<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="en-CH" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Hello Emil,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Thanks a lot for the reply!!<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">The two methods you provided are good solutions for one organization.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">It doesn’t work if there are more than one value in organization (organization can be a list, but the equal filter takes only one value to be compared with).
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">In my case, I want to show OrgType from a list of organizations.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">What I am doing now is using several object selectors for each org that might be shown in the list (i.e., repeating many times the block below in one reading authorization).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><object><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> <type>OrgType</type><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> <filter><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> <q:equal><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> <q:path>name</q:path><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> <expression><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> <script><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> <code><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> import com.evolveum.midpoint.xml.ns._public.common.common_3.UserType<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> UserType user = midpoint.getObject(UserType.class, midpoint.principalOid.toString())<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> orgUnits = user.getOrganization();<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> if(orgUnits.any { it =~ "management:org
</span><span lang="EN-US" style="mso-fareast-language:EN-US">XXXX</span><span style="mso-fareast-language:EN-US">"}){<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> return "org
</span><span lang="EN-US" style="mso-fareast-language:EN-US">XXXX</span><span style="mso-fareast-language:EN-US">"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> </code><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> </script><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> </expression><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> </q:equal><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"> </filter><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"></object><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">What I did is certainly not a good way to scale to lots of organizations.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Many thanks and best regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Hsin-Fang<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Emil Militzer <emil.militzer@posteo.de>
<br>
<b>Sent:</b> Sunday, February 6, 2022 10:15 AM<br>
<b>To:</b> Hsin-Fang Hsu <hsin-fang.hsu@itconcepts.ch>; midpoint@lists.evolveum.com<br>
<b>Subject:</b> Re: [midPoint] get the name of OrgType in filter<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hallo,<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I came to the realization that this is overcomplicated. Midpoint offers the path expression which is more clean and useful in this case.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<pre style="background:white"><span style="color:#AC780E"><authorization><br> <action></span><span style="color:black"><a href="http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read">http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</a></span><span style="color:#AC780E"></action><br> <object><br> <type></span><span style="color:#4A5C6E">OrgType</span><span style="color:#AC780E"></type><br> <filter><br> <</span><span style="color:#9B70B1">q</span><span style="color:#AC780E">:equal><br> <</span><span style="color:#9B70B1">q</span><span style="color:#AC780E">:path></span><span style="color:#4A5C6E">name</span><span style="color:#AC780E"></</span><span style="color:#9B70B1">q</span><span style="color:#AC780E">:path><br> <expression><br> <queryInterpretationOfNoValue></span><span style="color:#4A5C6E">filterNone</span><span style="color:#AC780E"></queryInterpretationOfNoValue><br> <path></span><span style="color:#4A5C6E">$subject/organization</span><span style="color:#AC780E"></path><br> </expression><br> </</span><span style="color:#9B70B1">q</span><span style="color:#AC780E">:equal><br> </filter><br> </object><br></authorization></span><span style="color:#4A5C6E"><o:p></o:p></span></pre>
<div>
<p class="MsoNormal">This is also the example from the midpoint Authorization configuration wiki page.<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Kind Regards<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Emil<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">Am 05.02.2022 um 21:15 schrieb Emil Militzer <<a href="mailto:emil.militzer@posteo.de">emil.militzer@posteo.de</a>>:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Hello,<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">You don’t have access to the name of the org in the expression context because inside the expression you need to compute the value list for the possible name parameters in the query.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">If I understand your requirement correctly you want to allow the read access to all orgs which are configured in the Organisation attribute of the user.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Can you try the following configuration?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">(It works with midpoint 4.3 and later, if you use an older version you can access <span style="font-family:"Courier New";color:#4A5C6E;background:white">midpoint.getPrincipal().getUser()
</span><span style="font-family:"Courier New";color:black;background:white">to get the UserType object.)</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<pre style="background:white"><span style="color:#AC780E"><authorization><br> <action></span><span style="color:black"><a href="http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read">http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</a></span><span style="color:#AC780E"></action><br> <object><br> <type></span><span style="color:#4A5C6E">OrgType</span><span style="color:#AC780E"></type><br> <filter><br> <</span><span style="color:#9B70B1">q</span><span style="color:#AC780E">:equal><br> <</span><span style="color:#9B70B1">q</span><span style="color:#AC780E">:path></span><span style="color:#4A5C6E">name</span><span style="color:#AC780E"></</span><span style="color:#9B70B1">q</span><span style="color:#AC780E">:path><br> <expression><br> <script><br> <code></span><span style="color:#4A5C6E">import com.evolveum.midpoint.xml.ns._public.common.common_3.UserType<br> return ((UserType)midpoint.getPrincipal().getFocus()).getOrganization()<br> </span><span style="color:#AC780E"></code><br> </script><br> </expression><br> </</span><span style="color:#9B70B1">q</span><span style="color:#AC780E">:equal><br> </filter><br> </object><br></authorization></span><span style="color:#4A5C6E"><o:p></o:p></span></pre>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<div>
<p class="MsoNormal">Kind Regards,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Emil<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<pre style="background:white;white-space:pre-wrap;caret-color: rgb(0, 0, 0)"><span style="color:black">I want to restrict the authorization to view only OrgType that in a predefined list of each user.</span><o:p></o:p></pre>
<pre style="background:white"><span style="color:black">Below is the code and I am wondering how to get something like the variable “thisInputOrgName”.</span><o:p></o:p></pre>
<pre style="background:white"><span style="color:black">Any idea?</span><o:p></o:p></pre>
<pre style="background:white"><o:p> </o:p></pre>
<pre style="background:white"><span style="color:black">[cid:<a href="https://lists.evolveum.com/mailman/listinfo/midpoint">image001.png at 01D819DF.61DF3890</a>]</span><o:p></o:p></pre>
<pre style="background:white"><o:p> </o:p></pre>
<pre style="background:white"><o:p> </o:p></pre>
<pre style="background:white"><span style="color:black">Many thanks for the help in advance!</span><o:p></o:p></pre>
<pre style="background:white"><o:p> </o:p></pre>
<pre style="background:white"><span style="color:black">Best regards,</span><o:p></o:p></pre>
<pre style="background:white"><span style="color:black">Hsin-Fang</span><o:p></o:p></pre>
<pre style="background:white"><o:p> </o:p></pre>
<pre style="background:white"><span style="color:black">-------------- next part --------------</span><o:p></o:p></pre>
<pre style="background:white"><span style="color:black">An HTML attachment was scrubbed...</span><o:p></o:p></pre>
<pre style="background:white"><span style="color:black">URL: <<a href="https://lists.evolveum.com/pipermail/midpoint/attachments/20220204/a22d90d1/attachment-0001.htm">https://lists.evolveum.com/pipermail/midpoint/attachments/20220204/a22d90d1/attachment-0001.htm</a>></span><o:p></o:p></pre>
<pre style="background:white"><span style="color:black">-------------- next part --------------</span><o:p></o:p></pre>
<pre style="background:white"><span style="color:black">A non-text attachment was scrubbed...</span><o:p></o:p></pre>
<pre style="background:white"><span style="color:black">Name: image001.png</span><o:p></o:p></pre>
<pre style="background:white"><span style="color:black">Type: image/png</span><o:p></o:p></pre>
<pre style="background:white"><span style="color:black">Size: 76589 bytes</span><o:p></o:p></pre>
<pre style="background:white"><span style="color:black">Desc: image001.png</span><o:p></o:p></pre>
<pre style="background:white"><span style="color:black">URL: <<a href="https://lists.evolveum.com/pipermail/midpoint/attachments/20220204/a22d90d1/attachment-0001.png">https://lists.evolveum.com/pipermail/midpoint/attachments/20220204/a22d90d1/attachment-0001.png</a>></span><o:p></o:p></pre>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>