GuyPaddock

@gael: Thank you — that is very helpful!

As an update to this thread: I’m working on extending OpenDJ with a related feature, as part of a pull request into the Wren:DS project:
https://github.com/WrenSecurity/wrends/pull/9

Using this feature, you can create a read-only collection resource that flattens the sub-tree of all users into a single collection, then filter that flat collection…[Read more]

@jnrouvignac Unfortunately, that only works on collection sub-resources. In other words, the list of groups, but not the members _inside_ the group.

You can use the CREST filters to locate a group based on name, description, etc, but not based on the members inside the group. It does not appear that query operations are supported at all on…[Read more]

FYI The UUID to OID tool moved. It is now here:
https://www.igorkromin.net/?uuid=1

(I am not the maintainer, and just now realized that the original site was down. Archive.org was able to show me the last post from the maintainer about the URL change).

@be164: Though I don’t seem to have the artifact you desire, you may be able to build it from the 10.0.1 branch of OpenAM: https://github.com/OpenRock/OpenAM/tree/ee89cb4bd1023e5d3cd5982a01d5c0ec5abb7364

@mariusg: I’m still getting the error “Are you sure you wanted to do that?” on posts, from time to time. The post gets lost when that happens. Any idea why that happens?

One more update of note @ludo: if I provide an “If-Match” header of “*” along with the request, it seems to behave correctly rather than trying to create the duplicate. I will do more testing to confirm, but that seems to be an important part.

Still seems wrong that it would create a duplicate resource, though, per REST conventions.

@ludo: Why might someone choose to use the OEM version instead of Standard? Was it a licensing issue? Otherwise, why would someone go with fewer features?

Is OEM still available in DS 5, now that PDB has been deprecated?

Another useful blog post, for reference, is this one:
https://yaunap.blogspot.com/2016/06/dynamic-profiles-in-openam-13.html

@acorysmart421-com: Thank you, as well! This makes sense. I had not considered creating a separate chain for users than the default one used for admins.

Can you expand a bit on this part? “In fact, best practice suggests you should disable the ability to bypass your chain and login with a single module altogether.”

@peter-major: Thanks. I did read that post beforehand, but what was not clicking was the relationship between the inheritance of the settings rather than the flow itself. I wasn’t understanding why modifying LDAP settings in 2-3 of the places I mentioned weren’t having an effect.

This forum post is actually where this all “clicked” for me — your…[Read more]

Just tried using "writability": "readOnlyDiscardWrites" for the entryDN but ended up with the error “The request cannot be processed because the reference field ‘/data/relationships/manager’ contains a value which does not contain a primary key”. That at least fixes the indefinite hang.

I’m guessing the limitation here is that the mapper for a…[Read more]

@ludo: There’s one other bug I’ve noted in CREST, as I mentioned in my other topic. If you setup a relationship mapper with a read-only attribute like entryDN and then attempt to do a PUT with that attribute included, the request will seemingly hang indefinitely though in actuality there’s a org.forgerock.json.resource.BadRequestException being…[Read more]

Thanks, Ludo!