Meta roles may be assigned to other roles. This is how meta-meta-roles are created. There are turtles all the way down. However, the situation may not be entirely clear in some cases. For example the
associationFromLink expression needs one object to get the links from. In the meta-meta-meta scenarios there are many objects to choose from. Until midPoint 3.7 there was a fixed algorithm that have chosen one of those objects. In midPoint 3.7 there is a way how to choose the object explicitly using assignmentPathIndex property of the
associationFromLink expression. This index points to the object that should be used as a source to get the link from. Index 0 is the focal object, index 1 is the first (plain) role, index 2 is meta-role, index 3 is meta-meta-role and so on. Negative index can also be used, in that case the order is reversed: index -1 is that last meta-meta-meta-...-role. index -2 is the one before and so on.
<inducement> <construction> <resourceRef oid="10000000-0000-0000-0000-000000000004"/> <kind>account</kind> <intent>default</intent> <association> <ref>ri:group</ref> <outbound> <expression> <associationFromLink> <projectionDiscriminator> <kind>entitlement</kind> <intent>group</intent> </projectionDiscriminator> <assignmentPathIndex>1</assignmentPathIndex> </associationFromLink> </expression> </outbound> </association> </construction> <order>3</order> </inducement>