Skip to Content.
Sympa Menu

grouper-users - Re: [grouper-users] null dto in class edu.internet2.middleware.grouper.GrouperSession error.

Subject: Grouper Users - Open Discussion List

List archive

Re: [grouper-users] null dto in class edu.internet2.middleware.grouper.GrouperSession error.

Chronological Thread 
  • From: Tom Barton <>
  • To: Sanjay Vivek <>
  • Cc: Grouper Users <>
  • Subject: Re: [grouper-users] null dto in class edu.internet2.middleware.grouper.GrouperSession error.
  • Date: Wed, 10 Oct 2007 16:13:37 -0500

Your subordinate-stem-queries element looks right to me. A sanity check: do you have working grouper config files in ldappc's conf folder (ehcache.xml,, and If you do, perhaps the next step is to look at appropriate debug logging. You probably have a statement like the following in your file: = INFO, ldappc_debug

In addition to replacing 'INFO' with 'debug', please add = info, ldappc_debug = info, ldappc_debug = info, ldappc_debug

and see if further clues to the problem emerge.

Sanjay Vivek wrote:
Hi everyone,

Unfortunately, I'm still unable to provision my groups in Grouper to the
LDAP server. I'd describe briefly the Grouper scenario I have in place.
As a test run, I have a root stem (ncl), and a stem underneath
(ncl:services). I also have 4 groups within ncl:services. There are 2
users in each group. I basically want to provision everything under my
root stem to LDAP. The <subordinate-stem-queries> element in ldappc.xml
is stated below:


Have I got this right? Are there any other config files besides
ldappc.xml and sources.xml that I have to edit to get it work? I believe
I have the ldappc working in principle but it's not provisioning the
grouper data to LDAP. Any help would be greatly appreciated. Cheers.


-----Original Message-----
From: Tom Barton [mailto:] Sent: 09 October 2007 15:19
To: Sanjay Vivek

Subject: Re: [grouper-users] null dto in class edu.internet2.middleware.grouper.GrouperSession error.

The jdbc_ncl source config declares, in part,

subject.subjectid as id, as name,
lfnamet.lfname as lfname, loginidt.loginid as loginid,
desct.description as description

So the name of the attribute attached to a Subject object is 'id' rather than 'subjectId'. Hence,

<source-subject-name-map source="jdbc_ncl"
subject-attribute="subjectId" />

should be

<source-subject-name-map source="jdbc_ncl"
subject-attribute="id" />

And although a corresponding change might be made to the <source-subject-identifiers> element, a look over your config files makes me wonder if it should instead be

<source-subject-identifier source="jdbc_ncl"
subject-attribute="loginid" >
<ldap-search base="ou=people,dc=ncl,dc=ac,dc=uk"
filter="(uid={0})" />

Ie, is the 'loginid' attribute in your jdbc source the same as the 'uid'
attribute for the corresponding Subject in LDAP? If so, that's how you want to tell Ldappc to identify jdbc-presented Subjects with their LDAP-presented counterparts. But if your subjectId is really the uid value, then make subject-attribute="id".

You might still get a "null dto" error even if the provisioning worked correctly - that bug has been noted.

Hope this helps,

Sanjay Vivek wrote:
Hi everyone,

This issue has been raised before but unfortunately I'm
stuck at this
point. I'm getting the following error when I run ldappc:

FATAL ErrorLog:
[edu.internet2.middleware.ldappc.LdappcGrouperProvisioner] Grouper Provision Failed: null dto in class edu.internet2.middleware.grouper.GrouperSession
A FATAL ERROR occurred when running Ldappc. Check error log file, correct the problem, and resubmit.

I've attached both my sources.xml and ldappc.xml with this
email (with
passwords omitted).

I believe the main sticking point is the
element in ldappc.xml. Our primary source of NCL subjects is
JDBC, and
we would like to configure that as the source from which to present subjects to Grouper (and ldappc). As shown below, the <source-subject-identifiers> element identifies for each Subject source how the provisioner locates the directory entry for a
given Subject.
There is a "subjectId" column in our Subjects table in the "jdbc-ncl"
source. However, the <source-subject-identifiers> element is configured to locate the Subject's directory entry from a
LDAP source
and not a JDBC source. How do I go about configuring <source-subject-identifiers> element to locate the Subject's
entry from a JDBC source instead? Any insight would be
helpful. Cheers.
<source-subject-identifier source="jdbc_ncl"
subject-attribute="subjectId" >
<ldap-search base="ou=people,dc=ncl,dc=ac,dc=uk" scope="subtree_scope" filter="(uid={0})" />

Sanjay Vivek
Web Team
University of Newcastle Upon Tyne

Archive powered by MHonArc 2.6.16.

Top of Page