Grouper Users - Open Discussion List

[Tom Zeller <>]

Apologies for the delay.

You're provisioning Active Directory, correct ? If so, remove
<memberships ... > (memberOf) from ldappc.xml.

Did you extend your AD schema to include eduMember ? If not, remove
<group-members-name-list ...> (hasMember).

Take a look at ldappc.example.ad.xml.

When adding a member to a group, Active Directory automatically
manages the memberOf attribute of the member objects. By default,
Active Directory does not support the hasMember attribute.

TomZ

On Tue, Aug 3, 2010 at 2:58 AM, Richard James
<>
 wrote:
> Hi Tom,
>
> I have attached our ldappc.xml file and also the properties file for which 
> I have removed any user credentials.
>
> Regards
>
> Richard
>
>>-----Original Message-----
>>From: 
>>
>> 
>>[mailto:]
>> On Behalf Of Tom
>>Zeller
>>Sent: 02 August 2010 17:56
>>To: Richard James
>>Cc: 
>>
>>Subject: Re: [grouper-users] Ldappc Provisioning to Active Directory
>>
>>Could you reply with a sanitized (passwordless) version of your
>>configuration, ldappc.xml, please ?
>>
>>On Mon, Aug 2, 2010 at 10:39 AM, Richard James
>><>
>> wrote:
>>> Hi All,
>>>
>>> We have recently started testing the provisioning of grouper groups
>>into our test Active directory using ldappc (we will move towards using
>>ldappcng once we have got ldappc working correctly). We have managed to
>>load a number of groups into the active directory but when it comes to
>>assigning members to these groups we are coming across a few issues.
>>>
>>> I have configured our ldappc.xml file in line with the example active
>>directory configuration which is documented here,
>>https://spaces.internet2.edu/display/GrouperWG/LDAPPC. Initially I
>>commented out any memberships config, as per the guidance, but on trying
>>to provision memberships, I got the error attached in
>>nomembershipconfig.txt. There is definitely a member within the group we
>>are trying to provision, so I'm not sure why this message is being
>>returned.
>>>
>>> I have then tried to add the memberships section into the config file,
>>this time it recognises that there is a member of the group and locates
>>the user with the correct path of the AD, but returns an attribute
>>conversion error on attempting to provision the membership.
>>(membershipconfig.txt).
>>>
>>> Unfortunately our experience of provisioning items into an ldap
>>directory is very limited. The fact that we are able to create the
>>groups in the active directory is very promising, but the assigning of
>>members is leaving us a little baffled at the moment, so any
>>pointers/guidance would be very much appreciated.
>>>
>>> Many thanks in advance
>>>
>>> Richard James
>>> ISS Middleware Team
>>> Newcastle University
>>>
>>>
>>>
>