<div dir="ltr"><div dir="ltr"><div dir="ltr">Hi <span style="color:rgb(80,0,80)">Al Lilianstrom</span><br></div><div dir="ltr"><span style="color:rgb(80,0,80)"><br></span></div><div dir="ltr"><span class="gmail-JLqJ4b gmail-ChMk0b" style="color:rgb(0,0,0);font-family:Roboto,RobotoDraft,Helvetica,Arial,sans-serif;font-size:18px;white-space:pre-wrap;background-color:rgb(245,245,245)"><span>In your tests, were you able to import accounts and groups from AD through Tasks and users and roles were created automatically in Midpoint?</span></span><span class="gmail-JLqJ4b" style="color:rgb(0,0,0);font-family:Roboto,RobotoDraft,Helvetica,Arial,sans-serif;font-size:18px;white-space:pre-wrap;background-color:rgb(245,245,245)"><span>
</span></span><span class="gmail-JLqJ4b gmail-ChMk0b" style="color:rgb(0,0,0);font-family:Roboto,RobotoDraft,Helvetica,Arial,sans-serif;font-size:18px;white-space:pre-wrap;background-color:rgb(245,245,245)"><span>I also keep trying to get that result.</span></span><span style="color:rgb(80,0,80)"><br></span></div><div dir="ltr"><span class="gmail-JLqJ4b gmail-ChMk0b" style="color:rgb(0,0,0);font-family:Roboto,RobotoDraft,Helvetica,Arial,sans-serif;font-size:18px;white-space:pre-wrap;background-color:rgb(245,245,245)"><span><br></span></span></div><div><span class="gmail-JLqJ4b gmail-ChMk0b" style="color:rgb(0,0,0);font-family:Roboto,RobotoDraft,Helvetica,Arial,sans-serif;font-size:18px;white-space:pre-wrap;background-color:rgb(245,245,245)"><span>Regards</span></span></div><div><span class="gmail-JLqJ4b gmail-ChMk0b" style="color:rgb(0,0,0);font-family:Roboto,RobotoDraft,Helvetica,Arial,sans-serif;font-size:18px;white-space:pre-wrap;background-color:rgb(245,245,245)"><span><br></span></span></div><div><span class="gmail-JLqJ4b gmail-ChMk0b" style="color:rgb(0,0,0);font-family:Roboto,RobotoDraft,Helvetica,Arial,sans-serif;font-size:18px;white-space:pre-wrap;background-color:rgb(245,245,245)"><span>Gus</span></span></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Em sex., 4 de dez. de 2020 às 10:12, Al Lilianstrom via midPoint <<a href="mailto:midpoint@lists.evolveum.com">midpoint@lists.evolveum.com</a>> escreveu:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Thanks Jason. I'll take a look at that. I was reading on filters in the wiki last night so it looks like I'm on the right path.<br>
<br>
al<br>
--<br>
Al Lilianstrom<br>
Authentication Services<br>
<br>
Fermi National Accelerator Laboratory<br>
<a href="http://www.fnal.gov" rel="noreferrer" target="_blank">www.fnal.gov</a><br>
<a href="mailto:lilstrom@fnal.gov" target="_blank">lilstrom@fnal.gov</a><br>
<br>
<br>
________________________________________<br>
From: Jason Everling <<a href="mailto:jeverling@bshp.edu" target="_blank">jeverling@bshp.edu</a>><br>
Sent: Thursday, December 3, 2020 9:56 AM<br>
To: midPoint General Discussion<br>
Cc: Al Lilianstrom<br>
Subject: RE: [midPoint] New to midPoint - AD integration<br>
<br>
You could also use a condition on the objectSynchronization instead of changing base conext, like below, midpoint will still see all your ad objects but will not import, sync, or create, etc.. unless they match the sync filter<br>
<br>
<condition><br>
<script><br>
<code><br>
obj = basic.getAttributeValue(shadow, '<a href="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3" rel="noreferrer" target="_blank">http://midpoint.evolveum.com/xml/ns/public/resource/instance-3</a><<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__midpoint.evolveum.com_xml_ns_public_resource_instance-2D3&d=DwQFaQ&c=gRgGjJ3BkIsb5y6s49QqsA&r=Ccoy53oEM8wW3-vUAuZFE1kez-3vbV9LOfLVoaEsm3A&m=zObqO0mO8lciEpAauzdu0RiHLAezgpZgOd7pZW1Bg_w&s=4eszi7VD8TaOMC-bSoeB2FXJDxmV3o3AdI8HNl6FUo4&e=" rel="noreferrer" target="_blank">https://urldefense.proofpoint.com/v2/url?u=http-3A__midpoint.evolveum.com_xml_ns_public_resource_instance-2D3&d=DwQFaQ&c=gRgGjJ3BkIsb5y6s49QqsA&r=Ccoy53oEM8wW3-vUAuZFE1kez-3vbV9LOfLVoaEsm3A&m=zObqO0mO8lciEpAauzdu0RiHLAezgpZgOd7pZW1Bg_w&s=4eszi7VD8TaOMC-bSoeB2FXJDxmV3o3AdI8HNl6FUo4&e=</a>>', 'dn');<br>
return (obj.contains('OU=Example'));<br>
</code><br>
</script><br>
</condition><br>
<br>
<br>
<br>
From: Al Lilianstrom via midPoint<mailto:<a href="mailto:midpoint@lists.evolveum.com" target="_blank">midpoint@lists.evolveum.com</a>><br>
Sent: Wednesday, December 2, 2020 7:59 AM<br>
To: midPoint General Discussion<mailto:<a href="mailto:midpoint@lists.evolveum.com" target="_blank">midpoint@lists.evolveum.com</a>><br>
Cc: Al Lilianstrom<mailto:<a href="mailto:lilstrom@fnal.gov" target="_blank">lilstrom@fnal.gov</a>><br>
Subject: Re: [midPoint] New to midPoint - AD integration<br>
<br>
Hi Javier,<br>
<br>
That seems to work for restricting the import but the usersync task breaks as the DirSync call now goes to the OU rather than the entire directory.<br>
<br>
I'm certain I'm missing something when it comes to the AD connector.<br>
<br>
OTOH the accounts that I had in midPoint from CSV linked up to the AD accounts that were pulled in and I could manage them so that is a step forward.<br>
<br>
al<br>
--<br>
Al Lilianstrom<br>
Authentication Services<br>
<br>
Fermi National Accelerator Laboratory<br>
<a href="http://www.fnal.gov" rel="noreferrer" target="_blank">http://www.fnal.gov</a><br>
<a href="mailto:lilstrom@fnal.gov" target="_blank">lilstrom@fnal.gov</a><br>
<br>
<br>
________________________________________<br>
From: Laza, Javier <<a href="mailto:Javier.Laza@ingrammicro.com" target="_blank">Javier.Laza@ingrammicro.com</a>><br>
Sent: Wednesday, December 2, 2020 2:51 AM<br>
To: midPoint General Discussion<br>
Cc: Al Lilianstrom<br>
Subject: RE: New to midPoint - AD integration<br>
<br>
You can use the 'Base Context' parameter in the AD connector, configure your OU there<br>
<br>
<br>
<br>
[cid:image001.png@01D6C890.BFBC68D0]<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
-----Original Message-----<br>
From: midPoint <<a href="mailto:midpoint-bounces@lists.evolveum.com" target="_blank">midpoint-bounces@lists.evolveum.com</a>> On Behalf Of Al Lilianstrom via midPoint<br>
Sent: martes, 1 de diciembre de 2020 21:44<br>
To: midPoint General Discussion <<a href="mailto:midpoint@lists.evolveum.com" target="_blank">midpoint@lists.evolveum.com</a>><br>
Cc: Al Lilianstrom <<a href="mailto:lilstrom@fnal.gov" target="_blank">lilstrom@fnal.gov</a>><br>
Subject: [midPoint] New to midPoint - AD integration<br>
<br>
<br>
<br>
Still working my way through the book.<br>
<br>
<br>
<br>
Running midPoint 4.2. CSV creating accounts in midPoint<br>
<br>
<br>
<br>
Connected one of my test Active Directories using the ad-ldap-medusa-medium.xml sample file. The accounts in the CSV exist in a test OU in AD so I'm working on linking them. I think I understand that process.<br>
<br>
<br>
<br>
What I'm trying to get a grasp on is how to limit what I the AD connector pulls in to midPoint. I have 30,000+ user objects in the AD and I don't want to pull them all in just yet. I just want to pull the objects in my test OU and go from there.<br>
<br>
<br>
<br>
Any pointers would be greatly appreciated.<br>
<br>
<br>
<br>
thanks, al<br>
<br>
<br>
<br>
--<br>
<br>
Al Lilianstrom<br>
<br>
Authentication Services<br>
<br>
<br>
<br>
Fermi National Accelerator Laboratory<br>
<br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__www.fnal.gov&d=DwIGaQ&c=--1RjWWBW4Kf6aBAaj53vPItwfT0BR1YjSDV46P5EvE&r=0OeKN_TS34QS-SJXC_YJThvidGwk12Q2O3mVC4v6a-g&m=Qr2V91d2Ip57WGd7ValnTgSil2wzkdfhEuP9wIvUDE0&s=evX712InlwqkzPVPmkNpUuUH5XHsAUOZobBSkhQFW1Q&e=" rel="noreferrer" target="_blank">https://urldefense.proofpoint.com/v2/url?u=http-3A__www.fnal.gov&d=DwIGaQ&c=--1RjWWBW4Kf6aBAaj53vPItwfT0BR1YjSDV46P5EvE&r=0OeKN_TS34QS-SJXC_YJThvidGwk12Q2O3mVC4v6a-g&m=Qr2V91d2Ip57WGd7ValnTgSil2wzkdfhEuP9wIvUDE0&s=evX712InlwqkzPVPmkNpUuUH5XHsAUOZobBSkhQFW1Q&e=</a><br>
<br>
<a href="mailto:lilstrom@fnal.gov" target="_blank">lilstrom@fnal.gov</a><mailto:<a href="mailto:lilstrom@fnal.gov" target="_blank">lilstrom@fnal.gov</a>><br>
<br>
<br>
<br>
_______________________________________________<br>
<br>
midPoint mailing list<br>
<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><mailto:<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a>><br>
<br>
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.evolveum.com_mailman_listinfo_midpoint&d=DwIGaQ&c=--1RjWWBW4Kf6aBAaj53vPItwfT0BR1YjSDV46P5EvE&r=0OeKN_TS34QS-SJXC_YJThvidGwk12Q2O3mVC4v6a-g&m=Qr2V91d2Ip57WGd7ValnTgSil2wzkdfhEuP9wIvUDE0&s=WsiUzjGpk_tQ20qzCHWz9P33zdiHZp14N2ET9IJ2ebs&e=" rel="noreferrer" target="_blank">https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.evolveum.com_mailman_listinfo_midpoint&d=DwIGaQ&c=--1RjWWBW4Kf6aBAaj53vPItwfT0BR1YjSDV46P5EvE&r=0OeKN_TS34QS-SJXC_YJThvidGwk12Q2O3mVC4v6a-g&m=Qr2V91d2Ip57WGd7ValnTgSil2wzkdfhEuP9wIvUDE0&s=WsiUzjGpk_tQ20qzCHWz9P33zdiHZp14N2ET9IJ2ebs&e=</a><br>
<br>
La información contenida en este mensaje es confidencial. En caso de que reciba este mensaje por error le rogamos lo comunique a la mayor brevedad al emisor y proceda a su eliminación definitiva, absteniéndose de copiar, almacenar o difundir su contenido. De acuerdo con lo establecido en la Ley Orgánica 15/1999, de Protección de Datos de Carácter Personal y en el Reglamento de Desarrollo 1720/2007, los datos personales que facilite a través de la dirección de correo indicada serán incorporados a un fichero titularidad de INGRAM MICRO, S.L.U., con domicilio en C/ Antonio Machado, 78-80 1ª y 2ª pl. Business Park ( 08840-Viladecans). Mediante el envío de sus datos, Ud. otorga su consentimiento expreso a INGRAM MICRO, S.L.U, para el tratamiento de sus datos, con la finalidad de atender a su consulta y/o mantener la relación profesional, comercial, y/o contractual que en su caso establezca con INGRAM MICRO, S.L.U. Puede ejercitar sus derechos de acceso, rectificación, cancelación y oposición notificándolo por escrito a la dirección del remitente, o a la siguiente dirección de correo <a href="mailto:nuevascuentas@ingrammicro.es" target="_blank">nuevascuentas@ingrammicro.es</a>. De acuerdo con la Ley 34/2002, de Servicios de la Sociedad de la Información y de Comercio Electrónico, Vd. podrá oponerse en cualquier momento al tratamiento de sus datos con fines promocionales notificándonoslo por escrito a la dirección de correo mencionada.<br>
..............................................................................................................................................................................................................................................<br>
The information contained in this message is confidential. If you receive this message by error please notify it as soon as possible to the sender and proceed to their final elimination by not copy, store or distribute its content. In accordance of what is stated in the Law 15/1999, of Data Personal Protection and Regulation Rule 1720/2007, the personal data provided through the email address you entered will be included in a file owned by INGRAM MICRO, SLU, located at C/ Antonio Machado, 78-80 1ª y 2ª pl. Business Park ( 08840-Viladecans). By submitting your data, you expressly give your consent to INGRAM MICRO, SLU, to the treatment of your data, in order to answer to your questions and / or keep the professional, commercial relationship and / or contractual set with INGRAM MICRO, SLU You can exercise your rights of access, rectification, cancellation and opposition by giving written notification to the sender address or to the following email: <a href="mailto:nuevascuentas@ingrammicro.es" target="_blank">nuevascuentas@ingrammicro.es</a>. According to Law 34/2002, of the Information Society and Electronic Commerce, you may object at any time to your data treatment for promotional purposes by notifying us in writing to the email address above.<br>
[Ingram_2818e5de]<br>
_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="https://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">https://lists.evolveum.com/mailman/listinfo/midpoint</a><<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.evolveum.com_mailman_listinfo_midpoint&d=DwQFaQ&c=gRgGjJ3BkIsb5y6s49QqsA&r=Ccoy53oEM8wW3-vUAuZFE1kez-3vbV9LOfLVoaEsm3A&m=zObqO0mO8lciEpAauzdu0RiHLAezgpZgOd7pZW1Bg_w&s=3CNjenvKco27VDCn4prn409jTYJA04syDa-yCleQ5gE&e=" rel="noreferrer" target="_blank">https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.evolveum.com_mailman_listinfo_midpoint&d=DwQFaQ&c=gRgGjJ3BkIsb5y6s49QqsA&r=Ccoy53oEM8wW3-vUAuZFE1kez-3vbV9LOfLVoaEsm3A&m=zObqO0mO8lciEpAauzdu0RiHLAezgpZgOd7pZW1Bg_w&s=3CNjenvKco27VDCn4prn409jTYJA04syDa-yCleQ5gE&e=</a>><br>
<br>
_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="https://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">https://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
</blockquote></div>