglamento de Desarrollo 1720/2007, los datos personales que facilite a través de la dirección de correo indicada serán incorporados a un fichero titularidad
de INGRAM MICRO, S.L.U., con domicilio en C/ Antonio Machado, 78-80 1ª y 2ª pl. Business Park ( 08840-Viladecans). Mediante el envío de sus datos, Ud. otorga su consentimiento expreso a INGRAM MICRO, S.L.U, para el tratamiento de sus datos, con la finalidad
de atender a su consulta y/o mantener la relación profesional, comercial, y/o contractual que en su caso establezca con INGRAM MICRO, S.L.U. Puede ejercitar sus derechos de acceso, rectificación, cancelación y oposición notificándolo por escrito a la dirección
del remitente, o a la siguiente dirección de correo <a href="mailto:nuevascuentas@ingrammicro.es" target="_blank">nuevascuentas@ingrammicro.es</a>. De acuerdo con la Ley 34/2002, de Servicios de la Sociedad de la Información y de Comercio Electrónico, Vd. podrá oponerse en cualquier momento al tratamiento de sus datos con
fines promocionales notificándonoslo por escrito a la dirección de correo mencionada.<br>
.................................................................................................................................................................................................................................................<br>
The information contained in this message is confidential. If you receive this message by error please notify it as soon as possible to the sender and proceed to their final elimination by not copy, store or distribute its content. In accordance of what is
stated in the Law 15/1999, of Data Personal Protection and Regulation Rule 1720/2007, the personal data provided through the email address you entered will be included in a file owned by INGRAM MICRO, SLU, located at C/ Antonio Machado, 78-80 1ª y 2ª pl. Business
Park ( 08840-Viladecans). By submitting your data, you expressly give your consent to INGRAM MICRO, SLU, to the treatment of your data, in order to answer to your questions and / or keep the professional, commercial relationship and / or contractual set with
INGRAM MICRO, SLU You can exercise your rights of access, rectification, cancellation and opposition by giving written notification to the sender address or to the following email: <a href="mailto:nuevascuentas@ingrammicro.es" target="_blank">nuevascuentas@ingrammicro.es</a>. According to Law 34/2002, of the Information
Society and Electronic Commerce, you may object at any time to your data treatment for promotional purposes by notifying us in writing to the email address above.<br>
<span style="color:rgb(255,255,255)">[Ingram_2818e5de]</span></span></p>
</div>
_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="https://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">https://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:13px"><p><strong>Arnošt Starosta</strong><br><span style="font-size:11px;color:rgb(128,128,128)">solution architect</span></p></div><p style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:11px">gsm: [+420] 603 794 932<br>e‑mail: <a href="mailto:arnost.starosta@ami.cz" target="_blank">arnost.starosta@ami.cz</a></p><p style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:11px"><strong>AMI Praha a.s.</strong><br>Pláničkova 11, 162 00 Praha 6</p><p style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:11px">tel.: [+420] 274 783 239 | web: <a href="https://www.ami.cz" target="_blank">www.ami.cz</a></p><p style="color:rgb(0,0,0);font-family:Verdana,Arial,Helvetica,sans-serif;font-size:10px;margin-top:20px"><img src="http://www.ami.cz/images/podpis/ami_logo.gif" alt="AMI Praha a.s." style="border: 0px;"></p><p style="font-family:Arial,sans-serif;font-size:11px;color:rgb(170,170,170)">Textem tohoto e‑mailu podepisující neslibuje uzavřít ani neuzavírá za společnost AMI Praha a.s.<br>jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně písemnou formu.<br><span style="font-size:6px"> </span><br>Tento e‑mail je určen výhradně pro potřeby jeho adresáta/ů a může obsahovat důvěrné nebo osobní<br>informace. Nejste‑li zamýšleným příjemcem, je zakázáno jakékoliv zveřejňování, zprostředkování<br>nebo jiné použití těchto informací. Pokud jste obdrželi e‑mail neoprávněně, informujte o tom prosím<br>odesílatele a vymažte neprodleně všechny kopie tohoto e‑mailu včetně všech jeho příloh. Nakládáním<br>s neoprávněně získanými informacemi se vystavujete riziku právního postihu.</p></div></div></div></div>