# ResourceObjectAssociationType (Complex Type)

### Namespace: http://midpoint.evolveum.com/xml/ns/public/common/common-3

Supertype: ResourceItemDefinitionType
Describes how entitlement is associated to the subject (e.g. account or other entitlement). Description of the entitlement handling details, such as display name, read/write access and so on. This is supposed to be used in schemaHandling part and in assignments/inducements, and therefore it describes the decisions of the system administrator about the way how entitlements are used in midPoint.

Item Summary
Name | Type | Multiplicity | Description
--- | --- | --- | ---
ref | property ItemPathType | [1,1] | Path of the item or association that this definition describes.
displayName | property string | [0,1] |
help | property string | [0,1] | Help text for the displayed item.
description | property string | [0,1] |
documentation | property string | [0,1] |
lifecycleState | property string | [0,1] | Lifecycle state of the item.
changeApplicationMode | property ItemChangeApplicationModeType | [0,1] | How should the computed changes of this item be regarded? (Applied, recorded, ignored.
displayOrder | property int | [0,1] |
limitations | container PropertyLimitationsType | [0,-1] | Limits the usage of the attribute, e.
matchingRule | property QName | [0,1] | Specification of a matching rule for an attribute.
valueEnumerationRef | reference ObjectReferenceType | [0,1] | Reference to an object that directly or indirectly represents possible values for this item.
tolerant | property boolean | [0,1] | When set to true, allows attribute/property values that are set outside midPoint (or outside object template mappings).
tolerantValuePattern | property string | [0,-1] | Pattern (regexp) for attribute/property value.
intolerantValuePattern | property string | [0,-1] | Pattern (regexp) for attribute/property value.
emphasized | property boolean | [0,1] | Set true for definitions that are more important than others and that should be emphasized during presentation.
deprecated | property boolean | [0,1] | This setting can be used to control the value of "deprecated" flag determined from the schema.
experimental | property boolean | [0,1] | This setting can be used to control the value of "experimental" flag determined from the schema.
validation | property FormItemValidationType | [0,1] | Validation rules for the item.
persistence | property ItemPersistenceType | [0,1] | Whether values of this item should be persisted.
correlator | container ItemCorrelatorDefinitionType | [0,1] | Creates a single-item correlator for this item.
exclusiveStrong | property boolean | [0,1] | When set to false then both strong and normal mapping values are merged to produce the final set of values.
modificationPriority | property int | [0,1] | Modification priority of this item.
readReplaceMode | property boolean | [0,1] | Modifications to this attribute are executed in REPLACE form only.
secondaryIdentifier | property boolean | [0,1] | Indicated if the attribute should be considered as secondary identifier.
volatilityTrigger | property boolean | [0,1] | If set to true it indicates that change of this attribute may cause changes in other attributes.
displayNameAttribute | property boolean | [0,1] | Indicated if the content of this attribute should be used as a human-readable name when displaying resource objects of this type.
fetchStrategy | property AttributeFetchStrategyType | [0,1] |
storageStrategy | property AttributeStorageStrategyType | [0,1] |
outbound | container MappingType | [0,1] | Defines how the attribute value is constructed in case of information flow from IDM to the resource, e.
inbound | container InboundMappingType | [0,-1] | Defines how the attribute values are used (assigned) in case of information flow from resource to IDM, e.
auxiliaryObjectClass | property QName | [0,1] | This association is considered valid only if the resource object (subject) has the specified auxiliary object class.
kind | property ShadowKindType | [0,1] | Kind of objects associated through this association type.
intent | property string | [0,-1] | A set of intents corresponding to this association type.
direction | property ResourceObjectAssociationDirectionType | [0,1] | Specifies the direction of association, i.
associationAttribute | property QName | [0,1] | Name of the attribute which represents the association.
valueAttribute | property QName | [0,1] | Name of the attribute from with a value for association attribute is taken.
shortcutAssociationAttribute | property QName | [0,1] | Association attribute short-cut.
shortcutValueAttribute | property QName | [0,1] | Association attribute short-cut.
explicitReferentialIntegrity | property boolean | [0,1] | Whether you require midPoint to provide referential integrity for object-to-subject associations.

- ### Items

  - #### ref

    Flags: RAM,runtime

    Multiplicity: [1,1]

    Path of the item or association that this definition describes. It must point to property or the attribute in the resource schema that belongs to an object class that is being described here.

  - #### displayName

    Flags: RAM,runtime

    Multiplicity: [0,1]

  - #### help

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Help text for the displayed item. Help text is usually displayed when the user clicks on help/information icon. This may be a longer text (several sentences).

    This is equivalent to "help" schema annotation and can be used to override it.

  - #### description

    Flags: RAM,runtime

    Multiplicity: [0,1]

  - #### documentation

    Flags: RAM,runtime

    Multiplicity: [0,1]

  - #### lifecycleState

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Lifecycle state of the item. Production configuration consists (by default) of `active` and `deprecated` ones. Development configuration consists (by default) of `active` and `proposed` ones. If the item is not in the configuration, it is ignored by the processing at the model level - no inbound nor outbound mappings are evaluated for it, as well as no (outbound) reconciliation is carried out. The effect is similar to setting "ignore" processing on the model level. Currently supported only for resource object items (attributes and associations).

  - #### changeApplicationMode

    Flags: RAM,runtime,AVals:3

    Multiplicity: [0,1]

    How should the computed changes of this item be regarded? (Applied, recorded, ignored.) Currently supported only for resource object attributes. TODO better name

  - #### displayOrder

    Flags: RAM,runtime

    Multiplicity: [0,1]

  - #### limitations

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Limits the usage of the attribute, e.g. whether it may is read-only, read write or entirely ignored. The limitations may apply to several system layers, therefore this element may be repeated several times. But it there may be only one instance for each layer.

  - #### matchingRule

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Specification of a matching rule for an attribute. Matching rule is used to compare values of the attribute. The default rule is a literal comparison which is good for most attribute types and for case-sensitive strings. An alternative matching rule may be specified e.g. for case insensitive strings.

  - #### valueEnumerationRef

    Flags: RAM

    Multiplicity: [0,1]

    Reference to an object that directly or indirectly represents possible values for this item. We do not define here what exactly the object has to be. It can be a lookup table, script that dynamically produces the values or anything similar. The object must produce the values of the correct type for this item otherwise an error occurs.

  - #### tolerant

    Flags: RAM,runtime

    Multiplicity: [0,1]

    When set to true, allows attribute/property values that are set outside midPoint (or outside object template mappings). The synchronization will only remove values that are assigned by midPoint (or template mappings), but will tolerate extra native values. When set to false, extra values are not tolerated. When midPoint detects such value (e.g. during reconciliation) it will remove it. Support of non-tolerant items in object templates is currently EXPERIMENTAL.

  - #### tolerantValuePattern

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Pattern (regexp) for attribute/property value. If the value matches the pattern such value is tolerated. It is left in the attribute/property even if it is not derived from any mapping. This element is currently supported only in resource object type definitions. Support in object templates is planned.

  - #### intolerantValuePattern

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Pattern (regexp) for attribute/property value. If the value matches the pattern such value is NOT tolerated. The value must be derived from a mapping or it will be removed. This element is currently supported only in resource object type definitions. Support in object templates is planned.

  - #### emphasized

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Set true for definitions that are more important than others and that should be emphasized during presentation. E.g. the emphasized definitions will always be displayed in the user interfaces (even if they are empty), they will always be included in the dumps, etc.

  - #### deprecated

    Flags: RAM,runtime

    Multiplicity: [0,1]

    This setting can be used to control the value of "deprecated" flag determined from the schema. I.e. it can be used to override the value taken from the schema. E.g. it can be used to "unmark" a deprecated item, so it will behave as normal, non-deprecated item. This may be used as a temporary measure during the period of migrating the configuration to non-deprecated setting.

  - #### experimental

    Flags: RAM,runtime

    Multiplicity: [0,1]

    This setting can be used to control the value of "experimental" flag determined from the schema. I.e. it can be used to override the value taken from the schema. E.g. it can be used to "unmark" an experimental item, so it will behave as normal, non-experimental item. USE WITH CARE. Experimental items are marked as experimental for a reason. When those items are "unmarked", they will not get any less experimental.

  - #### validation

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Validation rules for the item. Validation rule may be applied in the user interface. But server-side validation may also be applied during the computation process.

  - #### persistence

    Flags: RAM,runtime,AVals:3

    Multiplicity: [0,1]

    Whether values of this item should be persisted. Currently implemented for metadata only.

  - #### correlator

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Creates a single-item correlator for this item. For attributes this automatically turns on "beforeCorrelation" mapping evaluation phase. (If not explicitly forbidden in the attribute definition.) Currently supported for attributes only.

  - #### exclusiveStrong

    Flags: RAM,runtime

    Multiplicity: [0,1]

    When set to false then both strong and normal mapping values are merged to produce the final set of values. When set to true only strong values are used if there is at least one strong mapping. Normal values are used if there is no strong mapping.

  - #### modificationPriority

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Modification priority of this item. Items with specified priorities are modified in order that follows these priorities: these with lower numbers are modified first, these with higher numbers next, and items with unspecified priorities are modified last. Each priority level gets its own modify operation (or operations, if required by ICF limitations). Currently this field is supported only for attributes, even it is present on associations as well. (It is envisioned that 'addingPriority' could be created as well in the future; it would concern creating new objects. In that case, attributes with numerically lowest adding priority would be used to create an object, and other attributes would be set via MODIFY operation, again, according to their priorities.)

  - #### readReplaceMode

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Modifications to this attribute are executed in REPLACE form only. I.e. if ADD or DELETE VALUE is requested, midPoint will fetch the object state, compute the expected result and write it to the resource object via REPLACE VALUE operation. This works around some weird connector behavior. BEWARE: READ+REPLACE is currently supported for attributes only - not for subjectToObject associations. EXPERIMENTAL. May change in near future.

  - #### secondaryIdentifier

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Indicated if the attribute should be considered as secondary identifier. If set to true, this attribute is stored in repository and used for example by synchronization (correlation rule), consistency mechanism, etc.

  - #### volatilityTrigger

    Flags: RAM,runtime

    Multiplicity: [0,1]

    If set to true it indicates that change of this attribute may cause changes in other attributes. In that case midPoint re-reads the object after the change of this attributes.

  - #### displayNameAttribute

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Indicated if the content of this attribute should be used as a human-readable name when displaying resource objects of this type.

  - #### fetchStrategy

    Flags: RAM,runtime,AVals:3

    Multiplicity: [0,1]

  - #### storageStrategy

    Flags: RAM,runtime,AVals:2

    Multiplicity: [0,1]

  - #### outbound

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Defines how the attribute value is constructed in case of information flow from IDM to the resource, e.g. in case of provisioning. In case an expression is used, the expression variables should be as follows: $user - the user to whom the account belongs $account - the account to be changed Motivation: This is "value construction" type, it is using similar format that is used elsewhere in the system (e.g. in roles) and therefore a common expression processor can be used to process all of that. E.g. a single processor may take into a consideration both schema handling and dynamic attributes set by roles.

  - #### inbound

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Defines how the attribute values are used (assigned) in case of information flow from resource to IDM, e.g. in case of synchronization, reconciliation or discovery. In case a source expression is used, the expression variables should be as follows: $user - the user to whom the account belongs $account - the account that has been changed (after the change) Explanation: This is not a "value construction" as it is not constructing a new attribute value. It is rather using attribute value that was set be someone else. A simpler way how to express the assignment is needed here, especially a simple way how to express assignment target. Some rules may use that information and we definitely need that to generate correct relative change descriptions.

  - #### auxiliaryObjectClass

    Flags: RAM,runtime

    Multiplicity: [0,1]

    This association is considered valid only if the resource object (subject) has the specified auxiliary object class.

  - #### kind

    Flags: RAM,runtime,AVals:4

    Multiplicity: [0,1]

    Kind of objects associated through this association type.

  - #### intent

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    A set of intents corresponding to this association type. NOTE: All of them must point to the same resource ObjectClass! The association may point to many intents (many object types with different intents). This is sometimes useful, especially if there are many types of groups and each type is constructed in a slightly different way. The multi-intent associations are supported and often very useful. But there is an important hard limitation: all the object types referenced from a single association must have the same object type, attributes, matching rules, .... they must be equivalent in every aspect except for attribute mappings. If no intents are specified, then object type definition of given kind, and defaultForKind = true (or default = true) is used.

  - #### direction

    Flags: RAM,runtime,AVals:2

    Multiplicity: [0,1]

    Specifies the direction of association, i.e. if the association point from object to subject or the other way around.

  - #### associationAttribute

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Name of the attribute which represents the association. This is the attribute that will be modifier when the association changes. In object-to-subject associations this is the attribute of the object (e.g. group). In subject-to-object associations this is an attribute of the subject (e.g. account). Typical examples are: roles, privileges, member, uniqueMember

  - #### valueAttribute

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Name of the attribute from with a value for association attribute is taken. The value is taken from this attribute and it will be stored in the association attribute. This attribute will NOT be modified when the association changes, it is only for reading. In object-to-subject associations this is the attribute of the subject (e.g. account). In subject-to-object associations this is an attribute of the object (e.g. group). This attribute usually contain identifiers. Typical examples are: name, username, uid, id

  - #### shortcutAssociationAttribute

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Association attribute short-cut. There are cases when an object-to-subject association is the authoritative one, but reading object-to-subject is expensive. E.g. several searches must be done to fully resolve object-to-subject associations. This attribute provides a short-cut mechanism. It is used in cases when there is additional (virtual) attribute that goes in the opposite direction as the primary object-to-subject association attribute. The association short-cut is only usable for object-to-subject associations. This property specifies name of the attribute which represents the association short-cut. This is the attribute of the subject (e.g. account). This attribute will only be read, it is never written. The primary association attribute is used for writing. Typical examples are: memberOf, isMemberOf

  - #### shortcutValueAttribute

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Association attribute short-cut. There are cases when a object-to-subject association is the authoritative one, but reading object-to-subject is expensive. E.g. several searches must be done to fully resolve object-to-subject associations. This attribute provides a short-cut mechanism. It is used in cases when there is additional (virtual) attribute that goes in the opposite direction as the primary object-to-subject association attribute. The association short-cut is only usable for object-to-subject associations. This property specifies name of the attribute from with a value for association attribute short-cut is taken. The values of this attribute are expected to appear in association short-cut attribute. This is an attribute of the object (e.g. group). This attribute usually contain identifiers. Typical examples are: name, username, uid, id

  - #### explicitReferentialIntegrity

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Whether you require midPoint to provide referential integrity for object-to-subject associations. Used for resources that do not provide referential integrity by themselves, e.g. for OpenDJ with default settings (i.e. with referential integrity plugin turned off). For resources having referential integrity, e.g. for Active Directory, set this parameter to false.