Skip to Content.
Sympa Menu

comanage-users - Re: [comanage-users] LDAP Provisioner - automatic provisioning of groups

Subject: COmanage Users List

List archive

Re: [comanage-users] LDAP Provisioner - automatic provisioning of groups

Chronological Thread 
  • From: Benn Oshrin <>
  • To:
  • Subject: Re: [comanage-users] LDAP Provisioner - automatic provisioning of groups
  • Date: Thu, 05 Jun 2014 08:39:37 -0400

I'll have to try to reproduce this. I assume you have a group membership specified as part of the enrollment flow?

Can you open a JIRA for this?



On 6/3/14 4:15 PM, Mike Manske wrote:
We are running commit fdf500b229 in a production environment. We are
using the LDAP provisioner plugin, accessed at path

We have both a People Base DN and a Group Base DN defined. We have
objectclass 'groupOfNames' enabled. The provisioner status is set to
'Automatic Mode.'

The provisioning to the People Base DN seems to work fine when a
person is enrolled. However, the LDAP Group DN is not updated by an
enrollment. Looking at the LDAP records after an enrollment, we see
the person record has 'isMemberOf' attributes for the correct groups,
but the records for the corresponding groups do not have the person's
identifier in the 'hasMember' attribute.

To continue, if we manually remove a person from a group via
or modify membership via
the group change is automatically pushed to LDAP. Also, if we manually
provision a group via
this also pushes the change to LDAP.

Is there something I can check in my configuration to ensure the LDAP
groups are updated with new enrollments?

I have also attached screen images to avoid ambiguity.


Archive powered by MHonArc 2.6.16.

Top of Page