<div dir="auto">Thanks Jean for your reply.<div dir="auto"><br></div><div dir="auto">I've gotten it to work, and thanks to your reply it verified for me that I was on the right track. I am using associations but it was quite hard to understand how it all connects together with all the attributes. </div><div dir="auto"><br></div><div dir="auto">I'm sort of in a catch22 situation, I believe that midPoint could be a very good asset for my company, but I need to demo it for them it on order for them to possibly see value in it, which means there is no chance I get funding for any of the courses through Evolveum, which in turn makes it hard for me to be able to demo it properly so they see the potential and can fund a course for me 😵💫</div><div dir="auto"><br></div><div dir="auto">This means I've got to spend my free time to do all this reading and figuring out how to do all of it. </div><div dir="auto"><br></div><div dir="auto">I really appreciate your quick response Jean, and I wish you all a fantastic weekend 😎</div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">tor. 27. feb. 2025, 13:36 skrev Jean Michel via midPoint <<a href="mailto:midpoint@lists.evolveum.com">midpoint@lists.evolveum.com</a>>:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello Beck,<br>
<br>
I hope you well.<br>
<br>
I've used two ways to achieved assign and unassign user access from a <br>
group using the connID framework.<br>
<br>
1. Without association configured: Creating a multi-valued attribute on <br>
Account object, this attribute contains all access/groups where the user <br>
is member of. In your connector code, You can identify when this <br>
specific attribute is changed by Midpoint, and then perform the <br>
revoke/assign based on the type of operation, it will be defined by the <br>
Set of AttributeDelta parameter in the updateDelta method. This <br>
multi-valued attribute must contain the access/group UID and then you <br>
can perform insert/remove the user, using his userID<br>
<br>
2. With association configured: In this case, you will create a <br>
multi-valued attribute inside the Group/Access object, this attribute <br>
contains all members UIDs from this group. When Midpoint send to your <br>
connector a new assign, it will put the user UID as value to Add, and <br>
will pass this inside the Set of AttributeDelta. The same way it happens <br>
for revoke access, however Midpoint will send the user ID as value to <br>
Remove.<br>
<br>
There is an snippet of a method that assign or unassign users from a <br>
group when you have association configured on midpoint, you can see this <br>
below:<br>
<br>
public void assignOrUnassignUser(Uid uid, Set<AttributeDelta> set) {<br>
set.forEach(delta -> {<br>
List<Object> valuesToAdd = delta.getValuesToAdd();<br>
<br>
if (valuesToAdd != null) {<br>
String attrName = delta.getName();<br>
for (Object value: valuesToAdd) {<br>
if (attrName.equals(SchemaHandler.ROLE_MEMBERS)) { <br>
// ROLE_MEMBERS is the name of my multi-valued attribute on my Group <br>
Schema, that contains all members UIDs for the group<br>
LOG.info("Adding value {0} to attribute {1}", <br>
value, attrName);<br>
assignRole(uid.getUidValue(), <br>
value.toString()); // uid is the group UID, value is the account/user UID<br>
}<br>
}<br>
}<br>
});<br>
<br>
set.forEach(delta -> {<br>
List<Object> valuesToRemove = delta.getValuesToRemove();<br>
<br>
if (valuesToRemove != null) {<br>
String attrName = delta.getName();<br>
for (Object value: valuesToRemove) {<br>
if (attrName.equals(SchemaHandler.ROLE_MEMBERS)) {<br>
LOG.info("Removing value {0} to attribute {1}", <br>
value, attrName);<br>
unassignRole(uid.getUidValue(), <br>
value.toString()); // uid is the group UID, value is the account/user UID<br>
}<br>
}<br>
}<br>
});<br>
}<br>
<br>
The assignOrUnassign method is called from updateDelta method from main <br>
Connector class, it's only for assign and revoke operations.<br>
<br>
I hope this can help you on your development.<br>
<br>
If you have any question, please let me know.<br>
<br>
My best regards<br>
<br>
-- <br>
Jean Michel S. A. dos Santos<br>
+55 (51) 4042-8153 / +55 (51) 3984-2645<br>
<a href="https://www.ebz.tec.br/" rel="noreferrer noreferrer" target="_blank">https://www.ebz.tec.br/</a><br>
<br>
Em 27/02/2025 06:17, <a href="mailto:midpoint-request@lists.evolveum.com" target="_blank" rel="noreferrer">midpoint-request@lists.evolveum.com</a> escreveu:<br>
> Send midPoint mailing list submissions to<br>
> <a href="mailto:midpoint@lists.evolveum.com" target="_blank" rel="noreferrer">midpoint@lists.evolveum.com</a><br>
><br>
> To subscribe or unsubscribe via the World Wide Web, visit<br>
> <a href="https://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer noreferrer" target="_blank">https://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
> or, via email, send a message with subject or body 'help' to<br>
> <a href="mailto:midpoint-request@lists.evolveum.com" target="_blank" rel="noreferrer">midpoint-request@lists.evolveum.com</a><br>
><br>
> You can reach the person managing the list at<br>
> <a href="mailto:midpoint-owner@lists.evolveum.com" target="_blank" rel="noreferrer">midpoint-owner@lists.evolveum.com</a><br>
><br>
> When replying, please edit your Subject line so it is more specific<br>
> than "Re: Contents of midPoint digest..."<br>
><br>
><br>
> Today's Topics:<br>
><br>
> 1. Re: limiting livesync AD work (Matus Macik)<br>
> 2. Override default approval policy (Jussi Jokela)<br>
> 3. creating my first connector - unable to comprehend group<br>
> management (Odd Arne Beck)<br>
> 4. Table Layout Adjustment for Better Clarity, MidPoint 4.8<br>
> (Puchta Jaroslav Ing.)<br>
><br>
><br>
> ----------------------------------------------------------------------<br>
><br>
> Message: 1<br>
> Date: Wed, 26 Feb 2025 16:04:01 +0100 (CET)<br>
> From: Matus Macik <<a href="mailto:matus.macik@evolveum.com" target="_blank" rel="noreferrer">matus.macik@evolveum.com</a>><br>
> To: midPoint General Discussion <<a href="mailto:midpoint@lists.evolveum.com" target="_blank" rel="noreferrer">midpoint@lists.evolveum.com</a>><br>
> Subject: Re: [midPoint] limiting livesync AD work<br>
> Message-ID:<br>
> <<a href="mailto:1801336681.320368.1740582241827.JavaMail.zimbra@evolveum.com" target="_blank" rel="noreferrer">1801336681.320368.1740582241827.JavaMail.zimbra@evolveum.com</a>><br>
> Content-Type: text/plain; charset=utf-8<br>
><br>
> Hello,<br>
><br>
> This behavior can be achieved as mentioned, via the Synchronization > Reaction configuration of the object class you wish to limit.<br>
> In the reaction to a synchronization situation, you can specify the channel to which this reaction is limited. In your case, we can use the "objectImport" channel in reaction to the "linked" situation.<br>
><br>
> The configuration snipped could look somewhat like this:<br>
><br>
> <synchronization><br>
> <reaction><br>
> <situation>unmatched</situation><br>
> <actions><br>
> <addFocus/><br>
> </actions><br>
> </reaction><br>
> <reaction><br>
> <situation>unlinked</situation><br>
> <actions><br>
> <link/><br>
> </actions><br>
> </reaction><br>
> <reaction><br>
> <situation>linked</situation><br>
> <channel><a href="http://midpoint.evolveum.com/xml/ns/public/model/channels-3#objectImport" rel="noreferrer noreferrer" target="_blank">http://midpoint.evolveum.com/xml/ns/public/model/channels-3#objectImport</a></channel><br>
> <actions><br>
> <synchronize/><br>
> </actions><br>
> </reaction><br>
> </synchronization><br>
><br>
> With this configuration present, the execution of a reconciliation or LiveSync task should end up with the requested result.<br>
><br>
> Please have a look in our documentation regarding channels: <a href="https://docs.evolveum.com/midpoint/reference/support-4.9/resources/resource-configuration/schema-handling/synchronization/" rel="noreferrer noreferrer" target="_blank">https://docs.evolveum.com/midpoint/reference/support-4.9/resources/resource-configuration/schema-handling/synchronization/</a><br>
><br>
> Additionally, could you provide a more specific example of the use case you have in mind? Maybe there is an alternative solution or approach.<br>
><br>
> Best Regards,<br>
><br>
> Mat?? Mac?k | Identity and Access Management Engineer<br>
><br>
> [ <a href="https://evolveum.com/" rel="noreferrer noreferrer" target="_blank">https://evolveum.com/</a> ]<br>
> [ mailto:<a href="mailto:matus.macik@evolveum.com" target="_blank" rel="noreferrer">matus.macik@evolveum.com</a> | <a href="mailto:matus.macik@evolveum.com" target="_blank" rel="noreferrer">matus.macik@evolveum.com</a> ] | [ <a href="http://www.evolveum.com/" rel="noreferrer noreferrer" target="_blank">http://www.evolveum.com/</a> | <a href="http://www.evolveum.com" rel="noreferrer noreferrer" target="_blank">www.evolveum.com</a> ]<br>
> [ <a href="https://evolveum.com/upcoming-events/" rel="noreferrer noreferrer" target="_blank">https://evolveum.com/upcoming-events/</a> | ]<br>
><br>
> [ <a href="https://www.linkedin.com/company/evolveum" rel="noreferrer noreferrer" target="_blank">https://www.linkedin.com/company/evolveum</a> ] [ <a href="https://twitter.com/evolveum" rel="noreferrer noreferrer" target="_blank">https://twitter.com/evolveum</a> ] [ <a href="https://www.facebook.com/evolveum" rel="noreferrer noreferrer" target="_blank">https://www.facebook.com/evolveum</a> ]<br>
><br>
><br>
> Disclaimer: The contents of this e-mail and attachment(s) thereto are confidential and intended for the named recipient(s) only. It shall not attach any liability on the originator or Evolveum s.r.o. or its affiliates. Any views or opinions presented in this email are solely those of the author and may not necessarily reflect the opinions of Evolveum s.r.o. or its affiliates. Any form of reproduction, dissemination, copying, disclosure, modification, distribution and / or publication of this message without the prior written consent of the author of this e-mail is strictly prohibited. If you have received this email in error please delete it and notify the sender immediately.<br>
><br>
> ----- Original Message -----<br>
> From: "midPoint General Discussion" <<a href="mailto:midpoint@lists.evolveum.com" target="_blank" rel="noreferrer">midpoint@lists.evolveum.com</a>><br>
> To: "midPoint General Discussion" <<a href="mailto:midpoint@lists.evolveum.com" target="_blank" rel="noreferrer">midpoint@lists.evolveum.com</a>><br>
> Cc: "mikhail.nikolaenko" <<a href="mailto:mikhail.nikolaenko@proton.me" target="_blank" rel="noreferrer">mikhail.nikolaenko@proton.me</a>><br>
> Sent: Tuesday, February 25, 2025 10:29:32 AM<br>
> Subject: Re: [midPoint] limiting livesync AD work<br>
><br>
> Hello,<br>
><br>
> I am very new to the midPoint and only reading the book and playing with local test instance, but I guess it should be possible using just synchronization configuration in the object type (Resource -> Schema handling -> your object type -> synchronization).<br>
> You need situations:<br>
> Unmatched - means there is a new account so you define action: link<br>
> Deleted - unlink<br>
><br>
> Hope I am right and it helps :-)<br>
><br>
> With best regards,<br>
> Mike<br>
><br>
><br>
> Sent with Proton Mail secure email.<br>
><br>
> On Friday, 21 February 2025 at 4:48 PM, Ashwill, Steven L via midPoint <<a href="mailto:midpoint@lists.evolveum.com" target="_blank" rel="noreferrer">midpoint@lists.evolveum.com</a>> wrote:<br>
><br>
>> Hello,<br>
>> Is there a way that we can limit the livesync task in 4.8.x to simply pick up create events? Once a user is created and we have them linked, we no longer want to react to changes in the AD. Midpoint has authority on the mappings we control and we ignore everything else in the AD and therefore we don't want to process the 1000s of updates that occur daily. We just want to react to a create or delete of a user in the AD and link or unlink the user we have in midpoint<br>
>><br>
>><br>
>> STEVEN L ASHWILL<br>
>> Software Engineer Coordinator<br>
>><br>
>><br>
>><br>
>> Under the Illinois Freedom of Information Act any written communication to or from university employees regarding university business is a public record and may be subject to public disclosure.<br>
>><br>
>><br>
>> _______________________________________________<br>
>> midPoint mailing list<br>
>> <a href="mailto:midPoint@lists.evolveum.com" target="_blank" rel="noreferrer">midPoint@lists.evolveum.com</a><br>
>> <a href="https://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer noreferrer" target="_blank">https://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
> _______________________________________________<br>
> midPoint mailing list<br>
> <a href="mailto:midPoint@lists.evolveum.com" target="_blank" rel="noreferrer">midPoint@lists.evolveum.com</a><br>
> <a href="https://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer noreferrer" target="_blank">https://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
><br>
><br>
> ------------------------------<br>
><br>
> Message: 2<br>
> Date: Wed, 26 Feb 2025 15:27:33 +0200<br>
> From: Jussi Jokela <<a href="mailto:jussi.jokela92@gmail.com" target="_blank" rel="noreferrer">jussi.jokela92@gmail.com</a>><br>
> To: <a href="mailto:midpoint@lists.evolveum.com" target="_blank" rel="noreferrer">midpoint@lists.evolveum.com</a><br>
> Subject: [midPoint] Override default approval policy<br>
> Message-ID:<br>
> <CABQ2MC_s5rwJ=DhqFp97CFpoY4_pUL=<a href="mailto:F4GNzmV3eR3NT%2Buv3sw@mail.gmail.com" target="_blank" rel="noreferrer">F4GNzmV3eR3NT+uv3sw@mail.gmail.com</a>><br>
> Content-Type: text/plain; charset="utf-8"<br>
><br>
> I'm having difficulties overriding my "default approver" policy. I have two<br>
> metaroles, one for default approver and one for "high risk systems" (for<br>
> example) and<br>
> and the default approver is inherited from another metarole which is used<br>
> when creating new roles and the high risk metarole is assigned when the<br>
> created role requires it.<br>
><br>
> The high risk metarole has the <mergeOverwriting>true</mergeOverwriting><br>
> but it does not seem to have effect. When the default approver and high<br>
> risk system metaroles are induced to<br>
> created role, both policy stages require manual approval when the desired<br>
> outcome is just to approve the high risk system (all must approve) as it<br>
> has lower order (higher priority).<br>
><br>
> Here are the code snippets for both policy metaroles and the metarole that<br>
> includes the default approver policy:<br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
> * <displayName>Metarole: High risk systems</displayName> <inducement<br>
> id="1"> <policyRule> <policyConstraints><br>
> <assignment> <operation>add</operation><br>
> </assignment> </policyConstraints> <policyActions><br>
> <approval id="3"> <compositionStrategy><br>
> <order>5</order><br>
> <mergeOverwriting>true</mergeOverwriting><br>
> </compositionStrategy> <approvalSchema><br>
> <stage id="4"> <name>Security</name><br>
> <approverRef relation="org:default"<br>
> type="c:OrgType"> <filter><br>
> <q:text>name="High_risk_systems"</q:text><br>
> </filter><br>
> <resolutionTime>run</resolutionTime><br>
> </approverRef><br>
> <evaluationStrategy>allMustApprove</evaluationStrategy><br>
> <outcomeIfNoApprovers>reject</outcomeIfNoApprovers><br>
> <groupExpansion>onWorkItemCreation</groupExpansion><br>
> </stage> </approvalSchema><br>
> </approval> </policyActions> </policyRule><br>
> </inducement> <displayName>Default approver</displayName> <inducement<br>
> id="1"> <policyRule> <policyConstraints><br>
> <assignment> <operation>add</operation><br>
> </assignment> </policyConstraints> <policyActions><br>
> <approval id="16"> <compositionStrategy><br>
> <order>50</order><br>
> </compositionStrategy> <approvalSchema><br>
> <stage id="17"> <name>Default<br>
> approver</name> <approverRef<br>
> relation="org:default" type="c:OrgType"><br>
> <filter> <q:text>name="Default<br>
> approver"</q:text> </filter><br>
> <resolutionTime>run</resolutionTime><br>
> </approverRef><br>
> <evaluationStrategy>firstDecides</evaluationStrategy><br>
> <outcomeIfNoApprovers>reject</outcomeIfNoApprovers><br>
> <groupExpansion>onWorkItemCreation</groupExpansion><br>
> </stage> </approvalSchema><br>
> </approval> </policyActions> </policyRule><br>
> </inducement>*<br>
><br>
><br>
><br>
> * <inducement id="59"> <targetRef<br>
> oid="7c1a3009-b456-40e6-a160-be32f70c1c7c" (default approver)<br>
> relation="org:default" type="c:RoleType"/> </inducement>*<br>
><br>
><br>
> Hope my goal is clear. :)<br>
><br>
><br>
> Best regards,<br>
> Jussi<br>
> -------------- next part --------------<br>
> An HTML attachment was scrubbed...<br>
> URL: <<a href="https://lists.evolveum.com/pipermail/midpoint/attachments/20250226/81ad7911/attachment-0001.htm" rel="noreferrer noreferrer" target="_blank">https://lists.evolveum.com/pipermail/midpoint/attachments/20250226/81ad7911/attachment-0001.htm</a>><br>
><br>
> ------------------------------<br>
><br>
> Message: 3<br>
> Date: Wed, 26 Feb 2025 20:21:40 +0100<br>
> From: Odd Arne Beck <<a href="mailto:oddbeck@gmail.com" target="_blank" rel="noreferrer">oddbeck@gmail.com</a>><br>
> To: <a href="mailto:midpoint@lists.evolveum.com" target="_blank" rel="noreferrer">midpoint@lists.evolveum.com</a><br>
> Subject: [midPoint] creating my first connector - unable to comprehend<br>
> group management<br>
> Message-ID:<br>
> <CAKjv1x4c1c2ozyO0ct6dEtdQ=<a href="mailto:2yZeYdaY1rc2tYVzyO904x7Ww@mail.gmail.com" target="_blank" rel="noreferrer">2yZeYdaY1rc2tYVzyO904x7Ww@mail.gmail.com</a>><br>
> Content-Type: text/plain; charset="utf-8"<br>
><br>
> Hi!<br>
><br>
> I am on Midpoint 4.9.1 and I am trying to figure out developing a connector<br>
> and getting to know the framework for connectors. I've studied several<br>
> other connectors and their source code in the process.<br>
><br>
> I'm creating a basic connector for sqlite creating tables Users, Groups and<br>
> UsersGroups (mapping table for group membership). I use the hibernate ORM<br>
> for the database part.<br>
><br>
> As of now my connector is able to create the Users, and any roles (groups)<br>
> are also created through entitlements in the 'Groups' table.<br>
><br>
> However, when I assign a user to a group the create() / executeQuery() /<br>
> Update() and similar methods are triggered but I am not able to see<br>
> anywhere a ref to a user ID or something similar that I can use in order to<br>
> inject the UserId + GroupId into my "UsersGroups" table.<br>
><br>
> I am pretty sure I've set up the associations accordingly to the docs for<br>
> 4.9.1.<br>
> What am I missing or not understanding?<br>
><br>
> Thanks for any advice and help.<br>
><br>
> Best regards,<br>
><br>
> Odd Beck<br>
> -------------- next part --------------<br>
> An HTML attachment was scrubbed...<br>
> URL: <<a href="https://lists.evolveum.com/pipermail/midpoint/attachments/20250226/69a216a7/attachment-0001.htm" rel="noreferrer noreferrer" target="_blank">https://lists.evolveum.com/pipermail/midpoint/attachments/20250226/69a216a7/attachment-0001.htm</a>><br>
><br>
> ------------------------------<br>
><br>
> Message: 4<br>
> Date: Thu, 27 Feb 2025 09:17:25 +0000<br>
> From: Puchta Jaroslav Ing. <<a href="mailto:puchta.jaroslav@cpost.cz" target="_blank" rel="noreferrer">puchta.jaroslav@cpost.cz</a>><br>
> To: "<a href="mailto:midpoint@lists.evolveum.com" target="_blank" rel="noreferrer">midpoint@lists.evolveum.com</a>" <<a href="mailto:midpoint@lists.evolveum.com" target="_blank" rel="noreferrer">midpoint@lists.evolveum.com</a>><br>
> Subject: [midPoint] Table Layout Adjustment for Better Clarity,<br>
> MidPoint 4.8<br>
> Message-ID:<br>
> <<a href="mailto:DB9P189MB2097249279AB53442433A3B79DCD2@DB9P189MB2097.EURP189.PROD.OUTLOOK.COM" target="_blank" rel="noreferrer">DB9P189MB2097249279AB53442433A3B79DCD2@DB9P189MB2097.EURP189.PROD.OUTLOOK.COM</a>><br>
> <br>
> Content-Type: text/plain; charset="utf-8"<br>
><br>
> Hi everyone,<br>
> I would like to request your help with adjusting the layout of tables with roles. Currently, the description column takes up about 8/12 of the table's width, which causes line breaks for roles or service names. This line breaking makes it difficult to visually locate roles in the table.<br>
> I propose increasing the column width where the display names are shown to make it easier to find roles in the table. On the other hand, line breaks in the description column are not as problematic.<br>
> Best regards,<br>
> J.Puchta<br>
><br>
> -------------- next part --------------<br>
> An HTML attachment was scrubbed...<br>
> URL: <<a href="https://lists.evolveum.com/pipermail/midpoint/attachments/20250227/5300b5b7/attachment.htm" rel="noreferrer noreferrer" target="_blank">https://lists.evolveum.com/pipermail/midpoint/attachments/20250227/5300b5b7/attachment.htm</a>><br>
> -------------- next part --------------<br>
> A non-text attachment was scrubbed...<br>
> Name: smime.p7s<br>
> Type: application/pkcs7-signature<br>
> Size: 2812 bytes<br>
> Desc: not available<br>
> URL: <<a href="https://lists.evolveum.com/pipermail/midpoint/attachments/20250227/5300b5b7/attachment.bin" rel="noreferrer noreferrer" target="_blank">https://lists.evolveum.com/pipermail/midpoint/attachments/20250227/5300b5b7/attachment.bin</a>><br>
><br>
> ------------------------------<br>
><br>
> Subject: Digest Footer<br>
><br>
> _______________________________________________<br>
> midPoint mailing list<br>
> <a href="mailto:midPoint@lists.evolveum.com" target="_blank" rel="noreferrer">midPoint@lists.evolveum.com</a><br>
> <a href="https://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer noreferrer" target="_blank">https://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
><br>
><br>
> ------------------------------<br>
><br>
> End of midPoint Digest, Vol 154, Issue 17<br>
> *****************************************<br>
_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank" rel="noreferrer">midPoint@lists.evolveum.com</a><br>
<a href="https://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer noreferrer" target="_blank">https://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
</blockquote></div>