Grouper Users - Open Discussion List

[Shilen Patel <>]

Hi all,

We ended up discovering that the issue is a bug in the code that is incorrectly deleting memberships when an attribute definition is deleted in the newer attribute framework.

https://bugs.internet2.edu/jira/browse/GRP-880

The bug is fixed in the 2.1 branch and will be released with 2.1.4 probably in the next month or so.  If you're using the newer attribute framework, you may want to avoid deleting attribute definitions until you upgrade to 2.1.4.

Thanks!

-- Shilen

From: Gagné Sébastien <>
Date: Fri, 15 Feb 2013 11:15:09 -0500
To: Shilen Patel <>, Chris Hyzer <>
Cc: <>
Subject: RE: [grouper-dev] RE: Disapearing members ?!?!?!

No, grouper is the same, the only I changed was a custom Jar for a process that uses the Grouper API, some files in the UI (gettingStarted.jsp and nav.properties) and updated Java from 6u38 to 6u39. I did stop GrouperDaemon and Tomcat to do this update.

 

select * from grouper_group_set where owner_group_id='d3dcd08097f247f7ae432844797ce8ef'

I get 88 rows and the member_group_id matches Groups that were previously there

 

select * from grouper_memberships where owner_group_id='d3dcd08097f247f7ae432844797ce8ef'

I get 3 rows, 2 for GrouperAll, 1 for GrouperSysAdmin

 

 

 

 

De : Shilen Patel []
Envoyé : 15 février 2013 10:35
À : Gagné Sébastien; Chris Hyzer
Cc :
Objet : Re: [grouper-dev] RE: Disapearing members ?!?!?!

 

Are you saying you upgraded Grouper?  If so, from what version to what version?

 

What do the following queries give you?

 

select * from grouper_group_set where owner_group_id='<group id of all-admins>'

select * from grouper_memberships where owner_group_id='<group id of all-admins>'

 

Thanks!

 

-- Shilen

 

From: Gagné Sébastien <>
Date: Fri, 15 Feb 2013 09:34:28 -0500
To: Chris Hyzer <>
Cc: <>
Subject: [grouper-dev] RE: Disapearing members ?!?!?!

 

I am logged as a member of the GrouperSysAdmin group, so it’s not about privs

 

The rules I have only modify privileges, hooks wouldn’t delete anything. Anyway if that was the case, there would be traces in the audit log.

 

I don’t think it’s a UI or Priv problem since there are no lines in GROUPER_MEMEBERSHIP for that group (well there are 3, 1 for sysadmin, 2 for everyentity)

 

This is what I see for my bugged group (all-admins) in GROUPER_MEMBERSHIPS_V. crochet, gagns, larcheve are 3 people I added in the previous subgroup (dept1-admins). As you can see there are no immediate group membership, but effective members. These member were added AFTER the group bugged (it’s not residual)

 

GrouperSystem	g:isa	3741162bfb1b496ca0f36150c3b05a7b	access	admins	immediate
GrouperAll	g:isa	fe89dce18391454eb87fc14477d3ec1c	access	viewers	immediate
GrouperAll	g:isa	fe89dce18391454eb87fc14477d3ec1c	access	readers	immediate
crochetp	ldap	cab24a2645c54012b89ca9eb71f92ef6	list	members	effective
gagns	ldap	0388622ada904ffe808e764df016fa9a	list	members	effective
gagns	ldap	0388622ada904ffe808e764df016fa9a	access	admins	immediate
larcheve	ldap	ad3fe91e9dba4ac0acfe023f002fc275	list	members	effective
GrouperSystem	g:isa	3741162bfb1b496ca0f36150c3b05a7b	access	admins	immediate

 

I checked in GROUPER_MEMBERHSIP_LW_V and the bugged group has the same members as above and the dept1-admins isn’t a member of anything (except itself for privs)

 

Looking in the GROUPER_PIT_MEMBERSHIPS

I guess I see all the members, but strangely they almost all have an END_TIME and ACTIVE=F, converting it to human gives me yesterday at around 1:35 PM, around the time I have stopped the GrouperDaemon for my upgrade. All the END_TIMEs are within 8 seconds

 

Where does that end-time comes from ? Why don’t I have any audits saying a member was removed ?

 

I can try those utilities, but I don’t think it’ll tell me what cause those data to disappear. By the way, this isn’t a composite group it’s a simple group with members that are groups. What does the addAllMissingGroupSets does ? What’s a GroupSet ?

 

bin/gsh -findBadMemberships –all

Checking Composite Memberships

Checking Group Sets

No membership errors found.

 

 

De : Chris Hyzer []
Envoyé : 14 février 2013 16:36
À : Gagné Sébastien
Cc :
Objet : RE: Disapearing members ?!?!?!

 

Try running the bad membership utility:

 

https://spaces.internet2.edu/display/Grouper/Bad+Membership+Finder+Utility

 

Also, try the PIT and groupSet fixer (from GSH):

 

new edu.internet2.middleware.grouper.misc.SyncPITTables().syncAllPITTables()

 

new edu.internet2.middleware.grouper.misc.AddMissingGroupSets().addAllMissingGroupSets();

 

 

Thanks,

Chris

 

From: Gagné Sébastien []
Sent: Thursday, February 14, 2013 4:21 PM
To: Chris Hyzer
Cc:
Subject: Disapearing members ?!?!?!

 

Hi Chris (or any other that can help),

A little panic here : we did a release in production and for some reason, some groups have lost their memberships.  I’m not saying it was removed, but it vanished in thin air : no audit logged, nothing in the changelog. I checked the grouper_memberships table in the database and the records disappeared.

 

The structure we have/had :

all-admins

|-dept1-admins

                |-personA

                |-personB

|- dept2-admins

                |-personC

 

All the memberships between “all-admins and deptX-admins” and “deptX-admins and personY” have vanished, but the groups are still there.

 

Even weirder, if I re-add personA to dept1-admin, Grouper WILL SHOW personA as an indirect member of All-admins, while showing NO DIRECT MEMEBRS! (see attached screenshot)

 

This problem only occurred in Production, the identical test env has no problem…

 

We’re currently lost about what might have caused the problem, and would really appreciate some guidance to find the problem… Thanks

 

(PS the solution will be to manually re-add everything since it’s not much work, but we don’t want to lose any more data…)

 

 

 

 

No Direct members :

But has indirect members ?????

 

 

 

Sébastien Gagné,     | Analyste en informatique

514-343-6111 x33844  | Université de Montréal,

                     | Pavillon Roger-Gaudry, local X-100-11