Shadow Specific Operations

Last modified 21 Feb 2024 20:39 +01:00

Description

A set of operations related specifically to the Shadow object type of midPoint.

Request

There are multiple possible requests which are specific for the Shadow object type related operations.

The first operation would be the fetch of the Shadow object (e.g. representing an account) owner . For this operation you will have to use the HTTP GET method in your request. The resulting uri could look something like this:

Get shadow owner operation
GET http://localhost:8080/midpoint/ws/rest/shadows/{oid}/owner

Another operation is the import of a Shadow object (e.g. again representing an account), thus either linking them to an existing object in midPoint or creating a midPoint object as a result of this operation.

Import shadow object
POST http://localhost:8080/midpoint/ws/rest/shadows/{oid}/import

Headers

Regarding authorization type, the "Basic" Authorization header should be used.

Authorization header example, replace {Base64EncodedCredentials} with the encoded credentials
Authorization: Basic {Base64EncodedCredentials}

In case of the operations you need to specify the accepted type of content in case you are interested in a format different from xml (default)

Accept type header example, other media types are supported as well
"Accept: application/json"
For supported media types please refer to the following section of the documentation

Supported Media Types

Body

No additional data needed in the request body.

Options

No additional option parameters supported for these types of requests.

Response

Error code Meaning

1xx

Information. Stay tuned, operation is in progress.

2xx

Success. Operation finished successfully. There are two custom codes:

  • 250 for partial error which means that during processing some error occurred but some changes was executed.

  • 240 for handled error which means that there was originally error, but midPoint was able to fix this using its consistency mechanism.

In this two cases, midPoint returns the OperationResult where there details of executed operations can be found.

3xx

Redirection or "in progress". This is returned mostly to indicate two cases:

  • Operation has finished, but the results are not in this resource. Redirection is issues to point the client to the results. Typical example is creation of an object with POST to a collection web resource. In this case a new object is created, new URI is assigned and the client is redirected to this URI. Retrieving that URI provides created object and 200 status code, indicating that the operation is finished.

  • Operation is in progress (asynchronous operation). In this case midPoint API redirects the client to a task object that can be used to track progress of the operation.

4xx

Client errors. The client has sent request that cannot be processed. This indicates usual situation that are well handled by the midPoint code. Maybe the client request to create conflicting object, delete non-existent object, modification that violates the schema and so on. The OperationResult structure is usually provided in the response to provide more details about the situation.

5xx

Server errors. Situations that the server cannot handle and where the cause is unknown. This usually means bugs in the code, insufficient resources such as RAM or disk space, unforeseen failures in the infrastructure and so on. The OperationResult structure might or might not be provided in this case. Some errors are so severe that the structured error information might not be available.

Status codes and the indication of errors and asynchronous processing applies uniformly to all midPoint web resources (both RESTful and RPC).

Access Authorization

  • http://midpoint.evolveum.com/xml/ns/public/security/authorization-rest-3#findShadowOwner

  • http://midpoint.evolveum.com/xml/ns/public/security/authorization-rest-3#importShadow

Examples

Get Shadow owner
# Authenticating with the credentials "administrator" and password "y0uR_P455woR*d" on a localhost instance running on port 8080
curl --user administrator:y0uR_P455woR*d -H "Accept: application/json" -X GET http://localhost:8080/midpoint/ws/rest/shadows/062ac29f-f296-4824-aeab-9a0feb9e8bd3/owner -v

The response is an HTTP 200 code in case of success with a response body containing the queried item.

Example Output of "Get Shadow owner" example

The example is simplified, some properties were removed to keep the example output "short". This example does not contain all possible properties of this object type.

{
  "user" : {
    "oid" : "a9885c61-c442-42d8-af34-8182a8653e3c",
    "version" : "",
    "name" : "Jack",
    "metadata" : {},
    "operationExecution" : [ {}, {} ],
    "assignment" : [ {}, {} ],
    "iteration" : 0,
    "iterationToken" : "",
    "roleMembershipRef" : [ {}, {} ],
    "linkRef" : {
      "oid" : "062ac29f-f296-4824-aeab-9a0feb9e8bd3",
      "relation" : "org:default",
      "type" : "c:ShadowType"
    },
    "activation" : {},
    "emailAddress" : "jack@evolveum.com",
    "credentials" : {},
    "givenName" : "Jack",
    "familyName" : "Sparrow"
  }
}
Import shadow
# Authenticating with the credentials "administrator" and password "y0uR_P455woR*d" on a localhost instance running on port 8080
curl --user administrator:y0uR_P455woR*d -H "Accept: application/json" -X POST http://localhost:8080/midpoint/ws/rest/shadows/062ac29f-f296-4824-aeab-9a0feb9e8bd3/import -v

The response is an HTTP 200 code in case of success with a response body containing the queried item.

Example Output of "Import shadow" example

The example is simplified, some properties were removed to keep the example output "short". This example does not contain all possible properties of this object type.

{
  "@ns" : "http://prism.evolveum.com/xml/ns/public/types-3",
  "object" : {
    "@type" : "c:OperationResultType",
    "operation" : "importShadow",
    "status" : "success",
    "importance" : "normal",
    "start" : "",
    "end" : "",
    "microseconds" : ,
    "invocationId" : ,
    "token" : ,
  "partialResults" : [ {} ]
}
Was this page helpful?
YES NO
Thanks for your feedback