<div dir="ltr"><div><p class="gmail-font-claude-response-body gmail-break-words gmail-whitespace-normal">Hi all,<br>We're running into an issue with priority enforcement for application-roles for single service in MidPoint and would appreciate any insight.</p>
<p class="gmail-font-claude-response-body gmail-break-words gmail-whitespace-normal"><b>Our goal: </b>A service has multi application-role , a user John can have multiple org assignments with different relations → only the highest application-role (E5) wins, application-role F3 is suppressed.</p>
<p class="gmail-font-claude-response-body gmail-break-words gmail-whitespace-normal"><strong>What we tried (and failed):</strong></p>
<ul class="gmail-[li_&]:mb-0 gmail-[li_&]:mt-1 gmail-[li_&]:gap-1 gmail-[&:not(:last-child)_ul]:pb-1 gmail-[&:not(:last-child)_ol]:pb-1 gmail-list-disc gmail-flex gmail-flex-col gmail-gap-1 gmail-pl-8 gmail-mb-3">
<li class="gmail-font-claude-response-body gmail-whitespace-normal gmail-break-words gmail-pl-2">Orgs have 2 inducements:
<ul class="gmail-[li_&]:mb-0 gmail-[li_&]:mt-1 gmail-[li_&]:gap-1 gmail-[&:not(:last-child)_ul]:pb-1 gmail-[&:not(:last-child)_ol]:pb-1 gmail-list-disc gmail-flex gmail-flex-col gmail-gap-1 gmail-pl-8 gmail-mb-3">
<li class="gmail-font-claude-response-body gmail-whitespace-normal gmail-break-words gmail-pl-2">→ E5 (condition: <code class="gmail-bg-text-200/5 gmail-border gmail-border-0.5 gmail-border-border-300 gmail-text-danger-000 gmail-whitespace-pre-wrap gmail-rounded-[0.4rem] gmail-px-1 gmail-py-px gmail-text-[0.9rem]">relation=manager</code>)</li>
<li class="gmail-font-claude-response-body gmail-whitespace-normal gmail-break-words gmail-pl-2">→ F3 (no condition, everyone gets this as base)</li>
</ul>
</li>
<li class="gmail-font-claude-response-body gmail-whitespace-normal gmail-break-words gmail-pl-2">Service O365 has 2 application-roles: <br> - E5<br> - F3</li>
<li class="gmail-font-claude-response-body gmail-whitespace-normal gmail-break-words gmail-pl-2">F3 role has an exclusion policy rule → prune when E5 is present:</li></ul><div role="group" aria-label="xml code" tabindex="0" class="gmail-relative gmail-group/copy gmail-bg-bg-000/50 gmail-border-0.5 gmail-border-border-400 gmail-rounded-lg gmail-focus:outline-none gmail-focus-visible:ring-2 gmail-focus-visible:ring-accent-100"><div class="gmail-overflow-x-auto"><pre class="gmail-code-block__code gmail-!my-0 gmail-!rounded-lg gmail-!text-sm gmail-!leading-relaxed gmail-p-3.5" style="color:rgb(20,24,31);background:transparent;font-family:var(--font-mono)"><code class="gmail-language-xml" style="background:transparent;font-family:var(--font-mono)"><span class="gmail-token gmail-token" style="color:rgb(43,48,59)"><</span><span class="gmail-token gmail-token" style="color:rgb(184,10,24)">role</span><span class="gmail-token gmail-token" style="color:rgb(43,48,59)">></span>
<span class="gmail-token gmail-token" style="color:rgb(43,48,59)"><</span><span class="gmail-token gmail-token" style="color:rgb(184,10,24)">name</span><span class="gmail-token gmail-token" style="color:rgb(43,48,59)">></span>F3<span class="gmail-token gmail-token" style="color:rgb(43,48,59)"></</span><span class="gmail-token gmail-token" style="color:rgb(184,10,24)">name</span><span class="gmail-token gmail-token" style="color:rgb(43,48,59)">></span>
<span class="gmail-token gmail-token" style="color:rgb(43,48,59)"><</span><span class="gmail-token gmail-token" style="color:rgb(184,10,24)">assignment</span><span class="gmail-token gmail-token" style="color:rgb(43,48,59)">></span>
<span class="gmail-token gmail-token" style="color:rgb(43,48,59)"><</span><span class="gmail-token gmail-token" style="color:rgb(184,10,24)">policyRule</span><span class="gmail-token gmail-token" style="color:rgb(43,48,59)">></span>
<span class="gmail-token gmail-token" style="color:rgb(43,48,59)"><</span><span class="gmail-token gmail-token" style="color:rgb(184,10,24)">name</span><span class="gmail-token gmail-token" style="color:rgb(43,48,59)">></span>m365-f3-excluded-by-e5<span class="gmail-token gmail-token" style="color:rgb(43,48,59)"></</span><span class="gmail-token gmail-token" style="color:rgb(184,10,24)">name</span><span class="gmail-token gmail-token" style="color:rgb(43,48,59)">></span>
<span class="gmail-token gmail-token" style="color:rgb(43,48,59)"><</span><span class="gmail-token gmail-token" style="color:rgb(184,10,24)">policyConstraints</span><span class="gmail-token gmail-token" style="color:rgb(43,48,59)">></span>
<span class="gmail-token gmail-token" style="color:rgb(43,48,59)"><</span><span class="gmail-token gmail-token" style="color:rgb(184,10,24)">exclusion</span><span class="gmail-token gmail-token" style="color:rgb(43,48,59)">></span>
<span class="gmail-token gmail-token" style="color:rgb(43,48,59)"><</span><span class="gmail-token gmail-token" style="color:rgb(184,10,24)">targetRef</span><span class="gmail-token gmail-token" style="color:rgb(184,10,24)"> </span><span class="gmail-token gmail-token" style="color:rgb(189,15,30)">oid</span><span class="gmail-token gmail-token gmail-attr-equals" style="color:rgb(43,48,59)">=</span><span class="gmail-token gmail-token" style="color:rgb(43,48,59)">"</span><span class="gmail-token gmail-token" style="color:rgb(0,128,0)">E5</span><span class="gmail-token gmail-token" style="color:rgb(43,48,59)">"</span><span class="gmail-token gmail-token" style="color:rgb(184,10,24)"> </span><span class="gmail-token gmail-token" style="color:rgb(189,15,30)">type</span><span class="gmail-token gmail-token gmail-attr-equals" style="color:rgb(43,48,59)">=</span><span class="gmail-token gmail-token" style="color:rgb(43,48,59)">"</span><span class="gmail-token gmail-token" style="color:rgb(0,128,0)">c:RoleType</span><span class="gmail-token gmail-token" style="color:rgb(43,48,59)">"</span><span class="gmail-token gmail-token" style="color:rgb(43,48,59)">/></span>
<span class="gmail-token gmail-token" style="color:rgb(43,48,59)"></</span><span class="gmail-token gmail-token" style="color:rgb(184,10,24)">exclusion</span><span class="gmail-token gmail-token" style="color:rgb(43,48,59)">></span>
<span class="gmail-token gmail-token" style="color:rgb(43,48,59)"></</span><span class="gmail-token gmail-token" style="color:rgb(184,10,24)">policyConstraints</span><span class="gmail-token gmail-token" style="color:rgb(43,48,59)">></span>
<span class="gmail-token gmail-token" style="color:rgb(43,48,59)"><</span><span class="gmail-token gmail-token" style="color:rgb(184,10,24)">policyActions</span><span class="gmail-token gmail-token" style="color:rgb(43,48,59)">></span>
<span class="gmail-token gmail-token" style="color:rgb(43,48,59)"><</span><span class="gmail-token gmail-token" style="color:rgb(184,10,24)">prune</span><span class="gmail-token gmail-token" style="color:rgb(43,48,59)">/></span>
<span class="gmail-token gmail-token" style="color:rgb(43,48,59)"></</span><span class="gmail-token gmail-token" style="color:rgb(184,10,24)">policyActions</span><span class="gmail-token gmail-token" style="color:rgb(43,48,59)">></span>
<span class="gmail-token gmail-token" style="color:rgb(43,48,59)"></</span><span class="gmail-token gmail-token" style="color:rgb(184,10,24)">policyRule</span><span class="gmail-token gmail-token" style="color:rgb(43,48,59)">></span>
<span class="gmail-token gmail-token" style="color:rgb(43,48,59)"></</span><span class="gmail-token gmail-token" style="color:rgb(184,10,24)">assignment</span><span class="gmail-token gmail-token" style="color:rgb(43,48,59)">></span>
<br></code></pre></div></div>
<p class="gmail-font-claude-response-body gmail-break-words gmail-whitespace-normal"><strong>Steps to reproduce the failure:<br> </strong>Create new user John </p>
<ol class="gmail-[li_&]:mb-0 gmail-[li_&]:mt-1 gmail-[li_&]:gap-1 gmail-[&:not(:last-child)_ul]:pb-1 gmail-[&:not(:last-child)_ol]:pb-1 gmail-list-decimal gmail-flex gmail-flex-col gmail-gap-1 gmail-pl-8 gmail-mb-3">
<li class="gmail-font-claude-response-body gmail-whitespace-normal gmail-break-words gmail-pl-2">Assign John → org101 as <code class="gmail-bg-text-200/5 gmail-border gmail-border-0.5 gmail-border-border-300 gmail-text-danger-000 gmail-whitespace-pre-wrap gmail-rounded-[0.4rem] gmail-px-1 gmail-py-px gmail-text-[0.9rem]">manager</code> → gets E5 </li>
<li class="gmail-font-claude-response-body gmail-whitespace-normal gmail-break-words gmail-pl-2">Assign John → org102 as <code class="gmail-bg-text-200/5 gmail-border gmail-border-0.5 gmail-border-border-300 gmail-text-danger-000 gmail-whitespace-pre-wrap gmail-rounded-[0.4rem] gmail-px-1 gmail-py-px gmail-text-[0.9rem]">default</code> → <strong>org101 assignment gets removed</strong> ❌</li>
<li class="gmail-font-claude-response-body gmail-whitespace-normal gmail-break-words gmail-pl-2">Re-assign John → org101 as <code class="gmail-bg-text-200/5 gmail-border gmail-border-0.5 gmail-border-border-300 gmail-text-danger-000 gmail-whitespace-pre-wrap gmail-rounded-[0.4rem] gmail-px-1 gmail-py-px gmail-text-[0.9rem]">manager</code> → <strong>org102 assignment gets removed</strong> ❌</li>
</ol>
<p class="gmail-font-claude-response-body gmail-break-words gmail-whitespace-normal"><strong>Symptom:</strong><br>
The F3 and E5 prune fires and removes the upstream direct org assignment instead of just suppressing the application-role .</p>
<p class="gmail-font-claude-response-body gmail-break-words gmail-whitespace-normal"><strong>Question:</strong><br>
How do we configure MidPoint so O365 service (or in application-role) that E5 > F3 priority is enforced at the O365 service level, without affecting org assignments?</p></div><div><br></div><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">Bao Tran<div>Software developer</div></div></div></div>