<div dir="ltr"><div>Below my mapping for AD user's DN: </div><div><br></div> <attribute><br> <ref>ri:dn</ref><br> <outbound><br> <strength>strong</strength><br> <source><br> <path>parentOrgRef</path><br> </source><br> <source><br> <path>fullName</path><br> </source><br> <expression><br> <script><br> <code><div> OrgType link = midpoint.getOrgByOid(parentOrgRef.oid);<br> return basic.composeDn( . . .);<br> </code><br> </script><br> </expression><br> <condition><br> <script><br> <code><br> return parentOrgRef != null; <br> </code><br> </script><br> </condition><br> </outbound><br> </attribute><br><div><br></div><div>And simple role with user's AD account:</div><div><role><br> <name>User IT Role</name><br> <inducement><br> <construction><br> <resourceRef oid="746ecf5e-3e8c-11e6-b2f9-3c970e44b9e2" relation="org:default" type="c:ResourceType"/><br> <kind>account</kind><br> <intent>default</intent><br> </construction><br> </inducement><br></role><br></div><div><br></div><div>I am waiting that if I import updated user with new org</div><div>1) new org will be assigned instead of old one (this works). I use assignmentTargetSearch and createOnDemand with populateObject in UserObjectTemplate.</div><div>2) AD account will be updated based on new org attributes (this doesn't. I need to run extra recon to actualize AD account)</div><div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, 5 Apr 2022 at 21:47, Fabian Noll-Dukiewicz <<a href="mailto:fabian.noll-dukiewicz@fndit.de">fabian.noll-dukiewicz@fndit.de</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="DE" style="overflow-wrap: break-word;">
<div class="gmail-m_-6345049543922595247WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:11pt">I have one more idea: If you want that the AD account is reprovisioned to backend you can add parentOrgRef as an Outbound mapping. If the attribute is added or changed
on a user having an AD account, it would be change your AD data.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11pt">Maybe you can show us some sample data for a better understanding of what is your use case.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11pt">Kind regards,<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11pt">Fabian<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11pt"><u></u> <u></u></span></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0cm 0cm">
<p class="MsoNormal" style="margin-bottom:12pt"><b><span style="font-size:12pt;color:black">Von:
</span></b><span style="font-size:12pt;color:black">Yakov Revyakin <<a href="mailto:yrevyakin@gmail.com" target="_blank">yrevyakin@gmail.com</a>><br>
<b>Datum: </b>Dienstag, 5. April 2022 um 14:14<br>
<b>An: </b>Fabian Noll-Dukiewicz <<a href="mailto:fabian.noll-dukiewicz@fndit.de" target="_blank">fabian.noll-dukiewicz@fndit.de</a>><br>
<b>Cc: </b>MidPoint Mailing List <<a href="mailto:midpoint@lists.evolveum.com" target="_blank">midpoint@lists.evolveum.com</a>><br>
<b>Betreff: </b>Re: [midPoint] How to actualize an account based on parentOrgRef<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt">Thank you Fabian,<u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11pt">I will take a look at triggers. <u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt">About your second option:<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt">A user already has an appropriate role auto-assigned. During role assignment the role created an AD account based on parentOrgRef set previously. After, I reconcile the user and assign another org instead
of the one mentioned before. In result the user still has the same AD account based on data from the first org. So, after this reconciliation I have inconsistency: parentOrgRef is updated but AD account isn't. I could probably check the equivalence of parentOrgRef
and assignment.targetRef somewhere in condition but I am afraid I can get a role or account revoked.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
</div>
</div>
</div>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt">On Tue, 5 Apr 2022 at 14:29, Fabian Noll-Dukiewicz <<a href="mailto:fabian.noll-dukiewicz@fndit.de" target="_blank">fabian.noll-dukiewicz@fndit.de</a>> wrote:<u></u><u></u></span></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;color:black">Hi Yakov,<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;color:black"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;color:black">I think you have multiple options to handle this requirement but it depends on your configuration. In my mind you can use trigger to start a recomputation of the affected user. (take a look on
linked objects: <a href="https://docs.evolveum.com/midpoint/reference/synchronization/linked-objects/" target="_blank">https://docs.evolveum.com/midpoint/reference/synchronization/linked-objects/</a>)<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;color:black">Another possibility is to separate the two things. First setting the parentOrgRef in resource synchronization and second do the account creation (e.g. based on role assignment) in object template
or by automatic role assignment.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;color:black"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;color:black">Hope to give you some hints to make some progress.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;color:black"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;color:black">Kind regards,<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;color:black">Fabian<u></u><u></u></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12pt;color:black"><u></u> <u></u></span></p>
</div>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:11pt">
<hr size="0" width="100%" align="center">
</span></div>
<div id="gmail-m_-6345049543922595247gmail-m_-8212504199467955368divRplyFwdMsg">
<p class="MsoNormal"><b><span style="font-size:11pt;color:black">Von:</span></b><span style="font-size:11pt;color:black"> Yakov Revyakin <<a href="mailto:yrevyakin@gmail.com" target="_blank">yrevyakin@gmail.com</a>><br>
<b>Gesendet:</b> Montag, 4. April 2022 16:42<br>
<b>An:</b> midPoint General Discussion <<a href="mailto:midpoint@lists.evolveum.com" target="_blank">midpoint@lists.evolveum.com</a>><br>
<b>Betreff:</b> Re: [midPoint] How to actualize an account based on parentOrgRef</span><span style="font-size:11pt">
<u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11pt"> <u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt">Can someone help with my question?
<u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11pt">To actualize a user's AD account I run reconciliation with the user's HR source twice: first - to assign a parent org to the user, second - to create an account based on the parent org (because parentOrgRef
is empty during first run).<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt">Is it possible to configure the same effect running reconciliation only once? <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt">Thanks,<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt">J<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt">On Sun, 3 Apr 2022 at 19:56, Yakov Revyakin <<a href="mailto:yrevyakin@gmail.com" target="_blank">yrevyakin@gmail.com</a>> wrote:<u></u><u></u></span></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm">
<div>
<p class="MsoNormal"><span style="font-size:11pt">Hi, <u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt">AD shemaHandling recalculates user's AD account DN based on a value of parentOrgRef. If I assign another org instead of the previous recalculation doesn't happen because, as I understand, parentOrgRef gets
updated value after a phase when MP calculates projections. So, I need to reconcile the user additionally to actualize the AD account.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt">Is this the right suggestion?<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt">Can I manage this situation to have an actual state during a single import excluding extra recon? <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt">Thanks,<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt">J<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote></div>