<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if gte mso 9]><xml>
<w:WordDocument>
<w:DontUseAdvancedTypographyReadingMail/>
<w:DontUseJustificationAdvancedTypographyReadingMail/>
<w:DontUseHyphenationAdvancedTypographyReadingMail/>
</w:WordDocument>
</xml><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
@font-face
{font-family:"Segoe UI Emoji";
panose-1:2 11 5 2 4 2 4 2 2 3;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:"var\(--font-mono\)";
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
code
{mso-style-priority:99;
font-family:"Courier New";}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
font-size:10.0pt;
font-family:"Courier New";}
p.gmail-font-claude-response-body, li.gmail-font-claude-response-body, div.gmail-font-claude-response-body
{mso-style-name:gmail-font-claude-response-body;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.gmail-token
{mso-style-name:gmail-token;}
span.gmailsignatureprefix
{mso-style-name:gmail_signature_prefix;}
span.EmailStyle26
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:265701914;
mso-list-template-ids:999331000;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1
{mso-list-id:797381808;
mso-list-template-ids:-1000421646;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Hello Bau,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">My assumption is that the policy doesn’t affect indirect assignments induced by an org. Till you have certain org assigned it will induce.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">To implement the behavior, you need more complicated approach adding additional layer of abstraction in user archetype.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> midPoint <midpoint-bounces@lists.evolveum.com>
<b>On Behalf Of </b>Bao Tran via midPoint<br>
<b>Sent:</b> Wednesday, June 17, 2026 11:33 AM<br>
<b>To:</b> midpoint@lists.evolveum.com<br>
<b>Cc:</b> Bao Tran <bao.tran@csit.fi><br>
<b>Subject:</b> [midPoint] Application-role priority enforcement (per service)— prune removing org assignments unexpectedly<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="gmail-font-claude-response-body">Hi all,<br>
We're running into an issue with priority enforcement for application-roles for single service in MidPoint and would appreciate any insight.<o:p></o:p></p>
<p class="gmail-font-claude-response-body"><b>Our goal: </b>A service has multi application-role , a user John can have multiple org assignments with different relations → only the highest application-role (E5) wins, application-role F3 is suppressed.<o:p></o:p></p>
<p class="gmail-font-claude-response-body"><strong><span style="font-family:"Aptos",sans-serif">What we tried (and failed):</span></strong><o:p></o:p></p>
<ul type="disc">
<li class="gmail-font-claude-response-body" style="mso-list:l0 level1 lfo1">Orgs have 2 inducements:
<o:p></o:p></li></ul>
<ul type="disc">
<ul type="circle">
<li class="gmail-font-claude-response-body" style="mso-list:l0 level2 lfo1">→ E5 (condition:
<code><span style="font-size:10.0pt">relation=manager</span></code>)<o:p></o:p></li><li class="gmail-font-claude-response-body" style="mso-list:l0 level2 lfo1">→ F3 (no condition, everyone gets this as base)<o:p></o:p></li></ul>
</ul>
<ul type="disc">
<li class="gmail-font-claude-response-body" style="mso-list:l0 level1 lfo1">Service O365 has 2 application-roles:
<br>
- E5<br>
- F3<o:p></o:p></li><li class="gmail-font-claude-response-body" style="mso-list:l0 level1 lfo1">F3 role has an exclusion policy rule → prune when E5 is present:<o:p></o:p></li></ul>
<div>
<div>
<pre><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B"><</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#B80A18">role</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B">></span></span><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"><o:p></o:p></span></code></pre>
<pre><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"> </span></code><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B"><</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#B80A18">name</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B">></span></span><code><span style="font-family:"var(--font-mono)",serif;color:#14181F">F3</span></code><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B"></</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#B80A18">name</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B">></span></span><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"><o:p></o:p></span></code></pre>
<pre><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"> </span></code><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B"><</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#B80A18">assignment</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B">></span></span><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"><o:p></o:p></span></code></pre>
<pre><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"> </span></code><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B"><</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#B80A18">policyRule</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B">></span></span><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"><o:p></o:p></span></code></pre>
<pre><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"> </span></code><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B"><</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#B80A18">name</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B">></span></span><code><span style="font-family:"var(--font-mono)",serif;color:#14181F">m365-f3-excluded-by-e5</span></code><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B"></</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#B80A18">name</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B">></span></span><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"><o:p></o:p></span></code></pre>
<pre><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"> </span></code><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B"><</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#B80A18">policyConstraints</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B">></span></span><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"><o:p></o:p></span></code></pre>
<pre><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"> </span></code><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B"><</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#B80A18">exclusion</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B">></span></span><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"><o:p></o:p></span></code></pre>
<pre><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"> </span></code><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B"><</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#B80A18">targetRef </span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#BD0F1E">oid</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B">="</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:green">E5</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B">"</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#B80A18"> </span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#BD0F1E">type</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B">="</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:green">c:RoleType</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B">"/></span></span><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"><o:p></o:p></span></code></pre>
<pre><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"> </span></code><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B"></</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#B80A18">exclusion</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B">></span></span><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"><o:p></o:p></span></code></pre>
<pre><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"> </span></code><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B"></</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#B80A18">policyConstraints</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B">></span></span><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"><o:p></o:p></span></code></pre>
<pre><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"> </span></code><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B"><</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#B80A18">policyActions</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B">></span></span><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"><o:p></o:p></span></code></pre>
<pre><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"> </span></code><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B"><</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#B80A18">prune</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B">/></span></span><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"><o:p></o:p></span></code></pre>
<pre><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"> </span></code><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B"></</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#B80A18">policyActions</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B">></span></span><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"><o:p></o:p></span></code></pre>
<pre><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"> </span></code><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B"></</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#B80A18">policyRule</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B">></span></span><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"><o:p></o:p></span></code></pre>
<pre><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"> </span></code><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B"></</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#B80A18">assignment</span></span><span class="gmail-token"><span style="font-family:"var(--font-mono)",serif;color:#2B303B">></span></span><code><span style="font-family:"var(--font-mono)",serif;color:#14181F"><o:p></o:p></span></code></pre>
<pre><span style="font-family:"var(--font-mono)",serif;color:#14181F"><o:p> </o:p></span></pre>
</div>
</div>
<p class="gmail-font-claude-response-body"><strong><span style="font-family:"Aptos",sans-serif">Steps to reproduce the failure:</span></strong><b><br>
<strong><span style="font-family:"Aptos",sans-serif"> </span></strong></b>Create new user John <o:p></o:p></p>
<ol start="1" type="1">
<li class="gmail-font-claude-response-body" style="mso-list:l1 level1 lfo2">Assign John → org101 as
<code><span style="font-size:10.0pt">manager</span></code> → gets E5 <o:p></o:p></li><li class="gmail-font-claude-response-body" style="mso-list:l1 level1 lfo2">Assign John → org102 as
<code><span style="font-size:10.0pt">default</span></code> → <strong><span style="font-family:"Aptos",sans-serif">org101 assignment gets removed</span></strong>
<span style="font-family:"Segoe UI Emoji",sans-serif">❌</span><o:p></o:p></li><li class="gmail-font-claude-response-body" style="mso-list:l1 level1 lfo2">Re-assign John → org101 as
<code><span style="font-size:10.0pt">manager</span></code> → <strong><span style="font-family:"Aptos",sans-serif">org102 assignment gets removed</span></strong>
<span style="font-family:"Segoe UI Emoji",sans-serif">❌</span><o:p></o:p></li></ol>
<p class="gmail-font-claude-response-body"><strong><span style="font-family:"Aptos",sans-serif">Symptom:</span></strong><br>
The F3 and E5 prune fires and removes the upstream direct org assignment instead of just suppressing the application-role .<o:p></o:p></p>
<p class="gmail-font-claude-response-body"><strong><span style="font-family:"Aptos",sans-serif">Question:</span></strong><br>
How do we configure MidPoint so O365 service (or in application-role) that E5 > F3 priority is enforced at the O365 service level, without affecting org assignments?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><span class="gmailsignatureprefix">-- </span><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal">Bao Tran <o:p></o:p></p>
<div>
<p class="MsoNormal">Software developer<o:p></o:p></p>
</div>
</div>
</div>
</div>
<p><span style="color:red">Attention! This email came from outside the ISSP company. If you do not trust this sender, do not click on the link or open the attachments, as this could be a phishing message.</span><o:p></o:p></p>
<p> <o:p></o:p></p>
</div>
</body>
</html>