diff --git a/demo/complex2s/midpoint-objects/archetypes/archetype-affiliation.xml b/demo/complex2s/midpoint-objects/archetypes/archetype-affiliation.xml
new file mode 100644
index 0000000..0064575
--- /dev/null
+++ b/demo/complex2s/midpoint-objects/archetypes/archetype-affiliation.xml
@@ -0,0 +1,42 @@
+<archetype xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
+      xmlns:apti="http://midpoint.evolveum.com/xml/ns/public/common/api-types-3" 
+      xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
+      xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" 
+      xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3" 
+      xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
+      xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3" 
+      xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" 
+      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+      xmlns:ext="http://grouper-demo.tier.internet2.edu"
+      oid="56f53812-047d-4b69-83e8-519a73d161e1">
+    <name>affiliation</name>
+    <extension>
+        <ext:grouperNamePrefix>ref:affiliation:</ext:grouperNamePrefix>
+        <ext:ldapRootDn>ou=Affiliations,ou=Groups,dc=internet2,dc=edu</ext:ldapRootDn>
+        <ext:midPointNamePrefix>affiliation_</ext:midPointNamePrefix>
+        <ext:midPointDisplayNamePrefix>Affiliation: </ext:midPointDisplayNamePrefix>
+    </extension>
+    <assignment>
+        <targetRef oid="bcaec940-50c8-44bb-aa37-b2b5bb2d5b90" relation="org:default" type="c:RoleType" />     <!-- metarole-grouper-provided-group -->
+    </assignment>
+    <assignment>
+        <targetRef oid="8da46694-bd71-4e1e-bfd7-73865ae2ea9a" relation="org:default" type="c:RoleType" />     <!-- metarole-ldap-group -->
+    </assignment>
+    <inducement>
+        <targetRef oid="1d7c0e3a-4456-409c-9f50-95407b2eb785" relation="org:default" type="c:OrgType" />     <!-- affiliations -->
+    </inducement>
+    <!-- Group-type-specific data -->
+    <inducement>
+        <construction>
+            <resourceRef oid="e417225d-8a08-46f3-9b5d-624990b52386" relation="org:default" type="c:ResourceType" />     <!-- Faculty CSV -->
+        </construction>
+        <order>2</order>
+        <condition>
+            <expression>
+                <script>
+                    <code>assignmentPath[0].target.identifier == 'faculty'</code>
+                </script>
+            </expression>
+        </condition>
+    </inducement>
+</archetype>
diff --git a/demo/complex2s/midpoint-objects/archetypes/archetype-course.xml b/demo/complex2s/midpoint-objects/archetypes/archetype-course.xml
new file mode 100644
index 0000000..5a906e1
--- /dev/null
+++ b/demo/complex2s/midpoint-objects/archetypes/archetype-course.xml
@@ -0,0 +1,54 @@
+<archetype xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
+      xmlns:apti="http://midpoint.evolveum.com/xml/ns/public/common/api-types-3" 
+      xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
+      xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" 
+      xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3" 
+      xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
+      xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3" 
+      xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" 
+      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+      xmlns:ext="http://grouper-demo.tier.internet2.edu"
+      oid="3dab9a72-118b-4e40-a138-bb691c335eca">
+    <name>course</name>
+    <extension>
+        <ext:grouperNamePrefix>ref:course:</ext:grouperNamePrefix>
+        <ext:ldapRootDn>ou=Courses,ou=Groups,dc=internet2,dc=edu</ext:ldapRootDn>
+        <ext:midPointNamePrefix>course_</ext:midPointNamePrefix>
+        <ext:midPointDisplayNamePrefix>Course: </ext:midPointDisplayNamePrefix>
+    </extension>
+    <assignment>
+        <targetRef oid="bcaec940-50c8-44bb-aa37-b2b5bb2d5b90" relation="org:default" type="c:RoleType" />     <!-- metarole-grouper-provided-group -->
+    </assignment>
+    <assignment>
+        <targetRef oid="8da46694-bd71-4e1e-bfd7-73865ae2ea9a" relation="org:default" type="c:RoleType" />     <!-- metarole-ldap-group -->
+    </assignment>
+    <inducement>
+        <targetRef oid="225e9360-0639-40ba-8a31-7f31bef067be" relation="org:default" type="c:OrgType" />     <!-- courses -->
+    </inducement>
+    <!-- Group-type-specific data -->
+    <inducement>
+        <construction>
+            <strength>weak</strength>
+            <resourceRef oid="a343fc2e-3954-4034-ba1a-2b72c21e577a" relation="org:default" type="c:ResourceType" />     <!-- CS CSV -->
+            <attribute>
+                <c:ref>ri:courses</c:ref>
+                <outbound>
+                    <strength>strong</strength>
+                    <expression>
+                        <script>
+                            <code>assignmentPath[0].target.identifier</code>
+                        </script>
+                    </expression>
+                </outbound>
+            </attribute>
+        </construction>
+        <order>2</order>
+        <condition>
+            <expression>
+                <script>
+                    <code>assignmentPath[0].target.identifier?.startsWith('CS')</code>
+                </script>
+            </expression>
+        </condition>
+    </inducement>
+</archetype>
diff --git a/demo/complex2s/midpoint-objects/roles/metarole-department.xml b/demo/complex2s/midpoint-objects/archetypes/archetype-department.xml
similarity index 54%
rename from demo/complex2s/midpoint-objects/roles/metarole-department.xml
rename to demo/complex2s/midpoint-objects/archetypes/archetype-department.xml
index 4ebe378..c8cf8b4 100644
--- a/demo/complex2s/midpoint-objects/roles/metarole-department.xml
+++ b/demo/complex2s/midpoint-objects/archetypes/archetype-department.xml
@@ -1,4 +1,4 @@
-<role xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
+<archetype xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
       xmlns:apti="http://midpoint.evolveum.com/xml/ns/public/common/api-types-3" 
       xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
       xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" 
@@ -6,13 +6,24 @@
       xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
       xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3" 
       xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" 
-      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
-      oid="ffa9eaec-9539-4d15-97aa-24cd5b92ca5b">
-    <name>metarole-department</name>
-    <inducement id="1">
-        <targetRef oid="bee44c51-2469-411d-bac7-695728e9c241" type="c:OrgType"/>            <!-- departments -->
+      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+      xmlns:ext="http://grouper-demo.tier.internet2.edu"
+      oid="1cec5f78-8fba-459b-9547-ef7485009f40">
+    <name>department</name>
+    <extension>
+        <ext:grouperNamePrefix>ref:dept:</ext:grouperNamePrefix>
+        <ext:midPointNamePrefix>department_</ext:midPointNamePrefix>
+        <ext:midPointDisplayNamePrefix>Department: </ext:midPointDisplayNamePrefix>
+    </extension>
+    <assignment>
+        <targetRef oid="bcaec940-50c8-44bb-aa37-b2b5bb2d5b90" relation="org:default" type="c:RoleType" />     <!-- metarole-grouper-provided-group -->
+    </assignment>
+    <!--  No LDAP metarole here: we deal with LDAP ourselves -->
+    <inducement>
+        <targetRef oid="bee44c51-2469-411d-bac7-695728e9c241" relation="org:default" type="c:OrgType" />     <!-- departments -->
     </inducement>
-    <inducement id="2">
+    <!-- Group-type-specific data -->
+    <inducement>
         <construction>
             <resourceRef oid="0a37121f-d515-4a23-9b6d-554c5ef61272" relation="org:default" type="c:ResourceType" />     <!-- LDAP -->
             <attribute>
@@ -29,4 +40,4 @@
         </construction>
         <order>2</order>
     </inducement>
-</role>
+</archetype>
diff --git a/demo/complex2s/midpoint-objects/archetypes/archetype-generic-grouper-group.xml b/demo/complex2s/midpoint-objects/archetypes/archetype-generic-grouper-group.xml
new file mode 100644
index 0000000..08b09d6
--- /dev/null
+++ b/demo/complex2s/midpoint-objects/archetypes/archetype-generic-grouper-group.xml
@@ -0,0 +1,30 @@
+<archetype xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
+      xmlns:apti="http://midpoint.evolveum.com/xml/ns/public/common/api-types-3" 
+      xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
+      xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" 
+      xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3" 
+      xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
+      xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3" 
+      xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" 
+      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+      xmlns:ext="http://grouper-demo.tier.internet2.edu"
+      oid="5f2b96d2-49b5-4a8a-9601-14457309a69b">
+    <name>generic-grouper-group</name>
+    <extension>
+        <ext:grouperNamePrefix></ext:grouperNamePrefix>
+        <ext:ldapRootDn>ou=generic,ou=Groups,dc=internet2,dc=edu</ext:ldapRootDn>
+        <ext:midPointNamePrefix>generic_</ext:midPointNamePrefix>
+        <ext:midPointDisplayNamePrefix></ext:midPointDisplayNamePrefix>
+    </extension>
+    <assignment>
+        <targetRef oid="bcaec940-50c8-44bb-aa37-b2b5bb2d5b90" relation="org:default" type="c:RoleType" />     <!-- metarole-grouper-provided-group -->
+    </assignment>
+    <assignment>
+        <targetRef oid="8da46694-bd71-4e1e-bfd7-73865ae2ea9a" relation="org:default" type="c:RoleType" />     <!-- metarole-ldap-group -->
+    </assignment>
+    <inducement>
+        <targetRef oid="1f339075-5b2f-4a18-9c98-451f3eb0d28d" relation="org:default" type="c:OrgType" />     <!-- generic-groups -->
+    </inducement>
+    <!-- Group-type-specific data -->
+    <!--  nothing here by now -->
+</archetype>
diff --git a/demo/complex2s/midpoint-objects/archetypes/archetype-mailing-list.xml b/demo/complex2s/midpoint-objects/archetypes/archetype-mailing-list.xml
new file mode 100644
index 0000000..c5ed3a8
--- /dev/null
+++ b/demo/complex2s/midpoint-objects/archetypes/archetype-mailing-list.xml
@@ -0,0 +1,46 @@
+<archetype xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
+      xmlns:apti="http://midpoint.evolveum.com/xml/ns/public/common/api-types-3" 
+      xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
+      xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" 
+      xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3" 
+      xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
+      xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3" 
+      xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" 
+      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+      xmlns:ext="http://grouper-demo.tier.internet2.edu"
+      oid="1645d1dc-1f7c-4508-b50b-97b501ccdee3">
+    <name>mailing-list</name>
+    <extension>
+        <ext:grouperNamePrefix>app:mailinglist:</ext:grouperNamePrefix>
+        <ext:ldapRootDn>ou=generic,ou=Groups,dc=internet2,dc=edu</ext:ldapRootDn>       <!--  could be also something specific e.g. ou=lists,ou=Groups,dc=internet2,dc=edu -->
+        <ext:midPointNamePrefix>mailinglist_</ext:midPointNamePrefix>
+        <ext:midPointDisplayNamePrefix>Mailing list: </ext:midPointDisplayNamePrefix>
+    </extension>
+    <assignment>
+        <targetRef oid="bcaec940-50c8-44bb-aa37-b2b5bb2d5b90" relation="org:default" type="c:RoleType" />     <!-- metarole-grouper-provided-group -->
+    </assignment>
+    <assignment>
+        <targetRef oid="8da46694-bd71-4e1e-bfd7-73865ae2ea9a" relation="org:default" type="c:RoleType" />     <!-- metarole-ldap-group -->
+    </assignment>
+    <inducement>
+        <targetRef oid="d81fb46c-20c7-44d3-8402-fef404ea1264" relation="org:default" type="c:OrgType" />     <!-- generic-groups -->
+    </inducement>
+    <!-- Group-type-specific data -->
+    <inducement>
+        <construction>
+            <resourceRef oid="fe805d13-481b-43ec-97d8-9d2df72cd38e" relation="org:default" type="c:ResourceType" />     <!-- Mailing lists CSV -->
+            <attribute>
+                <c:ref>ri:lists</c:ref>
+                <outbound>
+                    <strength>strong</strength>
+                    <expression>
+                        <script>
+                            <code>assignmentPath[0].target.identifier</code>
+                        </script>
+                    </expression>
+                </outbound>
+            </attribute>
+        </construction>
+        <order>2</order>
+    </inducement>
+</archetype>
diff --git a/demo/complex2s/midpoint-objects/archetypes/archetype-midpoint-group.xml b/demo/complex2s/midpoint-objects/archetypes/archetype-midpoint-group.xml
new file mode 100644
index 0000000..eb94ab2
--- /dev/null
+++ b/demo/complex2s/midpoint-objects/archetypes/archetype-midpoint-group.xml
@@ -0,0 +1,22 @@
+<archetype xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
+      xmlns:apti="http://midpoint.evolveum.com/xml/ns/public/common/api-types-3" 
+      xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
+      xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" 
+      xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3" 
+      xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
+      xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3" 
+      xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" 
+      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+      xmlns:ext="http://grouper-demo.tier.internet2.edu"
+      oid="2be36917-71ad-4c3e-8789-89cadea2d5d6">
+    <name>midpoint-group</name>
+    <extension>
+        <ext:ldapRootDn>ou=midpoint,ou=Groups,dc=internet2,dc=edu</ext:ldapRootDn>
+    </extension>
+    <assignment>
+        <targetRef oid="8da46694-bd71-4e1e-bfd7-73865ae2ea9a" relation="org:default" type="c:RoleType" />     <!-- metarole-ldap-group -->
+    </assignment>
+    <inducement>
+        <targetRef oid="4790ab69-7ef0-41a4-8992-78877f3beb23" relation="org:default" type="c:OrgType" />     <!-- midpoint-groups -->
+    </inducement>
+</archetype>
diff --git a/demo/complex2s/midpoint-objects/objectTemplates/template-org-affiliation.xml b/demo/complex2s/midpoint-objects/objectTemplates/template-org-affiliation.xml
deleted file mode 100644
index 672f948..0000000
--- a/demo/complex2s/midpoint-objects/objectTemplates/template-org-affiliation.xml
+++ /dev/null
@@ -1,69 +0,0 @@
-<?xml version="1.0"?>
-<objectTemplate xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
-    oid="d87aa04f-189c-4d6f-b6e1-216dad622142">
-    <name>template-org-affiliation</name>
-    <mapping>
-        <name>metarole</name>
-        <strength>strong</strength>
-        <expression>
-            <assignmentTargetSearch>
-                <targetType>RoleType</targetType>
-                <oid>fecae27b-d1d3-40ae-95fa-8f7e44e2ee70</oid>     <!--  metarole-affiliation -->
-            </assignmentTargetSearch>
-        </expression>
-        <target>
-            <path>assignment</path>
-        </target>
-    </mapping>
-    <item>
-        <ref>identifier</ref>
-        <mapping>
-            <name>identifier</name>
-            <strength>strong</strength>
-            <source>
-                <path>extension/grouperName</path>
-            </source>
-            <expression>
-                <script>
-                    <code>
-                        grouperName?.substring(16)           // from ref:affiliation:xxx
-                    </code>
-                </script>
-            </expression>
-        </mapping>
-    </item>
-    <item>
-        <ref>name</ref>
-        <mapping>
-            <name>name</name>
-            <strength>strong</strength>
-            <source>
-                <path>identifier</path>
-            </source>
-            <expression>
-                <script>
-                    <code>
-                        'affiliation_' + identifier
-                    </code>
-                </script>
-            </expression>
-        </mapping>
-    </item>
-    <item>
-        <ref>displayName</ref>
-        <mapping>
-            <name>displayName</name>
-            <strength>strong</strength>
-            <source>
-                <path>identifier</path>
-            </source>
-            <expression>
-                <script>
-                    <code>
-                        'Affiliation: ' + identifier
-                    </code>
-                </script>
-            </expression>
-        </mapping>
-    </item>
-</objectTemplate>
diff --git a/demo/complex2s/midpoint-objects/objectTemplates/template-org-course.xml b/demo/complex2s/midpoint-objects/objectTemplates/template-org-course.xml
deleted file mode 100644
index bec4c40..0000000
--- a/demo/complex2s/midpoint-objects/objectTemplates/template-org-course.xml
+++ /dev/null
@@ -1,58 +0,0 @@
-<?xml version="1.0"?>
-<objectTemplate xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
-    oid="d35bdec6-643b-41d8-ad5d-8eeb701169d1">
-    <name>template-org-course</name>
-    <mapping>
-        <strength>strong</strength>
-        <expression>
-            <assignmentTargetSearch>
-                <targetType>RoleType</targetType>
-                <oid>8aa99e7b-f7d3-4585-9800-14bab4d26a43</oid>     <!--  metarole-course -->
-            </assignmentTargetSearch>
-        </expression>
-        <target>
-            <path>assignment</path>
-        </target>
-    </mapping>
-    <item>
-        <ref>identifier</ref>
-        <mapping>
-            <strength>strong</strength>
-            <source>
-                <path>extension/grouperName</path>
-            </source>
-            <expression>
-                <script>
-                    <code>
-                        grouperName?.substring(11)           // from ref:course:xxx
-                    </code>
-                </script>
-            </expression>
-        </mapping>
-    </item>
-    <item>
-        <ref>name</ref>
-        <mapping>
-            <strength>strong</strength>
-            <source>
-                <path>identifier</path>
-            </source>
-            <expression>
-                <script>
-                    <code>
-                        'course_' + identifier
-                    </code>
-                </script>
-            </expression>
-        </mapping>
-    </item>
-    <item>
-        <ref>displayName</ref>
-        <mapping>
-            <strength>strong</strength>
-            <source>
-                <path>identifier</path>
-            </source>
-        </mapping>
-    </item>
-</objectTemplate>
\ No newline at end of file
diff --git a/demo/complex2s/midpoint-objects/objectTemplates/template-org-department.xml b/demo/complex2s/midpoint-objects/objectTemplates/template-org-department.xml
deleted file mode 100644
index 6320e23..0000000
--- a/demo/complex2s/midpoint-objects/objectTemplates/template-org-department.xml
+++ /dev/null
@@ -1,58 +0,0 @@
-<?xml version="1.0"?>
-<objectTemplate xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
-    oid="0caf2f69-7c72-4946-b218-d84e78b2a057">
-    <name>template-org-department</name>
-    <mapping>
-        <strength>strong</strength>
-        <expression>
-            <assignmentTargetSearch>
-                <targetType>RoleType</targetType>
-                <oid>ffa9eaec-9539-4d15-97aa-24cd5b92ca5b</oid>     <!--  metarole-department -->
-            </assignmentTargetSearch>
-        </expression>
-        <target>
-            <path>assignment</path>
-        </target>
-    </mapping>
-    <item>
-        <ref>identifier</ref>
-        <mapping>
-            <strength>strong</strength>
-            <source>
-                <path>extension/grouperName</path>
-            </source>
-            <expression>
-                <script>
-                    <code>
-                        grouperName?.substring(9)           // from ref:dept:xxx
-                    </code>
-                </script>
-            </expression>
-        </mapping>
-    </item>
-    <item>
-        <ref>name</ref>
-        <mapping>
-            <strength>strong</strength>
-            <source>
-                <path>identifier</path>
-            </source>
-            <expression>
-                <script>
-                    <code>
-                        'department_' + identifier
-                    </code>
-                </script>
-            </expression>
-        </mapping>
-    </item>
-    <item>
-        <ref>displayName</ref>
-        <mapping>
-            <strength>strong</strength>
-            <source>
-                <path>identifier</path>
-            </source>
-        </mapping>
-    </item>    
-</objectTemplate>
\ No newline at end of file
diff --git a/demo/complex2s/midpoint-objects/objectTemplates/template-org-generic-group.xml b/demo/complex2s/midpoint-objects/objectTemplates/template-org-generic-group.xml
deleted file mode 100644
index 3492c5a..0000000
--- a/demo/complex2s/midpoint-objects/objectTemplates/template-org-generic-group.xml
+++ /dev/null
@@ -1,51 +0,0 @@
-<?xml version="1.0"?>
-<objectTemplate xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
-    oid="e2a6193a-8981-4143-9da1-9a7b32c0b819">
-    <name>template-org-generic-group</name>
-    <mapping>
-        <strength>strong</strength>
-        <expression>
-            <assignmentTargetSearch>
-                <targetType>RoleType</targetType>
-                <oid>48e231be-8474-4ed0-a85e-6acf4c5e8d52</oid>     <!--  metarole-generic-group -->
-            </assignmentTargetSearch>
-        </expression>
-        <target>
-            <path>assignment</path>
-        </target>
-    </mapping>
-    <item>
-        <ref>identifier</ref>
-        <mapping>
-            <strength>strong</strength>
-            <source>
-                <path>extension/grouperName</path>
-            </source>
-        </mapping>
-    </item>
-    <item>
-        <ref>name</ref>
-        <mapping>
-            <strength>strong</strength>
-            <source>
-                <path>identifier</path>
-            </source>
-            <expression>
-                <script>
-                    <code>
-                        'generic_' + identifier
-                    </code>
-                </script>
-            </expression>
-        </mapping>
-    </item>
-    <item>
-        <ref>displayName</ref>
-        <mapping>
-            <strength>strong</strength>
-            <source>
-                <path>identifier</path>
-            </source>
-        </mapping>
-    </item>    
-</objectTemplate>
diff --git a/demo/complex2s/midpoint-objects/objectTemplates/template-org-mailing-list.xml b/demo/complex2s/midpoint-objects/objectTemplates/template-org-mailing-list.xml
deleted file mode 100644
index 04c339e..0000000
--- a/demo/complex2s/midpoint-objects/objectTemplates/template-org-mailing-list.xml
+++ /dev/null
@@ -1,65 +0,0 @@
-<?xml version="1.0"?>
-<objectTemplate xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
-    oid="be84a39a-c004-490b-9b78-a871b837f6df">
-    <name>template-org-mailing-list</name>
-    <mapping>
-        <strength>strong</strength>
-        <expression>
-            <assignmentTargetSearch>
-                <targetType>RoleType</targetType>
-                <oid>1c7beff4-cdf6-4e9f-b54c-79d0766f6fbe</oid>     <!--  metarole-mailing-list -->
-            </assignmentTargetSearch>
-        </expression>
-        <target>
-            <path>assignment</path>
-        </target>
-    </mapping>
-    <item>
-        <ref>identifier</ref>
-        <mapping>
-            <strength>strong</strength>
-            <source>
-                <path>extension/grouperName</path>
-            </source>
-            <expression>
-                <script>
-                    <code>
-                        grouperName?.substring(16)           // from app:mailinglist:xxx
-                    </code>
-                </script>
-            </expression>
-        </mapping>
-    </item>
-    <item>
-        <ref>name</ref>
-        <mapping>
-            <strength>strong</strength>
-            <source>
-                <path>identifier</path>
-            </source>
-            <expression>
-                <script>
-                    <code>
-                        'mailinglist_' + identifier
-                    </code>
-                </script>
-            </expression>
-        </mapping>
-    </item>
-    <item>
-        <ref>displayName</ref>
-        <mapping>
-            <strength>strong</strength>
-            <expression>
-                <script>
-                    <code>
-                        'Mailing list: ' + identifier
-                    </code>
-                </script>
-            </expression>
-            <source>
-                <path>identifier</path>
-            </source>
-        </mapping>
-    </item>    
-</objectTemplate>
\ No newline at end of file
diff --git a/demo/complex2s/midpoint-objects/objectTemplates/template-role-midpoint-group.xml b/demo/complex2s/midpoint-objects/objectTemplates/template-role-midpoint-group.xml
deleted file mode 100644
index 62296e9..0000000
--- a/demo/complex2s/midpoint-objects/objectTemplates/template-role-midpoint-group.xml
+++ /dev/null
@@ -1,17 +0,0 @@
-<?xml version="1.0"?>
-<objectTemplate xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
-    oid="804f8658-0828-4dab-a2ed-f13985e4f80b">
-    <name>template-role-midpoint-group</name>
-    <mapping>
-        <strength>strong</strength>
-        <expression>
-            <assignmentTargetSearch>
-                <targetType>RoleType</targetType>
-                <oid>c691e15a-f30b-4e15-8445-532db07ceeeb</oid>     <!--  metarole-midpoint-group -->
-            </assignmentTargetSearch>
-        </expression>
-        <target>
-            <path>assignment</path>
-        </target>
-    </mapping>
-</objectTemplate>
diff --git a/demo/complex2s/midpoint-objects/roles/role-grouper-sysadmin.xml b/demo/complex2s/midpoint-objects/orgs/org-grouper-sysadmin.xml
similarity index 71%
rename from demo/complex2s/midpoint-objects/roles/role-grouper-sysadmin.xml
rename to demo/complex2s/midpoint-objects/orgs/org-grouper-sysadmin.xml
index cb81a23..a748ebe 100644
--- a/demo/complex2s/midpoint-objects/roles/role-grouper-sysadmin.xml
+++ b/demo/complex2s/midpoint-objects/orgs/org-grouper-sysadmin.xml
@@ -1,4 +1,4 @@
-<role xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
+<org xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
       xmlns:apti="http://midpoint.evolveum.com/xml/ns/public/common/api-types-3" 
       xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
       xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" 
@@ -8,10 +8,10 @@
       xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" 
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
       oid="d48ec05b-fffd-4262-acd3-d9ff63365b62">
-    <name>role-grouper-sysadmin</name>
+    <name>org-grouper-sysadmin</name>
+    <displayName>Grouper Administrators</displayName>
     <assignment id="1">
-        <targetRef oid="c691e15a-f30b-4e15-8445-532db07ceeeb" type="RoleType"/>         <!--  metarole-midpoint-group -->
+        <targetRef oid="2be36917-71ad-4c3e-8789-89cadea2d5d6" type="ArchetypeType"/>         <!--  archetype midpoint-group -->
     </assignment>
-    <subtype>midpoint-group</subtype>
     <identifier>sysadmingroup</identifier>
-</role>
+</org>
diff --git a/demo/complex2s/midpoint-objects/orgs/org-midpoint-groups.xml b/demo/complex2s/midpoint-objects/orgs/org-midpoint-groups.xml
new file mode 100644
index 0000000..5bb3a7f
--- /dev/null
+++ b/demo/complex2s/midpoint-objects/orgs/org-midpoint-groups.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<org xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
+    oid="4790ab69-7ef0-41a4-8992-78877f3beb23">
+    <name>midpoint-groups</name>
+    <displayName>midPoint groups</displayName>
+</org>
diff --git a/demo/complex2s/midpoint-objects/resources/ldap-main.xml b/demo/complex2s/midpoint-objects/resources/ldap-main.xml
index c1251f0..66a66dd 100644
--- a/demo/complex2s/midpoint-objects/resources/ldap-main.xml
+++ b/demo/complex2s/midpoint-objects/resources/ldap-main.xml
@@ -19,617 +19,325 @@
 	xmlns:mr="http://prism.evolveum.com/xml/ns/public/matching-rule-3"
 	xmlns:cap="http://midpoint.evolveum.com/xml/ns/public/resource/capabilities-3">
 
-		<name>LDAP (directory)</name>
+	<name>LDAP (directory)</name>
 
-		<connectorRef type="ConnectorType">
-			<filter>
-				<q:equal>
-					<q:path>c:connectorType</q:path>
-					<q:value>com.evolveum.polygon.connector.ldap.LdapConnector</q:value>
-				</q:equal>
-			</filter>
-		</connectorRef>
+	<connectorRef type="ConnectorType">
+		<filter>
+			<q:equal>
+				<q:path>c:connectorType</q:path>
+				<q:value>com.evolveum.polygon.connector.ldap.LdapConnector</q:value>
+			</q:equal>
+		</filter>
+	</connectorRef>
 
-		<connectorConfiguration
-			xmlns:icfc="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/connector-schema-3"
+	<connectorConfiguration
+		xmlns:icfc="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/connector-schema-3"
+		xmlns:icfcldap="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/bundle/com.evolveum.polygon.connector-ldap/com.evolveum.polygon.connector.ldap.LdapConnector">
+		<icfc:configurationProperties
 			xmlns:icfcldap="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/bundle/com.evolveum.polygon.connector-ldap/com.evolveum.polygon.connector.ldap.LdapConnector">
-			<icfc:configurationProperties
-				xmlns:icfcldap="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/bundle/com.evolveum.polygon.connector-ldap/com.evolveum.polygon.connector.ldap.LdapConnector">
-                <icfcldap:port>389</icfcldap:port>
-                <icfcldap:host>directory</icfcldap:host>
-				<icfcldap:baseContext>dc=internet2,dc=edu</icfcldap:baseContext>
-				<icfcldap:bindDn>cn=Directory Manager</icfcldap:bindDn>
-				<icfcldap:bindPassword>
-					<t:clearValue>password</t:clearValue>
-				</icfcldap:bindPassword>
-				<icfcldap:uidAttribute>nsUniqueId</icfcldap:uidAttribute>
-				<icfcldap:pagingStrategy>auto</icfcldap:pagingStrategy> <!-- spr? -->
-				<icfcldap:vlvSortAttribute>uid</icfcldap:vlvSortAttribute>
-				<icfcldap:operationalAttributes>memberOf</icfcldap:operationalAttributes>
-				<icfcldap:operationalAttributes>createTimestamp</icfcldap:operationalAttributes>
-				<icfcldap:operationalAttributes>nsAccountLock</icfcldap:operationalAttributes>
-				<!-- >icfcldap:usePermissiveModify>always</icfcldap:usePermissiveModify>
-				<icfcldap:passwordHashAlgorithm>SSHA</icfcldap:passwordHashAlgorithm  -->
-				<!-- >icfcldap:vlvSortAttribute>uid</icfcldap:vlvSortAttribute> <icfcldap:vlvSortOrderingRule>2.5.13.3</icfcldap:vlvSortOrderingRule -->
-			</icfc:configurationProperties>
-			<icfc:resultsHandlerConfiguration>
-				<icfc:enableNormalizingResultsHandler>false</icfc:enableNormalizingResultsHandler>
-				<icfc:enableFilteredResultsHandler>false</icfc:enableFilteredResultsHandler>
-				<icfc:enableAttributesToGetSearchResultsHandler>false</icfc:enableAttributesToGetSearchResultsHandler>
-			</icfc:resultsHandlerConfiguration>
-		</connectorConfiguration>
+            <icfcldap:port>389</icfcldap:port>
+            <icfcldap:host>directory</icfcldap:host>
+            <!-- <icfcldap:host>192.168.56.101</icfcldap:host>  -->
+			<icfcldap:baseContext>dc=internet2,dc=edu</icfcldap:baseContext>
+			<icfcldap:bindDn>cn=Directory Manager</icfcldap:bindDn>
+			<icfcldap:bindPassword>
+				<t:clearValue>password</t:clearValue>
+			</icfcldap:bindPassword>
+			<icfcldap:uidAttribute>nsUniqueId</icfcldap:uidAttribute>
+			<icfcldap:pagingStrategy>spr</icfcldap:pagingStrategy> <!-- spr? -->
+			<!--  <icfcldap:vlvSortAttribute>uid</icfcldap:vlvSortAttribute>  -->
+			<icfcldap:operationalAttributes>memberOf</icfcldap:operationalAttributes>
+			<icfcldap:operationalAttributes>createTimestamp</icfcldap:operationalAttributes>
+			<icfcldap:operationalAttributes>nsAccountLock</icfcldap:operationalAttributes>
+			<!-- >icfcldap:usePermissiveModify>always</icfcldap:usePermissiveModify>
+			<icfcldap:passwordHashAlgorithm>SSHA</icfcldap:passwordHashAlgorithm  -->
+			<!-- >icfcldap:vlvSortAttribute>uid</icfcldap:vlvSortAttribute> <icfcldap:vlvSortOrderingRule>2.5.13.3</icfcldap:vlvSortOrderingRule -->
+		</icfc:configurationProperties>
+		<icfc:resultsHandlerConfiguration>
+			<icfc:enableNormalizingResultsHandler>false</icfc:enableNormalizingResultsHandler>
+			<icfc:enableFilteredResultsHandler>false</icfc:enableFilteredResultsHandler>
+			<icfc:enableAttributesToGetSearchResultsHandler>false</icfc:enableAttributesToGetSearchResultsHandler>
+		</icfc:resultsHandlerConfiguration>
+	</connectorConfiguration>
 
-		<schema>
-			<generationConstraints>
-				<generateObjectClass>ri:inetOrgPerson</generateObjectClass>
-				<generateObjectClass>ri:eduPerson</generateObjectClass>
-				<generateObjectClass>ri:groupOfUniqueNames</generateObjectClass>
-				<generateObjectClass>ri:groupOfNames</generateObjectClass>
-				<generateObjectClass>ri:organizationalUnit</generateObjectClass>
-			</generationConstraints>
-		</schema>
+	<schema>
+		<generationConstraints>
+			<generateObjectClass>ri:inetOrgPerson</generateObjectClass>
+			<generateObjectClass>ri:eduPerson</generateObjectClass>
+			<generateObjectClass>ri:groupOfUniqueNames</generateObjectClass>
+			<generateObjectClass>ri:groupOfNames</generateObjectClass>
+			<generateObjectClass>ri:organizationalUnit</generateObjectClass>
+		</generationConstraints>
+	</schema>
 
-		<schemaHandling>
-			<objectType>
-				<kind>account</kind>
-				<displayName>Normal Account</displayName>
-				<default>true</default>
-				<objectClass>ri:inetOrgPerson</objectClass>
-				<auxiliaryObjectClass>ri:eduPerson</auxiliaryObjectClass>
-				<attribute>
-					<ref>ri:dn</ref>
-					<displayName>Distinguished Name</displayName>
-                    <limitations>
-                        <minOccurs>0</minOccurs>
-                    </limitations>
-                    <tolerant>false</tolerant>
-					<matchingRule>mr:stringIgnoreCase</matchingRule>
-                    <outbound>
-                        <strength>strong</strength>
-                        <source>
-                            <path>name</path>
-                        </source>
-                        <expression>
-                            <script>
-                                <code>
-                                    'uid=' + name + ',ou=People,dc=internet2,dc=edu'
-                                </code>
-                            </script>
-                        </expression>
-                    </outbound>
-				</attribute>
-				<attribute>
-					<ref>ri:cn</ref>
-					<displayName>Common Name</displayName>
-					<limitations>
-						<minOccurs>0</minOccurs>
-					</limitations>
-                    <tolerant>false</tolerant>
-                    <outbound>
-                        <strength>strong</strength>
-                        <source>
-                            <path>fullName</path>
-                        </source>
-                    </outbound>
-				</attribute>
-				<attribute>
-					<ref>ri:sn</ref>
-					<displayName>Surname</displayName>
-                    <limitations>
-                        <minOccurs>0</minOccurs>
-                    </limitations>
-                    <tolerant>false</tolerant>
-                    <outbound>
-                        <strength>strong</strength>
-                        <source>
-                            <path>familyName</path>
-                        </source>
-                    </outbound>
-				</attribute>
-				<attribute>
-					<ref>ri:givenName</ref>
-					<displayName>Given Name</displayName>
-                    <limitations>
-                        <minOccurs>0</minOccurs>
-                    </limitations>
-                    <tolerant>false</tolerant>
-                    <outbound>
-                        <strength>strong</strength>
-                        <source>
-                            <path>givenName</path>
-                        </source>
-                    </outbound>
-				</attribute>
-				<attribute>
-					<ref>ri:uid</ref>
-					<displayName>Login Name</displayName>
-                    <tolerant>false</tolerant>
-					<matchingRule>mr:stringIgnoreCase</matchingRule>
-                    <outbound>
-                        <strength>strong</strength>
-                        <source>
-                            <path>name</path>
-                        </source>
-                    </outbound>
-				</attribute>
-				<attribute>
-					<ref>ri:mail</ref>
-					<displayName>Mail</displayName>
-					<matchingRule>mr:stringIgnoreCase</matchingRule>
-                    <tolerant>false</tolerant>
-                    <outbound>
-                        <strength>strong</strength>
-                        <source>
-                            <path>emailAddress</path>
-                        </source>
-                    </outbound>
-				</attribute>
-				<attribute>
-					<ref>ri:employeeNumber</ref>
-                    <tolerant>false</tolerant>
-                    <outbound>
-                        <strength>strong</strength>
-                        <source>
-                            <path>employeeNumber</path>
-                        </source>
-                    </outbound>
-				</attribute>
-				<attribute>
-					<ref>ri:businessCategory</ref>
-                    <tolerant>false</tolerant>
-				</attribute>
+	<schemaHandling>
+		<objectType>
+			<kind>account</kind>
+			<displayName>Normal Account</displayName>
+			<default>true</default>
+			<objectClass>ri:inetOrgPerson</objectClass>
+			<auxiliaryObjectClass>ri:eduPerson</auxiliaryObjectClass>
+			<attribute>
+				<ref>ri:dn</ref>
+				<displayName>Distinguished Name</displayName>
+                <limitations>
+                    <minOccurs>0</minOccurs>
+                </limitations>
+                <tolerant>false</tolerant>
+				<matchingRule>mr:stringIgnoreCase</matchingRule>
+                <outbound>
+                    <strength>strong</strength>
+                    <source>
+                        <path>name</path>
+                    </source>
+                    <expression>
+                        <script>
+                            <code>
+                                'uid=' + name + ',ou=People,dc=internet2,dc=edu'
+                            </code>
+                        </script>
+                    </expression>
+                </outbound>
+			</attribute>
+			<attribute>
+				<ref>ri:cn</ref>
+				<displayName>Common Name</displayName>
+				<limitations>
+					<minOccurs>0</minOccurs>
+				</limitations>
+                <tolerant>false</tolerant>
+                <outbound>
+                    <strength>strong</strength>
+                    <source>
+                        <path>fullName</path>
+                    </source>
+                </outbound>
+			</attribute>
+			<attribute>
+				<ref>ri:sn</ref>
+				<displayName>Surname</displayName>
+                <limitations>
+                    <minOccurs>0</minOccurs>
+                </limitations>
+                <tolerant>false</tolerant>
+                <outbound>
+                    <strength>strong</strength>
+                    <source>
+                        <path>familyName</path>
+                    </source>
+                </outbound>
+			</attribute>
+			<attribute>
+				<ref>ri:givenName</ref>
+				<displayName>Given Name</displayName>
+                <limitations>
+                    <minOccurs>0</minOccurs>
+                </limitations>
+                <tolerant>false</tolerant>
+                <outbound>
+                    <strength>strong</strength>
+                    <source>
+                        <path>givenName</path>
+                    </source>
+                </outbound>
+			</attribute>
+			<attribute>
+				<ref>ri:uid</ref>
+				<displayName>Login Name</displayName>
+                <tolerant>false</tolerant>
+				<matchingRule>mr:stringIgnoreCase</matchingRule>
+                <outbound>
+                    <strength>strong</strength>
+                    <source>
+                        <path>name</path>
+                    </source>
+                </outbound>
+			</attribute>
+			<attribute>
+				<ref>ri:mail</ref>
+				<displayName>Mail</displayName>
+				<matchingRule>mr:stringIgnoreCase</matchingRule>
+                <tolerant>false</tolerant>
+                <outbound>
+                    <strength>strong</strength>
+                    <source>
+                        <path>emailAddress</path>
+                    </source>
+                </outbound>
+			</attribute>
+			<attribute>
+				<ref>ri:employeeNumber</ref>
+                <tolerant>false</tolerant>
+                <outbound>
+                    <strength>strong</strength>
+                    <source>
+                        <path>employeeNumber</path>
+                    </source>
+                </outbound>
+			</attribute>
+			<attribute>
+				<ref>ri:businessCategory</ref>
+                <tolerant>false</tolerant>
+			</attribute>
 <!-- 				<attribute>
-					<ref>ri:eduPersonAffiliation</ref>
-					<outbound>
-						<strength>strong</strength>
-						<source>
-							<path>extension/rawAffiliation</path>
-						</source>
-					</outbound>
-                    <tolerant>false</tolerant>
-				</attribute> -->
-                <association>
-                    <tolerant>false</tolerant>
-                    <ref>ri:group</ref>
-                    <kind>entitlement</kind>
-                    <intent>affiliation-group</intent>
-                    <intent>course-group</intent>
-                    <intent>midpoint-group</intent>
-                    <intent>generic-group</intent>
-                    <direction>objectToSubject</direction>
-                    <associationAttribute>ri:uniqueMember</associationAttribute>
-                    <valueAttribute>ri:dn</valueAttribute>
-                </association>
-				<protected>
-					<filter>
-						<q:equal>
-							<q:matching>http://prism.evolveum.com/xml/ns/public/matching-rule-3#stringIgnoreCase</q:matching>
-							<q:path>attributes/ri:dn</q:path>
-							<q:value>cn=root,dc=internet2,dc=edu</q:value>
-						</q:equal>
-					</filter>
-				</protected>
-                <credentials>
-                    <password>
-                        <outbound>
-                            <expression>
-                                <asIs />
-                            </expression>
-                        </outbound>
-                    </password>
-                </credentials>
-			</objectType>
-            
-            <objectType>
-                <kind>entitlement</kind>
-                <intent>affiliation-group</intent>
-                <displayName>LDAP Group for affiliations</displayName>
-                <objectClass>ri:groupOfUniqueNames</objectClass>
-                <attribute>
-                    <ref>ri:uniqueMember</ref>
-                    <matchingRule>mr:distinguishedName</matchingRule>
-                    <fetchStrategy>minimal</fetchStrategy>
-                </attribute>
-                <attribute>
-                    <ref>ri:dn</ref>
-                    <matchingRule>mr:stringIgnoreCase</matchingRule>
-                    <outbound>
-                        <strength>strong</strength>
-                        <source>
-                            <path>identifier</path>
-                        </source>
-                        <expression>
-                            <script>
-                                <code>
-                                    basic.composeDnWithSuffix('cn', identifier, 'ou=Affiliations,ou=Groups,dc=internet2,dc=edu')
-                                </code>
-                            </script>
-                        </expression>
-                    </outbound>
-                </attribute>
-                <attribute>
-                    <ref>ri:cn</ref>
-                    <matchingRule>mr:stringIgnoreCase</matchingRule>
-                    <outbound>
-                        <strength>weak</strength>
-                        <source>
-                            <path>identifier</path>
-                        </source>
-                    </outbound>
-                </attribute>
-            </objectType>
-            <objectType>
-                <kind>entitlement</kind>
-                <intent>course-group</intent>
-                <displayName>LDAP Group for courses</displayName>
-                <objectClass>ri:groupOfUniqueNames</objectClass>
-                <attribute>
-                    <ref>ri:uniqueMember</ref>
-                    <matchingRule>mr:distinguishedName</matchingRule>
-                    <fetchStrategy>minimal</fetchStrategy>
-                </attribute>
-                <attribute>
-                    <ref>ri:dn</ref>
-                    <matchingRule>mr:stringIgnoreCase</matchingRule>
-                    <outbound>
-                        <strength>strong</strength>
-                        <source>
-                            <path>identifier</path>
-                        </source>
-                        <expression>
-                            <script>
-                                <code>
-                                    basic.composeDnWithSuffix('cn', identifier, 'ou=Courses,ou=Groups,dc=internet2,dc=edu')
-                                </code>
-                            </script>
-                        </expression>
-                    </outbound>
-                </attribute>
-                <attribute>
-                    <ref>ri:cn</ref>
-                    <matchingRule>mr:stringIgnoreCase</matchingRule>
-                    <outbound>
-                        <strength>weak</strength>
-                        <source>
-                            <path>identifier</path>
-                        </source>
-                    </outbound>
-                </attribute>
-            </objectType>
-            <objectType>
+				<ref>ri:eduPersonAffiliation</ref>
+				<outbound>
+					<strength>strong</strength>
+					<source>
+						<path>extension/rawAffiliation</path>
+					</source>
+				</outbound>
+                <tolerant>false</tolerant>
+			</attribute> -->
+            <association>
+                <tolerant>false</tolerant>
+                <ref>ri:group</ref>
                 <kind>entitlement</kind>
-                <intent>midpoint-group</intent>
-                <displayName>LDAP Group</displayName>
-                <objectClass>ri:groupOfUniqueNames</objectClass>
-                <attribute>
-                    <ref>ri:uniqueMember</ref>
-                    <matchingRule>mr:distinguishedName</matchingRule>
-                    <fetchStrategy>minimal</fetchStrategy>
-                </attribute>
-                <attribute>
-                    <ref>ri:dn</ref>
-                    <matchingRule>mr:stringIgnoreCase</matchingRule>
-                    <outbound>
-                        <strength>strong</strength>
-                        <trace>true</trace>
-                        <source>
-                            <path>identifier</path>
-                        </source>
-                        <expression>
-                            <script>
-                                <code>
-                                    basic.composeDnWithSuffix('cn', identifier, 'ou=midpoint,ou=Groups,dc=internet2,dc=edu')
-                                </code>
-                            </script>
-                        </expression>
-                    </outbound>
-                </attribute>
-                <attribute>
-                    <ref>ri:cn</ref>
-                    <matchingRule>mr:stringIgnoreCase</matchingRule>
-                    <outbound>
-                        <strength>weak</strength>
-                        <source>
-                            <path>identifier</path>
-                        </source>
-                    </outbound>
-                </attribute>
-            </objectType>
-            <objectType>
-                <kind>entitlement</kind>
-                <intent>generic-group</intent>
-                <displayName>LDAP Group</displayName>
-                <objectClass>ri:groupOfUniqueNames</objectClass>
-                <attribute>
-                    <ref>ri:uniqueMember</ref>
-                    <matchingRule>mr:distinguishedName</matchingRule>
-                    <fetchStrategy>minimal</fetchStrategy>
-                </attribute>
-                <attribute>
-                    <ref>ri:dn</ref>
-                    <matchingRule>mr:stringIgnoreCase</matchingRule>
-                    <outbound>
-                        <strength>strong</strength>
-                        <trace>true</trace>
-                        <source>
-                            <path>extension/grouperName</path>
-                        </source>
-                        <expression>
-                            <script>
-                                <code>
-                                    basic.composeDnWithSuffix('cn', grouperName, 'ou=generic,ou=Groups,dc=internet2,dc=edu')
-                                </code>
-                            </script>
-                        </expression>
-                    </outbound>
-                </attribute>
-                <attribute>
-                    <ref>ri:cn</ref>
-                    <matchingRule>mr:stringIgnoreCase</matchingRule>
-                    <outbound>
-                        <strength>weak</strength>
-                        <source>
-                            <path>extension/grouperName</path>
-                        </source>
-                    </outbound>
-                </attribute>
-            </objectType>
-		</schemaHandling>
-
-		<synchronization>
-			<objectSynchronization>
-				<enabled>true</enabled>
-				<correlation>
+                <intent>group</intent>
+                <direction>objectToSubject</direction>
+                <associationAttribute>ri:uniqueMember</associationAttribute>
+                <valueAttribute>ri:dn</valueAttribute>
+            </association>
+			<protected>
+				<filter>
 					<q:equal>
-						<q:path>name</q:path>
-						<expression>
-							<path>
-								declare namespace ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3";
-								$account/attributes/ri:uid
-							</path>
-						</expression>
+						<q:matching>http://prism.evolveum.com/xml/ns/public/matching-rule-3#stringIgnoreCase</q:matching>
+						<q:path>attributes/ri:dn</q:path>
+						<q:value>cn=root,dc=internet2,dc=edu</q:value>
 					</q:equal>
-				</correlation>
-				<reaction>
-					<situation>linked</situation>
-					<synchronize>true</synchronize>
-				</reaction>
-				<reaction>
-					<situation>deleted</situation>
-					<synchronize>true</synchronize>
-					<action>
-						<handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlink</handlerUri>
-					</action>
-				</reaction>
-				<reaction>
-					<situation>unlinked</situation>
-					<synchronize>true</synchronize>
-					<action>
-						<handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#link</handlerUri>
-					</action>
-				</reaction>
-				<reaction>
-					<situation>unmatched</situation>
-					<synchronize>true</synchronize>
-					<action>
-						<handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#addFocus</handlerUri>
-					</action>
-				</reaction>
-			</objectSynchronization>
-            <objectSynchronization>
-                <name>affiliation-group sync</name>
-                <objectClass>ri:groupOfUniqueNames</objectClass>
-                <kind>entitlement</kind>
-                <intent>affiliation-group</intent>
-                <focusType>OrgType</focusType>
-                <enabled>true</enabled>
-                <condition>
-                    <script>
-                        <code>
-                            import javax.naming.ldap.*
-                            dn = new LdapName(basic.getAttributeValue(account, 'http://midpoint.evolveum.com/xml/ns/public/resource/instance-3', 'dn'))
-                            log.info('affiliation-group sync: considering {}; dn.size={}, dn.startsWith={}', dn, dn.size(), dn.startsWith(new LdapName('ou=Affiliations,ou=Groups,dc=internet2,dc=edu')))
-                            dn.size() == 5 &amp;&amp; dn.startsWith(new LdapName('ou=Affiliations,ou=Groups,dc=internet2,dc=edu'))
-                        </code>
-                    </script>
-                </condition>
-                <correlation>
-                    <q:and>
-                        <q:equal>
-                            <q:path>identifier</q:path>
-                            <expression>
-                                <path>$shadow/attributes/ri:cn</path>
-                            </expression>
-                        </q:equal>
-                        <q:equal>
-                            <q:path>subtype</q:path>
-                            <q:value>affiliation</q:value>
-                        </q:equal>
-                    </q:and>
-                </correlation>
-                <reaction>
-                    <situation>linked</situation>
-                    <synchronize>true</synchronize>
-                </reaction>
-                <reaction>
-                    <situation>deleted</situation>
-                    <synchronize>true</synchronize>
-                    <action>
-                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlink</handlerUri>
-                    </action>
-                </reaction>
-                <reaction>
-                    <situation>unlinked</situation>
-                    <synchronize>true</synchronize>
-                    <action>
-                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#link</handlerUri>
-                    </action>
-                </reaction>
-                <reaction>
-                    <situation>unmatched</situation>
-                </reaction>
-            </objectSynchronization>
-            <objectSynchronization>
-                <name>course-group sync</name>
-                <objectClass>ri:groupOfUniqueNames</objectClass>
-                <kind>entitlement</kind>
-                <intent>course-group</intent>
-                <focusType>OrgType</focusType>
-                <enabled>true</enabled>
-                <condition>
-                    <script>
-                        <code>
-                            import javax.naming.ldap.*
-                            dn = new LdapName(basic.getAttributeValue(account, 'http://midpoint.evolveum.com/xml/ns/public/resource/instance-3', 'dn'))
-                            log.info('course-group sync: considering {}; dn.size={}, dn.startsWith={}', dn, dn.size(), dn.startsWith(new LdapName('ou=Courses,ou=Groups,dc=internet2,dc=edu')))
-                            dn.size() == 5 &amp;&amp; dn.startsWith(new LdapName('ou=Courses,ou=Groups,dc=internet2,dc=edu'))
-                        </code>
-                    </script>
-                </condition>
-                <correlation>
-                    <q:and>
-                        <q:equal>
-                            <q:path>identifier</q:path>
-                            <expression>
-                                <path>$shadow/attributes/ri:cn</path>
-                            </expression>
-                        </q:equal>
-                        <q:equal>
-                            <q:path>subtype</q:path>
-                            <q:value>course</q:value>
-                        </q:equal>
-                    </q:and>
-                </correlation>
-                <reaction>
-                    <situation>linked</situation>
-                    <synchronize>true</synchronize>
-                </reaction>
-                <reaction>
-                    <situation>deleted</situation>
-                    <synchronize>true</synchronize>
-                    <action>
-                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlink</handlerUri>
-                    </action>
-                </reaction>
-                <reaction>
-                    <situation>unlinked</situation>
-                    <synchronize>true</synchronize>
-                    <action>
-                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#link</handlerUri>
-                    </action>
-                </reaction>
-                <reaction>
-                    <situation>unmatched</situation>
-                </reaction>
-            </objectSynchronization>
-            <objectSynchronization>
-                <name>midpoint-group sync</name>
-                <objectClass>ri:groupOfUniqueNames</objectClass>
-                <kind>entitlement</kind>
-                <intent>midpoint-group</intent>
-                <focusType>RoleType</focusType>
-                <enabled>true</enabled>
-                <condition>
-                    <script>
-                        <code>
-                            import javax.naming.ldap.*
-                            dn = new LdapName(basic.getAttributeValue(account, 'http://midpoint.evolveum.com/xml/ns/public/resource/instance-3', 'dn'))
-                            log.info('midpoint-group sync: considering {}; dn.size={}, dn.startsWith={}', dn, dn.size(), dn.startsWith(new LdapName('ou=midpoint,ou=Groups,dc=internet2,dc=edu')))
-                            dn.size() == 5 &amp;&amp; dn.startsWith(new LdapName('ou=midpoint,ou=Groups,dc=internet2,dc=edu'))
-                        </code>
-                    </script>
-                </condition>
-                <correlation>
-                    <q:and>
-                        <q:equal>
-                            <q:path>identifier</q:path>
-                            <expression>
-                                <path>$shadow/attributes/ri:cn</path>
-                            </expression>
-                        </q:equal>
-                        <q:equal>
-                            <q:path>subtype</q:path>
-                            <q:value>midpoint-group</q:value>
-                        </q:equal>
-                    </q:and>
-                </correlation>
-                <reaction>
-                    <situation>linked</situation>
-                    <synchronize>true</synchronize>
-                </reaction>
-                <reaction>
-                    <situation>deleted</situation>
-                    <synchronize>true</synchronize>
-                    <action>
-                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlink</handlerUri>
-                    </action>
-                </reaction>
-                <reaction>
-                    <situation>unlinked</situation>
-                    <synchronize>true</synchronize>
-                    <action>
-                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#link</handlerUri>
-                    </action>
-                </reaction>
-                <reaction>
-                    <situation>unmatched</situation>
-                </reaction>
-            </objectSynchronization>
-            <objectSynchronization>
-                <name>generic-group sync</name>
-                <objectClass>ri:groupOfUniqueNames</objectClass>
-                <kind>entitlement</kind>
-                <intent>generic-group</intent>
-                <focusType>OrgType</focusType>
-                <enabled>true</enabled>
-                <condition>
-                    <script>
-                        <code>
-                            import javax.naming.ldap.*
-                            dn = new LdapName(basic.getAttributeValue(account, 'http://midpoint.evolveum.com/xml/ns/public/resource/instance-3', 'dn'))
-                            log.info('generic-group sync: considering {}; dn.size={}, dn.startsWith={}', dn, dn.size(), dn.startsWith(new LdapName('ou=Generic,ou=Groups,dc=internet2,dc=edu')))
-                            dn.size() == 5 &amp;&amp; dn.startsWith(new LdapName('ou=Generic,ou=Groups,dc=internet2,dc=edu'))
-                        </code>
-                    </script>
-                </condition>
-                <correlation>
-                    <q:and>
-                        <q:equal>
-                            <q:path>identifier</q:path>
-                            <expression>
-                                <path>$shadow/attributes/ri:cn</path>
-                            </expression>
-                        </q:equal>
-                        <q:equal>
-                            <q:path>subtype</q:path>
-                            <q:value>generic-group</q:value>
-                        </q:equal>
-                    </q:and>
-                </correlation>
-                <reaction>
-                    <situation>linked</situation>
-                    <synchronize>true</synchronize>
-                </reaction>
-                <reaction>
-                    <situation>deleted</situation>
-                    <synchronize>true</synchronize>
-                    <action>
-                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlink</handlerUri>
-                    </action>
-                </reaction>
-                <reaction>
-                    <situation>unlinked</situation>
-                    <synchronize>true</synchronize>
-                    <action>
-                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#link</handlerUri>
-                    </action>
-                </reaction>
-                <reaction>
-                    <situation>unmatched</situation>
-                </reaction>
-            </objectSynchronization>
-		</synchronization>
-        <consistency>
-            <avoidDuplicateValues>true</avoidDuplicateValues>
-        </consistency>
+				</filter>
+			</protected>
+            <credentials>
+                <password>
+                    <outbound/>
+                </password>
+            </credentials>
+		</objectType>
+        
+        <objectType>
+            <kind>entitlement</kind>
+            <intent>group</intent>
+            <displayName>LDAP Group</displayName>
+            <objectClass>ri:groupOfUniqueNames</objectClass>
+            <attribute>
+                <ref>ri:uniqueMember</ref>
+                <matchingRule>mr:distinguishedName</matchingRule>
+                <fetchStrategy>minimal</fetchStrategy>
+            </attribute>
+            <attribute>
+                <ref>ri:dn</ref>
+                <matchingRule>mr:stringIgnoreCase</matchingRule>
+                <outbound>
+                    <strength>strong</strength>
+                    <source>
+                        <path>extension/ldapDn</path>
+                    </source>
+                </outbound>
+            </attribute>
+            <attribute>
+                <ref>ri:cn</ref>
+                <matchingRule>mr:stringIgnoreCase</matchingRule>
+                <outbound>
+                    <strength>weak</strength>
+                    <source>
+                        <path>identifier</path>
+                    </source>
+                </outbound>
+            </attribute>
+        </objectType>
+	</schemaHandling>
+
+	<synchronization>
+		<objectSynchronization>
+			<enabled>true</enabled>
+			<correlation>
+				<q:equal>
+					<q:path>name</q:path>
+					<expression>
+						<path>
+							declare namespace ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3";
+							$account/attributes/ri:uid
+						</path>
+					</expression>
+				</q:equal>
+			</correlation>
+			<reaction>
+				<situation>linked</situation>
+				<synchronize>true</synchronize>
+			</reaction>
+			<reaction>
+				<situation>deleted</situation>
+				<synchronize>true</synchronize>
+				<action>
+					<handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlink</handlerUri>
+				</action>
+			</reaction>
+			<reaction>
+				<situation>unlinked</situation>
+				<synchronize>true</synchronize>
+				<action>
+					<handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#link</handlerUri>
+				</action>
+			</reaction>
+			<reaction>
+				<situation>unmatched</situation>
+				<synchronize>true</synchronize>
+				<action>
+					<handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#addFocus</handlerUri>
+				</action>
+			</reaction>
+		</objectSynchronization>
+        <objectSynchronization>
+            <name>group sync</name>
+            <objectClass>ri:groupOfUniqueNames</objectClass>
+            <kind>entitlement</kind>
+            <intent>group</intent>
+            <focusType>OrgType</focusType>
+            <enabled>true</enabled>
+            <condition>
+                <script>
+                    <code>
+                        import javax.naming.ldap.*
+                        dn = new LdapName(basic.getAttributeValue(account, 'http://midpoint.evolveum.com/xml/ns/public/resource/instance-3', 'dn'))
+                        dn.startsWith(new LdapName('ou=Affiliations,ou=Groups,dc=internet2,dc=edu')) ||
+                            dn.startsWith(new LdapName('ou=Courses,ou=Groups,dc=internet2,dc=edu')) ||
+                            dn.startsWith(new LdapName('ou=generic,ou=Groups,dc=internet2,dc=edu')) ||
+                            dn.startsWith(new LdapName('ou=midpoint,ou=Groups,dc=internet2,dc=edu'))
+                    </code>
+                </script>
+            </condition>
+            <correlation>
+                <q:equal>
+                    <q:path>extension/ldapDn</q:path>
+                    <expression>
+                        <path>$shadow/attributes/ri:dn</path>
+                    </expression>
+                </q:equal>
+            </correlation>
+            <reaction>
+                <situation>linked</situation>
+                <synchronize>true</synchronize>
+            </reaction>
+            <reaction>
+                <situation>deleted</situation>
+                <synchronize>true</synchronize>
+                <action>
+                    <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlink</handlerUri>
+                </action>
+            </reaction>
+            <reaction>
+                <situation>unlinked</situation>
+                <synchronize>true</synchronize>
+                <action>
+                    <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#link</handlerUri>
+                </action>
+            </reaction>
+            <reaction>
+                <situation>unmatched</situation>
+            </reaction>
+        </objectSynchronization>
+	</synchronization>
+    <consistency>
+        <avoidDuplicateValues>true</avoidDuplicateValues>
+    </consistency>
 </resource>
diff --git a/demo/complex2s/midpoint-objects/resources/resource-grouper.xml b/demo/complex2s/midpoint-objects/resources/resource-grouper.xml
index 370c275..dc20c5d 100644
--- a/demo/complex2s/midpoint-objects/resources/resource-grouper.xml
+++ b/demo/complex2s/midpoint-objects/resources/resource-grouper.xml
@@ -112,18 +112,29 @@
                     <expression>
                         <script>
                             <code>
-                                switch (input) {
-                                    case ~/ref:affiliation:.*/: return 'affiliation'
-                                    case ~/ref:dept:.*/: return 'department'
-                                    case ~/ref:course:.*/: return 'course'
-                                    case ~/app:mailinglist:.*/: return 'mailing-list'
-                                    default: return 'generic-group'
+                                import com.evolveum.midpoint.schema.util
+                                import com.evolveum.midpoint.schema.constants
+                                
+                                if (input == null) {
+                                    null
+                                } else {
+                                    archetypeOid = '5f2b96d2-49b5-4a8a-9601-14457309a69b'       // generic-grouper-group
+                                    switch (input) {
+                                        case ~/ref:affiliation:.*/: archetypeOid = '56f53812-047d-4b69-83e8-519a73d161e1'; break;
+                                        case ~/ref:dept:.*/: archetypeOid = '1cec5f78-8fba-459b-9547-ef7485009f40'; break;
+                                        case ~/ref:course:.*/: archetypeOid = '3dab9a72-118b-4e40-a138-bb691c335eca'; break;
+                                        case ~/app:mailinglist:.*/: archetypeOid = '1645d1dc-1f7c-4508-b50b-97b501ccdee3'; break;
+                                    }
+                                    ObjectTypeUtil.createAssignmentTo(archetypeOid, ObjectTypes.ARCHETYPE, prismContext)
                                 }
                             </code>
                         </script>
                     </expression>
                     <target>
-                        <path>subtype</path>
+                        <path>assignment</path>
+                        <set>
+                            <predefined>all</predefined>    <!--  we tolerate no other assignments -->
+                        </set>
                     </target>
                 </inbound>
             </attribute>
diff --git a/demo/complex2s/midpoint-objects/roles/metarole-affiliation.xml b/demo/complex2s/midpoint-objects/roles/metarole-affiliation.xml
deleted file mode 100644
index 33aee68..0000000
--- a/demo/complex2s/midpoint-objects/roles/metarole-affiliation.xml
+++ /dev/null
@@ -1,54 +0,0 @@
-<role xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
-      xmlns:apti="http://midpoint.evolveum.com/xml/ns/public/common/api-types-3" 
-      xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
-      xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" 
-      xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3" 
-      xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
-      xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3" 
-      xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" 
-      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
-      oid="fecae27b-d1d3-40ae-95fa-8f7e44e2ee70">
-    <name>metarole-affiliation</name>
-    <inducement id="1">
-        <targetRef oid="1d7c0e3a-4456-409c-9f50-95407b2eb785" relation="org:default" type="c:OrgType" />     <!-- affiliations -->
-    </inducement>
-    <inducement id="2">
-        <construction>
-            <resourceRef oid="0a37121f-d515-4a23-9b6d-554c5ef61272" relation="org:default" type="c:ResourceType" />     <!-- LDAP -->
-            <kind>entitlement</kind>
-            <intent>affiliation-group</intent>
-        </construction>
-    </inducement>
-    <inducement id="3">
-        <construction>
-            <resourceRef oid="0a37121f-d515-4a23-9b6d-554c5ef61272" relation="org:default" type="c:ResourceType" />     <!-- LDAP -->
-            <association>
-                <c:ref>ri:group</c:ref>
-                <outbound>
-                    <expression>
-                        <associationFromLink>
-                            <projectionDiscriminator>
-                                <kind>entitlement</kind>
-                                <intent>affiliation-group</intent>
-                            </projectionDiscriminator>
-                        </associationFromLink>
-                    </expression>
-                </outbound>
-            </association>
-        </construction>
-        <order>2</order>
-    </inducement>
-    <inducement id="4">
-        <construction>
-            <resourceRef oid="e417225d-8a08-46f3-9b5d-624990b52386" relation="org:default" type="c:ResourceType" />     <!-- Faculty CSV -->
-        </construction>
-        <order>2</order>
-        <condition>
-            <expression>
-                <script>
-                    <code>assignmentPath[0].target.identifier == 'faculty'</code>
-                </script>
-            </expression>
-        </condition>
-    </inducement>
-</role>
diff --git a/demo/complex2s/midpoint-objects/roles/metarole-course.xml b/demo/complex2s/midpoint-objects/roles/metarole-course.xml
deleted file mode 100644
index 2fcda2f..0000000
--- a/demo/complex2s/midpoint-objects/roles/metarole-course.xml
+++ /dev/null
@@ -1,66 +0,0 @@
-<role xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
-      xmlns:apti="http://midpoint.evolveum.com/xml/ns/public/common/api-types-3" 
-      xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
-      xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" 
-      xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3" 
-      xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
-      xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3" 
-      xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" 
-      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
-      oid="8aa99e7b-f7d3-4585-9800-14bab4d26a43">
-    <name>metarole-course</name>
-    <inducement id="1">
-        <targetRef oid="225e9360-0639-40ba-8a31-7f31bef067be" type="c:OrgType"/>            <!-- courses -->
-    </inducement>
-    <inducement id="2">
-        <construction>
-            <resourceRef oid="0a37121f-d515-4a23-9b6d-554c5ef61272" relation="org:default" type="c:ResourceType" />     <!-- LDAP -->
-            <kind>entitlement</kind>
-            <intent>course-group</intent>
-        </construction>
-    </inducement>
-    <inducement id="3">
-        <construction>
-            <resourceRef oid="0a37121f-d515-4a23-9b6d-554c5ef61272" relation="org:default" type="c:ResourceType" />     <!-- LDAP -->
-            <association>
-                <c:ref>ri:group</c:ref>
-                <outbound>
-                    <expression>
-                        <associationFromLink>
-                            <projectionDiscriminator>
-                                <kind>entitlement</kind>
-                                <intent>course-group</intent>
-                            </projectionDiscriminator>
-                        </associationFromLink>
-                    </expression>
-                </outbound>
-            </association>
-        </construction>
-        <order>2</order>
-    </inducement>
-    <inducement id="4">
-        <construction>
-            <strength>weak</strength>
-            <resourceRef oid="a343fc2e-3954-4034-ba1a-2b72c21e577a" relation="org:default" type="c:ResourceType" />     <!-- CS CSV -->
-            <attribute>
-                <c:ref>ri:courses</c:ref>
-                <outbound>
-                    <strength>strong</strength>
-                    <expression>
-                        <script>
-                            <code>assignmentPath[0].target.identifier</code>
-                        </script>
-                    </expression>
-                </outbound>
-            </attribute>
-        </construction>
-        <condition>
-            <expression>
-                <script>
-                    <code>assignmentPath[0].target.identifier?.startsWith('CS')</code>
-                </script>
-            </expression>
-        </condition>
-        <order>2</order>
-    </inducement>
-</role>
diff --git a/demo/complex2s/midpoint-objects/roles/metarole-grouper-group.xml b/demo/complex2s/midpoint-objects/roles/metarole-grouper-group.xml
deleted file mode 100644
index 25229c0..0000000
--- a/demo/complex2s/midpoint-objects/roles/metarole-grouper-group.xml
+++ /dev/null
@@ -1,55 +0,0 @@
-<role xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
-      xmlns:apti="http://midpoint.evolveum.com/xml/ns/public/common/api-types-3" 
-      xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
-      xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" 
-      xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3" 
-      xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
-      xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3" 
-      xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" 
-      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
-      oid="48e231be-8474-4ed0-a85e-6acf4c5e8d52">
-    <name>metarole-grouper-group</name>
-    <inducement id="1">
-        <targetRef oid="1f339075-5b2f-4a18-9c98-451f3eb0d28d" relation="org:default" type="c:OrgType" />     <!-- groups -->
-    </inducement>
-    <inducement id="2">
-        <construction>
-            <resourceRef oid="0a37121f-d515-4a23-9b6d-554c5ef61272" relation="org:default" type="c:ResourceType" />     <!-- LDAP -->
-            <kind>entitlement</kind>
-            <intent>generic-group</intent>
-        </construction>
-        <order>1</order>
-    </inducement>
-    <inducement id="3">
-        <construction>
-            <resourceRef oid="0a37121f-d515-4a23-9b6d-554c5ef61272" relation="org:default" type="c:ResourceType" />     <!-- LDAP -->
-            <association>
-                <c:ref>ri:group</c:ref>
-                <outbound>
-                    <expression>
-                        <associationFromLink>
-                            <projectionDiscriminator>
-                                <kind>entitlement</kind>
-                                <intent>generic-group</intent>
-                            </projectionDiscriminator>
-                        </associationFromLink>
-                    </expression>
-                </outbound>
-            </association>
-        </construction>
-        <order>2</order>
-    </inducement>
-    <inducement id="4">
-        <construction>
-            <resourceRef oid="a343fc2e-3954-4034-ba1a-2b72c21e577a" relation="org:default" type="c:ResourceType" />     <!-- CS CSV -->
-        </construction>
-        <order>2</order>
-        <condition>
-            <expression>
-                <script>
-                    <code>assignmentPath[0].target.identifier == 'app:cs'</code>
-                </script>
-            </expression>
-        </condition>
-    </inducement>
-</role>
diff --git a/demo/complex2s/midpoint-objects/roles/metarole-grouper-provided-group.xml b/demo/complex2s/midpoint-objects/roles/metarole-grouper-provided-group.xml
new file mode 100644
index 0000000..b3022e1
--- /dev/null
+++ b/demo/complex2s/midpoint-objects/roles/metarole-grouper-provided-group.xml
@@ -0,0 +1,153 @@
+<role xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
+      xmlns:apti="http://midpoint.evolveum.com/xml/ns/public/common/api-types-3" 
+      xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
+      xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" 
+      xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3" 
+      xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
+      xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3" 
+      xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" 
+      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
+      oid="bcaec940-50c8-44bb-aa37-b2b5bb2d5b90">
+    <name>metarole-grouper-provided-group</name>
+    <description>A metarole for archetyped Grouper-provided groups</description>
+    <!-- 
+        This metarole arranges everything that is needed for a Grouper group to live in midPoint.
+        The schema is the following:
+        
+        Grouper group -> shadow -> org -> archetype -> this metarole
+        
+        e.g.
+        
+        ref:affiliation:member -> shadow -> affiliation_member -> archetype-affiliation -> metarole-grouper-provided-group 
+            
+        1) Grouper group (e.g. ref:affiliation:member) has a shadow object.
+        
+        2) An org object (affiliation_member) is created and linked to this shadow.
+        
+        3) At the same time, appropriate archetype is assigned to the org, based on the Grouper name 
+        (e.g. ref:affiliation:* leads to archetype-affiliation).
+        
+        4) This archetype defines basic parameters for the particular class of Grouper groups; e.g. where in midPoint
+        org tree they belong (e.g. under Affiliations org), where in LDAP tree they belong (e.g. under 
+        ou=Affiliations,ou=Groups,dc=internet2,dc=edu), what's the schema for their midPoint name
+        (e.g. affiliation_...) and displayName (e.g. Affiliation: ...).
+        
+        5) To avoid code duplication, these archetypes delegate specific processing
+        (i.e. filling-in appropriate properties of org objects) to metaroles:
+        to this one as well as to metarole-ldap-group.
+        
+        This metarole is devoted to process Grouper-specific information for Grouper groups.
+        As a source it needs only two pieces of information: extension/grouperName (e.g. ref:affiliation:member)
+        and particular archetype (e.g. archetype-affiliation) with its configuration data.
+        
+        It fills-in the following items: extension/grouperName -> identifier -> name and displayName
+        by inducing appropriate focus mappings to the org object.    
+         -->
+    <inducement>
+        <focusMappings>
+            <mapping>
+                <name>identifier</name>
+                <description>This mapping fills-in org identifier (e.g. 'member') from extension/grouperName (e.g. 'ref:affiliation:member').
+                It uses extension/grouperNamePrefix information from the archetype (e.g. 'ref:affiliation:' defined in affiliation-archetype)</description>
+                <strength>strong</strength>
+                <source>
+                    <path>extension/grouperName</path>
+                </source>
+                <expression>
+                    <script>
+                        <code>
+                            if (grouperName == null) {
+                                null
+                            } else {
+                                metarole = assignmentPath[-2].source       // e.g. metarole-affiliation
+                                log.info('metarole = {}', metarole)
+                                if (metarole == null) {
+                                    throw new IllegalStateException('No metarole in assignment path: ' + assignmentPath)
+                                }
+                                grouperNamePrefix = basic.getExtensionPropertyValue(metarole, 'grouperNamePrefix')      // e.g. 'ref:affiliation:'
+                                if (grouperNamePrefix == null) {
+                                    throw new IllegalStateException('No grouper name prefix in metarole ' + metarole)
+                                }
+                                // grouperName is e.g. 'ref:affiliation:member'
+                                if (grouperName.startsWith(grouperNamePrefix)) {
+                                    grouperName.substring(grouperNamePrefix.length())       // returning e.g. 'member'                                
+                                } else {
+                                    throw new IllegalStateException('Grouper name ' + grouperName + ' does not match the expected prefix: ' + grouperNamePrefix)
+                                }
+                            }
+                        </code>
+                    </script>
+                </expression>
+                <target>
+                    <path>identifier</path>
+                </target>
+            </mapping>
+
+            <mapping>
+                <name>name</name>
+                <description>This mapping fills-in org name (e.g. 'affiliation_member') from identifier (e.g. 'member').
+                It uses extension/midPointNamePrefix information from the archetype (e.g. 'affiliation_' defined in affiliation-archetype)</description>
+                <strength>strong</strength>
+                <source>
+                    <path>identifier</path>
+                </source>
+                <expression>
+                    <script>
+                        <code>
+                            if (identifier == null) {
+                                null
+                            } else {
+                                // e.g. identifier = 'member'
+                                metarole = assignmentPath[-2].source         // e.g. metarole-affiliation
+                                if (metarole == null) {
+                                    throw new IllegalStateException('No metarole in assignment path: ' + assignmentPath)
+                                }
+                                prefix = basic.getExtensionPropertyValue(metarole, 'midPointNamePrefix')        // e.g. 'affiliation_'
+                                prefix + identifier                                                             // e.g. 'affiliation_member'
+                            }
+                        </code>
+                    </script>
+                </expression>
+                <target>
+                    <path>name</path>
+                </target>
+            </mapping>
+            
+            <mapping>
+                <name>displayName</name>
+                <description>This mapping fills-in org displayName (e.g. 'Affiliation: member') from identifier (e.g. 'member').
+                It uses extension/midPointDisplayNamePrefix information from the archetype (e.g. 'Affiliation: ' defined in affiliation-archetype)</description>
+                <strength>strong</strength>
+                <source>
+                    <path>identifier</path>
+                </source>
+                <expression>
+                    <script>
+                        <code>
+                            if (identifier == null) {
+                                null
+                            } else {
+                                metarole = assignmentPath[-2].source                                                        // e.g. metarole-affiliation
+                                if (metarole == null) {
+                                    throw new IllegalStateException('No metarole in assignment path: ' + assignmentPath)
+                                }
+                                prefix = basic.getExtensionPropertyValue(metarole, 'midPointDisplayNamePrefix')         // e.g. 'Affiliation: '
+                                prefix + identifier                                                                     // e.g. 'Affiliation: member'
+                            }
+                        </code>
+                    </script>
+                </expression>
+                <target>
+                    <path>displayName</path>
+                </target>
+            </mapping>
+        </focusMappings>
+        
+        <!-- 
+            Inducement order of 2 means these mappings are to be applied on org object, because the assignment structure is like this:
+            
+                org -> archetype -> this-metarole
+         -->
+        <order>2</order>
+    </inducement>
+</role>
\ No newline at end of file
diff --git a/demo/complex2s/midpoint-objects/roles/metarole-ldap-group.xml b/demo/complex2s/midpoint-objects/roles/metarole-ldap-group.xml
new file mode 100644
index 0000000..c1bd880
--- /dev/null
+++ b/demo/complex2s/midpoint-objects/roles/metarole-ldap-group.xml
@@ -0,0 +1,121 @@
+<role xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
+      xmlns:apti="http://midpoint.evolveum.com/xml/ns/public/common/api-types-3" 
+      xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
+      xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" 
+      xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3" 
+      xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
+      xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3" 
+      xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" 
+      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
+      oid="8da46694-bd71-4e1e-bfd7-73865ae2ea9a">
+    <name>metarole-ldap-group</name>
+    <description>A metarole for archetyped LDAP groups</description>
+    <!--
+        This metarole supports LDAP groups that correspond to appropriately archetyped
+        org objects.
+        
+        The schema is the following:
+        
+        org -> archetype -> this metarole
+        
+        e.g.
+        
+        affiliation_member -> archetype affiliation -> metarole-ldap-group
+        or org-grouper-sysadmin -> archetype midpoint-group -> metarole-ldap-group   
+            
+        1) An org has appropriate archetype e.g. affiliation_member has an archetype of affiliation;
+        org-grouper-sysadmin has an archetype of midpoint-group.
+        
+        2) This archetype defines LDAP root the particular class of orgs e.g.  
+        ou=Affiliations,ou=Groups,dc=internet2,dc=edu for affiliations or
+        ou=midpoint,ou=Groups,dc=internet2,dc=edu for midPoint-defined groups.
+        
+        3) To avoid code duplication, these archetypes delegate everything related
+        to LDAP to this metarole.
+        
+        This metarole does the three things:
+        
+        1) It ensures that extension/ldapDn is filled in for particular org object.
+        This property is then used by LDAP resource outbound mappings to provide
+        a value for ri:dn attribute.
+        
+        The value of extension/ldapDn is determined as 
+        
+        cn=identifier (in org) + ldapRootDn (in archetype)
+        
+        2) It ensures that appropriate group object is created in LDAP.
+        This is done by inducing a construction with kind=entitlement,
+        intent=group to the org object (i.e. inducement order=2).
+        
+        3) It ensures that appropriate group membership is created in LDAP
+        for any user that has an assignment to the org object. This is done
+        by inducing a construction with default kind and intent (i.e. regular
+        account) to the user that has assigned the org object (i.e. inducement order=3).
+     --> 
+
+    <!--  Fills-in extension/ldapDn in org object -->
+    <inducement>
+        <focusMappings>
+            <mapping>
+                <name>ldapDn</name>
+                <strength>strong</strength>
+                <source>
+                    <path>identifier</path>
+                </source>
+                <expression>
+                    <script>
+                        <code>
+                            if (identifier == null) {
+                                null
+                            } else {
+                                // identifier = e.g. 'member'
+                                metarole = assignmentPath[-2].source        // e.g. metarole-affiliation
+                                log.info('metarole = {}', metarole)
+                                if (metarole == null) {
+                                    throw new IllegalStateException('No metarole in assignment path: ' + assignmentPath)
+                                }
+                                'cn=' + identifier + ',' + basic.getExtensionPropertyValue(metarole, 'ldapRootDn')
+                            }
+                        </code>
+                    </script>
+                </expression>
+                <target>
+                    <path>extension/ldapDn</path>
+                </target>
+            </mapping>
+        </focusMappings>
+        <order>2</order>        <!--  order=2 means the org object: org->archetype->metarole -->
+    </inducement>
+     
+    <!--  Provides LDAP group for the org object -->
+    <inducement>
+        <construction>
+            <resourceRef oid="0a37121f-d515-4a23-9b6d-554c5ef61272" relation="org:default" type="c:ResourceType" />    
+            <kind>entitlement</kind>
+            <intent>group</intent>
+        </construction>
+        <order>2</order>        <!--  order=2 means the org object: org->archetype->metarole -->
+    </inducement>
+    
+    <!--  Provides LDAP group membership for the org object members (users) -->
+    <inducement>
+        <construction>
+            <resourceRef oid="0a37121f-d515-4a23-9b6d-554c5ef61272" relation="org:default" type="c:ResourceType" />    
+            <association>
+                <c:ref>ri:group</c:ref>
+                <outbound>
+                    <expression>
+                        <associationFromLink>
+                            <projectionDiscriminator>
+                                <kind>entitlement</kind>
+                                <intent>group</intent>
+                            </projectionDiscriminator>
+                            <assignmentPathIndex>1</assignmentPathIndex>        <!--  derive from the immediately assigned org -->
+                        </associationFromLink>
+                    </expression>
+                </outbound>
+            </association>
+        </construction>
+        <order>3</order>        <!--  order=3 means the user object; user has an assignment to the org: user->org->archetype->metarole -->
+    </inducement>
+</role>
diff --git a/demo/complex2s/midpoint-objects/roles/metarole-mailing-list.xml b/demo/complex2s/midpoint-objects/roles/metarole-mailing-list.xml
deleted file mode 100644
index 6d90176..0000000
--- a/demo/complex2s/midpoint-objects/roles/metarole-mailing-list.xml
+++ /dev/null
@@ -1,59 +0,0 @@
-<role xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
-      xmlns:apti="http://midpoint.evolveum.com/xml/ns/public/common/api-types-3" 
-      xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
-      xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" 
-      xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3" 
-      xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
-      xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3" 
-      xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" 
-      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
-      oid="1c7beff4-cdf6-4e9f-b54c-79d0766f6fbe">
-    <name>metarole-mailing-list</name>
-    <inducement id="1">
-        <targetRef oid="d81fb46c-20c7-44d3-8402-fef404ea1264" relation="org:default" type="c:OrgType" />     <!-- mailing-lists -->
-    </inducement>
-    <inducement id="2">
-        <construction>
-            <resourceRef oid="0a37121f-d515-4a23-9b6d-554c5ef61272" relation="org:default" type="c:ResourceType" />     <!-- LDAP -->
-            <kind>entitlement</kind>
-            <intent>generic-group</intent>
-        </construction>
-        <order>1</order>
-    </inducement>
-    <inducement id="3">
-        <construction>
-            <resourceRef oid="0a37121f-d515-4a23-9b6d-554c5ef61272" relation="org:default" type="c:ResourceType" />     <!-- LDAP -->
-            <association>
-                <c:ref>ri:group</c:ref>
-                <outbound>
-                    <expression>
-                        <associationFromLink>
-                            <projectionDiscriminator>
-                                <kind>entitlement</kind>
-                                <intent>generic-group</intent>
-                            </projectionDiscriminator>
-                        </associationFromLink>
-                    </expression>
-                </outbound>
-            </association>
-        </construction>
-        <order>2</order>
-    </inducement>
-    <inducement id="4">
-        <construction>
-            <resourceRef oid="fe805d13-481b-43ec-97d8-9d2df72cd38e" relation="org:default" type="c:ResourceType" />     <!-- Mailing lists CSV -->
-            <attribute>
-                <c:ref>ri:lists</c:ref>
-                <outbound>
-                    <strength>strong</strength>
-                    <expression>
-                        <script>
-                            <code>assignmentPath[0].target.identifier</code>
-                        </script>
-                    </expression>
-                </outbound>
-            </attribute>
-        </construction>
-        <order>2</order>
-    </inducement>
-</role>
diff --git a/demo/complex2s/midpoint-objects/roles/metarole-midpoint-group.xml b/demo/complex2s/midpoint-objects/roles/metarole-midpoint-group.xml
deleted file mode 100644
index 6c1f2ce..0000000
--- a/demo/complex2s/midpoint-objects/roles/metarole-midpoint-group.xml
+++ /dev/null
@@ -1,38 +0,0 @@
-<role xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
-      xmlns:apti="http://midpoint.evolveum.com/xml/ns/public/common/api-types-3" 
-      xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" 
-      xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" 
-      xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3" 
-      xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
-      xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3" 
-      xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" 
-      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
-      oid="c691e15a-f30b-4e15-8445-532db07ceeeb">
-    <name>metarole-midpoint-group</name>
-    <inducement id="1">
-        <construction>
-            <resourceRef oid="0a37121f-d515-4a23-9b6d-554c5ef61272" relation="org:default" type="c:ResourceType" />     <!-- LDAP -->
-            <kind>entitlement</kind>
-            <intent>midpoint-group</intent>
-        </construction>
-    </inducement>
-    <inducement id="2">
-        <construction>
-            <resourceRef oid="0a37121f-d515-4a23-9b6d-554c5ef61272" relation="org:default" type="c:ResourceType" />     <!-- LDAP -->
-            <association>
-                <c:ref>ri:group</c:ref>
-                <outbound>
-                    <expression>
-                        <associationFromLink>
-                            <projectionDiscriminator>
-                                <kind>entitlement</kind>
-                                <intent>midpoint-group</intent>
-                            </projectionDiscriminator>
-                        </associationFromLink>
-                    </expression>
-                </outbound>
-            </association>
-        </construction>
-        <order>2</order>
-    </inducement>
-</role>
diff --git a/demo/complex2s/midpoint-objects/systemConfigurations/SystemConfiguration.xml b/demo/complex2s/midpoint-objects/systemConfigurations/SystemConfiguration.xml
index 78e4487..dce8990 100644
--- a/demo/complex2s/midpoint-objects/systemConfigurations/SystemConfiguration.xml
+++ b/demo/complex2s/midpoint-objects/systemConfigurations/SystemConfiguration.xml
@@ -134,36 +134,6 @@
             <details>false</details>
          </auditing>
       </logging>
-      <defaultObjectPolicyConfiguration id="18">
-         <type>OrgType</type>
-         <subtype>affiliation</subtype>
-         <objectTemplateRef xmlns:tns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" oid="d87aa04f-189c-4d6f-b6e1-216dad622142" relation="org:default" type="tns:ObjectTemplateType"/>
-      </defaultObjectPolicyConfiguration>
-      <defaultObjectPolicyConfiguration id="19">
-         <type>OrgType</type>
-         <subtype>department</subtype>
-         <objectTemplateRef xmlns:tns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" oid="0caf2f69-7c72-4946-b218-d84e78b2a057" relation="org:default" type="tns:ObjectTemplateType"/>
-      </defaultObjectPolicyConfiguration>
-      <defaultObjectPolicyConfiguration id="20">
-         <type>OrgType</type>
-         <subtype>course</subtype>
-         <objectTemplateRef xmlns:tns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" oid="d35bdec6-643b-41d8-ad5d-8eeb701169d1" relation="org:default" type="tns:ObjectTemplateType"/>
-      </defaultObjectPolicyConfiguration>
-      <defaultObjectPolicyConfiguration id="110">
-         <type>OrgType</type>
-         <subtype>mailing-list</subtype>
-         <objectTemplateRef xmlns:tns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" oid="be84a39a-c004-490b-9b78-a871b837f6df" relation="org:default" type="tns:ObjectTemplateType"/>
-      </defaultObjectPolicyConfiguration>
-      <defaultObjectPolicyConfiguration id="100">
-         <type>OrgType</type>
-         <subtype>generic-group</subtype>
-         <objectTemplateRef xmlns:tns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" oid="e2a6193a-8981-4143-9da1-9a7b32c0b819" relation="org:default" type="tns:ObjectTemplateType"/>
-      </defaultObjectPolicyConfiguration>
-      <defaultObjectPolicyConfiguration id="21">
-         <type>RoleType</type>
-         <subtype>midpoint-group</subtype>
-         <objectTemplateRef xmlns:tns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" oid="804f8658-0828-4dab-a2ed-f13985e4f80b" relation="org:default" type="tns:ObjectTemplateType"/>
-      </defaultObjectPolicyConfiguration>
       <defaultObjectPolicyConfiguration id="101">
          <type>UserType</type>
          <objectTemplateRef xmlns:tns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" oid="8098b124-c20c-4965-8adf-e528abedf7a4" relation="org:default" type="tns:ObjectTemplateType"/>
@@ -247,24 +217,42 @@
                      <level>normal</level>
                  </tracingTypeProfile>
              </profile>
-             <profile>
-                 <name>functional-with-full-log</name>
-                 <displayName>Functional tracing with full logging</displayName>
-                 <visible>true</visible>
-                 <fileNamePattern>functional-trace %{timestamp} %{focusName}</fileNamePattern>
-                 <createRepoObject>true</createRepoObject>
-                 <compressOutput>true</compressOutput>
-                 <collectLogEntries>true</collectLogEntries>
-                 <loggingOverride>
+            <profile>
+                <name>functional-model-logging</name>
+                <displayName>Functional tracing (with model logging)</displayName>
+                <visible>true</visible>
+                <fileNamePattern>functional-trace %{timestamp} %{focusName}</fileNamePattern>
+                <createRepoObject>true</createRepoObject>
+                <compressOutput>true</compressOutput>
+                <collectLogEntries>true</collectLogEntries>
+                <loggingOverride>
                     <levelOverride>
-                        <logger>com.evolveum.midpoint</logger>
+                        <logger>com.evolveum.midpoint.model</logger>
                         <level>TRACE</level>
                     </levelOverride>
-                 </loggingOverride>
-                 <tracingTypeProfile>
-                     <level>normal</level>
-                 </tracingTypeProfile>
-             </profile>
+                </loggingOverride>
+                <tracingTypeProfile>
+                    <level>normal</level>
+                </tracingTypeProfile>
+            </profile>
+            <profile>
+                <name>functional-sql-logging</name>
+                <displayName>Functional tracing (with SQL logging)</displayName>
+                <visible>true</visible>
+                <fileNamePattern>functional-trace %{timestamp} %{focusName}</fileNamePattern>
+                <createRepoObject>true</createRepoObject>
+                <compressOutput>true</compressOutput>
+                <collectLogEntries>true</collectLogEntries>
+                <loggingOverride>
+                    <levelOverride>
+                        <logger>org.hibernate.SQL</logger>
+                        <level>TRACE</level>
+                    </levelOverride>
+                </loggingOverride>
+                <tracingTypeProfile>
+                    <level>normal</level>
+                </tracingTypeProfile>
+            </profile>
          </tracing>
       </internals>
       <deploymentInformation>
diff --git a/demo/complex2s/midpoint-objects/users/user-banderson.xml b/demo/complex2s/midpoint-objects/users/user-banderson.xml
index fa1316a..6ef2563 100644
--- a/demo/complex2s/midpoint-objects/users/user-banderson.xml
+++ b/demo/complex2s/midpoint-objects/users/user-banderson.xml
@@ -4,8 +4,8 @@
       oid="e897468f-20bd-419c-8fc5-1fe60e2600de">
     <name>banderson</name>
     <assignment id="1">
-        <targetRef oid="d48ec05b-fffd-4262-acd3-d9ff63365b62" relation="org:default" type="c:RoleType">
-            <!-- role-grouper-sysadmin -->
+        <targetRef oid="d48ec05b-fffd-4262-acd3-d9ff63365b62" relation="org:default" type="c:OrgType">
+            <!-- org-grouper-sysadmin -->
         </targetRef>
     </assignment>
     <fullName>Bob Anderson</fullName>