Grouper Users - Open Discussion List

[Tom Zeller <>]

Not sure, but deleting unresolvable subjects from grouper_members
might impact auditing or other things.

When performing a bulkSync, all member subject ids are retrieved from
Grouper lazily, for performance reasons, meaning no searches are
performed to verify that the subjects actually exist in ldap.

The data connector could be modified to verify that each subject
exists in their source, but this might be a performance hit, depending
on the number of members.

This would be a reasonably small modification if someone was
interested in giving it a try.

http://anonsvn.internet2.edu/viewvc/viewvc.py/i2mi/java-provisioning-provider/trunk/psp-grouper-source/src/main/java/edu/internet2/middleware/psp/shibboleth/AllMemberSubjectIdsDataConnector.java?revision=7824&view=co

On Thu, Nov 15, 2012 at 5:57 AM, Vincent Repain
<>
 wrote:
> Okay, here's what i did :
>
> Recreated an grouper database
> Defined a ldap source
> Created a group "test" and added two members from the ldap source (stage01
> and stage02)
> Launched "gsh.sh -psp -bulkSync ..."
> => no error
> Deleted the entry "stage02" in the ldap source
> Launched "gsh.sh -psp -bulkSync ..." again
> => got the error in the logs (attached)
>
> I tried then : " bin/gsh.sh -usdu -all -delete"
> => member_uuid='3c1aa2123cb64ea385ef58de761155c0'
> subject='stage02'/'person'/'insa:ldap' group='grp:d:test list='members'
> delete
>
> but i got the same error when i launch "gsh.sh -psp -bulkSync" again
>
> So i think this error occurs when subjects are no longer in their source but
> still exist in grouper_member table
>
> Is this normal ?
>
> If yes, is there a simple way to delete subjects which no longer exist in
> the source from grouper_member table ?
>
> Thanks
>
>
> Le 14/11/2012 16:49, Tom Zeller a écrit :
>
>> Sure. Please attach the log output to your reply.
>>
>> On Wed, Nov 14, 2012 at 9:39 AM, Vincent Repain
>> <>
>>   wrote:
>>>
>>> Sorry, but nothing match "failure" in the childs of <bulkSyncResponse />
>>> I you agree, i can test with much less data and show you th full logs ?
>>> Thanks
>>>
>>>
>>> Le 14/11/2012 16:19, Tom Zeller a écrit :
>>>
>>>> At least one of the <syncResponse /> child elements of the
>>>> <bulkResponse /> should have status='failure' rather than
>>>> status='success'. Could you check again, please ?
>>>>
>>>> On Wed, Nov 14, 2012 at 8:49 AM, Vincent Repain
>>>> <>
>>>>   wrote:
>>>>>
>>>>> Hi,
>>>>>
>>>>> I am provisioning groups and members in a ldap directory with grouper
>>>>> psp
>>>>> (flat structure, config based on psp-example-grouper-to-openldap)
>>>>> This works fine, i.e my groups and memberships are correctly
>>>>> provisioned
>>>>> and
>>>>> updated, however, the log file show me an error like this :
>>>>>
>>>>> 2012-11-14 14:40:16,033: [Timer-2] ERROR Psp.execute(811) -  - Psp
>>>>> 'psp'
>>>>> -
>>>>> BulkSync
>>>>>
>>>>>
>>>>> BulkSyncResponse[id=<null>,status=failure,error=<null>,errorMessages={},requestID=2012/11/14-14:39:45.433,responses=2497]
>>>>> 2012-11-14 14:40:16,298: [Timer-2] ERROR Psp.execute(813) -  - Psp
>>>>> 'psp'
>>>>> -
>>>>> BulkSync SPML:
>>>>> <psp:bulkSyncResponse xmlns:psp='http://grouper.internet2.edu/psp'
>>>>> status='failure' requestID='2012/11/14-14:39:45.433'>
>>>>>     <psp:syncResponse status='success'
>>>>> requestID='2012/11/14-14:39:45.708'>
>>>>>       <psp:synchronizedResponse
>>>>> xmlns:psp='http://grouper.internet2.edu/psp'>
>>>>>         <psp:psoID ID='cn=grouper,ou=groups,dc=insa-rennes,dc=fr'
>>>>> targetID='insa:ldap'/>
>>>>>       </psp:synchronizedResponse>
>>>>>       <psp:id ID='grp:admin:grouper'/>
>>>>>     </psp:syncResponse>
>>>>>     <psp:syncResponse status='success'
>>>>> requestID='2012/11/14-14:39:45.817'>
>>>>>       <psp:synchronizedResponse
>>>>> xmlns:psp='http://grouper.internet2.edu/psp'>
>>>>>         <psp:psoID ID='cn=test,ou=groups,dc=insa-rennes,dc=fr'
>>>>> targetID='insa:ldap'/>
>>>>>       </psp:synchronizedResponse>
>>>>>       <psp:id ID='grp:d:test'/>
>>>>>     </psp:syncResponse>
>>>>> ....
>>>>>
>>>>> ...followed by the list of all my groups and members. All syncResponse
>>>>> in
>>>>> this list have the status 'success' and, again, the groups and members
>>>>> are
>>>>> correctly updated in my directory.
>>>>>
>>>>> This happend when i launch the provisioning using "gsh.sh -psp
>>>>> -bulkSync...", with or without "-interval ..."
>>>>> When I launch psp for one group for testing (with "-sync <id>"), the
>>>>> log
>>>>> file show me no error
>>>>>
>>>>> Did i miss something ?
>>>>>
>>>>> Thanks
>>>>>
>>>>> PS :
>>>>> log4j.logger.edu.internet2.middleware.psp = ERROR in log4j.properties
>>>>>
>>>>> --
>>>>> Vincent Repain
>>>>> INSA de Rennes
>>>>> Centre de ressources informatiques
>>>>> 02.23.23.83.31
>>>>>
>>> --
>>> Vincent Repain
>>> INSA de Rennes
>>> Centre de ressources informatiques
>>> 02.23.23.83.31
>>>
>
>
> --
> Vincent Repain
> INSA de Rennes
> Centre de ressources informatiques
> 02.23.23.83.31
>