diff --git a/Workbench/directory/Dockerfile b/Workbench/directory/Dockerfile
index 3fc3b6e..85b4164 100644
--- a/Workbench/directory/Dockerfile
+++ b/Workbench/directory/Dockerfile
@@ -24,7 +24,8 @@ RUN useradd ldapadmin \
&& /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-dir \
&& while ! curl -s ldap://localhost:389 > /dev/null; do echo waiting for ldap to start; sleep 1; done; \
ldapadd -H ldap:/// -f /seed-data/data.ldif -x -D "cn=Directory Manager" -w password \
- && ldapmodify -H ldap:/// -f /seed-data/incwbperson-obj.ldif -x -D "cn=Directory Manager" -w password
+ && ldapmodify -H ldap:/// -f /seed-data/incwbperson-obj.ldif -x -D "cn=Directory Manager" -w password \
+ && ldapmodify -H ldap:/// -f /seed-data/edumember-obj.ldif -x -D "cn=Directory Manager" -w password
EXPOSE 389 443
diff --git a/Workbench/directory/container_files/seed-data/edumember-obj.ldif b/Workbench/directory/container_files/seed-data/edumember-obj.ldif
new file mode 100644
index 0000000..38b287f
--- /dev/null
+++ b/Workbench/directory/container_files/seed-data/edumember-obj.ldif
@@ -0,0 +1,30 @@
+#
+# eduMember Objectclass
+#
+#
+# "eduMember" attributes
+#
+dn: cn=schema
+changetype: modify
+#
+add: attributetypes
+attributeTypes: ( 1.3.6.1.4.1.5923.1.5.1.1
+ NAME 'isMemberOf'
+ DESC 'identifiers for groups to which containing entity belongs'
+ EQUALITY caseExactMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+attributeTypes: ( 1.3.6.1.4.1.5923.1.5.1.2
+ NAME 'hasMember'
+ DESC 'identifiers for entities that are members of the group'
+ EQUALITY caseExactMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+-
+#
+add: objectclasses
+objectClasses: ( 1.3.6.1.4.1.5923.1.5.2 NAME 'eduMember'
+ AUXILIARY
+ MAY ( isMemberOf $ hasMember )
+ )
+#
+# end of LDIF
+#
diff --git a/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/resources/100-ldap-main.xml b/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/resources/100-ldap-main.xml
index f3a4892..0e7d770 100644
--- a/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/resources/100-ldap-main.xml
+++ b/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/resources/100-ldap-main.xml
@@ -61,6 +61,7 @@
ri:inetOrgPerson
ri:eduPerson
+ ri:eduMember
ri:incwbPerson
ri:organizationalPerson
ri:person
@@ -68,6 +69,1050 @@
ri:groupOfNames
ri:organizationalUnit
+
+
+
+
+
+
+
+
+ ri:nsUniqueId
+ ri:dn
+ ri:dn
+ ri:dn
+ eduMember
+ true
+
+
+
+
+
+
+ 120
+ nsAccountLock
+ nsAccountLock
+ false
+
+
+
+
+
+
+ 130
+ read
+ createTimestamp
+ createTimestamp
+ false
+
+
+
+
+
+
+ 140
+ qn973:distinguishedName
+ memberOf
+ memberOf
+ false
+
+
+
+
+
+
+ 150
+ hasMember
+ hasMember
+
+
+
+
+
+
+ 110
+ qn468:distinguishedName
+ dn
+ __NAME__
+
+
+
+
+
+
+ 160
+ isMemberOf
+ isMemberOf
+
+
+
+
+
+
+ 100
+ read
+ nsUniqueId
+ __UID__
+
+
+
+
+
+
+
+
+
+ ri:entryUUID
+ ri:dn
+ ri:dn
+ ri:dn
+ inetOrgPerson
+
+
+
+
+
+
+ 120
+ qn277:stringIgnoreCase
+ initials
+ initials
+
+
+
+
+
+
+ 130
+ memberOf
+ memberOf
+ false
+
+
+
+
+
+
+ 140
+ homePhone
+ homePhone
+
+
+
+
+
+
+ 150
+ audio
+ audio
+
+
+
+
+
+
+ 160
+ qn612:stringIgnoreCase
+ mail
+ mail
+
+
+
+
+
+
+ 170
+ qn779:stringIgnoreCase
+ carLicense
+ carLicense
+
+
+
+
+
+
+ 180
+ qn508:stringIgnoreCase
+ departmentNumber
+ departmentNumber
+
+
+
+
+
+
+ 190
+ qn578:distinguishedName
+ manager
+ manager
+
+
+
+
+
+
+ 200
+ qn454:stringIgnoreCase
+ businessCategory
+ businessCategory
+
+
+
+
+
+
+ 210
+ homePostalAddress
+ homePostalAddress
+
+
+
+
+
+
+ 220
+ qn723:distinguishedName
+ secretary
+ secretary
+
+
+
+
+
+
+ 230
+ photo
+ photo
+
+
+
+
+
+
+ 240
+ labeledURI
+ labeledURI
+
+
+
+
+
+
+ 250
+ qn735:stringIgnoreCase
+ displayName
+ displayName
+
+
+
+
+
+
+ 260
+ pager
+ pager
+
+
+
+
+
+
+ 270
+ qn74:stringIgnoreCase
+ roomNumber
+ roomNumber
+
+
+
+
+
+
+ 280
+ qn272:stringIgnoreCase
+ physicalDeliveryOfficeName
+ physicalDeliveryOfficeName
+
+
+
+
+
+
+ 290
+ qn301:stringIgnoreCase
+ uid
+ uid
+
+
+
+
+
+
+ 300
+ qn348:distinguishedName
+ seeAlso
+ seeAlso
+
+
+
+
+
+
+ 310
+ qn817:stringIgnoreCase
+ destinationIndicator
+ destinationIndicator
+
+
+
+
+
+
+ 320
+ postalAddress
+ postalAddress
+
+
+
+
+
+
+ 330
+ qn260:stringIgnoreCase
+ preferredLanguage
+ preferredLanguage
+
+
+
+
+
+
+ 340
+ preferredDeliveryMethod
+ preferredDeliveryMethod
+
+
+
+
+
+
+ 350
+ facsimileTelephoneNumber
+ facsimileTelephoneNumber
+
+
+
+
+
+
+ 360
+ qn847:stringIgnoreCase
+ employeeType
+ employeeType
+
+
+
+
+
+
+ 370
+ internationaliSDNNumber
+ internationaliSDNNumber
+
+
+
+
+
+
+ 380
+ qn290:stringIgnoreCase
+ postOfficeBox
+ postOfficeBox
+
+
+
+
+
+
+ 390
+ telephoneNumber
+ telephoneNumber
+
+
+
+
+
+
+ 400
+ qn79:stringIgnoreCase
+ l
+ l
+
+
+
+
+
+
+ 410
+ qn814:stringIgnoreCase
+ employeeNumber
+ employeeNumber
+
+
+
+
+
+
+ 420
+ jpegPhoto
+ jpegPhoto
+
+
+
+
+
+
+ 430
+ qn632:stringIgnoreCase
+ o
+ o
+
+
+
+
+
+
+ 440
+ userPKCS12
+ userPKCS12
+
+
+
+
+
+
+ 450
+ qn773:stringIgnoreCase
+ description
+ description
+
+
+
+
+
+
+ 110
+ qn855:distinguishedName
+ dn
+ __NAME__
+
+
+
+
+
+
+ 460
+ qn824:stringIgnoreCase
+ sn
+ sn
+
+
+
+
+
+
+ 470
+ qn72:stringIgnoreCase
+ givenName
+ givenName
+
+
+
+
+
+
+ 480
+ telexNumber
+ telexNumber
+
+
+
+
+
+
+ 490
+ qn503:stringIgnoreCase
+ postalCode
+ postalCode
+
+
+
+
+
+
+ 500
+ read
+ createTimestamp
+ createTimestamp
+ false
+
+
+
+
+
+
+ 510
+ userSMIMECertificate
+ userSMIMECertificate
+
+
+
+
+
+
+ 520
+ userCertificate
+ userCertificate
+
+
+
+
+
+
+ 530
+ qn417:stringIgnoreCase
+ st
+ st
+
+
+
+
+
+
+ 540
+ teletexTerminalIdentifier
+ teletexTerminalIdentifier
+
+
+
+
+
+
+ 550
+ qn682:stringIgnoreCase
+ ou
+ ou
+
+
+
+
+
+
+ 560
+ qn114:stringIgnoreCase
+ street
+ street
+
+
+
+
+
+
+ 570
+ qn260:stringIgnoreCase
+ cn
+ cn
+
+
+
+
+
+
+ 580
+ registeredAddress
+ registeredAddress
+
+
+
+
+
+
+ 590
+ x121Address
+ x121Address
+
+
+
+
+
+
+ 600
+ qn103:stringIgnoreCase
+ title
+ title
+
+
+
+
+
+
+ 610
+ x500UniqueIdentifier
+ x500UniqueIdentifier
+
+
+
+
+
+
+ 620
+ mobile
+ mobile
+
+
+
+
+
+
+ 100
+ read
+ qn946:uuid
+ entryUUID
+ __UID__
+
+
+
+
+
+
+
+
+
+ ri:entryUUID
+ ri:dn
+ ri:dn
+ ri:dn
+ groupOfUniqueNames
+
+
+
+
+
+
+ 120
+ read
+ createTimestamp
+ createTimestamp
+ false
+
+
+
+
+
+
+ 130
+ uniqueMember
+ uniqueMember
+
+
+
+
+
+
+ 140
+ memberOf
+ memberOf
+ false
+
+
+
+
+
+
+ 150
+ qn47:stringIgnoreCase
+ ou
+ ou
+
+
+
+
+
+
+ 160
+ qn800:stringIgnoreCase
+ cn
+ cn
+
+
+
+
+
+
+ 170
+ qn573:stringIgnoreCase
+ o
+ o
+
+
+
+
+
+
+ 180
+ qn389:distinguishedName
+ owner
+ owner
+
+
+
+
+
+
+ 190
+ qn748:distinguishedName
+ seeAlso
+ seeAlso
+
+
+
+
+
+
+ 200
+ qn447:stringIgnoreCase
+ description
+ description
+
+
+
+
+
+
+ 210
+ qn897:stringIgnoreCase
+ businessCategory
+ businessCategory
+
+
+
+
+
+
+ 110
+ qn327:distinguishedName
+ dn
+ __NAME__
+
+
+
+
+
+
+ 100
+ read
+ qn35:uuid
+ entryUUID
+ __UID__
+
+
+
+
+
+
+
+
+
+ ri:entryUUID
+ ri:dn
+ ri:dn
+ ri:dn
+ eduPerson
+ true
+
+
+
+
+
+
+ 120
+ read
+ createTimestamp
+ createTimestamp
+ false
+
+
+
+
+
+
+ 130
+ qn158:stringIgnoreCase
+ eduPersonScopedAffiliation
+ eduPersonScopedAffiliation
+
+
+
+
+
+
+ 140
+ memberOf
+ memberOf
+ false
+
+
+
+
+
+
+ 150
+ qn631:stringIgnoreCase
+ eduPersonPrimaryAffiliation
+ eduPersonPrimaryAffiliation
+
+
+
+
+
+
+ 160
+ qn676:distinguishedName
+ eduPersonOrgDN
+ eduPersonOrgDN
+
+
+
+
+
+
+ 170
+ qn444:distinguishedName
+ eduPersonOrgUnitDN
+ eduPersonOrgUnitDN
+
+
+
+
+
+
+ 180
+ qn549:stringIgnoreCase
+ eduPersonAffiliation
+ eduPersonAffiliation
+
+
+
+
+
+
+ 190
+ qn371:stringIgnoreCase
+ eduPersonPrincipalNamePrior
+ eduPersonPrincipalNamePrior
+
+
+
+
+
+
+ 200
+ qn469:stringIgnoreCase
+ eduPersonTargetedID
+ eduPersonTargetedID
+
+
+
+
+
+
+ 210
+ eduPersonEntitlement
+ eduPersonEntitlement
+
+
+
+
+
+
+ 220
+ qn27:stringIgnoreCase
+ eduPersonAssurance
+ eduPersonAssurance
+
+
+
+
+
+
+ 230
+ qn972:stringIgnoreCase
+ eduPersonNickname
+ eduPersonNickname
+
+
+
+
+
+
+ 240
+ qn626:stringIgnoreCase
+ eduPersonOrcid
+ eduPersonOrcid
+
+
+
+
+
+
+ 250
+ qn606:stringIgnoreCase
+ eduPersonPrincipalName
+ eduPersonPrincipalName
+
+
+
+
+
+
+ 260
+ qn835:distinguishedName
+ eduPersonPrimaryOrgUnitDN
+ eduPersonPrimaryOrgUnitDN
+
+
+
+
+
+
+ 110
+ qn348:distinguishedName
+ dn
+ __NAME__
+
+
+
+
+
+
+ 270
+ qn319:stringIgnoreCase
+ eduPersonUniqueId
+ eduPersonUniqueId
+
+
+
+
+
+
+ 100
+ read
+ qn942:uuid
+ entryUUID
+ __UID__
+
+
+
+
+
+
+
+
+
+ ri:nsUniqueId
+ ri:dn
+ ri:dn
+ ri:dn
+ incwbPerson
+ true
+
+
+
+
+
+
+ 120
+ nsAccountLock
+ nsAccountLock
+ false
+
+
+
+
+
+
+ 130
+ read
+ createTimestamp
+ createTimestamp
+ false
+
+
+
+
+
+
+ 140
+ qn940:distinguishedName
+ memberOf
+ memberOf
+ false
+
+
+
+
+
+
+ 150
+ qn491:stringIgnoreCase
+ incwbPersonEmployeeID
+ incwbPersonEmployeeID
+
+
+
+
+
+
+ 160
+ qn200:stringIgnoreCase
+ incwbPersonStudentID
+ incwbPersonStudentID
+
+
+
+
+
+
+ 170
+ qn405:stringIgnoreCase
+ incwbPersonGuestID
+ incwbPersonGuestID
+
+
+
+
+
+
+ 110
+ qn965:distinguishedName
+ dn
+ __NAME__
+
+
+
+
+
+
+ 100
+ read
+ nsUniqueId
+ __UID__
+
+
+
+
+
+
+
@@ -77,6 +1122,7 @@
true
ri:inetOrgPerson
ri:eduPerson
+ ri:eduMember
ri:incwbPerson
[ri:dn]
@@ -249,6 +1295,15 @@
objectToSubject
ri:uniqueMember
ri:dn
+
+
+ [ri:isMemberOfAssociation]
+ false
+ entitlement
+ group
+ subjectToObject
+ ri:isMemberOf
+ ri:cn
@@ -303,6 +1358,7 @@
[ri:cn]
mr:stringIgnoreCase
+ true
weak
diff --git a/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/roles/200-metarole-ldap-group.xml b/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/roles/200-metarole-ldap-group.xml
index 91bf370..dc52597 100644
--- a/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/roles/200-metarole-ldap-group.xml
+++ b/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/roles/200-metarole-ldap-group.xml
@@ -121,6 +121,20 @@
+
+
+ [ri:isMemberOfAssociation]
+
+
+
+
+ entitlement
+ group
+
+ 1
+
+
+
3