Grouper Users - Open Discussion List

[Tom Zeller <>]

Set provisioning log levels to debug in log4j.properties and try again.

Yes, your reckoning is likely correct, the "noSuchIdentifier" and
"unable to calculate provisioned object" error messages mean that no
provisioned object identifier could be calculated. However, this is
for 'stem:ADM1100-H12', so I do not think this means that cn=elbe can
not be resolved. If cn=elbe could not be resolved, then the calc
response would consist of a group (or is this a stem ?) without the
cn=elbe member.

Increasing log verbosity should help.

P.S. bonus points awarded for using the word "reckon".

# Provisioning : PSP (version 2.1+)
log4j.logger.edu.internet2.middleware.psp = DEBUG

# Provisioning : vt-ldap
log4j.logger.edu.vt.middleware.ldap = DEBUG

# Provisioning : Grouper plugin to Shibboleth attribute resolver
log4j.logger.edu.internet2.middleware.grouper.shibboleth = DEBUG

On Wed, Jun 6, 2012 at 2:08 PM, Jonathan Tellier 
<>
 wrote:
> Hi,
>
> I'm trying to set up a deployment where Grouper would retrieve its
> data from a DB and would then provision everything to an LDAP
> directory. In order to test, I'm using the sample HSQL DB with sample
> data that comes with the Grouper Installer. I've also set up an LDAP
> in which I've manually added an single entry corresponding to one of
> the subjects in the DB. I've added this one subject to a group by
> using Grouper. When I try to provision the stem to my LDAP by using
> GSH, I get this error:
>
>  <psp:calcResponse xmlns:psp='http://grouper.internet2.edu/psp'
> status='failure' requestID='2012/06/06-18:52:24.793'
> error='noSuchIdentifier'>
>  <errorMessage>Unable to calculate provisioned object.</errorMessage>
>  <psp:id ID='stem:ADM1100-H12'/>
> </psp:calcResponse>
>
> The logs do not give me any other useful information.
>
> Now, I think I've got an idea about what's happening, but I don't know
> how to fix my problem. The user that comes from the DB has the ID
> "elbe". Now, the "elbe" user that I've manually created in my LDAP has
> the following DN : "cn=elbe,ou=people,dc=example,dc=com". I reckon
> that Grouper cannot resolve the "elbe" ID into the
> "cn=elbe,ou=people,dc=example,dc=com" DN, thus raising a
> "noSuchIdentifier" error. Does that make sense?
>
> I've played with the attributes definition in order to set the CN as
> the subject identifier, but it didn't help.
>
> Any ideas about what I could do to be able to provision data into my LDAP?
>
> Thanks,
> --jtellier