<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:"Yu Gothic";
panose-1:2 11 4 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Arial Unicode MS";
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
@font-face
{font-family:"\@Yu Gothic";
panose-1:2 11 4 0 0 0 0 0 0 0;}
@font-face
{font-family:"MS PGothic";
panose-1:2 11 6 0 7 2 5 8 2 4;}
@font-face
{font-family:"\@MS PGothic";}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:12.0pt;
font-family:"MS PGothic",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Arial",sans-serif;
color:#272726;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="NL-BE" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726">Hello,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726">Thanks for the suggestion, it works now.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726">Kind regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><a href="http://www.sfpd.fgov.be/"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726;text-decoration:none"><img border="0" width="55" height="50" style="width:.575in;height:.525in" id="Picture_x0020_1" src="cid:image001.png@01DB7169.25DB37B0"></span></a><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726"><br>
<br>
</span><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#B50045">Robin Gorris<br>
</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726"><br>
Build & Release<br>
Federale Pensioendienst<br>
<br>
Tel. </span><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726"><a href="tel:%20+32 2 529 28 50"><span style="color:#272726;text-decoration:none">+32 2 529 28 50</span></a><br>
</span><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726"><br>
</span><a href="http://www.sfpd.fgov.be/"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726;text-decoration:none"><img border="0" width="25" height="25" style="width:.2583in;height:.2583in" id="Picture_x0020_2" src="cid:image002.gif@01DB7169.25DB37B0"></span></a><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726"> </span><a href="http://mypension.be/"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726;text-decoration:none"><img border="0" width="24" height="25" style="width:.25in;height:.2583in" id="Picture_x0020_3" src="cid:image003.gif@01DB7169.25DB37B0"></span></a><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726"> </span><a href="https://www.facebook.com/Pensioendienst"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726;text-decoration:none"><img border="0" width="25" height="25" style="width:.2583in;height:.2583in" id="Picture_x0020_4" src="cid:image004.gif@01DB7169.25DB37B0"></span></a><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726"> </span><a href="http://ow.ly/1059Df"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726;text-decoration:none"><img border="0" width="25" height="25" style="width:.2583in;height:.2583in" id="Picture_x0020_5" src="cid:image005.gif@01DB7169.25DB37B0"></span></a><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726"> </span><a href="https://twitter.com/Pensioendienst"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726;text-decoration:none"><img border="0" width="25" height="25" style="width:.2583in;height:.2583in" id="Picture_x0020_6" src="cid:image006.gif@01DB7169.25DB37B0"></span></a><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726"> </span><a href="http://ow.ly/1059Nc"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726;text-decoration:none"><img border="0" width="25" height="25" style="width:.2583in;height:.2583in" id="Picture_x0020_7" src="cid:image007.gif@01DB7169.25DB37B0"></span></a><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726"> </span><a href="https://www.youtube.com/channel/UCPhdJMkumaVUWvRiNcDsbzA"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726;text-decoration:none"><img border="0" width="25" height="25" style="width:.2583in;height:.2583in" id="Picture_x0020_8" src="cid:image008.gif@01DB7169.25DB37B0"></span></a><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726"> </span><a href="https://www.google.com/maps/place/Zuidertoren/@50.837610,4.336909,19z"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726;text-decoration:none"><img border="0" width="25" height="25" style="width:.2583in;height:.2583in" id="Picture_x0020_9" src="cid:image009.gif@01DB7169.25DB37B0"></span></a><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726"><o:p></o:p></span></p>
<div style="mso-element:para-border-div;border:none;border-top:solid #2D9BA5 1.0pt;padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal" style="border:none;padding:0cm"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#2D9BA5">Denk aan het milieu vooraleer je dit bericht afdrukt!<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#272726"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> midPoint <midpoint-bounces@lists.evolveum.com>
<b>On Behalf Of </b>h2-wada via midPoint<br>
<b>Sent:</b> donderdag 23 januari 2025 5:13<br>
<b>To:</b> midPoint General Discussion <midpoint@lists.evolveum.com><br>
<b>Cc:</b> h2-wada <h2-wada@nri.co.jp><br>
<b>Subject:</b> Re: [midPoint] How to configure ConnId options?<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" align="left" width="100%" style="width:100.0%">
<tbody>
<tr>
<td width="0" style="width:.3pt;background:#A6A6A6;padding:5.25pt 1.5pt 5.25pt 1.5pt">
</td>
<td width="100%" style="width:100.0%;background:#EAEAEA;padding:5.25pt 3.75pt 5.25pt 11.25pt;aspect-ratio: revert !important;background:revert !important;block-size: revert !important;border:revert !important;bottom: revert !important;color:revert !important;color-scheme: revert !important;content-visibility: revert !important;cursor:revert !important;direction:revert !important;display:revert !important;font-size:revert !important;height:revert !important;hyphens: revert !important;letter-spacing:revert !important;line-height:revert !important;margin:revert !important;opacity: revert !important;order: revert !important;outline: revert !important;overflow:revert !important;padding:revert !important;position:revert !important;resize: revert !important;rotate: revert !important;scale: revert !important;tab-size: revert !important;table-layout:revert !important;text-align:revert !important;text-indent:revert !important;text-orientation: revert !important;text-overflow: revert !important;text-shadow:revert !important;text-transform:revert !important;text-wrap: revert !important;top:revert !important;transition: revert !important;user-select: revert !important;vertical-align:revert !important;visibility:revert !important;white-space:revert !important;width:revert !important;word-break:revert !important;word-spacing:revert !important;writing-mode:revert !important;zoom: revert !important">
<div>
<p class="MsoNormal" style="mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-wrap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizontal:column;mso-height-rule:exactly">
<span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#212121">U ontvangt niet vaak e-mail van
<a href="mailto:midpoint@lists.evolveum.com">midpoint@lists.evolveum.com</a>. <a href="https://aka.ms/LearnAboutSenderIdentification">
Ontdek waarom dit belangrijk is</a> <o:p></o:p></span></p>
</div>
</td>
<td width="75" style="width:56.25pt;background:#EAEAEA;padding:5.25pt 3.75pt 5.25pt 3.75pt;aspect-ratio: revert !important;background:revert !important;block-size: revert !important;border:revert !important;bottom: revert !important;color:revert !important;color-scheme: revert !important;content-visibility: revert !important;cursor:revert !important;direction:revert !important;display:revert !important;font-size:revert !important;height:revert !important;hyphens: revert !important;letter-spacing:revert !important;line-height:revert !important;margin:revert !important;opacity: revert !important;order: revert !important;outline: revert !important;overflow:revert !important;padding:revert !important;position:revert !important;resize: revert !important;rotate: revert !important;scale: revert !important;tab-size: revert !important;table-layout:revert !important;text-align:revert !important;text-indent:revert !important;text-orientation: revert !important;text-overflow: revert !important;text-shadow:revert !important;text-transform:revert !important;text-wrap: revert !important;top:revert !important;transition: revert !important;user-select: revert !important;vertical-align:revert !important;visibility:revert !important;white-space:revert !important;width:revert !important;word-break:revert !important;word-spacing:revert !important;writing-mode:revert !important;zoom: revert !important;align: left !important">
</td>
</tr>
</tbody>
</table>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt">Hello,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt"><br>
I am the author of the Keycloak Connector.<br>
If all you want to achieve is simply assigning a user to group(s), I think you should be able to accomplish this by setting fetchStrategy to explicit.<br>
<br>
<attribute><br>
<c:ref>ri:groups</c:ref><br>
<fetchStrategy>explicit</fetchStrategy><br>
</attribute><br>
<br>
Here is a sample XML configuration:<br>
<a href="https://github.com/openstandia/connector-keycloak/wiki/Example-configuration#complex-example-user-and-group">https://github.com/openstandia/connector-keycloak/wiki/Example-configuration#complex-example-user-and-group</a><br>
<br>
As Pavol mentioned, midPoint hardcodes the value of allowPartialAttributeValues. However, this only applies during search operation. When synchronization is actually executed, get is called if needed, and it should work correctly.<br>
If it doesn’t work as expected, please let me know!<br>
<br>
<br>
Best regards,<br>
<br>
--<br>
Hiroyuki Wada<br>
<a href="mailto:h2-wada@nri.co.jp">h2-wada@nri.co.jp</a><br>
<br>
________________________________________<br>
<span lang="JA">差出人</span>: midPoint <<a href="mailto:midpoint-bounces@lists.evolveum.com">midpoint-bounces@lists.evolveum.com</a>>
<span lang="JA">が</span> Robin Gorris (SFPD) via midPoint <<a href="mailto:midpoint@lists.evolveum.com">midpoint@lists.evolveum.com</a>>
<span lang="JA">の代理で送信</span><br>
<span lang="JA">送信日時</span>: 2025<span lang="JA">年</span>1<span lang="JA">月</span>21<span lang="JA">日</span> 19:11<br>
<span lang="JA">宛先</span>: <a href="mailto:midpoint@lists.evolveum.com">midpoint@lists.evolveum.com</a><br>
CC: Robin Gorris (SFPD)<br>
<span lang="JA">件名</span>: [midPoint] How to configure ConnId options?<br>
<br>
Hello,<br>
<br>
Is there a way to configure ConnId properties through MidPoint configuration?<br>
<br>
Context: we’re evaluating the Keycloak connector from Openstandia, which has been working great.<br>
<br>
When configuring the user-to-group mappings, we need to be able to set the allowPartialAttributeValues value so that the connector doesn’t skip retrieving group memberships, as I understand from this bit of code:<br>
<br>
if (allowPartialAttributeValues) {<br>
// Suppress fetching groups<br>
LOGGER.ok("[{0}] Suppress fetching groups because return partial attribute values is requested", instanceName);<br>
<br>
AttributeBuilder ab = new AttributeBuilder();<br>
ab.setName(ATTR_GROUPS).setAttributeValueCompleteness(AttributeValueCompleteness.INCOMPLETE);<br>
ab.addValue(Collections.EMPTY_LIST);<br>
builder.addAttribute(ab.build());<br>
} else {<br>
if (attributesToGet == null) {<br>
// Suppress fetching groups default<br>
LOGGER.ok("[{0}] Suppress fetching groups because returned by default is true", instanceName);<br>
<br>
} else if (shouldReturn(attributesToGet, ATTR_GROUPS)) {<br>
// Fetch groups<br>
LOGGER.ok("[{0}] Fetching groups because attributes to get is requested", instanceName);<br>
<br>
List<GroupRepresentation> groups = users(realmName).get(user.getId()).groups();<br>
builder.addAttribute(ATTR_GROUPS, groups.stream().map(g -> g.getId()).collect(Collectors.toList()));<br>
}<br>
}<br>
<br>
The allowPartialAttributeValues variable is a ConnID Operation Option, for which I found the JavaDoc here: OperationOptions (ConnId 1.5.2.0 API)<<a href="https://connid.tirasa.net/apidocs/1.5/org/identityconnectors/framework/common/objects/OperationOptions.html#OP_ALLOW_PARTIAL_ATTRIBUTE_VALUES">https://connid.tirasa.net/apidocs/1.5/org/identityconnectors/framework/common/objects/OperationOptions.html#OP_ALLOW_PARTIAL_ATTRIBUTE_VALUES</a>><br>
<br>
The MidPoint version we’re using is 4.8.5.<br>
<br>
Regardless of our specific context, it would be good to know if and how ConnId options can be set through MidPoint configuration. I highly appreciate your feedback.<br>
<br>
Kind regards,<br>
<br>
[<a href="cid:image001.png@01DB6BF1.F23E4860">cid:image001.png@01DB6BF1.F23E4860</a>]<<a href="http://www.sfpd.fgov.be/">http://www.sfpd.fgov.be/</a>><br>
<br>
Robin Gorris<br>
<br>
Build & Release<br>
Federale Pensioendienst<br>
<br>
[<a href="cid:image002.gif@01DB6BF1.F23E4860">cid:image002.gif@01DB6BF1.F23E4860</a>]<<a href="http://www.sfpd.fgov.be/">http://www.sfpd.fgov.be/</a>> [<a href="cid:image003.gif@01DB6BF1.F23E4860">cid:image003.gif@01DB6BF1.F23E4860</a>] <<a href="http://mypension.be/">http://mypension.be/</a>>
[<a href="cid:image004.gif@01DB6BF1.F23E4860">cid:image004.gif@01DB6BF1.F23E4860</a>] <<a href="https://www.facebook.com/Pensioendienst">https://www.facebook.com/Pensioendienst</a>> [<a href="cid:image005.gif@01DB6BF1.F23E4860">cid:image005.gif@01DB6BF1.F23E4860</a>]
<<a href="http://ow.ly/1059Df">http://ow.ly/1059Df</a>> [<a href="cid:image006.gif@01DB6BF1.F23E4860">cid:image006.gif@01DB6BF1.F23E4860</a>] <<a href="https://twitter.com/Pensioendienst">https://twitter.com/Pensioendienst</a>> [<a href="cid:image007.gif@01DB6BF1.F23E4860">cid:image007.gif@01DB6BF1.F23E4860</a>]
<<a href="http://ow.ly/1059Nc">http://ow.ly/1059Nc</a>> [<a href="cid:image008.gif@01DB6BF1.F23E4860">cid:image008.gif@01DB6BF1.F23E4860</a>] <<a href="https://www.youtube.com/channel/UCPhdJMkumaVUWvRiNcDsbzA">https://www.youtube.com/channel/UCPhdJMkumaVUWvRiNcDsbzA</a>>
[<a href="cid:image009.gif@01DB6BF1.F23E4860">cid:image009.gif@01DB6BF1.F23E4860</a>] <<a href="https://www.google.com/maps/place/Zuidertoren/@50.837610,4.336909,19z">https://www.google.com/maps/place/Zuidertoren/@50.837610,4.336909,19z</a>><br>
Denk aan het milieu vooraleer je dit bericht afdrukt!<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</body>
</html>