diff --git a/demo/complex2s/midpoint-objects/objectTemplates/template-user.xml b/demo/complex2s/midpoint-objects/objectTemplates/template-user.xml
index 7079a1d..8c7959f 100644
--- a/demo/complex2s/midpoint-objects/objectTemplates/template-user.xml
+++ b/demo/complex2s/midpoint-objects/objectTemplates/template-user.xml
@@ -7,24 +7,67 @@
             <path>name</path>
         </source>
         <expression>
-            <assignmentTargetSearch>
-                <targetType>OrgType</targetType>
-                <filter>
-                    <q:equal>
-                        <q:path>extension/member</q:path>                       
-                        <expression>
-                            <script>
-                                <code>
-                                    basic.stringify(name)
-                                </code>
-                            </script>
-                        </expression>
-                    </q:equal>
-                </filter>
-                <assignmentProperties>
-                    <subtype>grouper-group</subtype>
-                </assignmentProperties>
-            </assignmentTargetSearch>       
+            <script>
+                <code>
+                    import com.evolveum.midpoint.xml.ns._public.common.common_3.*
+                    import com.evolveum.midpoint.schema.constants.*
+                    import com.evolveum.midpoint.schema.* 
+                    import javax.xml.namespace.*
+                    import com.evolveum.midpoint.util.*
+                    import com.evolveum.midpoint.prism.path.*
+                    
+                    GROUPER_RESOURCE_OID = '1eff65de-5bb6-483d-9edf-8cc2c2ee0233'
+                    MEMBER_NAME = new QName(MidPointConstants.NS_RI, 'member')
+                    
+                    memberDef = prismContext.definitionFactory().createPropertyDefinition(MEMBER_NAME, DOMUtil.XSD_STRING)
+                    memberDef.setMaxOccurs(-1)
+                    
+                    // TODO check for exists/dead
+                    shadowQuery = prismContext.queryFor(ShadowType.class)
+                        .item(ShadowType.F_RESOURCE_REF).ref(GROUPER_RESOURCE_OID)
+                        .and().item(ShadowType.F_SYNCHRONIZATION_SITUATION).eq(SynchronizationSituationType.LINKED)
+                        .and().item(ShadowType.F_KIND).eq(ShadowKindType.ENTITLEMENT)
+                        .and().item(ShadowType.F_INTENT).eq('group')
+                        .and().item(ItemPath.create(ShadowType.F_ATTRIBUTES, MEMBER_NAME), memberDef).eq(basic.stringify(name))
+                        .build()
+                        
+                    //log.info('shadowQuery = {}\n{}', shadowQuery, shadowQuery.debugDump())
+                    options = SelectorOptions.createCollection(GetOperationOptions.createNoFetch())
+                    shadows = midpoint.searchObjects(ShadowType.class, shadowQuery, options)
+                    //log.info('shadows found for {}: {}', name, shadows)
+                    
+                    orgNames = shadows.collect { basic.stringify(it.name) }            // todo - use attributes
+                    log.info('org names = {}', orgNames)
+                    
+                    if (!orgNames.isEmpty()) { 
+                        orgQueryBuilder = prismContext.queryFor(OrgType.class)
+                        
+                        first = true
+                        for (orgName in orgNames) {
+                            if (first) {
+                                first = false
+                            } else {
+                                orgQueryBuilder = orgQueryBuilder.or()
+                            }
+                            orgQueryBuilder = orgQueryBuilder.item(ItemPath.create(OrgType.F_EXTENSION, 'grouperName')).eq(orgName)
+                        }
+                            
+                        orgQuery = orgQueryBuilder.build()
+                        //log.info('org query:\n', orgQuery.debugDump())
+                        
+                        orgs = midpoint.searchObjects(OrgType.class, orgQuery, null)
+                        log.info('orgs found: {}', orgs)
+                        
+                        orgs.collect {
+                            new AssignmentType(prismContext)
+                                .subtype('grouper-group')
+                                .targetRef(it.oid, OrgType.COMPLEX_TYPE)
+                        }
+                    } else {
+                        null
+                    }
+                </code>
+            </script>
         </expression>
         <target>
             <path>assignment</path>
diff --git a/demo/complex2s/midpoint-objects/resources/resource-grouper.xml b/demo/complex2s/midpoint-objects/resources/resource-grouper.xml
index eafe0ff..6de99bd 100644
--- a/demo/complex2s/midpoint-objects/resources/resource-grouper.xml
+++ b/demo/complex2s/midpoint-objects/resources/resource-grouper.xml
@@ -130,15 +130,6 @@
             <attribute>
                 <ref>ri:member</ref>
                 <fetchStrategy>explicit</fetchStrategy>
-                <inbound>
-                    <strength>strong</strength>
-                    <target>
-                        <path>extension/member</path>
-                        <c:set>
-                            <c:predefined>all</c:predefined>
-                        </c:set>
-                    </target>
-                </inbound>
             </attribute>
         </objectType>
     </schemaHandling>
diff --git a/demo/complex2s/midpoint-objects/systemConfigurations/SystemConfiguration.xml b/demo/complex2s/midpoint-objects/systemConfigurations/SystemConfiguration.xml
index 74fb152..27d67ff 100644
--- a/demo/complex2s/midpoint-objects/systemConfigurations/SystemConfiguration.xml
+++ b/demo/complex2s/midpoint-objects/systemConfigurations/SystemConfiguration.xml
@@ -1,29 +1,7 @@
 <systemConfiguration xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:apti="http://midpoint.evolveum.com/xml/ns/public/common/api-types-3" xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3" xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3" xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3" xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" oid="00000000-0000-0000-0000-000000000001" version="2">
       <name>SystemConfiguration</name>
-      <metadata>
-         <requestTimestamp>2018-08-15T13:30:55.282+02:00</requestTimestamp>
-         <createTimestamp>2018-08-15T13:30:55.372+02:00</createTimestamp>
-         <createChannel>http://midpoint.evolveum.com/xml/ns/public/gui/channels-3#init</createChannel>
-      </metadata>
-      <operationExecution id="17">
-         <timestamp>2018-08-15T13:30:55.562+02:00</timestamp>
-         <operation>
-            <objectDelta>
-               <t:changeType>add</t:changeType>
-               <t:objectType>c:SystemConfigurationType</t:objectType>
-            </objectDelta>
-            <executionResult>
-               <operation>com.evolveum.midpoint.model.impl.lens.ChangeExecutor.executeDelta</operation>
-               <status>handled_error</status>
-               <token>1000000000000000009</token>
-               <message>Object of type 'SystemConfigurationType' with oid '00000000-0000-0000-0000-000000000001' was not found.</message>
-            </executionResult>
-            <objectName>SystemConfiguration</objectName>
-         </operation>
-         <status>handled_error</status>
-         <channel>http://midpoint.evolveum.com/xml/ns/public/gui/channels-3#init</channel>
-      </operationExecution>
       <globalSecurityPolicyRef xmlns:tns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" oid="00000000-0000-0000-0000-000000000120" relation="org:default" type="tns:SecurityPolicyType"/>
+<!--
       <modelHooks>
          <change>
             <hook>
@@ -89,7 +67,7 @@
             </hook>
          </change>
       </modelHooks>
-
+  -->
       <logging>
          <classLogger id="1">
             <level>ERROR</level>
@@ -271,6 +249,9 @@
              </profile>
          </tracing>
       </internals>
+      <deploymentInformation>
+         <name>demo/complex2s</name>
+      </deploymentInformation>
       <adminGuiConfiguration>
          <userDashboardLink id="13">
             <targetUrl>/self/profile</targetUrl>
@@ -312,6 +293,6 @@
             <color>purple</color>
             <authorization>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#resources</authorization>
          </userDashboardLink>
-         <enableExperimentalFeatures>false</enableExperimentalFeatures>
+         <enableExperimentalFeatures>true</enableExperimentalFeatures>
       </adminGuiConfiguration>
    </systemConfiguration>
diff --git a/demo/complex2s/midpoint_server/container_files/mp-home/config.xml b/demo/complex2s/midpoint_server/container_files/mp-home/config.xml
new file mode 100644
index 0000000..5a4e0ea
--- /dev/null
+++ b/demo/complex2s/midpoint_server/container_files/mp-home/config.xml
@@ -0,0 +1,64 @@
+<?xml version="1.0"?>
+<!--
+  ~ Copyright (c) 2010-2017 Evolveum
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~     http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<configuration>
+    <midpoint>
+        <webApplication>
+            <importFolder>${midpoint.home}/import</importFolder>
+        </webApplication>
+        <repository>
+            <repositoryServiceFactoryClass>com.evolveum.midpoint.repo.sql.SqlRepositoryFactory</repositoryServiceFactoryClass>
+            <baseDir>${midpoint.home}</baseDir>
+            <asServer>true</asServer>
+            <enableIndexOnlyItems>true</enableIndexOnlyItems>
+            <enableNoFetchExtensionValuesInsertion>true</enableNoFetchExtensionValuesInsertion>
+            <enableNoFetchExtensionValuesDeletion>true</enableNoFetchExtensionValuesDeletion>
+        </repository>
+        <audit>
+            <auditService>
+                <auditServiceFactoryClass>com.evolveum.midpoint.audit.impl.LoggerAuditServiceFactory</auditServiceFactoryClass>
+            </auditService>
+            <auditService>
+                <auditServiceFactoryClass>com.evolveum.midpoint.repo.sql.SqlAuditServiceFactory</auditServiceFactoryClass>
+            </auditService>
+        </audit>
+        <icf>
+            <scanClasspath>true</scanClasspath>
+            <scanDirectory>${midpoint.home}/icf-connectors</scanDirectory>
+        </icf>
+        <keystore>
+            <keyStorePath>${midpoint.home}/keystore.jceks</keyStorePath>
+            <keyStorePassword>changeit</keyStorePassword>
+            <encryptionKeyAlias>default</encryptionKeyAlias>
+            <!--
+            You can use smaller cipher key size for encryption. For:
+            AES_128 "http://www.w3.org/2001/04/xmlenc#aes128-cbc";
+            AES_256 "http://www.w3.org/2001/04/xmlenc#aes256-cbc";
+            AES_192 "http://www.w3.org/2001/04/xmlenc#aes192-cbc";
+
+            in element <xmlCipher></xmlCipher>
+            By default AES_128 is used. If you change key size, than
+            you must also create secret key in key store with proper key size and change encryptionKeyAlias.
+
+            To generate keystore with keytool use command:
+            keytool -genseckey -alias default -keystore keystore.jceks -storetype jceks -keyalg AES -keysize 128
+
+            secret key password is by default 'midpoint'
+            -->
+        </keystore>
+        <!-- <profilingMode>dynamic</profilingMode> -->
+    </midpoint>
+</configuration>