Grouper Users - Open Discussion List

[Tom Zeller <>]

There is a serious bug in ldappcng resulting in the incorrect deletion
of groups from provisioned targets when the -lastModifyTime option is
used for bulkSync operations.

https://bugs.internet2.edu/jira/browse/GRP-499

One of the last parts of ldappcng I wrote before the 1.6.0 release to
be feature-comparable with ldappc was the -lastModifyTime command line
option, and I did not think it through nor test it thoroughly.

The fix should be easy enough, a line or two of code. I think I can
release a patch or a version of ldappcng, 1.6.1.1 or similar, without
having to go through a Grouper release process. I imagine we will
decide on our Grouper dev call tomorrow.

To those of you using ldappcng or thinking about using it, my
apologies. As they say, "my bad".

For those interested, the bulkDiff operation includes logic whereby it
searches a provisioned target for the identifiers of all provisioned
objects and then deletes provisioned object identifiers which do not
have a corresponding source identifier. The -lastModifyTime option
filters source identifiers which were not modified after the given
lastModifyTime, resulting in their deletion from provisioned targets.

Thanks, Shilen, for pointing this out.

TomZ