Could you have a look at this issue, or at least tell me what Log files to
look at?
Using the method you described I just cannot provision (or deprovision)
already existing users, and this is a serious issue for my project (and for
syncope in general, what's an IDM product that cannot provision reliably?)
The only way I can get it to work is to do a rest call from the workflow,
but this is a hack, and unreliable
Jesse
On Tue, May 21, 2013 at 11:29 AM, Jesse van Bekkum <bek...@gmail.com> wrote:
> I am not trying an update to an external resource, I am trying a
> provisioning, but not on the creation of a user, but at a later point.
>
> I cannot find anything in the logs, in the connid log this user simply
> does not occur after activation. What logs would I have to look at?
>
> How does the console do it? The console is able to actually provision a
> user, and then the PropagationTO fields will be filled. In my activation,
> they are not.
>
> Jesse
>
>
> On Wed, May 15, 2013 at 9:24 AM, Francesco Chicchiriccò <
> ilgro...@apache.org> wrote:
>
>> On 14/05/2013 15:14, Jesse van Bekkum wrote:
>>
>> Hi Francesco
>>
>> I have used the code above to provision a resource. On a user that has
>> not been created yet (id = null) it works fine. However, on another user
>> who already existed, it does not provision. When I do another update action
>> on that user, even on a completely unrelated attribute, it triggers the
>> provisioning.
>>
>> I think I did not see this behavior on 1.0.7, but I see it on 1.1.1.
>> Any idea what the cause is?
>>
>>
>> It might be related on some optimizations made in the provisioning layer:
>> in 1.1.X an update is triggered towards an external resource only if one or
>> more of the mapped attributes is different from what is actually read from
>> the same resource. In this respect, this might not be a bug.
>>
>> I cannot tell you more, some additional investigation - with DEBUG
>> logging - is required.
>>
>> Regards.
>>
>>
>> I tried setting the usermod with the id of the existing user, but that
>> did not work.
>>
>> Jesse
>>
>>
>>
>> On Tue, Apr 30, 2013 at 10:22 AM, Francesco Chicchiriccò <
>> ilgro...@apache.org> wrote:
>>
>>> On 30/04/2013 10:21, Jesse van Bekkum wrote:
>>>
>>> No, I was just reading the requirements. I will get to it, but I will
>>> also need permission from Everett. The complete procedure will probably
>>> take a while I see.
>>>
>>>
>>> Ok, let's wait for that.
>>>
>>>
>>> Regards.
>>>
>>> On Tue, Apr 30, 2013 at 10:15 AM, Francesco Chicchiriccò <
>>> ilgro...@apache.org> wrote:
>>>
>>>> On 30/04/2013 10:09, Jesse van Bekkum wrote:
>>>>
>>>> Hi Francisco
>>>>
>>>> Sounds like a fine idea. My username is Jesse van Bekkum. You can
>>>> give me write access.
>>>>
>>>>
>>>> We have to wait for your ICLA to be received and notified: have you
>>>> already sent it?
>>>>
>>>> Regards.
>>>>
>>>>
>>>> On Tue, Apr 30, 2013 at 8:52 AM, Francesco Chicchiriccò <
>>>> ilgro...@apache.org> wrote:
>>>>
>>>>> On 29/04/2013 15:42, Jesse van Bekkum wrote:
>>>>>
>>>>> Hi Francesco
>>>>>
>>>>> Thanks for your help. There was one small issue with your example,
>>>>> since on user creation you do not have a usermod on the execution yet. But
>>>>> that was easily fixed.
>>>>>
>>>>> I have used the following code and rule in my workflow to get this
>>>>> working. Might I suggest that we use this in the standard deployment of
>>>>> Syncope? I think that provisioning via the workflow is functionality that
>>>>> should be included out of the box. The version I made is parameterized via
>>>>> the workflow (description of usage is included) so it is not specific to
>>>>> my
>>>>> project.
>>>>>
>>>>>
>>>>> Jesse,
>>>>> this sounds like a nice extension: why don't you report it in a wiki
>>>>> page under [2]?
>>>>>
>>>>> You need to:
>>>>> 1. complete and submit an ICLA [3]
>>>>> 2. create a wiki user (if not already done) and tell me the username
>>>>> so that I can grant you write access to the wiki
>>>>>
>>>>> WDYT?
>>>>>
>>>>> Regards.
>>>>>
>>>>>
>>>>> import org.activiti.engine.delegate.DelegateExecution;
>>>>> import org.activiti.engine.delegate.Expression;
>>>>> import org.apache.syncope.client.mod.UserMod;
>>>>> import org.apache.syncope.core.persistence.beans.user.SyncopeUser;
>>>>> import org.apache.syncope.core.propagation.PropagationByResource;
>>>>> import org.apache.syncope.core.workflow.ActivitiUserWorkflowAdapter;
>>>>> import org.apache.syncope.core.workflow.WorkflowException;
>>>>> import
>>>>> org.apache.syncope.core.workflow.activiti.AbstractActivitiDelegate;
>>>>> import org.slf4j.Logger;
>>>>> import org.slf4j.LoggerFactory;
>>>>>
>>>>> /**
>>>>> * This workflow service task allows to provision a resource to a user
>>>>> from the workflow.
>>>>> *
>>>>> * Use the following code in the workflow:
>>>>> *
>>>>> * <serviceTask id="addResource" name="Add Resource"
>>>>>
>>>>> activiti:class="org.apache.syncope.core.workflow.activiti.ProvisionResources">
>>>>> <extensionElements>
>>>>> <activiti:field name="resource"
>>>>> stringValue="%%YOUR_RESOURCE%%"/>
>>>>> </extensionElements>
>>>>> </serviceTask>
>>>>> */
>>>>> public class ProvisionResources extends AbstractActivitiDelegate {
>>>>>
>>>>> protected static final Logger LOG =
>>>>> LoggerFactory.getLogger(ProvisionResources.class);
>>>>>
>>>>> private Expression resource;
>>>>>
>>>>> public void setResource(Expression resource) {
>>>>> this.resource = resource;
>>>>> }
>>>>>
>>>>> @Override
>>>>> protected void doExecute(DelegateExecution execution) throws
>>>>> Exception {
>>>>> String resourceName = (String) resource.getValue(execution);
>>>>>
>>>>> if (resourceName == null || resourceName.isEmpty()) {
>>>>> throw new WorkflowException(new
>>>>> IllegalStateException("Please specify a resource"));
>>>>> }
>>>>>
>>>>> SyncopeUser user = (SyncopeUser)
>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>> UserMod userMod = (UserMod)
>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>>>> if (userMod == null) {
>>>>> userMod = new UserMod();
>>>>> }
>>>>>
>>>>> userMod.addResourceToBeAdded(resourceName);
>>>>>
>>>>> // update SyncopeUser
>>>>> PropagationByResource propByRes = dataBinder.update(user,
>>>>> userMod);
>>>>>
>>>>> // report updated user and propagation by resource as result
>>>>>
>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER, user);
>>>>>
>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>>>>> propByRes);
>>>>>
>>>>> }
>>>>> }
>>>>>
>>>>>
>>>>> On Tue, Apr 23, 2013 at 10:38 AM, Francesco Chicchiriccò <
>>>>> ilgro...@apache.org> wrote:
>>>>>
>>>>>> On 22/04/2013 21:40, Jesse van Bekkum wrote:
>>>>>>
>>>>>> Hi
>>>>>>
>>>>>> Quick question.
>>>>>>
>>>>>> How can you provision a resource to a user from the workflow? I
>>>>>> have a workflow, and after creating a user with a rest call, I want,
>>>>>> depending on the path through the workflow, to automatically provision a
>>>>>> resource.
>>>>>>
>>>>>> I tried this in a workflow step:
>>>>>>
>>>>>> ResourceDAO resourceDAO =
>>>>>> CONTEXT.getBean(ResourceDAO.class);
>>>>>> ExternalResource idp = resourceDAO.find("IDP_RESOURCE");
>>>>>> SyncopeUser user = (SyncopeUser)
>>>>>>
>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>>> user.addResource(idp);
>>>>>>
>>>>>> But after creation the user had no resources. In the past (0.7) we
>>>>>> have used manual propagation, by retrieving the propagation handler from
>>>>>> the context and firing it, but that seems a bit inelegant to me.
>>>>>>
>>>>>> What is the preferred solution to this (I think common) scenario?
>>>>>>
>>>>>>
>>>>>> Hi Jesse,
>>>>>> please take a look at the Update task [1]: you could change the
>>>>>> doExecute() method there to match the logic expressed above
>>>>>>
>>>>>>
>>>>>> SyncopeUser user = (SyncopeUser)
>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER);
>>>>>> UserMod userMod = (UserMod)
>>>>>> execution.getVariable(ActivitiUserWorkflowAdapter.USER_MOD);
>>>>>>
>>>>>> // YOUR step, e.g. add resource
>>>>>> userMod.addResourceToBeAdded("IDP_RESOURCE");
>>>>>>
>>>>>> // update SyncopeUser
>>>>>> PropagationByResource propByRes = dataBinder.update(user,
>>>>>> userMod);
>>>>>>
>>>>>> // report updated user and propagation by resource as result
>>>>>>
>>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.SYNCOPE_USER, user);
>>>>>>
>>>>>> execution.setVariable(ActivitiUserWorkflowAdapter.PROP_BY_RESOURCE,
>>>>>> propByRes);
>>>>>>
>>>>>> Please note the final statements execution.setVariable() - without
>>>>>> these the changes are not propagated back to the flow.
>>>>>>
>>>>>> Regards.
>>>>>>
>>>>>> [1]
>>>>>> https://svn.apache.org/repos/asf/syncope/branches/1_1_X/core/src/main/java/org/apache/syncope/core/workflow/user/activiti/task/Update.java
>>>>>>
>>>>> [2]
>>>>> https://cwiki.apache.org/confluence/display/SYNCOPE/Extending+Syncope
>>>>> [3] http://www.apache.org/dev/new-committers-guide.html#cla
>>>>>
>>>> --
>> Francesco Chicchiriccò
>>
>> ASF Member, Apache Syncope PMC chair, Apache Cocoon PMC
>> Memberhttp://people.apache.org/~ilgrosso/
>>
>>
>
