<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello Habtamu,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
For group memberships to be provisioned correctly, I work with this configuration.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
First you configure a reference in the capabilities:</div>
<pre class="elementToProof"><div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><cap:references>
<cap:type>
<cap:name>groupMembership</cap:name>
<cap:subject>
<cap:delineation>
<cap:objectClass>ri:user</cap:objectClass>
</cap:delineation>
<cap:primaryBindingAttributeRef>groups</cap:primaryBindingAttributeRef>
<cap:localItemName>groupMemberships</cap:localItemName>
</cap:subject>
<cap:object>
<cap:delineation>
<cap:objectClass>ri:group</cap:objectClass>
</cap:delineation>
<cap:primaryBindingAttributeRef>groupId</cap:primaryBindingAttributeRef>
</cap:object>
<cap:direction>subjectToObject</cap:direction>
</cap:type></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"></cap:references></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><br></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">After that you can make an association type:</div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><br></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><associationType></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <name>groupMembershipsAssociation</name></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <subject></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <objectType></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <kind>account</kind></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <intent>account</intent></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </objectType></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <association></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <ref>groupMemberships</ref></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <sourceAttributeRef>groupMemberships</sourceAttributeRef></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <outbound></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <name>outboundGroupAssociation</name></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <expression></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <associationConstruction xsi:type="c:AssociationConstructionExpressionEvaluatorType"/></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </expression></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </outbound></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <inbound></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <name>inbound association</name></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <expression></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <associationSynchronization xsi:type="c:AssociationSynchronizationExpressionEvaluatorType"></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <objectRef></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <ref>groupMemberships</ref></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <mapping></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <name>inbound-memberships</name></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <strength>strong</strength></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <expression></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <shadowOwnerReferenceSearch/></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </expression></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <target></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <path>targetRef</path></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </target></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </mapping></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </objectRef></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <correlation></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <correlators></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <items></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <name>correlate</name></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <item></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <ref>targetRef</ref></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </item></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </items></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </correlators></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </correlation></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <synchronization></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <reaction></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <name>unmatched</name></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <situation>unmatched</situation></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <actions></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <addFocusValue/></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </actions></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </reaction></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <reaction"></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <name>matched</name></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <situation>matched</situation></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <actions></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <synchronize/></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </actions></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </reaction></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </synchronization></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </associationSynchronization></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </expression></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </inbound></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <tolerant>true</tolerant></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </association></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </subject></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <object></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <objectType></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <kind>entitlement</kind></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <intent>group</intent></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </objectType></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </object></div><div class="elementToProof" style="white-space: normal; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> </associationType></div></pre>
<div id="Signature" class="elementToProof">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I have also attached my test environment config file with some more associations configured, note that this one uses my own experimental build of the keycloak connector but groupMembership should be unchanged.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I hope this helps you with your keycloak connector troubles.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<table id="x_zs-output-sig" role="presentation" cellspacing="0" cellpadding="0" border="0" style="text-align: left; line-height: 0px; margin: 0px; width: 700px; color: rgb(60, 54, 58); box-sizing: border-box; border-collapse: collapse; border-spacing: 0px;">
<tbody>
<tr>
<td style="text-align: left; line-height: 0px; width: inherit; height: inherit;">
<table id="x_inner-table" role="presentation" cellspacing="0" cellpadding="0" border="0" style="text-align: left; line-height: 0px; margin: 0px; box-sizing: border-box; border-collapse: collapse; border-spacing: 0px;">
<tbody>
<tr>
<td style="text-align: left; line-height: 14px; padding-bottom: 14px; width: inherit; height: inherit;">
<p class="elementToProof" style="text-align: left; line-height: 14px; margin: 0.04px;">
<span style="font-family: Montserrat, sans-serif; font-size: 12px; color: rgb(0, 1, 98); line-height: 14px;">Kind Regards,</span></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td style="text-align: left; line-height: 0px; width: inherit; height: inherit;">
<table id="x_inner-table" role="presentation" cellspacing="0" cellpadding="0" border="0" style="text-align: left; line-height: 0px; margin: 0px; box-sizing: border-box; border-collapse: collapse; border-spacing: 0px;">
<tbody>
<tr>
<td style="text-align: left; line-height: 22px; padding-bottom: 2px; width: inherit; height: inherit;">
<p class="elementToProof" style="text-align: left; line-height: 22px; margin: 0.04px;">
<span style="font-family: Montserrat, sans-serif; font-size: 20px; color: rgb(0, 1, 98); line-height: 22px; font-weight: 600;">Nemo Van den Eynde</span></p>
</td>
</tr>
<tr>
<td style="text-align: left; line-height: 18px; padding-bottom: 12px; width: inherit; height: inherit;">
<p class="elementToProof" style="text-align: left; line-height: 18px; margin: 0.04px;">
<span style="font-family: Montserrat, sans-serif; font-size: 16px; color: rgb(255, 84, 0); line-height: 18px; font-weight: 600;">IGA Engineer</span></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td style="text-align: left; line-height: 0px; width: inherit; height: inherit;">
<table id="x_inner-table" role="presentation" cellspacing="0" cellpadding="0" border="0" style="text-align: left; line-height: 0px; margin: 0px; box-sizing: border-box; border-collapse: collapse; border-spacing: 0px;">
<tbody>
<tr>
<td style="text-align: left; line-height: 0px; padding-right: 20px; width: inherit; height: inherit;">
<table role="presentation" cellspacing="0" cellpadding="0" border="0" style="text-align: left; line-height: 0px; margin: 0px; box-sizing: border-box; border-collapse: collapse; border-spacing: 0px;">
<tbody>
<tr>
<td style="text-align: left; line-height: 0px; width: inherit; height: inherit;">
<p class="elementToProof" style="text-align: left; line-height: 0px; margin: 0.04px;">
<span style="font-family: Arial, Helvetica, sans-serif; font-size: 0px; color: rgb(60, 54, 58); line-height: 0px;"><a href="https://www.acen.eu/" target="_blank" id="OWAc41c2e49-b686-7faa-8eb1-0019c794a241" class="OWAAutoLink" rel="nofollow" style="text-decoration: none; margin-top: 0px; margin-bottom: 0px;"><img alt="Logo" width="178" height="87" style="width: 178px; height: 87px; max-width: 100%; margin-top: 0px; margin-bottom: 0px;" src="https://img2.gimm.io/2440cd65-5ed6-4e84-879d-6d6147718078/-/resize/356x174/image.png"></a></span></p>
</td>
</tr>
</tbody>
</table>
</td>
<td style="text-align: left; line-height: 0px; background-color: rgb(255, 84, 0); vertical-align: top; width: 2px; height: inherit;">
</td>
<td style="text-align: left; line-height: 0px; padding-right: 20px; width: inherit; height: inherit;">
</td>
<td style="text-align: left; line-height: 0px; width: inherit; height: inherit;">
<table role="presentation" cellspacing="0" cellpadding="0" border="0" style="text-align: left; line-height: 0px; margin: 0px; box-sizing: border-box; border-collapse: collapse; border-spacing: 0px;">
<tbody>
<tr>
<td style="text-align: left; line-height: 0px; padding-right: 8px; width: inherit; height: inherit;">
<p class="elementToProof" style="text-align: left; line-height: 0px; margin: 0.04px;">
<span style="font-family: Arial, Helvetica, sans-serif; font-size: 1px; color: rgb(60, 54, 58);"><img width="24" height="24" style="width: 24px; height: 24px; max-width: 100%; margin-top: 0px; margin-bottom: 0px;" src="https://img2.gimm.io/a4c6f625-9220-4efe-83d2-48e568599c1a/image.png"></span></p>
</td>
<td style="text-align: left; line-height: 0px; width: inherit; height: inherit;">
<p class="elementToProof" style="text-align: left; line-height: 0px; margin: 0.04px;">
<span style="font-family: Montserrat, sans-serif; font-size: 12px; color: rgb(0, 1, 98); line-height: 14px;">+32 465 00 12 21 </span></p>
</td>
</tr>
<tr>
<td colspan="2" style="text-align: left; line-height: 0px; padding-bottom: 6px; width: inherit; height: inherit;">
</td>
</tr>
</tbody>
</table>
<table role="presentation" cellspacing="0" cellpadding="0" border="0" style="text-align: left; line-height: 0px; margin: 0px; box-sizing: border-box; border-collapse: collapse; border-spacing: 0px;">
<tbody>
<tr>
<td style="text-align: left; line-height: 0px; padding-right: 8px; width: inherit; height: inherit;">
<p class="elementToProof" style="text-align: left; line-height: 0px; margin: 0.04px;">
<span style="font-family: Arial, Helvetica, sans-serif; font-size: 1px; color: rgb(60, 54, 58);"><img width="24" height="24" style="width: 24px; height: 24px; max-width: 100%; margin-top: 0px; margin-bottom: 0px;" src="https://img2.gimm.io/10e53e9d-763a-4be6-98fa-eeca2977a790/image.png"></span></p>
</td>
<td style="text-align: left; line-height: 0px; width: inherit; height: inherit;">
<p class="elementToProof" style="text-align: left; line-height: 0px; margin: 0.04px;">
<span style="font-family: Montserrat, sans-serif; font-size: 12px; color: rgb(0, 1, 98); line-height: 14px;"><a href="mailto:nemo.vandeneynde@acen.eu" target="_blank" id="OWA6f23ddfe-de3c-9769-253e-707eda4e747b" class="OWAAutoLink" rel="nofollow" style="color: rgb(0, 1, 98); text-decoration: none; display: inline; margin-top: 0px; margin-bottom: 0px;">nemo.vandeneynde@acen.eu </a></span></p>
</td>
</tr>
<tr>
<td colspan="2" style="text-align: left; line-height: 0px; padding-bottom: 6px; width: inherit; height: inherit;">
</td>
</tr>
</tbody>
</table>
<table role="presentation" cellspacing="0" cellpadding="0" border="0" style="text-align: left; line-height: 0px; margin: 0px; box-sizing: border-box; border-collapse: collapse; border-spacing: 0px;">
<tbody>
<tr>
<td style="text-align: left; line-height: 0px; padding-right: 8px; width: inherit; height: inherit;">
<p class="elementToProof" style="text-align: left; line-height: 0px; margin: 0.04px;">
<span style="font-family: Arial, Helvetica, sans-serif; font-size: 1px; color: rgb(60, 54, 58);"><img width="24" height="24" style="width: 24px; height: 24px; max-width: 100%; margin-top: 0px; margin-bottom: 0px;" src="https://img2.gimm.io/1ae8c26f-8371-4eb1-a439-7868d9a3610d/image.png"></span></p>
</td>
<td style="text-align: left; line-height: 0px; width: inherit; height: inherit;">
<p class="elementToProof" style="text-align: left; line-height: 0px; margin: 0.04px;">
<span style="font-family: Montserrat, sans-serif; font-size: 12px; color: rgb(0, 1, 98); line-height: 14px;"><a href="http://www.acen.eu/" target="_blank" id="OWAd5682f64-ff2f-129e-77e7-6b7d45d29171" class="OWAAutoLink" rel="nofollow" style="color: rgb(0, 1, 98); text-decoration: none; display: inline; margin-top: 0px; margin-bottom: 0px;">www.acen.eu </a></span></p>
</td>
</tr>
<tr>
<td colspan="2" style="text-align: left; line-height: 0px; padding-bottom: 6px; width: inherit; height: inherit;">
</td>
</tr>
</tbody>
</table>
<table role="presentation" cellspacing="0" cellpadding="0" border="0" style="text-align: left; line-height: 0px; margin: 0px; box-sizing: border-box; border-collapse: collapse; border-spacing: 0px;">
<tbody>
<tr>
<td style="text-align: left; line-height: 0px; padding-right: 8px; width: inherit; height: inherit;">
<p class="elementToProof" style="text-align: left; line-height: 0px; margin: 0.04px;">
<span style="font-family: Arial, Helvetica, sans-serif; font-size: 1px; color: rgb(60, 54, 58);"><img width="24" height="24" style="width: 24px; height: 24px; max-width: 100%; margin-top: 0px; margin-bottom: 0px;" src="https://img2.gimm.io/32ff85f7-5c98-464f-8114-1fd12ac5e149/image.png"></span></p>
</td>
<td style="text-align: left; line-height: 0px; width: inherit; height: inherit;">
<p class="elementToProof" style="text-align: left; line-height: 0px; margin: 0.04px;">
<span style="font-family: Montserrat, sans-serif; font-size: 12px; color: rgb(0, 1, 98); line-height: 14px;"><a href="https://maps.app.goo.gl/M4nC67m22KWx2XE2A" target="_blank" id="OWA41a88c80-aca9-c0f3-773b-59a4fbeeb526" class="OWAAutoLink" rel="nofollow" style="color: rgb(0, 1, 98); text-decoration: none; display: inline; margin-top: 0px; margin-bottom: 0px;">Veldkant
7, 2550 Kontich </a></span></p>
</td>
</tr>
<tr>
<td colspan="2" style="text-align: left; line-height: 0px; padding-bottom: 6px; width: inherit; height: inherit;">
</td>
</tr>
</tbody>
</table>
<table role="presentation" cellspacing="0" cellpadding="0" border="0" style="text-align: left; line-height: 0px; margin: 0px; box-sizing: border-box; border-collapse: collapse; border-spacing: 0px;">
<tbody>
<tr>
<td style="text-align: left; line-height: 0px; padding-right: 8px; width: inherit; height: inherit;">
<p class="elementToProof" style="text-align: left; line-height: 0px; margin: 0.04px;">
<span style="font-family: Arial, Helvetica, sans-serif; font-size: 1px; color: rgb(60, 54, 58);"><img width="24" height="24" style="width: 24px; height: 24px; max-width: 100%; margin-top: 0px; margin-bottom: 0px;" src="https://img2.gimm.io/95d2ac0a-846f-4eab-b7d1-27a6ac793a95/image.png"></span></p>
</td>
<td style="text-align: left; line-height: 0px; width: inherit; height: inherit;">
<div class="elementToProof" style="text-align: left; line-height: 0px; font-family: Montserrat, sans-serif; font-size: 12px; color: rgb(0, 1, 98);">
<span style="line-height: 14px; font-weight: 700;"><a href="https://www.acen.eu/en/working-at-acen/" target="_blank" id="OWA20286f71-8d73-e273-a9fa-37903d61d8bd" class="OWAAutoLink" rel="nofollow" style="color: rgb(0, 1, 98); text-decoration: none; display: inline;">Discover
our jobs </a></span></div>
</td>
</tr>
<tr>
<td colspan="2" style="text-align: left; line-height: 0px; padding-bottom: 6px; width: inherit; height: inherit;">
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td style="text-align: left; line-height: 0px; width: inherit; height: inherit;">
<table id="x_inner-table" role="presentation" cellspacing="0" cellpadding="0" border="0" style="text-align: left; line-height: 0px; margin: 0px; box-sizing: border-box; border-collapse: collapse; border-spacing: 0px;">
<tbody>
<tr>
<td style="text-align: left; line-height: 0px; padding-right: 8px; width: inherit; height: inherit;">
<p class="elementToProof" style="text-align: left; line-height: 0px; margin: 0.04px;">
<span style="font-family: Arial, Helvetica, sans-serif; font-size: 1px; color: rgb(60, 54, 58);"><img width="24" height="24" style="width: 24px; height: 24px; max-width: 100%; margin-top: 0px; margin-bottom: 0px;" src="https://img2.gimm.io/e875ab9e-8ef1-4573-9dd2-d378f95d82ed/image.png"></span></p>
</td>
<td style="text-align: left; line-height: 0px; width: inherit; height: inherit;">
<p class="elementToProof" style="text-align: left; line-height: 0px; margin: 0.04px;">
<span style="font-family: Montserrat, sans-serif; font-size: 12px; color: rgb(0, 1, 98); line-height: 14px; font-weight: 700;"><a href="https://www.linkedin.com/company/98341614/admin/feed/posts/?feedType=following" target="_blank" id="OWA5971918a-dca0-10d0-f98b-22eead68b024" class="OWAAutoLink" rel="nofollow" style="color: rgb(0, 1, 98); text-decoration: none; display: inline; margin-top: 0px; margin-bottom: 0px;">Follow
us </a></span></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td style="text-align: left; line-height: 0px; padding-bottom: 16px; width: inherit; height: inherit;">
</td>
</tr>
</tbody>
</table>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr style="display: inline-block; width: 98%;">
<div id="divRplyFwdMsg">
<div style="direction: ltr; font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<b>From:</b> midPoint <midpoint-bounces@lists.evolveum.com> on behalf of Habtamu Wubneh via midPoint <midpoint@lists.evolveum.com><br>
<b>Sent:</b> Tuesday, July 7, 2026 15:46<br>
<b>To:</b> midpoint@lists.evolveum.com <midpoint@lists.evolveum.com><br>
<b>Cc:</b> Habtamu Wubneh <habtamuwubneh5@gmail.com><br>
<b>Subject:</b> [midPoint] Active Directory and Keycloak connector Issues with Group Membership Provisioning in midPoint 4.10.2</div>
<div style="direction: ltr;"> </div>
</div>
<div style="font-size: 11pt;">Dear midPoint Support Team,<br>
I hope this email finds you well. I am currently facing several issues<br>
while trying to provision users and group memberships from midPoint<br>
(version 4.10.2) to both Keycloak (version 24.0.5) and Active<br>
Directory using the AD/LDAP connector. I would appreciate your<br>
assistance in resolving these challenges.<br>
<br>
Environment Details<br>
<br>
Component Version<br>
midPoint 4.10.2 (Docker: evolveum/midpoint:4.10.2-alpine)<br>
Keycloak 24.0.5 (Docker: quay.io/keycloak/keycloak:24.0.5)<br>
Keycloak Connectorjp.openstandia.connector.keycloak.Keycloak Connector<br>
v1.1.7-SNAPSHOT<br>
AD/LDAP Connectorcom.evolveum.polygon.connector.ldap.ad.AdLdapConnector<br>
Deployment Docker Compose<br>
<br>
Part 1: Keycloak Connector Issues<br>
<br>
Issue 1.1: User Provisioning Works, but Group Memberships Are Not Provisioned<br>
<br>
When I create a user in midPoint and assign them a role (which should<br>
map to a Keycloak group), the user is successfully created in<br>
Keycloak, but:<br>
<br>
The user is NOT added to the group (the Members tab in Keycloak Groups<br>
shows no members)<br>
<br>
The user's Member Of section is empty<br>
<br>
Issue 1.2: Invalid XML Syntax for Attribute Mappings in midPoint 4.10.2<br>
<br>
I have tried multiple approaches to map the ri:groups attribute, but I<br>
keep encountering XML validation errors:<br>
<br>
Attempt 1: Using script under source<br>
<br>
text<br>
<br>
Error: No field 'script' in class class<br>
com.evolveum.midpoint.xml.ns._public.common.common_3.VariableBindingDefinitionType<br>
<br>
Attempt 2: Using expression with script<br>
<br>
text<br>
<br>
Error: No field 'expression' in class class<br>
com.evolveum.midpoint.xml.ns._public.common.common_3.VariableBindingDefinitionType<br>
<br>
Attempt 3: Using value under source<br>
<br>
text<br>
<br>
Error: No field 'value' in class class<br>
com.evolveum.midpoint.xml.ns._public.common.common_3.VariableBindingDefinitionType<br>
<br>
Attempt 4: Using constant: prefix<br>
<br>
text<br>
<br>
Error: This works but does not resolve the role name dynamically<br>
<br>
Attempt 5: Using association for groups<br>
<br>
text<br>
<br>
Error: Legacy association 'groups' is already defined as an attribute<br>
in resource association definition for 'groups' in object type<br>
ACCOUNT/default<br>
<br>
Issue 1.3: Role Inducement Not Creating Groups<br>
<br>
When I create a role with an inducement to create a group in Keycloak:<br>
<br>
xml<br>
<br>
<inducement><br>
<construction><br>
<resourceRef oid="9beeeddb-10ca-42c8-8ba0-734d519e4bee"/><br>
<kind>entitlement</kind><br>
<intent>group</intent><br>
<attribute><br>
<ref>ri:name</ref><br>
<value>InitiativeOwner</value><br>
</attribute><br>
</construction><br>
</inducement><br>
<br>
The group is not created in Keycloak unless the role's name matches<br>
the group name.<br>
<br>
Issue 1.4: Correlation Not Working as Expected<br>
<br>
The correlation mechanism does not seem to work properly. When<br>
multiple users are assigned the same role, midPoint tries to create a<br>
new group for each user instead of adding them to the existing group.<br>
This results in:<br>
<br>
Duplicate groups being created (or conflicts)<br>
<br>
The ri:groups attribute is not being used for correlation<br>
<br>
Issue 1.5: Casting Error When Using roleMembershipRef<br>
<br>
When trying to map roleMembershipRef directly to ri:groups, I get:<br>
<br>
text<br>
<br>
Error: class com.evolveum.midpoint.prism.impl.PrismReferenceValueImpl<br>
cannot be cast to class com.evolveum.midpoint.prism.PrismPropertyValue<br>
<br>
________________________________<br>
<br>
Part 2: AD/LDAP Connector Issues<br>
<br>
Issue 2.1: Group Synchronization Problems<br>
<br>
Based on the AD/LDAP connector documentation, configuring group<br>
synchronization requires specific settings. I am facing issues with:<br>
<br>
Group object synchronization - Groups are not being synchronized<br>
properly between midPoint and AD<br>
<br>
Group membership provisioning - Users are not being added to groups in AD<br>
<br>
Issue 2.2: Association Configuration Challenges<br>
<br>
According to the official documentation, the AD/LDAP connector<br>
requires specific association configuration for group memberships:<br>
<br>
xml<br>
<br>
<association><br>
<ref>ri:group</ref><br>
<displayName>AD Group Membership</displayName><br>
<kind>entitlement</kind><br>
<intent>group</intent><br>
<direction>objectToSubject</direction><br>
<associationAttribute>ri:member</associationAttribute><br>
<valueAttribute>ri:dn</valueAttribute><br>
<shortcutAssociationAttribute>ri:memberOf</shortcutAssociationAttribute><br>
<shortcutValueAttribute>ri:dn</shortcutValueAttribute><br>
<explicitReferentialIntegrity>false</explicitReferentialIntegrity><br>
</association><br>
<br>
However, I'm encountering issues with this configuration not working<br>
as expected.<br>
<br>
Issue 2.3: Administrative Account Privileges<br>
<br>
The documentation states that the administrative account used by<br>
midPoint needs specific privileges:<br>
<br>
Create, delete and manage user accounts<br>
<br>
Reset user passwords and force password change at next logon<br>
<br>
Read all user information<br>
<br>
Create, delete and manage groups<br>
<br>
Modify the membership of a group<br>
<br>
I have confirmed these privileges are assigned, but group membership<br>
still fails.<br>
<br>
Issue 2.4: LDAP Search Errors<br>
<br>
I am also experiencing LDAP search errors similar to those documented<br>
in the midPoint bug tracker:<br>
<br>
text<br>
<br>
LDAP error during search: operationsError: 00002120: SvcErr:<br>
DSID-03120496, problem 5012 (DIR_ERROR), data 592060<br>
<br>
This appears to be related to group object processing from Active Directory.<br>
<br>
Issue 2.5: Association Outbound Mapping Configuration<br>
<br>
The documentation mentions that for provisioning users with group<br>
memberships, you need to configure the outbound mapping for<br>
associations. I have tried both the association approach and the<br>
attribute approach, but neither is working consistently.<br>
<br>
According to the group synchronization HOWTO, groups should be<br>
synchronized with roles using the following configuration:<br>
<br>
xml<br>
<br>
<objectSynchronization><br>
<enabled>true</enabled><br>
<objectClass>ri:CustomGroupObjectClass</objectClass><br>
<kind>entitlement</kind><br>
<intent>group</intent><br>
<focusType>c:RoleType</focusType><br>
<!-- correlation and reactions --><br>
</objectSynchronization><br>
<br>
I have configured this but it's not working as expected.<br>
<br>
________________________________<br>
<br>
What I'm Trying to Achieve<br>
<br>
Keycloak: Create a role in midPoint that represents a group in<br>
Keycloak, assign users to this role, and automatically provision both<br>
the group and the user's membership<br>
<br>
AD/LDAP: Similarly, synchronize users and groups between midPoint and<br>
Active Directory, ensuring group memberships are properly provisioned<br>
<br>
Questions<br>
<br>
For Keycloak Connector:<br>
<br>
What is the correct XML syntax for mapping ri:groups to a dynamic role<br>
name in midPoint 4.10.2?<br>
<br>
What is the correct way to create groups via role inducements in<br>
midPoint 4.10.2?<br>
<br>
How should I configure correlation to prevent duplicate group creation<br>
when assigning multiple users to the same role?<br>
<br>
Should I use attribute or association for group memberships in the<br>
schemaHandling?<br>
<br>
For AD/LDAP Connector:<br>
<br>
What is the correct configuration for group membership provisioning<br>
with the AD/LDAP connector in midPoint 4.10.2?<br>
<br>
Are there specific settings required for managedAssociationPairs and<br>
explicitReferentialIntegrity that I might be missing?<br>
<br>
Is there a known issue with the AD/LDAP connector and group<br>
synchronization in midPoint 4.10.2?<br>
<br>
Could the LDAP search error be related to the connector version or<br>
configuration?<br>
<br>
________________________________<br>
<br>
Current Resource Configuration (Simplified)<br>
<br>
Keycloak Resource<br>
<br>
xml<br>
<br>
<schemaHandling><br>
<objectType id="4"><br>
<kind>account</kind><br>
<intent>default</intent><br>
<delineation><br>
<objectClass>ri:user</objectClass><br>
</delineation><br>
<!-- User attributes mapping --><br>
<attribute><br>
<ref>ri:username</ref><br>
<outbound><br>
<source><br>
<path>name</path><br>
</source><br>
</outbound><br>
</attribute><br>
<!-- ❌ Groups mapping not working --><br>
<attribute><br>
<ref>ri:groups</ref><br>
<outbound><br>
<source><br>
<path>constant:InitiativeOwner</path><br>
</source><br>
</outbound><br>
</attribute><br>
</objectType><br>
</schemaHandling><br>
<br>
AD/LDAP Resource<br>
<br>
xml<br>
<br>
<connectorConfiguration><br>
<icfc:configurationProperties><br>
<icfcldap:host>ad.example.com</icfcldap:host><br>
<icfcldap:port>636</icfcldap:port><br>
<icfcldap:baseContext>DC=example,DC=com</icfcldap:baseContext><br>
<icfcldap:bindDn>CN=midpoint,CN=Users,DC=example,DC=com</icfcldap:bindDn><br>
<icfcldap:connectionSecurity>ssl</icfcldap:connectionSecurity><br>
<icfcldap:pagingBlockSize>100</icfcldap:pagingBlockSize><br>
</icfc:configurationProperties><br>
</connectorConfiguration><br>
<br>
________________________________<br>
<br>
I would greatly appreciate any guidance on the correct configuration<br>
for both connectors in midPoint 4.10.2. Please let me know if you need<br>
any additional information, logs, or configuration details.<br>
<br>
Thank you for your time and support.<br>
<br>
Best regards,<br>
Habtamu Wubneh Yirdaw'<br>
Senior IT Architecture and Modernization Officer<br>
phone: +251938101164<br>
email: habtamuwubneh5@gmail.com<br>
_______________________________________________<br>
midPoint mailing list<br>
midPoint@lists.evolveum.com<br>
<a href="https://lists.evolveum.com/mailman/listinfo/midpoint" id="OWAd4790329-cc15-847f-bddc-8a080ccfef4c" class="OWAAutoLink" data-auth="NotApplicable">https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.evolveum.com%2Fmailman%2Flistinfo%2Fmidpoint&data=05%7C02%7Cnemo.vandeneynde%40is4u.be%7C7713d2eacc8748d4ee4308dedcc8eaaf%7C49c3d703357947bfa8887c913fbdced9%7C0%7C0%7C639190952723817609%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=GL05mBzvxs%2FzEYBGQDqAOkyKgVHdBXEqVsdjs0UFF40%3D&reserved=0</a></div>
</body>
</html>