<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Steven,</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
this is quite simple. You can create an administrator role as copy of the default super user user role with the „authorization-3#all“ action. To avoid deletion, you add a second authorization block with the „authorization-model-3#delete“ action and decision
„deny“. The following screenshot shows my role configuration:</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<img src="cid:542DBAA0-0172-4B95-A26D-0177B210342D" alt="image.png" id="id-542DBAA0-0172-4B95-A26D-0177B210342D" width="652" style="width: 652px; max-width: 100%;"></div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Kind regards,</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Fabian</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
--</div>
<div id="ms-outlook-mobile-signature" style="color: inherit; background-color: inherit;">
<p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 11pt;">
<span style="font-family: Verdana, sans-serif; font-size: 10pt; color: black;"><b>Fabian Noll-Dukiewicz</b></span></p>
<p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 11pt;">
<span style="font-family: Verdana, sans-serif; font-size: 10pt; color: black;"><i>Spezialist Identity & Access Management | Geschäftsführer</i></span></p>
<p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 11pt;">
<span style="font-family: Verdana, sans-serif; font-size: 10pt; color: black;">Tel.: +49 152 244 63 211</span></p>
<p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 11pt;">
<span style="font-family: Verdana, sans-serif; font-size: 10pt; color: black;">Email: fabian.noll-dukiewicz@veryfy.gmbh</span></p>
<p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 11pt;">
<span style="font-family: Verdana, sans-serif; font-size: 10pt; color: black;">Web:
</span><span style="font-family: Verdana, sans-serif; font-size: 10pt; color: rgb(5, 99, 193);"><u><a href="https://veryfy.gmbh" data-outlook-id="fe8cd8e0-caa3-4902-b5af-c404057f6eee" style="color: rgb(5, 99, 193); margin-top: 0px; margin-bottom: 0px;">https://veryfy.gmbh</a></u></span><span style="font-family: Verdana, sans-serif; font-size: 10pt; color: black;">
</span><span style="color: black;"> </span></p>
<p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 11pt;">
</p>
</div>
<div id="mail-editor-reference-message-container" style="color: inherit; background-color: inherit;">
<div class="ms-outlook-mobile-reference-message skipProofing">
<meta name="Generator" content="Microsoft Exchange Server" style="color: inherit; background-color: inherit;">
</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="text-align: left; padding: 3pt 0in 0in; border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) currentcolor currentcolor; font-family: Aptos; font-size: 12pt; color: black;">
<b>Von: </b>midPoint <midpoint-bounces@lists.evolveum.com> im Auftrag von Ashwill, Steven L via midPoint <midpoint@lists.evolveum.com><br>
<b>Datum: </b>Mittwoch, 1. Juli 2026 um 16:13<br>
<b>An: </b>midpoint@lists.evolveum.com <midpoint@lists.evolveum.com><br>
<b>Cc: </b>Ashwill, Steven L <sashwill@uillinois.edu><br>
<b>Betreff: </b>[midPoint] disable "DeleteAll" options in production<br>
<br>
</div>
<div class="PlainText" style="font-size: 11pt;">Is there a way to remove the option or the permissions that allow a super user to "Delete All Objects" or "Delete all Shadows" from the repository menu and other screen where that may exist. There is no reason
that I can think of where we would want to do this in production and unfortunately it has happen by accident twice in the last 2 years.<br>
<br>
<br>
STEVEN L ASHWILL<br>
Software Engineer Coordinator<br>
Administrative Information Technology Services<br>
University of Illinois at Urbana-Champaign<br>
50 Gerty Drive | M/C 673<br>
Champaign, IL 61820<br>
217.265.6337 | sashwill@uillinois.edu<br>
<a href="http://www.aits.uillinois.edu" data-outlook-id="a1b93ca0-8e7c-4377-86a5-2c913c33b4d6">www.aits.uillinois.edu</a><br>
<br>
<br>
<br>
Under the Illinois Freedom of Information Act any written communication to or from university employees regarding university business is a public record and may be subject to public disclosure. <br>
<br>
<br>
_______________________________________________<br>
midPoint mailing list<br>
midPoint@lists.evolveum.com<br>
<a href="https://lists.evolveum.com/mailman/listinfo/midpoint" data-outlook-id="b5927554-3a00-43c3-88ab-5ec9f85e23a4">https://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
</div>
</div>
</body>
</html>