<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1250">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Mike,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
regarding to your problem you could inspirate by advanced <a href="https://github.com/Evolveum/midpoint-samples/blob/master/samples/resources/ad-ldap/AD%20advanced/resources/ADfirststep.xml" id="OWA691d823e-e56e-6ff8-2741-0700cc6624d3" class="OWAAutoLink" title="https://github.com/Evolveum/midpoint-samples/blob/master/samples/resources/ad-ldap/AD%20advanced/resources/ADfirststep.xml">
AD example</a> . In your case is missing inbound mapping configuration in association for synchronization of user group membership. From advanced ad example you could reuse inbound mapping within related function for identifying removed group membership placed
in ad-library.xml file, which shall be imported before.</div>
<div id="appendonsend"></div>
<div class="elementToProof"><br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Best regards</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<b>Lubomir Marton</b></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
identity engineer </div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr style="display: inline-block; width: 98%;">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<b>Od:</b> midPoint v mene používateľa mikhail.nikolaenko via midPoint<br>
<b>Odoslané:</b> Pondelok, 7. apríla 2025 15:16<br>
<b>Komu:</b> midPoint General Discussion<br>
<b>Kópia:</b> mikhail.nikolaenko<br>
<b>Predmet:</b> Re: [midPoint] AD Groups associations in MP 4.8.7 </div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, sans-serif; font-size: 14px;"><br>
</div>
<div style="font-family: Arial, sans-serif; font-size: 14px;"><br>
</div>
<div style="font-family: Arial, sans-serif; font-size: 14px;">Hello again,</div>
<div style="font-family: Arial, sans-serif; font-size: 14px;"><br>
</div>
<div style="font-family: Arial, sans-serif; font-size: 14px;">I have found what was a problem. Association I have defined in the resource indeed keep track for member and memberOf attributes both account and group type objects. In the advanced example there
is also inbound mapping for assignment and this is why after reconciliation all users are getting role assignments for AD groups they belong to, and roles are entitlements reconciled from AD groups.</div>
<div style="font-family: Arial, sans-serif; font-size: 14px;"><br>
</div>
<div style="font-family: Arial, sans-serif; font-size: 14px;">Now what I missed is this document:
<a href="https://docs.evolveum.com/connectors/resources/active-directory/group-synchronization-howto/" id="OWAba458920-11a7-f08b-9c78-610392292f17" class="OWAAutoLink" rel="noreferrer nofollow noopener" data-auth="NotApplicable">
https://docs.evolveum.com/connectors/resources/active-directory/group-synchronization-howto/</a><br>
So if we want to provision role assignment as a group membership in the AD we have to define inducement. In my case I have defined new archetype AD Group (inheriting application role) with new object template for role with assignment for new metarole which
defines this inducement. In the resource I have defined this archetype for group schema handling, so all groups in AD will be reconciled as "AD Groups" roles and will have inducement for AD. Only difference in my case, I did not configure global RoleType to
use this metarole, but have defined my own archetype.</div>
<div style="font-family: Arial, sans-serif; font-size: 14px;"><br>
</div>
<div style="font-family: Arial, sans-serif; font-size: 14px;">Hope this could help someone :)</div>
<div style="font-family: Arial, sans-serif; font-size: 14px;"><br>
</div>
<div style="font-family: Arial, sans-serif; font-size: 14px;">PS. Only one thing which is still open is the issue when I delete user from group in AD the user is added back after reconciliation in midPoint. So in my case the midPoint is the master. But I need
to have AD being a master for some tenants and midpoint for others (I can use different object types with different baseContext but do not understand how I can properly configure the case when AD is a master).</div>
<div style="font-family: Arial, sans-serif; font-size: 14px;"><br>
</div>
<div style="font-family: Arial, sans-serif; font-size: 14px;">With best regards,</div>
<div style="font-family: Arial, sans-serif; font-size: 14px;">Mike</div>
<div style="font-family: Arial, sans-serif; font-size: 14px;"><br>
</div>
<div style="font-family: Arial, sans-serif; font-size: 14px;">On Tuesday, 1 April 2025 at 4:53 PM, mikhail.nikolaenko via midPoint <midpoint@lists.evolveum.com> wrote:<br>
</div>
<blockquote>
<div style="font-family: Arial, sans-serif; font-size: 14px;">Dear community,</div>
<div style="font-family: Arial, sans-serif; font-size: 14px;">I am trying to implement AD groups in MP v. 4.8.7 and have issues.<br>
<br>
</div>
<p><span style="font-family: Arial, sans-serif; font-size: 14px;"><b>Our Requirements:</b></span></p>
<ol start="1" data-end="286" data-start="65" data-listchain="__List_Chain_1222">
<li style="font-family: Arial, sans-serif; font-size: 14px;">
<p>AD accounts are provisioned as users.</p>
</li><li style="font-family: Arial, sans-serif; font-size: 14px;">
<p>AD groups are provisioned as entitlements (Archetype - application role).</p>
</li><li style="font-family: Arial, sans-serif; font-size: 14px;">
<p>We’ve attempted to set up associations for account and group in resource types (following examples).</p>
</li></ol>
<p><span style="font-family: Arial, sans-serif; font-size: 14px;"><b>Results:</b></span></p>
<ol start="1" data-end="867" data-start="304" data-listchain="__List_Chain_1223">
<li style="font-family: Arial, sans-serif; font-size: 14px;">
<p>Provisioning and reconciliation of users and groups work correctly in both directions.</p>
</li><li style="font-family: Arial, sans-serif; font-size: 14px;">
<p>Assignment issues:<br>
a. When a user is assigned to a group in AD, the corresponding role is assigned to user in MidPoint, which is correct.<br>
b. When a user is removed from a group in AD, the role in MidPoint remains assigned. If I set the range to
<code><predefined>all</predefined></code>, roles are removed, but this also deletes all roles, including non-AD roles. I also tried the "tolerate" setting, but with no success.<br>
c. Adding or removing a role in MidPoint has no effect on AD.</p>
</li></ol>
<p><span style="font-family: Arial, sans-serif; font-size: 14px;">Could someone provide insight into what might be going wrong? I’ve compared the configurations with different examples but haven’t identified any significant differences.</span></p>
<div style="font-family: Arial, sans-serif; font-size: 14px;">With best regards,</div>
<div style="font-family: Arial, sans-serif; font-size: 14px;">Mike</div>
</blockquote>
<div style="font-family: Arial, sans-serif; font-size: 14px;"><br>
</div>
</body>
</html>