midpoint源码阅读九（使用示例：多租户用户管理五——示例配置文件分析）

忘是亡心i 2022-05-22 10:27 318阅读 0赞

上篇 [midpoint源码阅读八（使用示例：多租户用户管理四——示例操作步骤）][midpoint] 介绍了如何使用该示例的配置文件将环境搭建好，本篇将通过分析其配置文件，说明系统中的组织、用户是如何关联创建的。

# 1、组织结构 #

官网对组织结构（Organizational Structure）的介绍地址：[https://wiki.evolveum.com/display/midPoint/Organizational+Structure][https_wiki.evolveum.com_display_midPoint_Organizational_Structure]

<objects xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3">
    <org xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3" xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3" oid="0271f2da-f77b-4a27-9a80-832f7f2f99e4" version="0">
       
       <name>CUSTOMERS</name>
       <activation>
          <effectiveStatus>enabled</effectiveStatus>
          <enableTimestamp>2016-02-05T10:22:40.341+01:00</enableTimestamp>
       </activation>
       
       <displayName>Customers</displayName>
       
      <identifier>0001</identifier>
      
      <orgType>functional</orgType>
    </org>
    </objects>

# 2、数据字典 #

定义了员工类型

<lookupTable oid="5783c174-d141-11e4-bb29-001e8c717e5b" xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance' xmlns='http://midpoint.evolveum.com/xml/ns/public/common/common-3' xmlns:c='http://midpoint.evolveum.com/xml/ns/public/common/common-3' xmlns:t='http://prism.evolveum.com/xml/ns/public/types-3' xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3" xmlns:piracy='http://midpoint.evolveum.com/xml/ns/samples/piracy'>
        <name>Employee Type</name>
        <row>
            
            <key>customer-admin</key>
            
            <label>customer-admin</label>
        </row>
        <row>
            <key>customer-user</key>
            <label>customer-user</label>
        </row>
    </lookupTable>

# 3、资源配置文件 #

连接器的配置可以参看官网手册：[https://wiki.evolveum.com/display/midPoint/Resource+Configuration][https_wiki.evolveum.com_display_midPoint_Resource_Configuration]

## ①入站映射（inbound）（同步数据到midpoint） ##

我们来看看crm-simulation-sync.xml文件，学习midpoint中资源的配置  
该文件说明了如何将源中数据同步到midpoint中。

<c:resource oid="b2911718-cbe3-11e5-b1ea-3c970e44b9e2">
        
        <c:name>CRM Simulation</c:name>
        
        <connectorRef type="ConnectorType">
            <filter>
                <q:equal>
                    <q:path>c:connectorType</q:path>
                    <q:value>com.evolveum.polygon.csvfile.CSVFileConnector</q:value>
                </q:equal>
            </filter>
        </connectorRef>
        
        <c:connectorConfiguration>
            <icfc:configurationProperties xmlns:icfccsvfile="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/bundle/com.evolveum.polygon.connector-csvfile/com.evolveum.polygon.csvfile.CSVFileConnector">
                <icfccsvfile:filePath>C://ProjectIntelljIdea//midpoint//samples//stories//multitenant-idm-saas//misc//midpoint-crm-flatfile.csv</icfccsvfile:filePath>
                <icfccsvfile:encoding>utf-8</icfccsvfile:encoding>
                <icfccsvfile:valueQualifier>"</icfccsvfile:valueQualifier>
                <icfccsvfile:fieldDelimiter>,</icfccsvfile:fieldDelimiter>
                <icfccsvfile:multivalueDelimiter>;</icfccsvfile:multivalueDelimiter>
                <icfccsvfile:usingMultivalue>false</icfccsvfile:usingMultivalue>
                <icfccsvfile:uniqueAttribute>name</icfccsvfile:uniqueAttribute>
            </icfc:configurationProperties>
        </c:connectorConfiguration>
    
        
        <schemaHandling>
            
            <objectType>
                <displayName>Default Account</displayName>
                <default>true</default>
                
                <objectClass>ri:AccountObjectClass</objectClass>
                <attribute>
                    <ref>icfs:uid</ref>
                    <displayName>Entry UUID</displayName>
                    
                    <limitations>
                        <access>
                            <read>true</read>
                        </access>
                    </limitations>
                </attribute>
                <attribute>
                    <ref>icfs:name</ref>
                    <displayName>Name</displayName>
                    <limitations>
                        <minOccurs>0</minOccurs>
                        <access>
                            <read>true</read>
                            <add>false</add>
                            <modify>false</modify>
                        </access>
                    </limitations>
                    
                    <inbound>
                        <target>
                            <path>$user/name</path>
                        </target>
                    </inbound>
                    
                    <inbound>
                        <expression>
                            <value>customer-admin</value>
                        </expression>
                        <target>
                            <path>$user/employeeType</path>
                        </target>
                    </inbound>
                </attribute>
                ........
                <attribute>
                    <ref>ri:customerName</ref>
                    <displayName>Customer Name (Organization)</displayName>
                    <description>Definition of customerName attribute handling.</description>
                    <limitations>
                        <access>
                            <read>true</read>
                            <add>false</add>
                            <modify>false</modify>
                        </access>
                    </limitations>
                    <inbound>
                        <target>
                            <path>$user/organizationalUnit</path>
                        </target>
                    </inbound>
                </attribute>
                <attribute>
                    <ref>ri:customerDisplayName</ref>
                    <displayName>Customer Display Name (Organization)</displayName>
                    <description>Definition of customerDisplayName attribute handling.</description>
                    <limitations>
                        <access>
                            <read>true</read>
                            <add>false</add>
                            <modify>false</modify>
                        </access>
                    </limitations>
                    <inbound>
                        <target>
                            <path>$user/organization</path>
                        </target>
                    </inbound>
                </attribute>
                <attribute>
                    <ref>ri:customerContact</ref>
                    <displayName>Customer Contact (Email)</displayName>
                    <description>Definition of customerContact attribute handling.</description>
                    <limitations>
                        <access>
                            <read>true</read>
                            <add>false</add>
                            <modify>false</modify>
                        </access>
                    </limitations>
                    <inbound>
                        <target>
                            <path>$user/emailAddress</path>
                        </target>
                    </inbound>
                </attribute>
    
                <activation>
                    <administrativeStatus>
                        <inbound/>
                    </administrativeStatus>
                </activation>
                
                <credentials>
                    <password>
                        <inbound>
                            <strength>weak</strength>
                            <expression>
                                <generate/>
                            </expression>
                        </inbound>
                    </password>
                </credentials>
            </objectType>
        </schemaHandling>
        
        <capabilities xmlns:cap="http://midpoint.evolveum.com/xml/ns/public/resource/capabilities-3">
            <configured>
                <cap:activation>
                    <cap:status>
                        <cap:attribute>ri:disabled</cap:attribute>
                        <cap:enableValue>false</cap:enableValue>
                        <cap:disableValue>true</cap:disableValue>
                    </cap:status>
                </cap:activation>
                <cap:delete>
                    <cap:enabled>false</cap:enabled>
                </cap:delete>
            </configured>
        </capabilities>
        <synchronization>
            <objectSynchronization>
                <enabled>true</enabled>
    
                <correlation>
                    <q:description>
                        Correlation expression is a search query.
                        Following search query will look for users that have "name"
                        equal to the "name" attribute of the account. Simply speaking,
                        it will look for match in usernames in the IDM and the resource.
                        The correlation rule always looks for users, so it will not match
                        any other object type.
                    </q:description>
                    <q:equal>
                        <q:path>c:name</q:path>
                        <expression>
                            <path>
                                declare namespace icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3";
                                $account/attributes/icfs:name
                            </path>
                        </expression>
                    </q:equal>
                </correlation>
                <reaction>
                    <situation>linked</situation>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#modifyUser</handlerUri>
                    </action>
                </reaction>
                <reaction>
                    <situation>deleted</situation>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlinkAccount</handlerUri>
                    </action>
                </reaction>
                <reaction>
                    <situation>unlinked</situation>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#linkAccount</handlerUri>
                    </action>
                </reaction>
                <reaction>
                    <situation>unmatched</situation>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#addUser</handlerUri>
                    </action>
                </reaction>
            </objectSynchronization>
        </synchronization>
    </c:resource>

该资源定义，官网给出的整体图如下：  
![整体][70]

## ②出站映射（outbound）（从midpoint同步数据到数据源） ##

下面来看看openldap-customers.xml文件，该文件说明的是 如何把midpoint中的数据创建到openldap中

<resource oid="40be7fa0-cbec-11e5-926a-3c970e44b9e2">
        
        <name>OpenLDAP for Customers</name>
        <description>
            LDAP resource using a ConnId LDAP connector. It contains configuration
            for use with OpenLDAP servers.
        </description>
        <connectorRef type="ConnectorType">
            <description>
                Reference to the OpenICF LDAP connector. This is dynamic reference, it will be translated to
                OID during import.
            </description>
            <filter>
                <q:equal>
            <q:path>c:connectorType</q:path>
            <q:value>com.evolveum.polygon.connector.ldap.LdapConnector</q:value>
                </q:equal>
            </filter>
        </connectorRef>
       <connectorConfiguration xmlns:icfc="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/connector-schema-3" xmlns:icfcldap="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/bundle/com.evolveum.polygon.connector-ldap/com.evolveum.polygon.connector.ldap.LdapConnector">
            <icfc:configurationProperties>
                <icfcldap:port>389</icfcldap:port>
                <icfcldap:host>xap.com</icfcldap:host>
                <icfcldap:baseContext>ou=customers,dc=example,dc=com</icfcldap:baseContext>
                <icfcldap:bindDn>cn=admin,dc=example,dc=com</icfcldap:bindDn>
                <icfcldap:bindPassword><t:clearValue>zhl</t:clearValue></icfcldap:bindPassword>
                <icfcldap:pagingStrategy>auto</icfcldap:pagingStrategy>
                <icfcldap:passwordHashAlgorithm>SSHA</icfcldap:passwordHashAlgorithm>
                <icfcldap:vlvSortAttribute>uid</icfcldap:vlvSortAttribute>
                <icfcldap:vlvSortOrderingRule>2.5.13.3</icfcldap:vlvSortOrderingRule>
                <icfcldap:operationalAttributes>memberOf</icfcldap:operationalAttributes>
                <icfcldap:operationalAttributes>createTimestamp</icfcldap:operationalAttributes>
            </icfc:configurationProperties>
            <icfc:resultsHandlerConfiguration>
                <icfc:enableNormalizingResultsHandler>false</icfc:enableNormalizingResultsHandler>
                <icfc:enableFilteredResultsHandler>false</icfc:enableFilteredResultsHandler>
                <icfc:enableAttributesToGetSearchResultsHandler>false</icfc:enableAttributesToGetSearchResultsHandler>
            </icfc:resultsHandlerConfiguration>
        </connectorConfiguration>
      <schema>
        
          <generationConstraints>
              <generateObjectClass>ri:inetOrgPerson</generateObjectClass>
              <generateObjectClass>ri:groupOfUniqueNames</generateObjectClass>
              <generateObjectClass>ri:groupOfNames</generateObjectClass>
              <generateObjectClass>ri:organizationalUnit</generateObjectClass>
          </generationConstraints>
      </schema>
        <schemaHandling>
            
            <objectType>
                <kind>account</kind>
                <displayName>Normal Account</displayName>
                <default>true</default>
                
                <objectClass>ri:inetOrgPerson</objectClass>
                <attribute>
                    <ref>ri:dn</ref>
                    <displayName>Distinguished Name</displayName>
                    <limitations>
                        <minOccurs>0</minOccurs>
                        <access>
                            <read>true</read>
                            <add>true</add>
                            <modify>true</modify>
                        </access>
                    </limitations>
                    <matchingRule>mr:stringIgnoreCase</matchingRule>
                    
                    <outbound>
                        <source>
                            <path>$user/name</path>
                        </source>
                        <source>
                            <path>$user/organizationalUnit</path>
                        </source>
                        <expression>
                            <script> <code> 'uid=' + name + ',ou=' + organizationalUnit + ',ou=customers,dc=example,dc=com' </code> </script>
                        </expression>
                    </outbound>
                </attribute>
                <attribute>
                    <ref>ri:entryUUID</ref>
                    <displayName>Entry UUID</displayName>
                    <limitations>
                        <access>
                            <read>true</read>
                            <add>false</add>
                            <modify>true</modify>
                        </access>
                    </limitations>
                    <matchingRule>mr:stringIgnoreCase</matchingRule>
                </attribute>
                <attribute>
                    <ref>ri:cn</ref>
                    <displayName>Common Name</displayName>
                    <limitations>
                        <minOccurs>0</minOccurs>
                        <access>
                            <read>true</read>
                            <add>true</add>
                            <modify>true</modify>
                        </access>
                    </limitations>
                    <outbound>
                        <source>
                            <path>$user/fullName</path>
                        </source>
                    </outbound>
                </attribute>
                <attribute>
                    <ref>ri:sn</ref>
                    <displayName>Surname</displayName>
                    <limitations>
                        <minOccurs>0</minOccurs>
                    </limitations>
                    <outbound>
                        <source>
                            
                            <path>familyName</path>
                        </source>
                    </outbound>
                </attribute>
                <attribute>
                    <ref>ri:givenName</ref>
                <displayName>Given Name</displayName>
                <outbound>
                    <source>
                        
                        <path>$c:user/c:givenName</path>
                    </source>
                </outbound>
            </attribute>
            <attribute>
                <ref>ri:uid</ref>
                <displayName>Login Name</displayName>
                <matchingRule>mr:stringIgnoreCase</matchingRule>
                <outbound>
                    <strength>weak</strength>
                    <source>
                        <description>Source may have description</description>
                        <path>$user/name</path>
                    </source>
                    <expression>
                        <script> <code>name</code> </script>
                    </expression>
                </outbound>
            </attribute>
            <attribute>
                <ref>ri:description</ref>
                <outbound>
                    <source>
                        <path>$user/description</path>
                    </source>
                </outbound>
            </attribute>
            <attribute>
                <ref>ri:l</ref>
                <displayName>Location</displayName>
                <outbound>
                    <source>
                        <path>$user/locality</path>
                    </source>
                </outbound>
            </attribute>
            <attribute>
                <ref>ri:employeeType</ref>
                <displayName>Employee Type</displayName>
                <tolerant>false</tolerant>
                <outbound>
                    <source>
                        <path>$user/employeeType</path>
                    </source>
                </outbound>
            </attribute>
    
            <association>
                <ref>ri:group</ref>
                <displayName>LDAP Group Membership</displayName>
                <kind>entitlement</kind>
                <intent>ldapGroup</intent>
                <intent>group-org-admin</intent>
                <intent>group-org-user</intent>
                <intent>group-org-poweruser</intent>
                <intent>group-custom</intent>
                <direction>objectToSubject</direction>
                <associationAttribute>ri:member</associationAttribute>
                <valueAttribute>ri:dn</valueAttribute>
                <explicitReferentialIntegrity>true</explicitReferentialIntegrity>
            </association>
    
            <iteration>
                <maxIterations>5</maxIterations>
            </iteration>
    
            <protected>
            <filter>
                <q:equal>
                    <q:matching>http://prism.evolveum.com/xml/ns/public/matching-rule-3#stringIgnoreCase</q:matching>
                    <q:path>attributes/ri:dn</q:path>
                    <q:value>cn=idm,ou=Administrators,dc=example,dc=com</q:value>
                </q:equal>
            </filter>
            </protected>
    
            <activation>
        <administrativeStatus>
            <outbound/>
        </administrativeStatus>
        </activation>
    
        <credentials>
        <password>
            <outbound>
            <expression>
                <asIs/>
            </expression>
            </outbound>
        </password>
        </credentials>
    
        </objectType>
            
            <objectType>
                <kind>generic</kind>
                <intent>ou-customer</intent>
                <displayName>Customer Organizational Unit</displayName>
                <default>true</default>
                
                <objectClass>ri:organizationalUnit</objectClass>
                <attribute>
                    <ref>ri:dn</ref>
                    <matchingRule>mr:stringIgnoreCase</matchingRule>
                    <outbound>
                        
                        <source>
                            <path>$focus/name</path>
                        </source>
                            <expression>
                                <script> <code> return 'ou=' + name + ',ou=customers,dc=example,dc=com' </code> </script>
                            </expression>
                    </outbound>
                </attribute>
                <attribute>
                    <ref>ri:ou</ref>
                    <matchingRule>mr:stringIgnoreCase</matchingRule>
                    <outbound>
                        <strength>weak</strength>
                        <source>
                            <path>$focus/name</path>
                        </source>
                    </outbound>
                </attribute>
                <attribute>
                    <ref>ri:description</ref>
                    <outbound>
                        <source>
                            <path>description</path>
                        </source>
                    </outbound>
                </attribute>
            </objectType>
            
            <objectType>
                <kind>entitlement</kind>
                <intent>ldapGroup</intent>
                <displayName>LDAP Group</displayName>   
                <default>true</default>
                
                <objectClass>ri:groupOfNames</objectClass>
                <attribute>
                    <ref>ri:member</ref>
                    <matchingRule>mr:distinguishedName</matchingRule>
                    <fetchStrategy>minimal</fetchStrategy>
                </attribute>            
                <configuredCapabilities>
                    <cap:pagedSearch>
                        <cap:defaultSortField>ri:uid</cap:defaultSortField>
                    </cap:pagedSearch>
                </configuredCapabilities>
            </objectType>
            
            <objectType>
                <kind>entitlement</kind>
                <intent>group-org-poweruser</intent>
                <displayName>LDAP Group - Power Users</displayName>
                <objectClass>ri:groupOfNames</objectClass>
                <attribute>
                    <ref>ri:dn</ref>
                    <matchingRule>mr:stringIgnoreCase</matchingRule>
                    <outbound>
                        
                        <source>
                            <path>$focus/name</path>
                        </source>
                            <expression>
                                <script> <code> return 'cn=' + name + '-powerusers,ou=' + name + ',ou=customers,dc=example,dc=com' </code> </script>
                            </expression>
                    </outbound>
                </attribute>
                <attribute>
                    <ref>ri:member</ref>
                    <matchingRule>mr:distinguishedName</matchingRule>
                    <fetchStrategy>minimal</fetchStrategy>
                    <outbound>
                        <strength>strong</strength>
                        
                        <expression>
                            <value>cn=dummy,o=whatever</value>
                        </expression>
                    </outbound>
                </attribute>            
                <attribute>
                    <ref>ri:cn</ref>
                    <matchingRule>mr:stringIgnoreCase</matchingRule>
                    <outbound>
                        <strength>weak</strength>
                        <source>
                            <path>$focus/name</path>
                        </source>
                        <expression>
                            <script> <code>return name + '-powerusers'</code> </script>
                        </expression>
                    </outbound>
                </attribute>
                <attribute>
                    <ref>ri:description</ref>
                    <outbound>
                        <source>
                            <path>description</path>
                        </source>
                    </outbound>
                </attribute>
                <dependency>
                    <kind>generic</kind>
                    <intent>ou-customer</intent>
                    <strictness>relaxed</strictness>
                </dependency>
                <configuredCapabilities>
                    <cap:pagedSearch>
                        <cap:defaultSortField>ri:uid</cap:defaultSortField>
                    </cap:pagedSearch>
                </configuredCapabilities>
            </objectType>
            
            <objectType>
                <kind>entitlement</kind>
                <intent>group-org-user</intent>
                <displayName>LDAP Group - Users</displayName>
                <objectClass>ri:groupOfNames</objectClass>
    
                <attribute>
                    <ref>ri:dn</ref>
                    <matchingRule>mr:stringIgnoreCase</matchingRule>
                    <outbound>
                        
                        <source>
                            <path>$focus/name</path>
                        </source>
                            <expression>
                                <script> <code> return 'cn=' + name + '-users,ou=' + name + ',ou=customers,dc=example,dc=com' </code> </script>
                            </expression>
                    </outbound>
                </attribute>
                <attribute>
                    <ref>ri:member</ref>
                    <matchingRule>mr:distinguishedName</matchingRule>
                    <fetchStrategy>minimal</fetchStrategy>
                    <outbound>
                        <strength>strong</strength>
                        
                        <expression>
                            <value>cn=dummy,o=whatever</value>
                        </expression>
                    </outbound>
                </attribute>            
                <attribute>
                    <ref>ri:cn</ref>
                    <matchingRule>mr:stringIgnoreCase</matchingRule>
                    <outbound>
                        <strength>weak</strength>
                        <source>
                            <path>$focus/name</path>
                        </source>
                        <expression>
                            <script> <code>return name + '-users'</code> </script>
                        </expression>
                    </outbound>
                </attribute>
                <attribute>
                    <ref>ri:description</ref>
                    <outbound>
                        <source>
                            <path>description</path>
                        </source>
                    </outbound>
                </attribute>
                <dependency>
                    <kind>generic</kind>
                    <intent>ou-customer</intent>
                    <strictness>relaxed</strictness>
                </dependency>
                <configuredCapabilities>
                    <cap:pagedSearch>
                        <cap:defaultSortField>ri:uid</cap:defaultSortField>
                    </cap:pagedSearch>
                </configuredCapabilities>
            </objectType>
            
            <objectType>
                <kind>entitlement</kind>
                <intent>group-org-admin</intent>
                <displayName>LDAP Group - Admin</displayName>
                <objectClass>ri:groupOfNames</objectClass>
    
                <attribute>
                    <ref>ri:dn</ref>
                    <matchingRule>mr:stringIgnoreCase</matchingRule>
                    <outbound>
                        
                        <source>
                            <path>$focus/name</path>
                        </source>
                            <expression>
                                <script> <code> return 'cn=' + name + '-admins,ou=' + name + ',ou=customers,dc=example,dc=com' </code> </script>
                            </expression>
                    </outbound>
                </attribute>
                <attribute>
                    <ref>ri:member</ref>
                    <matchingRule>mr:distinguishedName</matchingRule>
                    <fetchStrategy>minimal</fetchStrategy>
                    <outbound>
                        <strength>strong</strength>
                        
                        <expression>
                            <value>cn=dummy,o=whatever</value>
                        </expression>
                    </outbound>
                </attribute>            
                <attribute>
                    <ref>ri:cn</ref>
                    <matchingRule>mr:stringIgnoreCase</matchingRule>
                    <outbound>
                        <strength>weak</strength>
                        <source>
                            <path>$focus/name</path>
                        </source>
                        <expression>
                            <script> <code>return name + '-admins'</code> </script>
                        </expression>
                    </outbound>
                </attribute>
                <attribute>
                    <ref>ri:description</ref>
                    <outbound>
                        <source>
                            <path>description</path>
                        </source>
                    </outbound>
                </attribute>
                <dependency>
                    <kind>generic</kind>
                    <intent>ou-customer</intent>
                    <strictness>relaxed</strictness>
                </dependency>
                <configuredCapabilities>
                    <cap:pagedSearch>
                        <cap:defaultSortField>ri:uid</cap:defaultSortField>
                    </cap:pagedSearch>
                </configuredCapabilities>
            </objectType>
        </schemaHandling>
    
        <consistency>
            <avoidDuplicateValues>true</avoidDuplicateValues>
        </consistency>
    
        
        <synchronization>
            <objectSynchronization>
                <enabled>true</enabled>
                <correlation>
                    <q:description>
                        Correlation expression is a search query.
                        Following search query will look for users that have "name"
                        equal to the "uid" attribute of the account. Simply speaking,
                        it will look for match in usernames in the IDM and the resource.
                        The correlation rule always looks for users, so it will not match
                        any other object type.
                    </q:description>
                    <q:equal>
                        <q:path>name</q:path>
                        <expression>
                            <path>
                                declare namespace ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3";
                                $account/attributes/ri:uid
                            </path>
                        </expression>
                    </q:equal>
                </correlation>
                <reaction>
                    <situation>linked</situation>
                    <synchronize>true</synchronize>
                </reaction>
                <reaction>
                    <situation>deleted</situation>
                    <synchronize>true</synchronize>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlink</handlerUri>
                    </action>
                </reaction>
                <reaction>
                    <situation>unlinked</situation>
                    <synchronize>true</synchronize>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#link</handlerUri>
                    </action>
                </reaction>
                <reaction>
                    <situation>unmatched</situation>
                </reaction>
            </objectSynchronization>
            <objectSynchronization>
                <objectClass>ri:organizationalUnit</objectClass>
                <kind>generic</kind>
                <intent>ou-customer</intent>
                <focusType>c:OrgType</focusType>
                <enabled>true</enabled>
                <condition>
                    <script> <code> import static com.evolveum.midpoint.schema.constants.SchemaConstants.* tmpSuffix = '(?i)^ou=.*,ou=customers,dc=example,dc=com$' re = ~tmpSuffix basic.getAttributeValue(shadow, 'http://midpoint.evolveum.com/xml/ns/public/resource/instance-3', 'dn') ==~ re </code> </script>
                </condition>
                <correlation>
                    <q:equal>
                        <q:matching>polyStringNorm</q:matching>
                        <q:path>c:name</q:path>
                        <expression>
                            <path>
                                declare namespace ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3";
                                $shadow/attributes/ri:ou
                            </path>
                        </expression>
                    </q:equal>
                </correlation>
                <reaction>
                    <situation>linked</situation>
                    <synchronize>true</synchronize>
                </reaction>
                <reaction>
                    <situation>deleted</situation>
                    <synchronize>true</synchronize>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlink</handlerUri>
                    </action>
                </reaction>
                <reaction>
                    <situation>unlinked</situation>
                    <synchronize>true</synchronize>
                    <action>
                      <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#link</handlerUri>
                    </action>
                </reaction>
                <reaction>
                    <situation>unmatched</situation>
                </reaction>
            </objectSynchronization>
            .......
            <objectSynchronization>
                    <objectClass>ri:groupOfNames</objectClass>
                    <kind>entitlement</kind>
                    <intent>group-org-admin</intent>
                    <focusType>c:OrgType</focusType>
                <enabled>true</enabled>
    
                    <condition>
                        <script> <code> import static com.evolveum.midpoint.schema.constants.SchemaConstants.* tmpSuffix = '(?i)^cn=.*-admins,ou=.*,ou=customers,dc=example,dc=com$' re = ~tmpSuffix basic.getAttributeValue(shadow, 'http://midpoint.evolveum.com/xml/ns/public/resource/instance-3', 'dn') ==~ re </code> </script>
                </condition>
                <correlation>
                    <q:equal>
                        <q:matching>polyStringNorm</q:matching>
                        <q:path>c:name</q:path>
                        <expression>
                            <script> <code> tmpCn = basic.getAttributeValue(shadow, 'http://midpoint.evolveum.com/xml/ns/public/resource/instance-3', 'cn') re = /(?i)^(.*)-admins$/ matcher = (tmpCn =~ re) if (matcher.matches()) return matcher[0][1] </code> </script>
                        </expression>
                    </q:equal>
                </correlation>
                <reaction>
                    <situation>linked</situation>
                    <synchronize>true</synchronize>
                </reaction>
                <reaction>
                    <situation>deleted</situation>
                    <synchronize>true</synchronize>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlink</handlerUri>
                    </action>
                </reaction>
    
                <reaction>
                    <situation>unlinked</situation>
                    <synchronize>true</synchronize>
                    <action>
                      <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#link</handlerUri>
                    </action>
                </reaction>
                <reaction>
                    <situation>unmatched</situation>
                </reaction>
            </objectSynchronization>
        </synchronization>
    </resource>

# 4、对象模板 #

对象模板在midpoint用于 创建该模板的对象时，自动处理好该对象的附加属性

## ① 用户对象模板 ##

下面是用户对象模板object-user-template.xml配置文件的解读，该示例代码在创建用户的时候，会根据该模板将用户的fullName补齐、（若该用户组织还未创建，则创建该组织）、同时根据employType的属性给该用户赋予对应的角色。

<objectTemplate oid="e63e1118-cbe5-11e5-b08e-3c970e44b9e2" xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance' xmlns='http://midpoint.evolveum.com/xml/ns/public/common/common-3' xmlns:c='http://midpoint.evolveum.com/xml/ns/public/common/common-3' xmlns:t='http://prism.evolveum.com/xml/ns/public/types-3' xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3" xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3">
        <name>User Template</name>
        <item>
            <ref>employeeType</ref>
            <valueEnumerationRef oid="5783c174-d141-11e4-bb29-001e8c717e5b"/>
        </item>
        
        <item>
            <ref>organization</ref>
        </item>
        
        <item>
            <ref>organizationalUnit</ref>
        </item>
        
        <mapping>
            <name>Fullname</name>
            <authoritative>true</authoritative>
            <strength>strong</strength>
            <source>
                <path>givenName</path>
            </source>
            <source>
                <path>familyName</path>
            </source>
            <expression>
                <script> <code>basic.concatName(givenName, familyName)</code> </script>
            </expression>
            <target>
                <path>fullName</path>
            </target>
        </mapping>
        
        <mapping>
            <name>Org mapping - organization member</name>
            <description>
                Look for appropriate Org objects by using the user's organizationalUnit property
                as the name of the org object. When no such object is found we want to create it on
                demand. We want to populate new Org object with a name and displayName derived from
                the user.
            </description>
            <authoritative>true</authoritative>
            <strength>strong</strength>
            <source>
                <path>organization</path>
            </source>
            <source>
                <path>organizationalUnit</path>
            </source>
            <expression>
                
                <assignmentTargetSearch>
                    
                    <targetType>c:OrgType</targetType>
                    <filter>
                        <q:equal>
                            <q:path>c:name</q:path>
                            <expression>
                                <script> <code> log.info("XXXXXX USER TEMPLATE assignmentTargetSearch, organizationalUnit {}", organizationalUnit); return organizationalUnit </code> </script>
                            </expression>
                        </q:equal>
                    </filter>
                    <createOnDemand>true</createOnDemand>
                    <populateObject>
                        <populateItem>
                            <expression>
                                <script> <code> log.info("XXXXXX USER TEMPLATE populate item organizationalUnit {}", organizationalUnit); return organizationalUnit </code> </script>
                            </expression>
                            <target>
                                <path>name</path>
                            </target>
                        </populateItem>
                        <populateItem>
                            <expression>
                                <script> <code> log.info("XXXXXX USER TEMPLATE populate item organization {}", organization); return organization </code> </script>
                            </expression>
                            <target>
                                <path>displayName</path>
                            </target>
                        </populateItem>
                        <populateItem>
                            <expression>
                                <value>customer</value>
                            </expression>
                            
                            <target>
                                <path>orgType</path>
                            </target>
                        </populateItem>
                    </populateObject>
                </assignmentTargetSearch>       
            </expression>
            <target>
                <path>assignment</path>
            </target>
        </mapping>
    
        <mapping>
            <name>Org mapping - organization manager</name>
            <description>
                Look for appropriate Org objects by using the user's organizationalUnit property
                as the name of the org object. When no such object is found we want to create it on
                demand. We want to populate new Org object with a name and displayName derived from
                the user.
            </description>
            <authoritative>true</authoritative>
            <strength>strong</strength>
            <source>
                <path>organization</path>
            </source>
            <source>
                <path>organizationalUnit</path>
            </source>
            <source>
                <path>employeeType</path>
            </source>
            <expression>
                <assignmentTargetSearch>
                    <targetType>c:OrgType</targetType>
                    <filter>
                    <q:equal>
                        <q:path>c:name</q:path>
                        <expression>
                            <script> <code> log.info("XXXXXX USER TEMPLATE assignmentTargetSearch, organizationalUnit {}", organizationalUnit); return organizationalUnit </code> </script>
                        </expression>
                    </q:equal>
                </filter>
                <relation>org:manager</relation>
                </assignmentTargetSearch>       
            </expression>
            <target>
                <path>assignment</path>
            </target>
            <condition>
                <script> <code>employeeType == 'customer-admin'</code> </script>
            </condition>
        </mapping>
        
        <mapping>
            <name>Basic Customer Admin role assignment</name>
            <strength>strong</strength>
            <source>
                <path>$user/employeeType</path>
            </source>
            <expression>
                <assignmentTargetSearch>
                    <targetType>c:RoleType</targetType>
                    <oid>3410a44a-cc00-11e5-bc03-3c970e44b9e2</oid>
                </assignmentTargetSearch>       
            </expression>
            <target>
                <path>assignment</path>
            </target>
        <condition>
            <script> <code>employeeType == 'customer-admin'</code> </script>
        </condition>
        </mapping>
        ..........
    </objectTemplate>

## ②组织对象模板 ##

组织对象模板object-template-org.xml相对来说比较简单，仅仅用于创建组织的时候给该组织赋予相应的角色，在此就不展示了。

# 5、组织——数据源角色 #

在metarole-org.xml中通过间接分配，给组织分配了 在数据源中 对应的角色

<role oid="bb1adfda-cbee-11e5-a445-3c970e44b9e2" xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3" xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3">
       <name>Functional Orgstruct Metarole</name>
       <inducement>
            <construction>
                    
                    <resourceRef oid="40be7fa0-cbec-11e5-926a-3c970e44b9e2" type="c:ResourceType"/>
                    
                    <kind>generic</kind>
                    <intent>ou-customer</intent>
            </construction>
            <condition>
                <source>
                    <path>$immediateRole/orgType</path>
                </source>
                    <expression>
                        <script> <code>orgType == 'customer'</code> </script>
                    </expression>
            </condition>
       </inducement>
       <inducement>
            <construction>
                    
                    <resourceRef oid="40be7fa0-cbec-11e5-926a-3c970e44b9e2" type="c:ResourceType"/>
                    
                    <kind>entitlement</kind>
                    <intent>group-org-admin</intent>
            </construction>
            <condition>
                <source>
                    <path>$immediateRole/orgType</path>
                </source>
                    <expression>
                        <script> <code>orgType == 'customer'</code> </script>
                    </expression>
            </condition>
        </inducement>
        ..........
       <inducement>
           <focusMappings>
               <mapping>
                   <name>Set organizationalUnit from organization name</name>
                   <strength>weak</strength>
                   <source>
                       <path>$immediateRole/name</path>
                   </source>
                   <target>
                       <path>$user/organizationalUnit</path>
                   </target>
               </mapping>
           </focusMappings>
           <order>2</order>
           <focusType>c:UserType</focusType>
        </inducement>
    </role>

# 6、角色权限配置 #

该类配置文件就不详细介绍了，直接参看示例配置就行。

<role oid="c546fe38-def1-11e5-85bb-3c970e44b9e2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3" xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3" xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3">
        <name>Delegated Administration Role</name>
        <description>Role to delegate administration to customer admins.</description>
        
        <authorization>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#users</action> 
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#user</action> 
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#userDetails</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#findUsers</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#orgStruct</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#orgTree</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#orgUnit</action>
        </authorization>
        <authorization>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <object>
                <special>self</special>
            </object>
        </authorization>
        <authorization>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <object>
                <type>ShadowType</type>
                <owner>
                    <special>self</special>
                </owner>
            </object>
        </authorization>
        <authorization>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#changeCredentials</action>
            <phase>request</phase>
            <object>
                <special>self</special>
            </object>
            <item>credentials</item>
        </authorization>
        <authorization>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
            <phase>execution</phase>
            <object>
                <special>self</special>
            </object>
            <item>credentials</item>
        </authorization>
    
        <authorization>
        <name>Read for all password policies, all resources and roles of roleType=customer and End User</name>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <object>
                <type>ValuePolicyType</type>
            </object>
            <object>
                <type>ResourceType</type>
            </object>
            <object>
                <type>RoleType</type>
                <filter>
                     <q:or>
                        <q:equal>
                                <q:path>roleType</q:path>
                                <q:value>customer</q:value>
                        </q:equal>
                        <q:equal>
                                <q:path>name</q:path>
                                <q:value>End user</q:value>
                        </q:equal>
                        <q:equal>
                                <q:path>name</q:path>
                                <q:value>Delegated Administration Role</q:value>
                        </q:equal>
                   </q:or>
                </filter>
            </object>
        </authorization>
        
        <authorization>
        <name>Read for lookuptable</name>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <object>
                <type>LookupTableType</type>
            </object>
        </authorization>
        
        <authorization>
        <name>Magic read/modify</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
            <object>
                <orgRelation>
                    <subjectRelation>org:manager</subjectRelation>
                    <scope>allDescendants</scope>
                    <includeReferenceOrg>true</includeReferenceOrg>
                </orgRelation>
            </object>
        </authorization>
        
        <authorization>
        <name>Modify some user attributes</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
            <object>
                <type>UserType</type>
                <orgRelation>
                    <subjectRelation>org:manager</subjectRelation>
                </orgRelation>
            </object>
            <item>name</item>
            <item>description</item>
            <item>givenName</item>
            <item>familyName</item>
            <item>employeeType</item>
            <item>emailAddress</item>
            <item>activation</item>
            <item>credentials</item>
        </authorization>
        
        <authorization>
            <name>Authz: CRD UserType</name>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add</action>
    
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#delete</action>
            <object>
                <type>UserType</type>
                <orgRelation>
                    <subjectRelation>org:manager</subjectRelation>
                </orgRelation>
            </object>
        </authorization>
        
        <authorization>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#assign</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#unassign</action>
            <object>
                <type>UserType</type>
                <orgRelation>
                    <subjectRelation>org:manager</subjectRelation>
                </orgRelation>
            </object>
            <target>
                    <type>RoleType</type>
                    <filter>
                        <q:or>
                            <q:equal>
                                    <q:path>roleType</q:path>
                                    <q:value>customer</q:value>
                            </q:equal>
                            <q:equal>
                                    <q:path>name</q:path>
                                    <q:value>End user</q:value>
                            </q:equal>
                        </q:or>
                    </filter>
            </target>
        
        <authorization>
        <name>Read all entitlements and generic shadows</name>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <object>
                <type>ShadowType</type>
                <filter>
                    <q:or>
                        <q:equal>
                            <q:path>kind</q:path>
                            <q:value>entitlement</q:value>
                        </q:equal>
                        <q:equal>
                            <q:path>kind</q:path>
                            <q:value>generic</q:value>
                    </q:equal>
                    </q:or>
                </filter>
            </object>
        </authorization>
        <requestable>false</requestable>
    </role>

# 7、示例代码后台数据创建过程 #

1）导入租户管理员csv文件（midpoint-crm-flatfile.csv）  
2）根据该文件的用户记录，填充好fullName （object-template-user.xml）  
3）根据该文件的用户记录，查询用户所属的组织是否存在，不存在的话，根据“Org mapping - organization membe” mapping里的描述创建该组织（object-template-user.xml）  
4）创建组织时参照 组织模板文件 （object-template-org.xml）给创建的组织赋予父节点，根据metarole-org.xml文件 参照inducement段中的描述创建 projection  
5）根据metarole-org.xml)中的inducement同时参照openldap-customers.xml的outbound描述在openldap中创建该组织及该组织下的角色组(groupOfNames)和用户(inetOrgPerson)  
6）组织创建好后，在该用户的assignment中加入该组织  
7）根据用户的employType给用户赋予midpoint中的角色，该角色事先通过角色权限文件（role-customer-authz-admin.xml等）导入到系统中。  
8）至此用户创建完毕

[midpoint]: https://blog.csdn.net/fengshuiyue/article/details/80747671
[https_wiki.evolveum.com_display_midPoint_Organizational_Structure]: https://wiki.evolveum.com/display/midPoint/Organizational+Structure
[https_wiki.evolveum.com_display_midPoint_Resource_Configuration]: https://wiki.evolveum.com/display/midPoint/Resource+Configuration
[70]: /images/20220522/f4a0c0966f3e4de8a94005c14b3b505a.png