<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"Preformattato HTML Carattere";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.PreformattatoHTMLCarattere
{mso-style-name:"Preformattato HTML Carattere";
mso-style-priority:99;
mso-style-link:"Preformattato HTML";
font-family:"Consolas",serif;}
span.StileMessaggioDiPostaElettronica23
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 2.0cm 2.0cm 2.0cm;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:991719186;
mso-list-type:hybrid;
mso-list-template-ids:1023152740 1577247008 68157443 68157445 68157441 68157443 68157445 68157441 68157443 68157445;}
@list l0:level1
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:-;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-font-family:Calibri;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="IT" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hi Richard,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">thank you for your help. A couple of question about your .xml:
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">I think that in the first part you are providing to the application the attributes that needs, right?<o:p></o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="mso-fareast-language:EN-US">F_EXTENSION</span></b><span lang="EN-US" style="mso-fareast-language:EN-US"> refers to the fact that they are extended attributes, but if instead they were “normal” attributes (the
base attributes of Midpoint) what can I use?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">In the second part (I apologize but I’m not familiar with coding ecc.), how the object query works? Which steps perform? Why I see only two attributes inside the <greater> tag?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Thank you for your time and help!<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Andrea<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b>From:</b> midPoint <midpoint-bounces@lists.evolveum.com> <b>
On Behalf Of </b>Richard Frovarp via midPoint<br>
<b>Sent:</b> Wednesday, October 21, 2020 4:47 PM<br>
<b>To:</b> midpoint@lists.evolveum.com<br>
<b>Cc:</b> Richard Frovarp <richard.frovarp@ndsu.edu><br>
<b>Subject:</b> Re: [midPoint] Problem deprovisioning<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">I was able to find a reasonable work around for my user population. I have a bulk task that runs every day. One feature that would be nice is this functionality in the query options that I use all of the time in our legacy system in direct
SQL<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">where pk not in (select pk from other_table where user has some sort of attribute)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Since I can't figure out how to do that in this query syntax, have a slight work around. I have a bulk task that runs on schedule. It queries for everyone that has one of the attributes I want to blank out. It then iterates through each
of those users to see if they have a shadow in the resource that created those attributes. If they don't, it blanks the attributes out. Attached is one such task. For anyone wondering, I am supporting two different institutions in midPoint, hence the need
for custom schema extension for attributes in midPoint already, like title. Plus I'm higher education, so people can be in multiple departments, hence the "primary". This takes just over 3 minutes on just under 6k people. And we really haven't taken any time
to tune the performance of our environment other than making sure midPoint has plenty of memory assigned to it.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">There's also probably a way to collapse this down to be a bit more efficient, but this is efficient enough for us at this moment. Note my method for checking if the user has a shadow in the specified resource. I was doing bad things previously
where I iterated over all shadows the user had, and that wasn't good. So only hunt for the one you want.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">On Wed, 2020-10-21 at 16:34 +0200, Pavol Mederly via midPoint wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #729FCF 1.5pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<p>Hello,<o:p></o:p></p>
<p>as far as I know, this seemingly "innocent" scenario is surprisingly not directly supported by midPoint. Richard Frovarp asked about it here in July. Just look for "How to blank out user properties?" thread.<o:p></o:p></p>
<p>The technical reason why the data cannot be cleaned up by the same mapping that provides them is the fact that the inbound mapping is no longer applied when the account is gone.<o:p></o:p></p>
<p>So a workaround has to be conceived. Some of these workarounds are discussed in the mentioned thread. (What comes to my mind, though, is to map data from the resource to a set of auxiliary user properties, from where they are propagated to the "main" properties
- Titolo, Matricola, ... - under condition of hasLinkedAccount for the resource.)<o:p></o:p></p>
<p>Best regards,<o:p></o:p></p>
<pre>Pavol Mederly<o:p></o:p></pre>
<pre>Software developer<o:p></o:p></pre>
<pre>evolveum.com<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<div>
<p class="MsoNormal">On 21/10/2020 15:43, Andrea Picconi via midPoint wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #729FCF 1.5pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hi Petr,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">I mean that the field (or fields) must be blank.
</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">With the account still linked, the fields are filled (example here)</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><img width="437" height="142" style="width:4.552in;height:1.4791in" id="Immagine_x0020_1" src="cid:image001.jpg@01D6A7D3.C3115780"></span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">but if I unlink the account, I expect midpoint to deprovision and remove the attributes of that account (here the same with what I expect)</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><img width="467" height="145" style="width:4.8645in;height:1.5104in" id="Immagine_x0020_2" src="cid:image002.jpg@01D6A7D3.C3115780"></span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Thanks</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Petr Gašparík - AMI Praha a.s.
<a href="mailto:petr.gasparik@ami.cz"><petr.gasparik@ami.cz></a> <br>
<b>Sent:</b> Wednesday, October 21, 2020 3:32 PM<br>
<b>To:</b> midPoint General Discussion <a href="mailto:midpoint@lists.evolveum.com">
<midpoint@lists.evolveum.com></a><br>
<b>Cc:</b> Andrea Picconi <a href="mailto:andrea.picconi@innovery.net"><andrea.picconi@innovery.net></a>; Marianna De Biasio
<a href="mailto:marianna.debiasio@innovery.net"><marianna.debiasio@innovery.net></a>; Jacopo Giuliano
<a href="mailto:jacopo.giuliano@innovery.net"><jacopo.giuliano@innovery.net></a><br>
<b>Subject:</b> Re: [midPoint] Problem deprovisioning</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US"> </span><o:p></o:p></p>
<div>
<p class="MsoNormal">Please elaborate more on what means "delete attributes" :)<br clear="all">
<o:p></o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p><span style="font-size:10.0pt;font-family:"Arial",sans-serif">--</span><o:p></o:p></p>
<p><span style="font-size:10.0pt;font-family:"Arial",sans-serif">s pozdravem</span><o:p></o:p></p>
<div>
<p><strong><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black">Petr Gašparík</span></strong><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black"><br>
</span><span style="font-size:8.5pt;font-family:"Arial",sans-serif;color:gray">konzultant IT bezpečnosti</span><o:p></o:p></p>
</div>
<p><span style="font-size:8.5pt;font-family:"Arial",sans-serif;color:black">gsm: [+420] 603 523 860<br>
e‑mail: <a href="mailto:petr.gasparik@ami.cz" target="_blank">petr.gasparik@ami.cz</a></span><o:p></o:p></p>
<p><strong><span style="font-size:8.5pt;font-family:"Arial",sans-serif;color:black">AMI Praha a.s.</span></strong><span style="font-size:8.5pt;font-family:"Arial",sans-serif;color:black"><br>
Pláničkova 11, 162 00 Praha 6</span><o:p></o:p></p>
<p><span style="font-size:8.5pt;font-family:"Arial",sans-serif;color:black">tel.: [+420] 274 783 239 | web: <a href="https://www.ami.cz" target="_blank">www.ami.cz</a></span><o:p></o:p></p>
<p style="margin-top:15.0pt"><span style="font-size:7.5pt;font-family:"Verdana",sans-serif;color:black;border:solid windowtext 1.0pt;padding:0cm"><img border="0" width="100" height="100" style="width:1.0416in;height:1.0416in" id="_x0000_i1027" src="cid:image003.jpg@01D6A7D3.C3115780" alt="Immagine rimossa dal
mittente. AMI Praha a.s."></span><o:p></o:p></p>
<p><span style="font-size:8.5pt;font-family:"Arial",sans-serif;color:#AAAAAA">Textem tohoto e‑mailu podepisující neslibuje uzavřít ani neuzavírá za společnost AMI Praha a.s.<br>
jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně písemnou formu.<br>
</span><span style="font-size:4.5pt;font-family:"Arial",sans-serif;color:#AAAAAA"> </span><span style="font-size:8.5pt;font-family:"Arial",sans-serif;color:#AAAAAA"><br>
Tento e‑mail je určen výhradně pro potřeby jeho adresáta/ů a může obsahovat důvěrné nebo osobní<br>
informace. Nejste‑li zamýšleným příjemcem, je zakázáno jakékoliv zveřejňování, zprostředkování<br>
nebo jiné použití těchto informací. Pokud jste obdrželi e‑mail neoprávněně, informujte o tom prosím<br>
odesílatele a vymažte neprodleně všechny kopie tohoto e‑mailu včetně všech jeho příloh. Nakládáním<br>
s neoprávněně získanými informacemi se vystavujete riziku právního postihu.</span><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<p class="MsoNormal"> <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal">st 21. 10. 2020 v 15:24 odesílatel Andrea Picconi via midPoint <<a href="mailto:midpoint@lists.evolveum.com">midpoint@lists.evolveum.com</a>> napsal:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #729FCF 1.5pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p><span lang="EN-US">Hello everyone,</span><o:p></o:p></p>
<p><span lang="EN-US">I have a problem while unlinking an account from a user: what happens is that the unlink process correctly removes the account inside the Projections tab , but it doesn’t deprovision the attributes that are mapped within that account.</span><o:p></o:p></p>
<p><span lang="EN-US">What could cause this unexpected behaviour? And how do i get all these attributes to be deleted from Midpoint ?</span><o:p></o:p></p>
<p>Regards,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:10.0pt">Andrea Picconi</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt"><i><span style="font-size:10.0pt">IAM (Identity Access Management)</span></i><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US"><img border="0" width="136" height="33" style="width:1.4166in;height:.3437in" id="gmail-m_-2628088092099569107Immagine_x0020_1" src="cid:image004.png@01D6A7D3.C3115780" alt="Innovery"></span><span style="font-size:10.0pt"><br>
Skype: precons</span><br>
<span style="font-size:10.0pt">T: +39 06 51963439 (int. 196) <br>
</span><span style="font-size:12.0pt"><br>
</span><span style="font-size:10.0pt;color:black">Strada Quattro Palazzina A6 c/o Centro Direzionale Milanofiori, 20057 Assago (MI).<br>
</span><span style="font-size:10.0pt"><a href="http://www.innovery.net/" target="_blank"><span style="color:#0563C1">www.innovery.net</span></a> | T: +39 06 519 63 439</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="https://lists.evolveum.com/mailman/listinfo/midpoint" target="_blank">https://lists.evolveum.com/mailman/listinfo/midpoint</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>midPoint mailing list<o:p></o:p></pre>
<pre><a href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a><o:p></o:p></pre>
<pre><a href="https://lists.evolveum.com/mailman/listinfo/midpoint">https://lists.evolveum.com/mailman/listinfo/midpoint</a><o:p></o:p></pre>
<pre><o:p> </o:p></pre>
</blockquote>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>midPoint mailing list<o:p></o:p></pre>
<pre><a href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a><o:p></o:p></pre>
<pre><a href="https://lists.evolveum.com/mailman/listinfo/midpoint">https://lists.evolveum.com/mailman/listinfo/midpoint</a><o:p></o:p></pre>
<pre><o:p> </o:p></pre>
</blockquote>
</div>
</body>
</html>