<div style="font-family: Arial, sans-serif; font-size: 14px;">Hi Fabian,</div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;">associations work, I think. </div><div style="font-family: Arial, sans-serif; font-size: 14px;">But as far as I can tell, you don't really see them. </div><div style="font-family: Arial, sans-serif; font-size: 14px;">As an end-user they don't show up in "All Accesses" I have to click on Projections and the FreeIPA account to see them.</div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;">And if you cannot see the entitlements in an easy way, how can you remove them?</div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;">So I'm been trying this (it is the "one-off" import that I'm after)</div><div style="font-family: Arial, sans-serif; font-size: 14px;"><div style="font-family: "JetBrains Mono", monospace; font-size: 9.8pt; color: rgb(101, 123, 131); background-color: rgb(253, 246, 227);"><pre><span style="color: rgb(147, 161, 161);"><</span><span style="color: rgb(38, 139, 210);">attribute</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="color: rgb(38, 139, 210);">ref</span><span style="color: rgb(147, 161, 161);">></span>ri:memberof_group<span style="color: rgb(147, 161, 161);"></</span><span style="color: rgb(38, 139, 210);">ref</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="color: rgb(38, 139, 210);">inbound</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="color: rgb(38, 139, 210);">strength</span><span style="color: rgb(147, 161, 161);">></span>strong<span style="color: rgb(147, 161, 161);"></</span><span style="color: rgb(38, 139, 210);">strength</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="color: rgb(38, 139, 210);">expression</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="color: rgb(38, 139, 210);">trace</span><span style="color: rgb(147, 161, 161);">></span>true<span style="color: rgb(147, 161, 161);"></</span><span style="color: rgb(38, 139, 210);">trace</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="color: rgb(38, 139, 210);">assignmentTargetSearch</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="color: rgb(38, 139, 210);">targetType</span><span style="color: rgb(147, 161, 161);">></span>RoleType<span style="color: rgb(147, 161, 161);"></</span><span style="color: rgb(38, 139, 210);">targetType</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="color: rgb(38, 139, 210);">filter</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="color: rgb(108, 113, 196);">q</span><span style="color: rgb(38, 139, 210);">:equal</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="color: rgb(108, 113, 196);">q</span><span style="color: rgb(38, 139, 210);">:path</span><span style="color: rgb(147, 161, 161);">></span>name<span style="color: rgb(147, 161, 161);"></</span><span style="color: rgb(108, 113, 196);">q</span><span style="color: rgb(38, 139, 210);">:path</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="color: rgb(38, 139, 210);">expression</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="color: rgb(38, 139, 210);">value</span><span style="color: rgb(147, 161, 161);">></span>$input<span style="color: rgb(147, 161, 161);"></</span><span style="color: rgb(38, 139, 210);">value</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> </</span><span style="color: rgb(38, 139, 210);">expression</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> </</span><span style="color: rgb(108, 113, 196);">q</span><span style="color: rgb(38, 139, 210);">:equal</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> </</span><span style="color: rgb(38, 139, 210);">filter</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> </</span><span style="color: rgb(38, 139, 210);">assignmentTargetSearch</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> </</span><span style="color: rgb(38, 139, 210);">expression</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="color: rgb(38, 139, 210);">target</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> <</span><span style="color: rgb(38, 139, 210);">path</span><span style="color: rgb(147, 161, 161);">></span>assignment<span style="color: rgb(147, 161, 161);"></</span><span style="color: rgb(38, 139, 210);">path</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> </</span><span style="color: rgb(38, 139, 210);">target</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"> </</span><span style="color: rgb(38, 139, 210);">inbound</span><span style="color: rgb(147, 161, 161);">><br></span><span style="color: rgb(147, 161, 161);"></</span><span style="color: rgb(38, 139, 210);">attribute</span><span style="color: rgb(147, 161, 161);">><br></span></pre></div>And I see this from the trace:</div><div style="font-family: Arial, sans-serif; font-size: 14px;"><blockquote style="border-left: 3px solid rgb(200, 200, 200); border-top-color: rgb(200, 200, 200); border-right-color: rgb(200, 200, 200); border-bottom-color: rgb(200, 200, 200); padding-left: 10px; color: rgb(102, 102, 102);"><span>Sources:</span><div><span> Source {.../common/common-3}input</span></div><div><span> old:</span></div><div><span> memberof_group: [ ipausers, group1, group2 ]</span></div><div><span> delta: null</span></div><div><span> new:</span></div><div><span> memberof_group: [ ipausers, group1, group2 ]</span></div></blockquote><div><br></div><span></span>I don't get any errors, but something is not quite working...</div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div>
<div class="protonmail_signature_block" style="font-family: Arial, sans-serif; font-size: 14px;">
<div class="protonmail_signature_block-user">
Markus Calmius<br>Proton AG
</div>
<div class="protonmail_signature_block-proton protonmail_signature_block-empty">
</div>
</div>
<div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div><div class="protonmail_quote">
------- Original Message -------<br>
On Thursday, September 14th, 2023 at 19:09, Fabian Noll-Dukiewicz <fabian.noll-dukiewicz@veryfy.gmbh> wrote:<br><br>
<blockquote class="protonmail_quote" type="cite">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US">Hi Markus,</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US" lang="EN-US">for Active Directory this is done by Association on the user account object and on these association is set an inbound mapping to “assignment”. Please see the midpoint
samples for a more detailed view. (<a href="https://github.com/Evolveum/midpoint-samples/blob/master/samples/resources/ad-ldap/ad-ldap-medusa-medium.xml" rel="noreferrer nofollow noopener" target="_blank">some like this</a>)</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US" lang="EN-US"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US" lang="EN-US"><img alt="Ein Bild, das Text, Screenshot, Schrift enthält.
Automatisch generierte Beschreibung" id="Grafik_x0020_1" style="width:6.1354in;height:2.5208in" height="242" width="589" border="0" class="proton-embedded" src="cid:image001.png@01D9E73E.F89DF3B0"></span><span style="font-size:11.0pt;mso-fareast-language:EN-US" lang="EN-US"></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US" lang="EN-US"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US" lang="EN-US">Kind regards,</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US" lang="EN-US">Fabian</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US" lang="EN-US"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US" lang="EN-US">--</span></p>
<div>
<p class="MsoNormal"><b><span style="font-family:"Verdana",sans-serif;color:black">Fabian Noll-Dukiewicz</span></b><span style="font-size:11.0pt;color:black"></span></p>
<p class="MsoNormal"><i><span style="font-family:"Verdana",sans-serif;color:black">Spezialist Identity & Access Management | Geschäftsführer</span></i></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:black" lang="EN-US">Tel.: +49 152 244 63 211</span><span style="font-size:11.0pt;color:black" lang="EN-US"></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:black" lang="EN-US">Email: fabian.noll-dukiewicz@veryfy.gmbh</span><span style="font-size:11.0pt;color:black" lang="EN-US"></span></p>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif;color:black">Web: </span><span style="font-family:"Verdana",sans-serif;color:black;mso-fareast-language:EN-US"><a href="https://veryfy.gmbh" rel="noreferrer nofollow noopener" target="_blank"><span style="color:#0563C1">https://veryfy.gmbh</span></a>
</span><span style="font-size:11.0pt;color:black"> </span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"> </span></p>
<div id="mail-editor-reference-message-container">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p style="margin-bottom:12.0pt" class="MsoNormal"><b><span style="font-size:12.0pt;color:black">Von:
</span></b><span style="font-size:12.0pt;color:black">midPoint <midpoint-bounces@lists.evolveum.com> im Auftrag von Markus Calmius via midPoint <midpoint@lists.evolveum.com><br>
<b>Datum: </b>Donnerstag, 14. September 2023 um 16:23<br>
<b>An: </b>midpoint@lists.evolveum.com <midpoint@lists.evolveum.com><br>
<b>Cc: </b>Markus Calmius <markus.calmius@proton.ch><br>
<b>Betreff: </b>Re: [midPoint] Integrating existing LDAP</span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">Hi again,</span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">not quite working.</span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">Creating a role in midPoint creates the corresponding group in LDAP.</span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">Actually, it's not LDAP, but FreeIPA, so I'm using <a target="_blank" href="https://github.com/artinsolutions/midpoint-connector-freeipa/tree/master" rel="noreferrer nofollow noopener">https://github.com/artinsolutions/midpoint-connector-freeipa/tree/master</a>.</span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">Assigning the role to a user, creates and/or updates FreeIPA with the membership.</span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">So the "next step" is working fine.</span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">But before I get there, it's the reverse I would like to do: </span></p>
</div>
<div>
<ul type="disc">
<li style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1" class="MsoNormal">
<span style="font-size:10.5pt;font-family:"Arial",sans-serif">create roles for all freeipa groups: done</span></li></ul>
<ul type="disc">
<ul type="circle">
<li style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level2 lfo1" class="MsoNormal">
<span style="font-size:10.5pt;font-family:"Arial",sans-serif">I am also assigning an archetype to differentiate them from other roles</span></li></ul>
</ul>
</div>
<div>
<ul type="disc">
<li style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo2" class="MsoNormal">
<span style="font-size:10.5pt;font-family:"Arial",sans-serif">assign the midPoint role(s) to all users that are member of the group</span></li></ul>
<ul type="disc">
<ul type="circle">
<li style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level2 lfo2" class="MsoNormal">
<span style="font-size:10.5pt;font-family:"Arial",sans-serif">this is not working, I'm probably missing something, but when I read everything and check the xml-files all I see is outbound. And I guess I need something inbound. And, since it's related to the
user, would it mean a user object template that could do this?</span></li></ul>
</ul>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">Thanks in advance</span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"> </span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">Markus Calmius<br>
Proton AG </span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt">------- Original Message -------<br>
On Monday, September 11th, 2023 at 14:34, Markus Calmius <markus.calmius@proton.ch> wrote:<br>
<br>
<br>
</span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">Thank you Fabian and David for the information. </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">I will read the pages you've linked to and see if I can figure it out .</span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"> </span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">Markus Calmius<br>
Proton AG </span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt">------- Original Message -------<br>
On Monday, September 11th, 2023 at 09:46, Markus Calmius <markus.calmius@proton.ch> wrote:<br>
<br>
<br>
</span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">Hi,</span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">I'm trying to figure out how to best integrate an existing LDAP server that contains users and groups. The users is not a difficult problem to solve, but the groups and mainly
the group-membership eats up quite some time for me.</span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">To be fair, I am quite new to midPoint (although I have taken the fundamentals training), and I am still wrapping my head around everything.</span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">What I want to achieve, in the long run, is for midPoint to be the authoritative source for the LDAP directory, but before getting there, I need to import everything.</span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">Using various pages from the mailing-list and docs.evovleum.com I have managed to import all groups as roles. Which is the first step I guess, but since the midPoint Role doesn't
contains "members" I got a bit stuck. The problem with searching things online is that there isn't a "best before" note on the information you find. So sometimes the information is old and dated. </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">So, I basically have two questions:</span></p>
</div>
<div>
<ol type="1" start="1">
<li style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 level1 lfo3" class="MsoNormal">
<span style="font-size:10.5pt;font-family:"Arial",sans-serif">is there a better way to do this?</span></li><li style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 level1 lfo3" class="MsoNormal">
<span style="font-size:10.5pt;font-family:"Arial",sans-serif">if not, how do I also get the midPoint roles to include the ldap group membership</span></li></ol>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">If you can point me in the right direction I will much appreciate it.</span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">Thanks in advance!</span></p>
</div>
<div>
<div>
<p style="margin-bottom:12.0pt" class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif">Markus Calmius</span></p>
</div>
</div>
</blockquote>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span></p>
</div>
</blockquote>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span></p>
</div>
</div>
</div>
</div>
</blockquote><br>
</div>