Linked Objects Scenario 5: Deletion-Safe Organizations

Last modified 22 Apr 2021 17:31 +02:00
Since 4.2
This functionality is available since version 4.2.


Is it possible to delete an organization in such a way that all its members (users, child orgs, and other objects) will not end up in an inconsistent state? I.e. that their assignments to the particular org will be deleted, instead of becoming hanging?

Yes, using a simple policy rule this can be easily implemented.

An implementation

Implementation of this scenario consists of a single global policy rule.

Global policy rule that ensures unassigning of org being deleted
        <!-- finer selection (e.g. based on archetype) can be used here if needed -->
        Unassigns members when an org is deleted.
                <linkSource/> <!-- all objects linked to the current focus -->
                            <!-- all assignments targeting the current focus -->
                                        import com.evolveum.midpoint.schema.util.ObjectTypeUtil

Complete configuration for this scenario is in directory (and associated system configuration file).


This scenario works in the majority of cases. More specifically, it assumes that "assigned" is the same as "linked":

  1. All assignments are effective (valid and conditions evaluated to true), so they are reflected in links.

  2. All links are backed by assignments, i.e. there are no links created by inducements or created manually (editing parentOrgRef).

But the scenario can be extended and made more robust, by:

  1. Replacing linkSource specification by custom query looking after assignment/targetRef filters.

  2. Creating additional global policy rule that will clean up the inducements for organization being deleted.