<div style="font-family: Arial, sans-serif; font-size: 14px;"><p>Answering my own question here.</p><p>I think I've found a work-around. Although I need to test it a lot more.<br>
Basically, by default, users cannot search for other users. So by adding an authorisation:<br></p><div style="margin-top: 14px; margin-bottom: 14px;"><span> <authorization></span><div><span> <name>search-other-users</name></span></div><div><span> <action><a target="_blank" rel="noreferrer nofollow noopener" href="http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#search">http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#search</a></action></span></div><div><span> <object></span></div><div><span> <type>UserType</type></span></div><div><span> <filter></span></div><div><span> <q:text>roleMembershipRef/@/name = "name_of_role_that_approvers_have"</q:text></span></div><div><span> </filter></span></div><div><span> </object></span></div><div><span> </authorization></span></div><span></span><br></div><div style="margin-top: 14px; margin-bottom: 14px;">That might work. Just need to verify that it works for all higher privileged users (to see all users)</div><p>/M</p>
<br>
<br>
On Wednesday, 2 July 2025 at 10:38, <a href="mailto:midpoint-request@lists.evolveum.com">midpoint-request@lists.evolveum.com</a> <a href="mailto:midpoint-request@lists.evolveum.com">midpoint-request@lists.evolveum.com</a> wrote:<p></p>
<p></p>
<blockquote>
<p>Send midPoint mailing list submissions to<br>
<a href="mailto:midpoint@lists.evolveum.com">midpoint@lists.evolveum.com</a></p>
<p>To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://lists.evolveum.com/mailman/listinfo/midpoint">https://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:midpoint-request@lists.evolveum.com">midpoint-request@lists.evolveum.com</a></p>
<p>You can reach the person managing the list at<br>
<a href="mailto:midpoint-owner@lists.evolveum.com">midpoint-owner@lists.evolveum.com</a></p>
<p>When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of midPoint digest..."</p>
<p>Today's Topics:</p>
<p>1. Add delegation view (Markus Calmius)<br>
2. Re: How to add extension-attribute from HR - inbound Schema ?<br>
(Ivan Noris)</p>
<p>----------------------------------------------------------------------</p>
<p>Message: 1<br>
Date: Tue, 01 Jul 2025 15:17:40 +0000<br>
From: Markus Calmius <a href="mailto:markus.calmius@proton.ch">markus.calmius@proton.ch</a></p>
<p>To: midPoint General Discussion <a href="mailto:midpoint@lists.evolveum.com">midpoint@lists.evolveum.com</a></p>
<p>Subject: [midPoint] Add delegation view<br>
Message-ID:<br>
<a href="mailto:3Ahz5V-u8FQ3Q98oNuVkVi4lv2ifANDrRyBQVNBYJIDsybHjA2-9LkDFrdsCA73EhqOIR8acfVADc2KTRVLIDZUX_HfiHjRLvRYFvo65UGo=@proton.ch">3Ahz5V-u8FQ3Q98oNuVkVi4lv2ifANDrRyBQVNBYJIDsybHjA2-9LkDFrdsCA73EhqOIR8acfVADc2KTRVLIDZUX_HfiHjRLvRYFvo65UGo=@proton.ch</a></p>
<p>Content-Type: text/plain; charset="utf-8"</p>
<p>Hi,</p>
<p>I think I asked this, or similar question, last year.</p>
<p>Setup:<br>
Midpoint: 4.8.5<br>
Users have a few default roles, they do NOT have authorisation to Approve or Delegate requests by default.<br>
We have some approval-roles that use an archetype that also authorises those members to approve requests.</p>
<p>Vacation time is upon us.<br>
I would like for all that have approval rights to be able to delegate to other users. But only delegate to users that also have approval rights.</p>
<p>I have created an Object Collection that displays this, but how can I force this object collection to be the only one available when a user clicks "Add Delegation"<br>
I seem to remember, hopefully wrongly, that this is not possible...</p>
<p>How can I force a specific collection for a specific part of the gui?</p>
<p>Thanks in advance,<br>
Markus<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <a href="https://lists.evolveum.com/pipermail/midpoint/attachments/20250701/52ef1250/attachment-0001.htm">https://lists.evolveum.com/pipermail/midpoint/attachments/20250701/52ef1250/attachment-0001.htm</a></p>
<p>------------------------------</p>
<p>Message: 2<br>
Date: Wed, 2 Jul 2025 10:38:06 +0200<br>
From: Ivan Noris <a href="mailto:ivan.noris@evolveum.com">ivan.noris@evolveum.com</a></p>
<p>To: <a href="mailto:midpoint@lists.evolveum.com">midpoint@lists.evolveum.com</a><br>
Subject: Re: [midPoint] How to add extension-attribute from HR -<br>
inbound Schema ?<br>
Message-ID: <a href="mailto:a74203af-6fd5-425c-85ad-92056c1de139@evolveum.com">a74203af-6fd5-425c-85ad-92056c1de139@evolveum.com</a></p>
<p>Content-Type: text/plain; charset="utf-8"; Format="flowed"</p>
<p>Hi,</p>
<p>I think what you want is to /populate/ (this is the keyword) the<br>
assignment properties. That is done outside the "target" element, but in<br>
"assignmentTargetSearch".</p>
<p>You should be able to use assignment properties (extensions) like this:</p>
<p><expression></p>
<p><assignmentTargetSearch></p>
<p><targetType>OrgType</targetType></p>
<p><filter></p>
<p><!-- ... --> </filter></p>
<p><populate></p>
<p><populateItem></p>
<p><expression></p>
<p><script></p>
<p><code>return 'General Manager of Universe'</code></p>
<p></script></p>
<p></expression></p>
<p><target></p>
<p><path>extension/title</path></p>
<p></target></p>
<p></populateItem></p>
<p></populate></p>
<p></assignmentTargetSearch></p>
<p></expression></p>
<p>See also here:<br>
<a href="https://docs.evolveum.com/midpoint/reference/support-4.9/expressions/expressions/#assignment-target-search">https://docs.evolveum.com/midpoint/reference/support-4.9/expressions/expressions/#assignment-target-search</a><br>
Relation and subtype can be set using "assignmentProperties" element as<br>
displayed in the documentation (chapter: Relation parameter).<br>
Chapter: Activation parameters shows how activation properties of<br>
assignment can be set; the example above for extension property is<br>
analogous.</p>
<p>Hope this helps.<br>
Best regards,<br>
Ivan</p>
<p>On 30. 6. 2025 18:40, Bao Tran via midPoint wrote:</p>
<blockquote>
<p>Hi all,</p>
<p>1. We have successfully added an AssignmentExtensionSchema.xml?<br>
(attachment) with detail:<br>
- extension ref="c:AssignmentType"<br>
- name=JobTitle<br>
- DisplayName=title</p>
<p>And in ?midpoint GUI , it look like screenshot below<br>
title extension.png</p>
<p>2. Currently, we can only add assignment to user via OrganizationName<br>
(below xml)</p>
<p>Our goal: is how to configure the HR-application-inbound.xml. ::<br>
inbound-schema , in order?to<br>
- Assign the user into Organization and add value for the<br>
title?(which is extension above)</p>
<p><attribute id="49"><br>
<ref>ri:OrganizationName</ref><br>
? ? ? ? ? ? <inbound id="50"><br>
<name>set-org-level1</name><br>
? ? ? ? ? ? ? ? ? ? ? ? ? <expression><br>
<assignmentTargetSearch><br>
?<targetType>OrgType</targetType><br>
?<filter><br>
<q:equal><br>
? ? ?<q:path>name</q:path><br>
? ? ?<expression><br>
? ? ? ? ? ? <script><br>
? ? ? ? ? ? ? ? ? ?<code>input</code><br>
? ? ? ? ? ? ?</script><br>
? ? ? ? </expression><br>
?</q:equal><br>
?</filter><br>
</assignmentTargetSearch><br>
?</expression></p>
<p><target>*<br>
?<path>assignment</path>*<br>
? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? <-- We can only find the<br>
OrganizationName and make assignment for user --><br>
<-- How do we set value for extension::JobTitle above ? --><br>
</target><br>
? ? ? ? ? ? ?</inbound><br>
</attribute></p>
<p>Thank you in advance<br>
--<br>
Bao Tran<br>
Software developer</p>
<p>_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a><br>
<a href="https://lists.evolveum.com/mailman/listinfo/midpoint">https://lists.evolveum.com/mailman/listinfo/midpoint</a></p>
</blockquote>
<p>--<br>
Ivan Noris<br>
Expert Identity Engineer<br>
<a href="http://evolveum.com">evolveum.com</a><br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <a href="https://lists.evolveum.com/pipermail/midpoint/attachments/20250702/87a00263/attachment.htm">https://lists.evolveum.com/pipermail/midpoint/attachments/20250702/87a00263/attachment.htm</a></p>
<p>-------------- next part --------------<br>
A non-text attachment was scrubbed...<br>
Name: title extension.png<br>
Type: image/png<br>
Size: 135041 bytes<br>
Desc: not available<br>
URL: <a href="https://lists.evolveum.com/pipermail/midpoint/attachments/20250702/87a00263/attachment.png">https://lists.evolveum.com/pipermail/midpoint/attachments/20250702/87a00263/attachment.png</a></p>
<p>------------------------------</p>
<p>Subject: Digest Footer</p>
<p>_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a><br>
<a href="https://lists.evolveum.com/mailman/listinfo/midpoint">https://lists.evolveum.com/mailman/listinfo/midpoint</a></p>
<p>------------------------------</p>
<p>End of midPoint Digest, Vol 159, Issue 1<br>
****************************************</p>
</blockquote></div>