<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hello,<div class=""><br class=""></div><div class="">You don’t have access to the name of the org in the expression context because inside the expression you need to compute the value list for the possible name parameters in the query.</div><div class="">If I understand your requirement correctly you want to allow the read access to all orgs which are configured in the Organisation attribute of the user.</div><div class="">Can you try the following configuration?</div><div class="">(It works with midpoint 4.3 and later, if you use an older version you can access <span style="color: rgb(74, 92, 110); font-family: "JetBrains Mono", monospace; background-color: rgb(255, 255, 255);" class="">midpoint.getPrincipal().getUser() </span><span style="font-family: "JetBrains Mono", monospace; background-color: rgb(255, 255, 255); caret-color: rgb(0, 0, 0);" class=""><font color="#000000" class="">to get the UserType object.)</font></span></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><pre style="background-color: rgb(255, 255, 255); color: rgb(74, 92, 110); font-family: "JetBrains Mono", monospace;" class=""><span style="color: rgb(172, 120, 14);" class=""><authorization><br class=""></span><span style="color: rgb(172, 120, 14);" class=""> <action></span><a href="http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read" class="">http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</a><span style="color: rgb(172, 120, 14);" class=""></action><br class=""></span><span style="color: rgb(172, 120, 14);" class=""> <object><br class=""></span><span style="color: rgb(172, 120, 14);" class=""> <type></span>OrgType<span style="color: rgb(172, 120, 14);" class=""></type><br class=""></span><span style="color: rgb(172, 120, 14);" class=""> <filter><br class=""></span><span style="color: rgb(172, 120, 14);" class=""> <</span><span style="color: rgb(155, 112, 177);" class="">q</span><span style="color: rgb(172, 120, 14);" class="">:equal><br class=""></span><span style="color: rgb(172, 120, 14);" class=""> <</span><span style="color: rgb(155, 112, 177);" class="">q</span><span style="color: rgb(172, 120, 14);" class="">:path></span>name<span style="color: rgb(172, 120, 14);" class=""></</span><span style="color: rgb(155, 112, 177);" class="">q</span><span style="color: rgb(172, 120, 14);" class="">:path><br class=""></span><span style="color: rgb(172, 120, 14);" class=""> <expression><br class=""></span><span style="color: rgb(172, 120, 14);" class=""> <script><br class=""></span><span style="color: rgb(172, 120, 14);" class=""> <code></span>import com.evolveum.midpoint.xml.ns._public.common.common_3.UserType<br class=""> return ((UserType)midpoint.getPrincipal().getFocus()).getOrganization()<br class=""> <span style="color: rgb(172, 120, 14);" class=""></code><br class=""></span><span style="color: rgb(172, 120, 14);" class=""> </script><br class=""></span><span style="color: rgb(172, 120, 14);" class=""> </expression><br class=""></span><span style="color: rgb(172, 120, 14);" class=""> </</span><span style="color: rgb(155, 112, 177);" class="">q</span><span style="color: rgb(172, 120, 14);" class="">:equal><br class=""></span><span style="color: rgb(172, 120, 14);" class=""> </filter><br class=""></span><span style="color: rgb(172, 120, 14);" class=""> </object><br class=""></span><span style="color: rgb(172, 120, 14);" class=""></authorization></span></pre><div class=""><br class=""></div></div><div class="">Kind Regards,</div><div class="">Emil</div><div class=""><br class=""><div><pre style="white-space: pre-wrap; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="">
I want to restrict the authorization to view only OrgType that in a predefined list of each user.
Below is the code and I am wondering how to get something like the variable “thisInputOrgName”.
Any idea?
[cid:<a href="https://lists.evolveum.com/mailman/listinfo/midpoint" class="">image001.png at 01D819DF.61DF3890</a>]
Many thanks for the help in advance!
Best regards,
Hsin-Fang
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <<a href="https://lists.evolveum.com/pipermail/midpoint/attachments/20220204/a22d90d1/attachment-0001.htm" class="">https://lists.evolveum.com/pipermail/midpoint/attachments/20220204/a22d90d1/attachment-0001.htm</a>>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 76589 bytes
Desc: image001.png
URL: <<a href="https://lists.evolveum.com/pipermail/midpoint/attachments/20220204/a22d90d1/attachment-0001.png" class="">https://lists.evolveum.com/pipermail/midpoint/attachments/20220204/a22d90d1/attachment-0001.png</a>></pre><div class=""><br class=""></div></div><br class=""></div></body></html>