<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Tahoma",sans-serif;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Thank you very much for this detailed feedback, Kamil. We are in the process of implementing 4.8.3 at our organization, and I look forward to trying this out when we get that done. It’s also very nice to see
this working in the demo instance. Very helpful!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Jared<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> midPoint <midpoint-bounces@lists.evolveum.com>
<b>On Behalf Of </b>Kamil Jires via midPoint<br>
<b>Sent:</b> Thursday, July 25, 2024 6:47 PM<br>
<b>To:</b> midpoint@lists.evolveum.com<br>
<b>Cc:</b> Kamil Jires <kamil.jires@evolveum.com><br>
<b>Subject:</b> Re: [midPoint] distinguishedName Support in API Search<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p>Hi Jared,<o:p></o:p></p>
<p>it is possible to search shadow object using Distinguished Name attribute with the current LTS 4.8.3. I have also tried on 4.4.8 but without success.<o:p></o:p></p>
<p><o:p> </o:p></p>
<p>The DistinguishedName is available with path *attributes/ri:dn* in the shadow object.<o:p></o:p></p>
<p><o:p> </o:p></p>
<p>Let me note that shadow is specific object as it is representing real object (usually account or group) located on the resource - external system. In case, you show the content of the shadow (e.g. user - projection, resource - accounts ) you see the information
which is updated / merged with the current information on the resource. In the midPoint's repository there is not stored all the information you see in GUI (except the case you show the raw object or list repository objects directly). By default there is stored
only identifiers (both primary and secondaries) from the resource's attributes on the shadow object in the repository.<o:p></o:p></p>
<p><o:p> </o:p></p>
<p>You can search also over the attributes which is not stored in midPoint's shadow object but in that case there is utilized communication with the resource and the resulting time may be impacted. In case you want to search over the attribute stored in the
repository you can use options *raw* or *noFetch* to keep searching (and also result) only on the content stored in the midPoint's repository - the benefit could be response time. It is design question on your implementation what you prefer / need. One of
the options could be also adding the additional secondary identifier in the resource setting.<o:p></o:p></p>
<p><o:p> </o:p></p>
<p>With midPoint release 4.9+ there will be introduced caching feature on resource. This may help you also reduce communication with the resource and related response time.<o:p></o:p></p>
<p><o:p> </o:p></p>
<p>OK, back to your question... You can try yourself with our demo - <a href="https://urldefense.com/v3/__https:/demo.evolveum.com/__;!!DZ3fjg!-HgJM_1xzNoqahXxhzUNuumEF-7JSQ4KemuDNY7TXhpQtANzWlri4YbUpLEohcWGVViUOTpI2ZEM4JtSJqdiodv4ALw$">
https://demo.evolveum.com/</a> (credentials are visible on the login page) .<o:p></o:p></p>
<p><o:p> </o:p></p>
<p>example of the call with the filter:<o:p></o:p></p>
<p> - query causing communication with relevant resource :<br>
curl -u administrator:<password> -H "Content-Type: application/json" -H "Accept: application/json" -X POST
<a href="https://urldefense.com/v3/__https:/demo.evolveum.com/midpoint/ws/rest/shadows/search__;!!DZ3fjg!-HgJM_1xzNoqahXxhzUNuumEF-7JSQ4KemuDNY7TXhpQtANzWlri4YbUpLEohcWGVViUOTpI2ZEM4JtSJqdiRs6yw2U$">
https://demo.evolveum.com/midpoint/ws/rest/shadows/search</a> --data-binary @filter-file<o:p></o:p></p>
<p><o:p> </o:p></p>
<p> - query limited to the midPoint's repository content :<br>
curl -u administrator:<password> -H "Content-Type: application/json" -H "Accept: application/json" -X POST
<a href="https://urldefense.com/v3/__https:/demo.evolveum.com/midpoint/ws/rest/shadows/search?options=raw__;!!DZ3fjg!-HgJM_1xzNoqahXxhzUNuumEF-7JSQ4KemuDNY7TXhpQtANzWlri4YbUpLEohcWGVViUOTpI2ZEM4JtSJqdif1W2D5k$">
https://demo.evolveum.com/midpoint/ws/rest/shadows/search?options=raw</a> --data-binary @filter-file<o:p></o:p></p>
<p><o:p> </o:p></p>
<p>where the content of the filter-file is:<o:p></o:p></p>
<p>{<br>
"query": {<br>
"filter": {<br>
"text": "resourceRef matches (oid = \"ebd0bf7b-7e80-4175-ba5e-4fd5de2ecd62\") and kind = \"account\" and intent = \"default\" and attributes/dn = \"uid=raphael,ou=people,dc=example,dc=com\" "<br>
},<br>
"paging": {<br>
"maxSize": 5<br>
}<br>
}<br>
}<o:p></o:p></p>
<p><o:p> </o:p></p>
<p>Please note that the kind and intent are required to be able to match proper schema.<o:p></o:p></p>
<p><o:p> </o:p></p>
<p>I hope this information will help you to solve the issue.<o:p></o:p></p>
<p><o:p> </o:p></p>
<p>Relevant links to the docs:<o:p></o:p></p>
<p> - <a href="https://urldefense.com/v3/__https:/docs.evolveum.com/midpoint/reference/support-4.8/concepts/query/midpoint-query-language/search-using-shadow-attributes/*free-form-search__;Iw!!DZ3fjg!-HgJM_1xzNoqahXxhzUNuumEF-7JSQ4KemuDNY7TXhpQtANzWlri4YbUpLEohcWGVViUOTpI2ZEM4JtSJqdi4YR64cc$">
https://docs.evolveum.com/midpoint/reference/support-4.8/concepts/query/midpoint-query-language/search-using-shadow-attributes/#free-form-search</a><o:p></o:p></p>
<p> - <a href="https://urldefense.com/v3/__https:/docs.evolveum.com/midpoint/reference/support-4.8/interfaces/rest/operations/get-op-rest/__;!!DZ3fjg!-HgJM_1xzNoqahXxhzUNuumEF-7JSQ4KemuDNY7TXhpQtANzWlri4YbUpLEohcWGVViUOTpI2ZEM4JtSJqdivwhAdkw$">
https://docs.evolveum.com/midpoint/reference/support-4.8/interfaces/rest/operations/get-op-rest/</a><o:p></o:p></p>
<p> - <a href="https://urldefense.com/v3/__https:/docs.evolveum.com/midpoint/reference/support-4.8/interfaces/rest/operations/shadow-op-rest/__;!!DZ3fjg!-HgJM_1xzNoqahXxhzUNuumEF-7JSQ4KemuDNY7TXhpQtANzWlri4YbUpLEohcWGVViUOTpI2ZEM4JtSJqdij6iwSKs$">
https://docs.evolveum.com/midpoint/reference/support-4.8/interfaces/rest/operations/shadow-op-rest/</a><o:p></o:p></p>
<p> - <a href="https://urldefense.com/v3/__https:/docs.evolveum.com/midpoint/demo/__;!!DZ3fjg!-HgJM_1xzNoqahXxhzUNuumEF-7JSQ4KemuDNY7TXhpQtANzWlri4YbUpLEohcWGVViUOTpI2ZEM4JtSJqdij5iVCys$">
https://docs.evolveum.com/midpoint/demo/</a><o:p></o:p></p>
<p><o:p> </o:p></p>
<div>
<p>Best Regards,<o:p></o:p></p>
<p><strong><span style="font-family:"Arial",sans-serif">Kamil Jires</span></strong><span style="font-family:"Arial",sans-serif"> | Identity Engineer</span><o:p></o:p></p>
<p><a href="https://urldefense.com/v3/__https:/evolveum.com/__;!!DZ3fjg!-HgJM_1xzNoqahXxhzUNuumEF-7JSQ4KemuDNY7TXhpQtANzWlri4YbUpLEohcWGVViUOTpI2ZEM4JtSJqdi7INE6Zs$" target="_blank"><span style="font-family:"Arial",sans-serif;border:solid windowtext 1.0pt;padding:0in;text-decoration:none"><img border="0" width="299" height="73" style="width:3.1166in;height:.7583in" id="Picture_x0020_1" src="cid:~WRD0001.jpg" alt="Image removed by sender."></span></a><span style="font-family:"Arial",sans-serif"><br>
</span><a href="mailto:kamil.jires@evolveum.com" target="_blank"><span style="font-size:10.0pt">kamil.jires@evolveum.com</span></a>
<span style="font-size:10.0pt">| </span><a href="https://urldefense.com/v3/__http:/www.evolveum.com/__;!!DZ3fjg!-HgJM_1xzNoqahXxhzUNuumEF-7JSQ4KemuDNY7TXhpQtANzWlri4YbUpLEohcWGVViUOTpI2ZEM4JtSJqdicBtFpP4$" target="_blank"><span style="font-size:10.0pt">www.evolveum.com</span></a><o:p></o:p></p>
<div>
<p class="MsoNormal"><a href="https://urldefense.com/v3/__https:/www.linkedin.com/company/evolveum__;!!DZ3fjg!-HgJM_1xzNoqahXxhzUNuumEF-7JSQ4KemuDNY7TXhpQtANzWlri4YbUpLEohcWGVViUOTpI2ZEM4JtSJqdik0qf9LQ$" target="_blank"><span style="border:solid windowtext 1.0pt;padding:0in;text-decoration:none"><img border="0" width="23" height="23" style="width:.2416in;height:.2416in" id="Picture_x0020_2" src="cid:~WRD0001.jpg" alt="Image removed by sender. Evolveum LinkedIn"></span></a><a href="https://urldefense.com/v3/__https:/twitter.com/evolveum__;!!DZ3fjg!-HgJM_1xzNoqahXxhzUNuumEF-7JSQ4KemuDNY7TXhpQtANzWlri4YbUpLEohcWGVViUOTpI2ZEM4JtSJqdiZglHtPA$" target="_blank"><span style="border:solid windowtext 1.0pt;padding:0in;text-decoration:none"><img border="0" width="23" height="23" style="width:.2416in;height:.2416in" id="Picture_x0020_3" src="cid:~WRD0001.jpg" alt="Image removed by sender. Evolveum Twitter"></span></a><a href="https://urldefense.com/v3/__https:/www.facebook.com/evolveum__;!!DZ3fjg!-HgJM_1xzNoqahXxhzUNuumEF-7JSQ4KemuDNY7TXhpQtANzWlri4YbUpLEohcWGVViUOTpI2ZEM4JtSJqdiGKD5vi0$" target="_blank"><span style="border:solid windowtext 1.0pt;padding:0in;text-decoration:none"><img border="0" width="23" height="23" style="width:.2416in;height:.2416in" id="Picture_x0020_4" src="cid:~WRD0001.jpg" alt="Image removed by sender. Evolveum Facebook"></span></a><o:p></o:p></p>
</div>
<p style="margin-bottom:12.0pt"><span style="font-size:9.0pt">Disclaimer: The contents of this e-mail and attachment(s) thereto are confidential and intended for the named recipient(s) only. It shall not attach any liability on the originator or Evolveum s.r.o.
or its affiliates. Any views or opinions presented in this email are solely those of the author and may not necessarily reflect the opinions of Evolveum s.r.o. or its affiliates. Any form of reproduction, dissemination, copying, disclosure, modification, distribution
and / or publication of this message without the prior written consent of the author of this e-mail is strictly prohibited. If you have received this email in error please delete it and notify the sender immediately.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">On 7/15/24 15:04, Crowe, Jared via midPoint wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">Hello.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">I'd like to use the distinguishedName matching rule to search shadow data via the REST API. Is this supported in 4.4.8 (or in some later version)? If so, does anyone have a working example they
could share?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">E.g. (what I'm trying)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:11.0pt;color:black">{<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:11.0pt;color:black"> "@ns":
<a href="https://urldefense.com/v3/__http:/prism.evolveum.com/xml/ns/public/query-3__;!!DZ3fjg!-HgJM_1xzNoqahXxhzUNuumEF-7JSQ4KemuDNY7TXhpQtANzWlri4YbUpLEohcWGVViUOTpI2ZEM4JtSJqdiEo5dBfo$">
"http://prism.evolveum.com/xml/ns/public/query-3"</a>,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:11.0pt;color:black"> "query": {<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:11.0pt;color:black"> "filter": {<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:11.0pt;color:black"> "text": "resourceRef matches (oid = \"11111111-1111-1111-111-111111100001\") and name equal [distinguishedName] \"uid=user,ou=Production, ou=People, dc=someorg,
dc=edu\""<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:11.0pt;color:black"> },<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:11.0pt;color:black"> "paging": {<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:11.0pt;color:black"> "maxSize": 5<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:11.0pt;color:black"> }<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:11.0pt;color:black"> }<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt"><span style="font-size:11.0pt;color:black">}<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">Thanks in advance!<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div id="Signature">
<p style="background:white"><b><span style="font-family:"Aptos",sans-serif;color:#13294B">JARED CROWE</span></b><span style="font-family:"Aptos",sans-serif;color:black"><br>
</span><i><span style="font-family:"Aptos",sans-serif;color:#13294B">ASSISTANT DIRECTOR INTEGRATIONS</span></i><span style="font-family:"Aptos",sans-serif"><o:p></o:p></span></p>
<p style="background:white"><span style="font-family:"Aptos",sans-serif;color:#13294B">Administrative Information Technology Services</span><span style="font-family:"Aptos",sans-serif;color:#1F497D"> (AITS)</span><span style="font-family:"Aptos",sans-serif;color:black"><br>
</span><span style="font-family:"Aptos",sans-serif;color:#13294B">University of Illinois System</span><span style="font-family:"Aptos",sans-serif;color:black"><br>
</span><span style="font-family:"Aptos",sans-serif;color:#13294B">50 Gerty Dr. #133d | M/C 673</span><span style="font-family:"Aptos",sans-serif;color:#1F497D"> | Champaign, IL 61820</span><span style="font-family:"Aptos",sans-serif;color:black"><br>
</span><span style="font-family:"Aptos",sans-serif;color:#13294B">217.333.2098 | </span>
<span style="font-family:"Aptos",sans-serif;color:#1F497D"><a href="mailto:jmcrowe@illinois.edu" target="_blank">jmcrowe@illinois.edu</a></span><span style="font-family:"Aptos",sans-serif;color:black"><br>
</span><span style="font-family:"Aptos",sans-serif;color:#13294B"><a href="http://www.aits.uillinois.edu/" target="_blank">www.aits.uillinois.edu</a></span><span style="font-family:"Aptos",sans-serif"><o:p></o:p></span></p>
<p style="background:white"><span style="font-family:"Aptos",sans-serif;color:#13294B"> </span><span style="font-family:"Aptos",sans-serif"><o:p></o:p></span></p>
<p style="background:white"><span style="color:black"><a href="https://www.uillinois.edu/" target="_blank"><span style="font-family:"Aptos",sans-serif;color:black;text-decoration:none"><img border="0" width="255" height="18" style="width:2.6583in;height:.1916in" id="Picture_x0020_5" src="cid:image001.png@01DAE4AC.C687FE40"></span></a></span><span style="font-family:"Aptos",sans-serif;color:black"><br>
<br>
</span><i><span style="font-family:"Aptos",sans-serif;color:#666666">Under the Illinois Freedom of Information Act any written communication to or from university employees regarding university business is a public record and may be subject to public disclosure. </span></i><span style="font-family:"Aptos",sans-serif"><o:p></o:p></span></p>
<p style="background:white"><span style="font-family:"Aptos",sans-serif;color:black"> </span><span style="font-family:"Aptos",sans-serif"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>midPoint mailing list<o:p></o:p></pre>
<pre><a href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a><o:p></o:p></pre>
<pre><a href="https://urldefense.com/v3/__https:/lists.evolveum.com/mailman/listinfo/midpoint__;!!DZ3fjg!-HgJM_1xzNoqahXxhzUNuumEF-7JSQ4KemuDNY7TXhpQtANzWlri4YbUpLEohcWGVViUOTpI2ZEM4JtSJqdiPR95OC8$">https://lists.evolveum.com/mailman/listinfo/midpoint</a><o:p></o:p></pre>
</blockquote>
</div>
</body>
</html>