For users provisioned to midPoint, it would be helpful to be able to assign a role (one or more) to these users (to do "default" things for all users, like creating a LDAP account).  This is set in the 'assignment' attribute on user objects.  Here is an example of setting this via REST: https://github.com/Evolveum/midpoint-samples/blob/master/samples/rest/modify-user-assign-role.xml    The UI would need to collect (and probably validate) an OID for the needed role assignment(s) in midPoint.