Grouper Users - Open Discussion List

[Tom Barton <>]

Your subordinate-stem-queries element looks right to me. A sanity check: 
do you have working grouper config files in ldappc's conf folder 
(ehcache.xml, grouper.hibernate.properties, and grouper.properties)? If 
you do, perhaps the next step is to look at appropriate debug logging. 
You probably have a statement like the following in your 
log4j.properties file:

log4j.logger.edu.internet2.middleware.ldappc.logging.DebugLog 
  = INFO, ldappc_debug

In addition to replacing 'INFO' with 'debug', please add

log4j.logger.edu.internet2.middleware.grouper.EventLog = info, ldappc_debug
log4j.logger.edu.internet2.middleware.subject = info, ldappc_debug
log4j.logger.edu.internet2.middleware.subject.provider = info, ldappc_debug

and see if further clues to the problem emerge.

Sanjay Vivek wrote:
> Hi everyone,
>
> Unfortunately, I'm still unable to provision my groups in Grouper to the
> LDAP server. I'd describe briefly the Grouper scenario I have in place.
> As a test run, I have a root stem (ncl), and a stem underneath
> (ncl:services). I also have 4 groups within ncl:services. There are 2
> users in each group. I basically want to provision everything under my
> root stem to LDAP. The <subordinate-stem-queries> element in ldappc.xml
> is stated below:
>
> <subordinate-stem-queries>
>         <stem-list>
>          <stem>ncl</stem>
>         </stem-list>
> </subordinate-stem-queries>
>
> Have I got this right? Are there any other config files besides
> ldappc.xml and sources.xml that I have to edit to get it work? I believe
> I have the ldappc working in principle but it's not provisioning the
> grouper data to LDAP. Any help would be greatly appreciated. Cheers.
>
> Regards
> Sanjay
>
> > -----Original Message-----
> > From: Tom Barton [mailto:] 
> > Sent: 09 October 2007 15:19
> > To: Sanjay Vivek
> > Cc: 
> >
> > Subject: Re: [grouper-users] null dto in class 
> > edu.internet2.middleware.grouper.GrouperSession error.
> >
> > The jdbc_ncl source config declares, in part,
> >
> > select
> >    subject.subjectid as id, subject.name as name,
> >    lfnamet.lfname as lfname, loginidt.loginid as loginid,
> >    desct.description as description
> >
> > So the name of the attribute attached to a Subject object is 
> > 'id' rather than 'subjectId'. Hence,
> >
> > <source-subject-name-map source="jdbc_ncl"
> >   subject-attribute="subjectId" />
> >
> > should be
> >
> > <source-subject-name-map source="jdbc_ncl"
> >   subject-attribute="id" />
> >
> > And although a corresponding change might be made to the 
> > <source-subject-identifiers> element, a look over your config 
> > files makes me wonder if it should instead be
> >
> >   <source-subject-identifiers>
> >     <source-subject-identifier source="jdbc_ncl"
> >         subject-attribute="loginid" >
> >       <ldap-search base="ou=people,dc=ncl,dc=ac,dc=uk"
> >         scope="subtree_scope"
> >         filter="(uid={0})" />
> >     </source-subject-identifier>
> >   </source-subject-identifiers>
> >
> > Ie, is the 'loginid' attribute in your jdbc source the same as 
> > the 'uid'
> > attribute for the corresponding Subject in LDAP? If so, that's 
> > how you want to tell Ldappc to identify jdbc-presented 
> > Subjects with their LDAP-presented counterparts. But if your 
> > subjectId is really the uid value, then make subject-attribute="id".
> >
> > You might still get a "null dto" error even if the 
> > provisioning worked correctly - that bug has been noted.
> >
> > Hope this helps,
> > Tom
> >
> > Sanjay Vivek wrote:
> > > Hi everyone,
> > >
> > > This issue has been raised before but unfortunately I'm 
> > stuck at this 
> > > point. I'm getting the following error when I run ldappc:
> > >
> > > FATAL ErrorLog:
> > > [edu.internet2.middleware.ldappc.LdappcGrouperProvisioner] Grouper 
> > > Provision Failed: null dto in class 
> > > edu.internet2.middleware.grouper.GrouperSession
> > > A FATAL ERROR occurred when running Ldappc.  
> > > Check error log file, correct the problem, and resubmit.
> > >
> > > I've attached both my sources.xml and ldappc.xml with this 
> > email (with 
> > > passwords omitted).
> > >
> > > I believe the main sticking point is the 
> > <source-subject-identifiers> 
> > > element in ldappc.xml. Our primary source of NCL subjects is 
> > JDBC, and 
> > > we would like to configure that as the source from which to present 
> > > subjects to Grouper (and ldappc). As shown below, the 
> > > <source-subject-identifiers> element identifies for each Subject 
> > > source how the provisioner locates the directory entry for a 
> > given Subject.
> > > There is a "subjectId" column in our Subjects table in the "jdbc-ncl"
> > > source. However, the <source-subject-identifiers> element is 
> > > configured to locate the Subject's directory entry from a 
> > LDAP source 
> > > and not a JDBC source. How do I go about configuring 
> > > <source-subject-identifiers> element to locate the Subject's 
> > directory 
> > > entry from a JDBC source instead? Any insight would be 
> > helpful. Cheers.
> > >   <source-subject-identifiers>
> > >     <source-subject-identifier source="jdbc_ncl"
> > > subject-attribute="subjectId" >
> > >       <ldap-search base="ou=people,dc=ncl,dc=ac,dc=uk" 
> > >         scope="subtree_scope" 
> > >         filter="(uid={0})" />
> > >     </source-subject-identifier>
> > >   </source-subject-identifiers>
> > >
> > > Regards
> > > --------------
> > > Sanjay Vivek
> > > Web Team
> > > ISS
> > > University of Newcastle Upon Tyne