Grouper Users - Open Discussion List

[David Langenberg <>]

Hi,

GroupExactAttribute filter only works on attributes.  Types are a different structure.  This is why that filter doesn't work.  You get the type back from the DataConnector because it does wrap the Types up as a different attribute structure (Shib attribute).  At present it seems there is no way to filter on GroupType.  I've created GRP-910 to address this.  Changing from a type to a real attribute would be the best work-around I can think of.

Dave

On Mon, Jun 3, 2013 at 5:23 PM, Dominique Petitpierre <> wrote:

Hello,

In Grouper 2.1.3, I am trying to define a PSP connector that would
filter groups on the base of an attribute, along the lines described
in

Subject: [grouper-users] Replicating peculiar functionality with psp
https://lists.internet2.edu/sympa/arc/grouper-users/2012-04/msg00005.html

and

http://anonsvn.internet2.edu/viewvc/viewvc.py/i2mi/java-provisioning-provider/trunk/psp-example-grouper-uchicago/src/test/resources/psp-resolver.xml?revision=8234&content-type=text%2Fplain&view=co

The attribute, LDAPFilter, exists for some groups and can be extracted
by an AttributeDefinition like the following which will put the value
in the description of the group:

  <resolver:AttributeDefinition
    id="groupDescription"
    xsi:type="ad:Simple"
    sourceAttributeID="LDAPFilter">
    <resolver:Dependency ref="GroupWithoutMermbershipsDataConnector" />
    <resolver:Dependency ref="UpdateGroupDescriptionChangeLogDataConnector" />
  </resolver:AttributeDefinition>

But if the same attribute is used in a grouper:GroupExactAttribute
filter like the following, it does not work and no group is selected:

 <resolver:DataConnector
    id="GroupWithoutMermbershipsDataConnector"
    xsi:type="grouper:GroupDataConnector">
     <grouper:Filter
        xsi:type="grouper:GroupExactAttribute"
        name="LDAPFilter"
        value="yes"
        />
  </resolver:DataConnector>


The attribute LDAPFilter was declared as a field of a group type:

<registry>
  <metadata>
    <groupTypesMetaData>
    <groupTypeDef name='LDAPSync'>
      <field name='LDAPFilter'
             required='false'
             type='attribute'
             readPriv='read'
             writePriv='update'
             />
    </groupTypeDef>
    </groupTypesMetaData>
  </metadata>
</registry>


- Why doesn't grouper:GroupExactAttribute work in that case?

And a side question:
- is it possible to filter groups based on their types?
  The attribute name "Type" mentioned in the grouper-users message
  cited above seems to imply that it is, but I could not use that
  name, neither for filtering nor as sourceAttributeID.

Thanks in advance for your lights on this issue!

--
Mr Dominique Petitpierre, user=Dominique.Petitpierre domain=unige.ch
IT Division, University of Geneva, Switzerland

--
David Langenberg

Identity & Access Management

The University of Chicago