Grouper Users - Open Discussion List

[Vincent Repain <>]

Thank you, i may try this in the future. My main problem was the writing 
of the BulkSyncResponse in the logs when this error occurs, which made 
log files very huge... I solved this by setting logSpml=false in 
psp-services.xml

Le 15/11/2012 17:51, Tom Zeller a écrit :
> Not sure, but deleting unresolvable subjects from grouper_members
> might impact auditing or other things.
>
> When performing a bulkSync, all member subject ids are retrieved from
> Grouper lazily, for performance reasons, meaning no searches are
> performed to verify that the subjects actually exist in ldap.
>
> The data connector could be modified to verify that each subject
> exists in their source, but this might be a performance hit, depending
> on the number of members.
>
> This would be a reasonably small modification if someone was
> interested in giving it a try.
>
> http://anonsvn.internet2.edu/viewvc/viewvc.py/i2mi/java-provisioning-provider/trunk/psp-grouper-source/src/main/java/edu/internet2/middleware/psp/shibboleth/AllMemberSubjectIdsDataConnector.java?revision=7824&view=co
>
> On Thu, Nov 15, 2012 at 5:57 AM, Vincent Repain
> <>
>  wrote:
> > Okay, here's what i did :
> >
> > Recreated an grouper database
> > Defined a ldap source
> > Created a group "test" and added two members from the ldap source (stage01
> > and stage02)
> > Launched "gsh.sh -psp -bulkSync ..."
> > => no error
> > Deleted the entry "stage02" in the ldap source
> > Launched "gsh.sh -psp -bulkSync ..." again
> > => got the error in the logs (attached)
> >
> > I tried then : " bin/gsh.sh -usdu -all -delete"
> > => member_uuid='3c1aa2123cb64ea385ef58de761155c0'
> > subject='stage02'/'person'/'insa:ldap' group='grp:d:test list='members'
> > delete
> >
> > but i got the same error when i launch "gsh.sh -psp -bulkSync" again
> >
> > So i think this error occurs when subjects are no longer in their source but
> > still exist in grouper_member table
> >
> > Is this normal ?
> >
> > If yes, is there a simple way to delete subjects which no longer exist in
> > the source from grouper_member table ?
> >
> > Thanks
> >
> >
> > Le 14/11/2012 16:49, Tom Zeller a écrit :
> >
> > > Sure. Please attach the log output to your reply.
> > >
> > > On Wed, Nov 14, 2012 at 9:39 AM, Vincent Repain
> > > <>
> > >   wrote:
> > > > Sorry, but nothing match "failure" in the childs of <bulkSyncResponse />
> > > > I you agree, i can test with much less data and show you th full logs ?
> > > > Thanks
> > > >
> > > >
> > > > Le 14/11/2012 16:19, Tom Zeller a écrit :
> > > >
> > > > > At least one of the <syncResponse /> child elements of the
> > > > > <bulkResponse /> should have status='failure' rather than
> > > > > status='success'. Could you check again, please ?
> > > > >
> > > > > On Wed, Nov 14, 2012 at 8:49 AM, Vincent Repain
> > > > > <>
> > > > >   wrote:
> > > > > > Hi,
> > > > > >
> > > > > > I am provisioning groups and members in a ldap directory with grouper
> > > > > > psp
> > > > > > (flat structure, config based on psp-example-grouper-to-openldap)
> > > > > > This works fine, i.e my groups and memberships are correctly
> > > > > > provisioned
> > > > > > and
> > > > > > updated, however, the log file show me an error like this :
> > > > > >
> > > > > > 2012-11-14 14:40:16,033: [Timer-2] ERROR Psp.execute(811) -  - Psp
> > > > > > 'psp'
> > > > > > -
> > > > > > BulkSync
> > > > > >
> > > > > >
> > > > > > BulkSyncResponse[id=<null>,status=failure,error=<null>,errorMessages={},requestID=2012/11/14-14:39:45.433,responses=2497]
> > > > > > 2012-11-14 14:40:16,298: [Timer-2] ERROR Psp.execute(813) -  - Psp
> > > > > > 'psp'
> > > > > > -
> > > > > > BulkSync SPML:
> > > > > > <psp:bulkSyncResponse xmlns:psp='http://grouper.internet2.edu/psp'
> > > > > > status='failure' requestID='2012/11/14-14:39:45.433'>
> > > > > >      <psp:syncResponse status='success'
> > > > > > requestID='2012/11/14-14:39:45.708'>
> > > > > >        <psp:synchronizedResponse
> > > > > > xmlns:psp='http://grouper.internet2.edu/psp'>
> > > > > >          <psp:psoID ID='cn=grouper,ou=groups,dc=insa-rennes,dc=fr'
> > > > > > targetID='insa:ldap'/>
> > > > > >        </psp:synchronizedResponse>
> > > > > >        <psp:id ID='grp:admin:grouper'/>
> > > > > >      </psp:syncResponse>
> > > > > >      <psp:syncResponse status='success'
> > > > > > requestID='2012/11/14-14:39:45.817'>
> > > > > >        <psp:synchronizedResponse
> > > > > > xmlns:psp='http://grouper.internet2.edu/psp'>
> > > > > >          <psp:psoID ID='cn=test,ou=groups,dc=insa-rennes,dc=fr'
> > > > > > targetID='insa:ldap'/>
> > > > > >        </psp:synchronizedResponse>
> > > > > >        <psp:id ID='grp:d:test'/>
> > > > > >      </psp:syncResponse>
> > > > > > ....
> > > > > >
> > > > > > ...followed by the list of all my groups and members. All syncResponse
> > > > > > in
> > > > > > this list have the status 'success' and, again, the groups and members
> > > > > > are
> > > > > > correctly updated in my directory.
> > > > > >
> > > > > > This happend when i launch the provisioning using "gsh.sh -psp
> > > > > > -bulkSync...", with or without "-interval ..."
> > > > > > When I launch psp for one group for testing (with "-sync <id>"), the
> > > > > > log
> > > > > > file show me no error
> > > > > >
> > > > > > Did i miss something ?
> > > > > >
> > > > > > Thanks
> > > > > >
> > > > > > PS :
> > > > > > log4j.logger.edu.internet2.middleware.psp = ERROR in log4j.properties
> > > > > >
> > > > > > --
> > > > > > Vincent Repain
> > > > > > INSA de Rennes
> > > > > > Centre de ressources informatiques
> > > > > > 02.23.23.83.31
> > > > --
> > > > Vincent Repain
> > > > INSA de Rennes
> > > > Centre de ressources informatiques
> > > > 02.23.23.83.31
> >
> > --
> > Vincent Repain
> > INSA de Rennes
> > Centre de ressources informatiques
> > 02.23.23.83.31