Grouper Users - Open Discussion List

[Gagné Sébastien <>]

Hi,

We are now provisionning our AD target with a flat structure. This structure uses only the extension so we don’t have the whole folder path in the group’s name (we have group unicity).

 

I was having trouble with ChangeLog membership changes: it couldn’t match the Grouper group to the AD group, so I changed the script a little in psp-resolver to extract the group’s extension out of the Group name, see yellow in #1 below. Looking at the grouper-to-tivoli example (which uses a flat structure) I see a different and simpler attribute definition, see #2. Is there a way to get the group’s extension in a changelogdataconnector ?

 

My question boils down to : could I have done better or simpler ?

 

=== #1 ===

  <resolver:AttributeDefinition

    id="changeLogMembershipGroupName"

    xsi:type="ad:Script">

    <resolver:Dependency ref="AddMembershipChangeLogDataConnector" />

    <resolver:Dependency ref="DeleteMembershipChangeLogDataConnector" />

    <ad:Script><![CDATA[

        // Import Shibboleth attribute provider.

        importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);

 

        // Create the attribute to be returned.

        changeLogMembershipGroupName = new BasicAttribute("changeLogMembershipGroupName")

 

        // Return the group name if it is a child of the base stem to be provisioned, omitting 'etc'.

        if (typeof groupName != "undefined" && groupName != null ) {

            // The name of the base stem to be provisioned.

            var scriptBaseStem = "${edu.internet2.middleware.psp.baseStem}";

 

            // If the base stem is the root stem, ignore groups under the 'etc' stem.

            if (scriptBaseStem.length == 0) {

                if (groupName.getValues().get(0).lastIndexOf("etc:", 0) === -1) {

                    changeLogMembershipGroupName.getValues().add(groupName.getValues().get(0) .substring(groupName.getValues().get(0).lastIndexOf(":")+1));

                }

            // Return the group name if it starts with the base stem to be provisioned.

            } else {

                if (groupName.getValues().get(0).lastIndexOf(scriptBaseStem + ":", 0) != -1) {

                    changeLogMembershipGroupName.getValues().add(groupName.getValues().get(0).substring(groupName.getValues().get(0).lastIndexOf(":")+1));           

                }

            }

        }

    ]]></ad:Script>

  </resolver:AttributeDefinition>

 

=== #2 ===

<resolver:AttributeDefinition

    id="changeLogMembershipGroupName"

    xsi:type="grouper:FilteredName"

    sourceAttributeID="groupName">

    <resolver:Dependency ref="AddMembershipChangeLogDataConnector" />

    <resolver:Dependency ref="DeleteMembershipChangeLogDataConnector" />

    <!-- The MINUS filter matches stems which match the first child filter and not the second. -->

    <grouper:Filter xsi:type="grouper:MINUS">

      <!-- The NameInStem filter matches names which are children of the given stem. -->

      <grouper:Filter

        xsi:type="grouper:NameInStem"

        name="${edu.internet2.middleware.psp.baseStem}"

        scope="SUB" />

      <grouper:Filter

        xsi:type="grouper:NameInStem"

        name="etc"

        scope="SUB" />

    </grouper:Filter>

  </resolver:AttributeDefinition>

 

 

Sébastien Gagné,     | Analyste en informatique

514-343-6111 x33844  | Université de Montréal,

                     | Pavillon Roger-Gaudry, local X-100-11