private <TV,TA> ObjectQuery createQuery(RefinedAssociationDefinition assocDefType, RefinedAttributeDefinition<TA> assocAttrDef, ResourceAttribute<TV> valueAttr) throws SchemaException{ MatchingRule<TA> matchingRule = matchingRuleRegistry.getMatchingRule(assocDefType.getResourceObjectAssociationType().getMatchingRule(), assocAttrDef.getTypeName()); if (valueAttr.size() > 1) { throw new IllegalStateException("Attributes with more than 1 values are not supported here"); } PrismPropertyValue<TA> converted = PrismUtil.convertPropertyValue(valueAttr.getAnyValue(), valueAttr.getDefinition(), assocAttrDef, prismContext); TA normalizedRealValue = matchingRule.normalize(converted.getValue()); PrismPropertyValue<TA> normalized = prismContext.itemFactory().createPropertyValue(normalizedRealValue); LOGGER.trace("Converted entitlement filter value: {} ({}) def={}", normalized, normalized.getValue().getClass(), assocAttrDef); ObjectQuery query = prismContext.queryFor(ShadowType.class) .item(ItemPath.create(ShadowType.F_ATTRIBUTES, assocAttrDef.getName()), assocAttrDef).eq(normalized) .build(); query.setAllowPartialResults(true); return query; }