Skip to Content.
Sympa Menu

grouper-users - [grouper-users] RE: Grouper Loader LDAP with AD

Subject: Grouper Users - Open Discussion List

List archive

[grouper-users] RE: Grouper Loader LDAP with AD

Chronological Thread 
  • From: Chris Hyzer <>
  • To: Gagné Sébastien <>, "" <>
  • Subject: [grouper-users] RE: Grouper Loader LDAP with AD
  • Date: Thu, 10 May 2012 15:47:41 +0000
  • Accept-language: en-US

I think it can do it, but we have to adapt the convertDbToSpecificValue part…


Ie. A person DN is CN=gagns,OU=People,DC=dev,DC=umontreal,DC=ca

A group DN is (Im making this up): CN=someGroup,OU=Groups,DC=dev,DC=umontreal,DC=ca


Then we need a simple Java method that we will add to the LDAP subject _expression_ which:


Looks at the DB, and if it is in People, then return the CN value, if it is Groups (or wherever), then we need the group name in Grouper: umontreal:adgroups:someGroup or whatever the translation is…


1.       Edit the


(edit this existing entry)

loader.ldap.el.classes = ca.umontreal.grouper.UmontrealLoaderElUtils


(add these [and configure to your env] ) =,OU=Groups,DC=dev,DC=umontreal,DC=ca = umontreal:adgroups:


2.       Add the attached jar to your lib dir


3.       Change your attribute:


LDAP subject _expression_              ${umontrealLoaderElUtils.convertAdDnToSpecificValue(subjectId)}


I didn’t test it… see if it helps… J




Btw, the source of that jar is one file.. look at the logic, will it work or do you need something different?



* @author mchyzer

* $Id$


package ca.umontreal.grouper;


import org.apache.commons.lang.StringUtils;




import edu.internet2.middleware.grouper.util.GrouperUtil;






public class UmontrealLoaderElUtils {




   * convert a user dn to a user, and a group dn to a group

   * @param dn

   * @return the dn


  public static String convertAdDnToSpecificValue(String dn) {


    //e.g. ,OU=Groups,DC=dev,DC=umontreal,DC=ca

    String adGroupSuffix = GrouperLoaderConfig.getPropertyString("", true);


    //not sure why this would happen

    if (dn == null) {

      return dn;



    if (dn.toLowerCase().endsWith(adGroupSuffix.toLowerCase())) {

      String cn = dn.substring(0, dn.length()-adGroupSuffix.length());


      if (StringUtils.countMatches(cn, "=") != 1) {

        throw new RuntimeException("Why is there not 1 equals in this CN??? '" + cn + "'");



      //this should be CN=groupName, convert to groupName

      cn = GrouperUtil.prefixOrSuffix(cn, "=", false);


      //e.g. = umontreal:adgroups:

      String grouperGroupPrefix = GrouperLoaderConfig.getPropertyString("", true);


      return grouperGroupPrefix + cn;



    //not a group

    return LoaderLdapElUtils.convertDnToSpecificValue(dn);






From: [mailto:] On Behalf Of Gagné Sébastien
Sent: Thursday, May 10, 2012 11:13 AM
Subject: RE: [grouper-users] RE: Grouper Loader LDAP with AD



I have a new question : Does the Loader LDAP support group membership in a group (i.e GroupA is a member of GroupB in LDAP)


It seems the standard Grouper Loader can do this : “Penn is using it in production to load membership for groups, and for groups of groups”


When I tried it, the loader couldn’t find GroupA in the subject source (since I filter using objectClass=person). I removed this part of the filter, it added the group, but not as a Grouper group but as an AD subject. So I put the filter back like it was with the objectClass=person and removed the source ID thinking the loader could search the Group Source Adapter (g:gsa), but it didn’t work.


Here are my current configuration, I tried to keep it as plain as possible :

LDAP type


LDAP filter


LDAP subject attribute name


LDAP source ID

LDAP subject ID type


LDAP server ID


LDAP quartz cron

30 * * * * ?

LDAP subject _expression_



In the Group’s member attribute contains both Group DNs and Member DNs with no


Thank you again.


De : [] De la part de Chris Hyzer
Envoyé : 9 mai 2012 11:51
À : Gagné Sébastien;
Objet : [grouper-users] RE: Grouper Loader LDAP with AD


This is what TomB asked at the member meeting and I said, “Uh, I think it does that”  J


I think you need:




To the value:




That should work for subjectId, or subjectIdentifier, or subjectIdOrIdentifier.  See if that works.


If not can you let me know all the loader job attributes and values you have set?






From: On Behalf Of Gagné Sébastien
Sent: Wednesday, May 09, 2012 11:30 AM
Subject: [grouper-users] Grouper Loader LDAP with AD



I’m trying to configure the Grouper Loader LDAP to work with our AD, but I’m stuck with a problem. Basically what we would like is to retrieve all groups in AD and load them in Grouper.


I’ve set the loader type to LDAP_GROUP_LIST with a filter (objectClass=group) (dev AD has 5-6 groups). This properly returns all groups and they are added in Grouper.


The problem is with the members : it sees them in the AD group, but cannot find them in the source, which is the same AD.


I’ve set the subject attribute name to member and my source ID is ldap (I’m also using the PSP)

The group’s member attribute is a multivalued set of “Distinguished Name” (e.g. CN=gagns,OU=People,DC=dev,DC=umontreal,DC=ca). This is a problem since my subject ID is the sAMAccountName (i.e. gagns). What I did, is use the search type subjectIdentifier and modified the filter in sources.xml to use the full DN :










Unfortunately it doesn’t work and I don’t know why. When manually running the loader job (i.e. loaderRunOneJob(group) in, in the logs I see that it find the members of the groups, but that the every search for one of the subject fails :


2012-05-09 09:06:24,001: [main] ERROR GrouperLoaderResultset$Row.getSubject(1112) -  - Problem with subjectIdentifier: CN=gagns,OU=People,DC=dev,DC=umontreal,DC=ca, subjectSourceId: ldap, in jobName: LDAP_GROUP_LIST__etc:confLDAPLoader__e7b97262558b477fab09c0b48f98ed1c


edu.internet2.middleware.subject.SubjectNotFoundException: No results: searchSubjectByIdentifier filter:(&(distinguishedName=%TERM%)(objectclass=person)) searchValue: CN=gagns,OU=People,DC=dev,DC=umontreal,DC=ca


        at edu.internet2.middleware.subject.provider.LdapSourceAdapter.getLdapUnique(

        at edu.internet2.middleware.subject.provider.LdapSourceAdapter.getSubjectByIdentifier(

        at edu.internet2.middleware.grouper.subj.SourcesXmlResolver.findByIdentifier(




I tried an ldapsearch and manually changing the %TERM% to the DN and it works fine :


ldapsearch -h -D "<grouper service account DN>" -w <pass> -b "OU=People,DC=dev,DC=umontreal,DC=ca"  "(&(distinguishedName=CN=gagns,OU=People,DC=dev,DC=umontreal,DC=ca)(objectclass=person))"











Anyone has an idea what might be happening here ? Anyone did a successful AD configuration ?


Thank you



What I find weird is if I use subjectId (not subjectIdentifier), I get slightly different results in the exceptions. JobName is different and membership count also.


2012-05-09 10:22:49,165: [main] ERROR GrouperLoaderResultset$Row.getSubject(1112) -  - Problem with subjectId: CN=gagns,OU=People,DC=devsim,DC=umontreal,DC=ca, subjectSourceId: ldap, in jobName: groups:UdeM:fromAD1


edu.internet2.middleware.subject.SubjectNotFoundException: No results: searchSubject filter:(&(sAMAccountName=%TERM%)(objectclass=person)) searchValue: CN=gagns,OU=People,DC=devsim,DC=umontreal,DC=ca


with subjectIdentifier :

loader ran successfully, inserted 0 memberships, deleted 0 memberships, total membership count: 0

with subjectId :

loader ran successfully, inserted 0 memberships, deleted 0 memberships, total membership count: 40





Sébastien Gagné,     | Analyste en informatique

514-343-6111 x33844  | Université de Montréal,

                     | Pavillon Roger-Gaudry, local X-100-11


Attachment: umontrealGrouper.jar
Description: umontrealGrouper.jar

Archive powered by MHonArc 2.6.16.

Top of Page