Grouper Developers Forum

[Gagné Sébastien <>]

It might be a good idea to add comment where the "Base Stem" are defined to 
be sure to match the case of the directory 

e.g. writing it all in lowercase(dc=domain, dc=ca)  when AD will use 
"DC=domain, DC=ca" , I did this mistake at the beginning 


-----Message d'origine-----
De : 

 
[mailto:]
 De la part de Tom Zeller
Envoyé : 29 août 2012 16:37
À : 

Objet : [grouper-dev] another psp 2.1.2 release candidate

Another psp 2.1.2 release candidate is now available.

 http://www.internet2.edu/grouper/release/2.1.2/

A pretty horrible bug was introduced in 2.1.1 which catastrophically deletes 
all provisioned objects when provisioning Active Directory.
Hence, I disabled downloads of 2.1.1.

The psp considers identifiers to be case sensitive, and defaults to lowercase 
rdn attribute types, for example

 dc=example,dc=edu

while Active Directory returns uppercase rdn attribute types, for example

 DC=example,DC=edu

The difference between uppercase and lowercase rdn attribute types resulted 
in the psp incorrectly deleting provisioned objects.

When provisioning Active Directory, care should be taken to make sure that 
ldap dns are calculated with uppercase rdn attribute types. Prior to version 
2.1.2, rdn attribute types were not configurable when calculating ldap dns 
from grouper names. This 2.1.2 release candidate allows rdn attribute types 
to be configured, for example

  <resolver:AttributeDefinition
    id="groupDn"
    xsi:type="psp-grouper-ldap:LdapDnFromGrouperNamePSOIdentifier"
    rdnAttributeName="CN"
    stemRdnAttributeName="OU"
    ... />

At first I thought that comparing identifiers case-insensitively was the 
right thing to do, but the openspml library uses string equals() to compare 
identifiers, and I decided this would be messy to override.
So for now, identifiers are case sensitive.

Changes made in version 2.1.1 to improve performance exposed this issue. I 
hurried 2.1.1 without adequate testing. It took a while to acquire another 
Active Directory test environment, mostly because of my schedule.

Thanks for your patience,
and apologies for the inconvenience,
TomZ