Uploaded image for project: 'MidPoint'
  1. MidPoint
  2. MID-7470

Improve handling of object class name in synchronization tasks

    XMLWordPrintable

    Details

    • Type: Improvement
    • Status: Resolved
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: 4.4
    • Fix Version/s: 4.6
    • Component/s: Provisioning, Tasks
    • Labels:
      None
    • Subscription:
      Internal

      Description

      The objectclass specification in synchronization activities in rare cases does not work quite as expected. The current implementation is that when used, the provisioning module selects one of objectType definitions in schemaHandling section of resource definition (the one with default being true if it exists, or an arbitrary one). It then uses its parameters to formulate the query on resource: objectClass and baseContext (maybe others as well).

      So, for example, if one has the following two object types defined:

      • kind: account, intent: default, default: true, base context: ou=people,dc=example,dc=com
      • kind: account, intent: other, default: false, base context: ou=other-people,dc=example,dc=com

      (see resource-openldap-two-accounts.xml)

      and runs the following task:

      <task xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
            xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3"
            oid="d58f37cc-5220-4156-bddb-742d703af39d">
          <name>reconciliation-two-accounts-by-object-class&amp;amp;lt;/name>
          <ownerRef oid="00000000-0000-0000-0000-000000000002" type="UserType"/>
          <executionState>runnable</executionState>
          <activity>
              <work>
                  <reconciliation>
                      <resourceObjects>
                          <resourceRef oid="5528fab6-ac70-4ae8-b135-7163d5d44984"/>
                          <objectclass>ri:inetOrgPerson</objectclass>
                      </resourceObjects>
                  </reconciliation>
              </work>
          </activity>
      </task>
      

      Then only the accounts in ou=people are synchronized:

      (We have one account in ou=people and one account in ou=other-people.)

      Suggested resolution: Change provisioning module to interpret objectclass=X queries so that they will cover all objects on given resource with given object class.

      See also:

        Attachments

          Activity

            People

            Assignee:
            mederly Pavol Mederly
            Reporter:
            mederly Pavol Mederly
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved: