Grouper Users - Open Discussion List

[Tom Zeller <>]

Upon receiving reports of poor provisioning performance (25 hours !)
in version 2.1.0, I spent some time profiling, and have made some
improvements slated for 2.1.1 which are available for testing now.

The most easily identifiable performance bottlenecks were in the
grouper-shib plugin, which is an extension to the shibboleth attribute
resolver which provides grouper data connectors and attribute
definitions. This plugin is the interface from grouper, via an
attribute resolver, to the provisioner (the psp).

[1] The first performance improvement is to only return the attribute
framework attributes you want, instead of querying for all attributes.
This is a reversion to pre-2.1.0 behavior.

[2] The second performance improvement is to fix a bug in the member
data connector where two grouper caches were used instead of one,
resulting in an additional ldap search for every membership, yikes!

[3] The third performance improvement is to restrict the member data
connector to only search a single source (for example, ldap), instead
of all subject sources, when looking for group members.


To test these changes in a 2.1.0 installation, you will need to :
(a) replace lib/custom/grouper-shib-2.1.0.jar with
lib/custom/grouper-shib-2.1.1.jar
(b) modify psp-resolver.xml

You may download the latest 2.1.1 psp snapshot, which contains
grouper-shib-2.1.1.jar, from the grouper release url :

 http://www.internet2.edu/grouper/release/2.1.1/grouper.psp-2.1.1.tar.gz

The modification to psp-resolver.xml involves adding the following filter

 <!-- Return members from the "ldap" source only. -->
    <grouper:Filter
      xsi:type="grouper:MemberSource"
      sourceId="ldap" />

to your MemberDataConnector. See the jira issue [3] for details.

TomZ

[1] https://bugs.internet2.edu/jira/browse/GRP-598

[2] https://bugs.internet2.edu/jira/browse/GRP-789

[3] https://bugs.internet2.edu/jira/browse/GRP-787

P.S. This is snapshot 20120512.025405-1 :

 
https://oss.sonatype.org/content/repositories/snapshots/edu/internet2/middleware/

And, yes, I think release candidates should be identified by -snapshot
or something similar, but our current versioning paradigm does not
support such things.