<div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div>
<div class="protonmail_signature_block" style="font-family: Arial, sans-serif; font-size: 14px;">
<div class="protonmail_signature_block-user protonmail_signature_block-empty">
</div>
<div class="protonmail_signature_block-proton">Hello again,</div><div class="protonmail_signature_block-proton"><br></div><div class="protonmail_signature_block-proton">I have found what was a problem. Association I have defined in the resource indeed keep track for member and memberOf attributes both account and group type objects. In the advanced example there is also inbound mapping for assignment and this is why after reconciliation all users are getting role assignments for AD groups they belong to, and roles are entitlements reconciled from AD groups.</div><div class="protonmail_signature_block-proton"><br></div><div class="protonmail_signature_block-proton">Now what I missed is this document: <span><a target="_blank" rel="noreferrer nofollow noopener" href="https://docs.evolveum.com/connectors/resources/active-directory/group-synchronization-howto/">https://docs.evolveum.com/connectors/resources/active-directory/group-synchronization-howto/</a><br>So if we want to provision role assignment as a group membership in the AD we have to define inducement. In my case I have defined new archetype AD Group (inheriting application role) with new object template for role with assignment for new metarole which defines this inducement. In the resource I have defined this archetype for group schema handling, so all groups in AD will be reconciled as "AD Groups" roles and will have inducement for AD. Only difference in my case, I did not configure global RoleType to use this metarole, but have defined my own archetype.</span></div><div class="protonmail_signature_block-proton"><span><br></span></div><div class="protonmail_signature_block-proton"><span>Hope this could help someone :)</span></div><div class="protonmail_signature_block-proton"><span><br></span></div><div class="protonmail_signature_block-proton"><span>PS. Only one thing which is still open is the issue when I delete user from group in AD the user is added back after reconciliation in midPoint. So in my case the midPoint is the master. But I need to have AD being a master for some tenants and midpoint for others (I can use different object types with different <span>baseContext but do not understand how I can properly configure the case when AD is a master</span>).</span></div><div class="protonmail_signature_block-proton"><span><br></span></div>
</div>
<div style="font-family: Arial, sans-serif; font-size: 14px;">With best regards,</div><div style="font-family: Arial, sans-serif; font-size: 14px;">Mike</div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br><div class="protonmail_quote">
On Tuesday, 1 April 2025 at 4:53 PM, mikhail.nikolaenko via midPoint <midpoint@lists.evolveum.com> wrote:<br>
<blockquote class="protonmail_quote" type="cite">
<div style="font-family: Arial, sans-serif; font-size: 14px;">Dear community,</div><div style="font-family: Arial, sans-serif; font-size: 14px;">I am trying to implement AD groups in MP v. 4.8.7 and have issues.<br><br><p data-end="64" data-start="47"><strong data-end="64" data-start="47">Our Requirements:</strong></p><ol data-end="286" data-start="65" data-listchain="__List_Chain_1222"><li data-end="105" data-start="65"><p data-end="105" data-start="68">AD accounts are provisioned as users.</p></li><li data-end="182" data-start="106"><p data-end="182" data-start="109">AD groups are provisioned as entitlements (Archetype - application role).</p></li><li data-end="286" data-start="183"><p data-end="286" data-start="186">We’ve attempted to set up associations for account and group in resource types (following examples).</p></li></ol><p data-end="303" data-start="288"><strong data-end="303" data-start="288">Results:</strong></p><ol data-end="867" data-start="304" data-listchain="__List_Chain_1223"><li data-end="393" data-start="304"><p data-end="393" data-start="307">Provisioning and reconciliation of users and groups work correctly in both directions.</p></li><li data-end="867" data-start="394"><p data-end="867" data-start="397">Assignment issues:
<br>a. When a user is assigned to a group in AD, the corresponding role is assigned to user in MidPoint, which is correct.
<br>b. When a user is removed from a group in AD, the role in MidPoint remains assigned. If I set the range to <code data-end="667" data-start="637"><predefined>all</predefined></code>, roles are removed, but this also deletes all roles, including non-AD roles. I also tried the "tolerate" setting, but with no success.
<br>c. Adding or removing a role in MidPoint has no effect on AD.</p></li></ol><p data-end="1039" data-start="869">Could someone provide insight into what might be going wrong? I’ve compared the configurations with different examples but haven’t identified any significant differences.</p>With best regards,</div><div style="font-family: Arial, sans-serif; font-size: 14px;">Mike</div><div style="font-family: Arial, sans-serif; font-size: 14px;" class="protonmail_signature_block">
</div>
</blockquote><br>
</div></div>