<div dir="ltr"><div>Hello,</div><div><br></div><div></div><div>I'm evaluating midpoint (I'm new to IDMs in general) and I'm having trouble getting midpoint to work as follows:</div><div><br></div><div>I have two authoritative resources for users:</div><div>A trainee
system (TS)<br></div><div>An
<span class="gmail-HwtZe" lang="en"><span class="gmail-jCAhz gmail-ChMk0b"><span class="gmail-ryNqvb">outsourced employee</span></span></span> system (OES) <br></div><div><br></div><div>Someone can exist and be active in the trainee system or can exist an be active in the outsourced employee system, but cannot be active at both systems at the same time (including begin/end dates). Some attributes can be a little different (for example, the person's name, organizational unit, phone, etc), and I would like to synchronize only the attributes from the resource in which the identity is active.<br></div><div><br></div><div>Sorry if my question is too basic, but how could I configure midpoint to work with this policy?</div><div></div><div><br></div><div></div><div>I've tried to create 2 "radio button" roles: trainee and outsourced and I could make only one of them be assigned.</div><div>My problem here was with synchronization, since midpoint kept updating the name based on the resource in which the user was disabled.</div><div>Sometimes it worked, but the history for the identity started to grow with each synchronization execution, because resources were "competing" to update the attributes.</div><div></div><div><br></div><div>I tried to use defaultAuthoritativeSource (and multisourced fields), but I'm having difficulty with the selection of the resource in which the identity is currently active.</div><div>My defaultAuthoritativeSource configuration (below) doesn't work properly.</div><div></div><div></div><div><br></div><div><multiSource><br> <defaultAuthoritativeSource><br> <expression><br> <script><br> <code><br> import com.evolveum.midpoint.util.MiscUtil<br> import com.evolveum.midpoint.prism.delta.*<br> import com.evolveum.midpoint.xml.ns._public.common.common_3.*<br> import com.evolveum.midpoint.util.DebugUtil<br> import com.evolveum.midpoint.xml.ns._public.common.common_3.ActivationStatusType<br> import com.evolveum.midpoint.util.exception.*<br><br> if(identity == null){<br> return null<br> }<br><br> def RESOURCE_TRAINEE = '466c4e70-ed4b-48f6-8842-99f8c12f9d9d'<br> def RESOURCE_OUTSOURCED = '82f6b6cf-eaf2-45e1-9e27-5349279248c2'<br> def res = [RESOURCE_TRAINEE, RESOURCE_OUTSOURCED]<br></div><div> <br></div><div> // trying to find what is the resource in which the user is active<br></div><div> def sources = identity<br> .collect { it.source }<br> .findAll { source -> res.contains(source?.resourceRef?.oid) }<br> .findAll { source -> midpoint.getObject(ShadowType.class, source.shadowRef.oid)?.isExists() }<br><br> if (sources?.size() == 1) {<br> // found only one, return it<br> return sources.get(0)<br> }<br><br> if (sources?.size() > 1) {<br> throw new PolicyViolationException("The identity is active in multiple authoritative resources")<br> }<br><br> return null<br> </code><br> </script><br> </expression><br> </defaultAuthoritativeSource><br></multiSource></div><div><br></div><div>The code above seems to work initially, but fails when I execute these steps:</div><div>1) I manually import the user from the trainee resource</div><div>2) I delete the user in the trainee resource</div><div>3) I run reconciliation for the user, and he becomes disabled</div><div>4) I manually import the user from the outsourced employee resource</div><div>5) he is correctly updated and is not a trainee anymore</div><div>6) I create the user again in the trainee resource</div><div>7) in this moment, when I try to manually import the trainee again, midpoint allows (shouldn't it throw the exception I programmed in the defaultAuthoritativeSource?)</div><div><br></div><div>Does anyone know what I'm doing wrong?<br></div><div><br></div><div>Additionally, in the code above I tried to interrupt the execution when I detected
that the identity existed in multiple resources with an exception (is it
done this way?).</div><div><br></div><div>Thanks in advance and sorry if my question is too basic!</div><div><br></div><div><br>
</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><br></div>