<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Following up on this, I'm still not able to createOnDemand with associationTargetSearch.<div class=""><br class=""></div><div class="">So I decided to replace this with an assignmenttTargetSearch with createOnDemand role in midPoint that maps to the group in AD.</div><div class="">But doing this, I faced another problem.</div><div class=""><br class=""></div><div class="">This assignment is created in an inbound mapping from another resource, so it’s a secondary change.</div><div class="">Doing this, the association to the AD group is not done until I recompute the user again.</div><div class="">This wouldn’t be such a problem if the assignment removal worked, however it does not.</div><div class="">If the inbound mapping removes this assignment, the group association is not removed, even after recomputing.</div><div class=""><br class=""></div><div class="">If the assignment is created and removed manually directly in midpoint, it works fine.</div><div class=""><br class=""></div><div class="">Here’s what I’m trying to achieve:</div><div class=""><br class=""></div><div class="">Inbound mapping from Resource A creates user assignment to a role, with some context value on it</div><div class=""><br class=""></div><div class="">User —context:999—> Role R</div><div class=""><br class=""></div><div class="">I want this to map to an AD group R_999</div><div class=""><br class=""></div><div class="">so first I tried with associationTargetSearch and createOnDemand , could not make it work.</div><div class="">(context values are not fixed, I need to create on demand)</div><div class=""><br class=""></div><div class="">So I tried this</div><div class=""><br class=""></div><div class="">User —context:999 —> Role R —> focusMapping assignmentTargetSearch createOnDemand —> Role R_999 —> AD group R_999</div><div class=""><div><br class=""></div><div>This does not ‘finish’, it stops at Role R_999 creation and assignment, but the association is not made. I guess it’s too long a chain of events for midpoint.</div><div>Since the context is dynamic, I cannot create beforehand the groups. </div><div>Is there a better way to achieve this?</div><div><br class=""></div><div><br class=""></div><div>Thanks in advance for any help on this</div><div><br class=""><blockquote type="cite" class=""><div class="">Em 27 de fev. de 2023, à(s) 20:43, Alcides Moraes <<a href="mailto:alcides.neto@gmail.com" class="">alcides.neto@gmail.com</a>> escreveu:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hello list,<div class=""><br class=""></div><div class="">I’m attempting to use createOnDemand with associationTargetSearch with Active Directory groups, is this possible?</div><div class="">I have not seen any example or documentation on this.</div><div class=""><br class=""></div><div class="">The associationTargetSearch works if the group exists, but I cannot seem to create a group with createOnDemand.</div><div class="">I’ve created roles with createOnDemand with no problem, but since this is a resource object, is this supported? According to the schema, it should.</div><div class=""><br class=""></div><div class="">I’m getting this error, there is a single populateItem trying to write do the DN attribute:</div><div class=""><br class=""></div><div class=""><b class="">Error evaluating mapping for association {.../resource/instance-3}group
in construction for
(resource:xxxx(AD)/ACCOUNT/default/null)
in role:xxx(Metarole): No target item that would conform to the path
attributes/dn in expression in mapping in outbound mapping for
association</b></div><div class=""><b class=""><br class=""></b></div><div class="">I have tried “dn”, “ri:dn”, “attributes/ri:dn” on the <path> element, none of them worked.</div><div class=""><br class=""></div><div class="">My code:</div><div class=""><associationTargetSearch><br class=""> <filter><br class=""> <q:equal><br class=""> <q:path>attributes/ri:dn</q:path><br class=""> <expression><br class=""> <script><br class=""> <code><br class=""> // my logic here<br class=""> </code><br class=""> </script><br class=""> </expression><br class=""> </q:equal><br class=""> </filter><br class=""> <searchStrategy>onResourceIfNeeded</searchStrategy><br class=""> <createOnDemand>true</createOnDemand><br class=""> <populateObject><br class=""> <populateItem><br class=""> <expression><br class=""> <script><br class=""> <code><br class=""> // my logic here<br class=""> </code><br class=""> </script><br class=""> </expression><br class=""> <target><br class=""> <path>attributes/dn</path><br class=""> </target><br class=""> </populateItem><br class=""> </populateObject><br class=""></associationTargetSearch></div><div class=""><br class=""></div><div class=""><br class=""></div></div></div></blockquote></div><br class=""></div></body></html>