From 8fade63bd6460a150dfa376bf1fd030bd863f317 Mon Sep 17 00:00:00 2001
From: Paul Caskey <pcaskey@internet2.edu>
Date: Thu, 12 Oct 2023 19:12:47 +0000
Subject: [PATCH] changes for midpoint's grouper resource

---
 .../objectTemplates/100-template-user.xml     | 40 +++++++++++-
 .../resources/100-grouper-new.xml             | 62 ++-----------------
 2 files changed, 43 insertions(+), 59 deletions(-)

diff --git a/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/objectTemplates/100-template-user.xml b/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/objectTemplates/100-template-user.xml
index fb5239a..2c11989 100644
--- a/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/objectTemplates/100-template-user.xml
+++ b/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/objectTemplates/100-template-user.xml
@@ -37,14 +37,14 @@
             </variable>
             <script>
                 <code>
-				    import com.evolveum.midpoint.xml.ns._public.common.common_3.*
+		    import com.evolveum.midpoint.xml.ns._public.common.common_3.*
                     import com.evolveum.midpoint.schema.constants.*
                     import com.evolveum.midpoint.schema.* 
                     import javax.xml.namespace.*
                     import com.evolveum.midpoint.util.*
                     import com.evolveum.midpoint.prism.path.*
-					import com.evolveum.midpoint.prism.polystring.*
-					import com.evolveum.midpoint.prism.PrismContainer.*
+		    import com.evolveum.midpoint.prism.polystring.*
+		    import com.evolveum.midpoint.prism.PrismContainer.*
 
 					def nameunique = false
 					def uidunique = false
@@ -126,4 +126,38 @@
 			</condition>
 		</mapping>
 	</item>
+
+    <mapping>
+        <description>
+          This mapping will remove assignments with grouper-grouper subtype for all users who don't have account linked on Grouper resource.
+          This is addressing the situation when a user account on Grouper resource is deleted and therefore is not logner synchronized.
+          Also, this will clean up all grouper-group assignments that shouldn't exist. We want such assignments exist only if they exists in Grouper resource.
+        </description>
+        <strength>strong</strength>
+        <expression>
+            <script>
+                <code>
+                  return null
+                </code>
+            </script>
+        </expression>
+        <target>
+            <path>assignment</path>
+            <set>
+                <condition>
+                    <script>
+                        <code>
+                           //OID points to Grouper resource
+                           if(!midpoint.hasLinkedAccount('fb0bbf07-e33f-4ddd-85a1-16a7edc237f2')) {
+                             return assignment?.subtype?.contains('grouper-group')
+                           } else {
+                              return false
+                           }
+                        </code>
+                    </script>
+                </condition>
+            </set>
+        </target>
+    </mapping>
+
 </objectTemplate>
diff --git a/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/resources/100-grouper-new.xml b/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/resources/100-grouper-new.xml
index 14d588c..af52478 100644
--- a/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/resources/100-grouper-new.xml
+++ b/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/resources/100-grouper-new.xml
@@ -199,6 +199,12 @@
                         <synchronize/>
                     </actions>
                 </reaction>
+                <reaction>
+                    <situation>deleted</situation>
+                    <actions>
+                        <synchronize/>
+                    </actions>
+                </reaction>
             </synchronization>
 
         </objectType>
@@ -289,62 +295,6 @@
                 <fetchStrategy>explicit</fetchStrategy>
             </attribute>
 
-            <association>
-                <ref>ri:subjects</ref>
-                <inbound>
-                    <expression>
-                        <assignmentTargetSearch>
-                            <targetType>c:OrgType</targetType>
-                            <filter>
-                                <q:equal>
-                                    <q:path>name</q:path>
-                                    <expression>
-                                        <script>
-                                            <code>
-                                                def groupName;
-                                                if (entitlement!=null){
-                                                def attrs = entitlement.getAttributes();
-                                                pcvi = attrs.asPrismContainerValue().getItems();
-
-                                                for (obj in pcvi){
-                                                if (obj.isSingleValue()){
-
-                                                if("uid".equals(obj?.getElementName().toString())){
-
-                                                groupName = obj?.getValue()?.getRealValue()
-
-                                                //TODO remove log
-                                                log.info("The group name: " +groupName)
-
-                                                return groupName
-                                                }
-                                                }
-                                                }
-
-                                                }
-
-                                                return groupName;
-                                            </code>
-                                        </script>
-                                    </expression>
-                                </q:equal>
-                            </filter>
-                        </assignmentTargetSearch>
-                    </expression>
-                    <target>
-                        <path>assignment</path>
-                    </target>
-                </inbound>
-                <kind>account</kind>
-                <intent>default</intent>
-                <direction>subjectToObject</direction>
-                <associationAttribute>ri:members</associationAttribute>
-                <valueAttribute>icfs:uid</valueAttribute>
-                <shortcutAssociationAttribute>ri:member_of</shortcutAssociationAttribute>
-                <shortcutValueAttribute>icfs:uid</shortcutValueAttribute>
-                <explicitReferentialIntegrity>false</explicitReferentialIntegrity>
-            </association>
-
             <correlation>
                 <correlators>
                     <items>