Grouper Users - Open Discussion List

[Kathryn Huxtable <>]

Thanks. I'll see if I can build it on Ubuntu, which is what I'm running.

-K

On Jun 6, 2008, at 12:31 PM, Michael R. Gettes wrote:

> Fedora directory came from iPlanet.  It wants to use uniqueMember  
> attributes.
> OpenLDAP wants the member attribute.  Fedora Dir will run on redhat  
> and similar systems.
> I believe source is provided so you can build for other environments  
> as well.
>
> I hope this helps.
>
> /mrg
>
> On Jun 6, 2008, at 13:25, Kathryn Huxtable wrote:
>
> > All respect to Tom, but I'm not certain that case has anything to  
> > do with this. I don't have Fedora running. Can I run Fedora  
> > Directory server without it? Do I need a license?
> >
> > My testing has been done on OpenLDAP.
> >
> > I'm looking further into this, because I'm not convinced it's an  
> > LDAP problem.
> >
> > -K
> >
> > On Jun 6, 2008, at 3:30 AM, Graham Seaman wrote:
> >
> > > Thanks Kathryn. Let me know if there are any other tests I can do  
> > > for you. And please remember I am fairly new to ldap - it may be  
> > > that there are settings which an experienced ldap administrator  
> > > would take for granted, but which I am not aware of. In  
> > > particular, there may be permissions issues.
> > >
> > > Graham
> > >
> > > Kathryn Huxtable wrote:
> > > > I'll look into it. Thanks for reporting this. -K
> > > >
> > > > Graham Seaman wrote:
> > > > > Tom Barton wrote:
> > > > > > Googling for the meaning of err: 20, it seems possible that  
> > > > > > there's a case sensitivity bug, probably somewhere in Ldappc,  
> > > > > > that's being exposed by your DN having mixed case. Is it easy  
> > > > > > for you to change the case of that OU to all lower, just to  
> > > > > > test and confirm that this somehow exposes the exception?
> > > > > I'm afraid that makes no difference at all:
> > > > >
> > > > > javax.naming.directory.AttributeInUseException: [LDAP: error  
> > > > > code 20 - Attribute Or Value Exists]; remaining name  
> > > > > 'cn=seamang,ou=flame users,dc=lse,dc=ac,dc=uk'
> > > > >
> > > > >
> > > > > Graham
> > > > >
> > > > >
> > > > >
> > > > > > I've created bug MCO-15 in jira to track this.
> > > > > >
> > > > > > Tom
> > > > > >
> > > > > > Graham Seaman wrote:
> > > > > > > Hi,
> > > > > > >
> > > > > > > I'm trying to use ldappc to provision ldap (Fedora Directory  
> > > > > > > Server) from grouper. I'm fairly new to both ldap and grouper.  
> > > > > > > My source for users is the ldap directory. After a lot of  
> > > > > > > struggling[1], I can now get ldappc to provision grouper  
> > > > > > > groups into the ldap directory, correctly creating the group  
> > > > > > > information and populating them with the group members. But I  
> > > > > > > have not been able to  persuade ldappc to  work with the - 
> > > > > > > memberships option.
> > > > > > >
> > > > > > > My initial intent was  to  use the existing   
> > > > > > > eduPersonEntitlement field to carry the membership  
> > > > > > > information, with ldappc.xml set up as:
> > > > > > >
> > > > > > > <member-groups-list
> > > > > > >     list-object-class="eduPerson"
> > > > > > >     list-attribute="eduPersonEntitlement"
> > > > > > >     naming-attribute="name" />
> > > > > > >
> > > > > > > This attribute is already in use in my directory, but a quick  
> > > > > > > look at GrouperProvisioner.java suggested it should be able to  
> > > > > > > append group names to existing information in the  attribute.   
> > > > > > > When I attempted this ldappc managed to find the records to  
> > > > > > > update, but threw exceptions when trying to update them:
> > > > > > >
> > > > > > > ./ldappc  -memberships -subject GrouperSystem
> > > > > > >
> > > > > > > javax.naming.directory.AttributeInUseException: [LDAP: error  
> > > > > > > code 20 - Attribute Or Value Exists]; remaining name  
> > > > > > > 'CN=xyz,ou=Flame
> > > > > > > Users,dc=lse,dc=ac,dc=uk'
> > > > > > >      at
> > > > > > > com 
> > > > > > > .sun 
> > > > > > > .jndi 
> > > > > > > .toolkit 
> > > > > > > .ctx 
> > > > > > > .PartialCompositeDirContext 
> > > > > > > .modifyAttributes(PartialCompositeDirContext.java:172)
> > > > > > >     at
> > > > > > > com 
> > > > > > > .sun 
> > > > > > > .jndi 
> > > > > > > .toolkit 
> > > > > > > .ctx 
> > > > > > > .PartialCompositeDirContext 
> > > > > > > .modifyAttributes(PartialCompositeDirContext.java:161)
> > > > > > >     at
> > > > > > > javax 
> > > > > > > .naming 
> > > > > > > .directory 
> > > > > > > .InitialDirContext.modifyAttributes(InitialDirContext.java:148)
> > > > > > >     at
> > > > > > > edu 
> > > > > > > .internet2 
> > > > > > > .middleware 
> > > > > > > .ldappc 
> > > > > > > .GrouperProvisioner.updateSubject(GrouperProvisioner.java:735)
> > > > > > >     at
> > > > > > > edu 
> > > > > > > .internet2 
> > > > > > > .middleware 
> > > > > > > .ldappc 
> > > > > > > .GrouperProvisioner 
> > > > > > > .performActualMembershipUpdates(GrouperProvisioner.java:622)
> > > > > > >     at
> > > > > > > edu 
> > > > > > > .internet2 
> > > > > > > .middleware 
> > > > > > > .ldappc 
> > > > > > > .GrouperProvisioner 
> > > > > > > .provisionMemberships(GrouperProvisioner.java:437)
> > > > > > >     at
> > > > > > > edu 
> > > > > > > .internet2 
> > > > > > > .middleware 
> > > > > > > .ldappc.GrouperProvisioner.provision(GrouperProvisioner.java: 
> > > > > > > 185)
> > > > > > >
> > > > > > > (in the ldap log this shows as
> > > > > > > [05/Jun/2008:14:04:12 +0100] conn=18 op=9 MOD  
> > > > > > > dn="CN=xyz,ou=Flame Users,dc=lse,dc=ac,dc=uk"
> > > > > > > [05/Jun/2008:14:04:12 +0100] conn=18 op=9 RESULT err=20  
> > > > > > > tag=103 nentries=0 etime=0 )
> > > > > > >
> > > > > > > OK, so I assumed the problem was in the attribute already  
> > > > > > > being in use. I went back and redefined my ldap entries as  
> > > > > > > having objectclass eduMember, and restored ldappc.xml to the  
> > > > > > > original default values:
> > > > > > >
> > > > > > > <memberships>
> > > > > > >   <member-groups-list
> > > > > > >     list-object-class="eduMember"
> > > > > > >     list-attribute="isMemberOf"
> > > > > > >     naming-attribute="name" />
> > > > > > > </memberships>
> > > > > > >
> > > > > > > But ldappc still throws exactly the same exception, although  
> > > > > > > the isMemberOf attribute is empty.
> > > > > > >
> > > > > > > Any suggestions as to what to try next?
> > > > > > >
> > > > > > > Thanks
> > > > > > > Graham Seaman
> > > > > > > [1] The initial configuration problems included a faulty  
> > > > > > > configuration causing ldappc to delete the entire ldap  
> > > > > > > directory, requiring a reinstall. After that I realised it  
> > > > > > > would be sensible for ldappc not to connect as the Directory  
> > > > > > > manager, but as a user with rather less power. Unfortunately  
> > > > > > > this led to a series of minor problems needing acis and  
> > > > > > > exceptional rules which lead to my user being effectively an  
> > > > > > > administrator anyway..
> > >
> > >
> > > --
> > > Sponsor me from London to Brighton on http://www.justgiving.com/grahamseaman