Grouper Users - Open Discussion List

[Dominique Petitpierre <>]

Hello,

On 06/04/2013 07:08 PM, David Langenberg wrote:
...
> Changing from a type to a real attribute would be the best
> work-around I can think of.
...

Trying this work-around I get stuck in a similar place (with Grouper 2.1.3):

The "real" attribute "etc:attribute:ldapSync:syncType" exists for some
groups and can be extracted by an AttributeDefinition like the
following which will put the value in the description of the group
(cf.  psp calc output at the end of this message).

 <resolver:AttributeDefinition
    id="groupDescription"
    xsi:type="ad:Simple"
    sourceAttributeID="etc:attribute:ldapSync:syncType">
    <resolver:Dependency ref="GroupWithoutMermbershipsDataConnector" />
    <resolver:Dependency 
ref="UpdateGroupDescriptionChangeLogDataConnector" />
  </resolver:AttributeDefinition>


But if the same attribute is used in a grouper:GroupExactAttribute
filter like the following, it does not work and no group is selected:

  <resolver:DataConnector
    id="GroupWithoutMermbershipsDataConnector"
    xsi:type="grouper:GroupDataConnector">
     <grouper:Filter xsi:type="grouper:MINUS">
       <grouper:Filter xsi:type="grouper:AND">
         <grouper:Filter
             xsi:type="grouper:GroupExactAttribute"
             name="etc:attribute:ldapSync:syncType"
             value="to_group" />
         <grouper:Filter
             xsi:type="grouper:GroupInStem"
             name="application"
             scope="SUB" />
       </grouper:Filter>
       <grouper:Filter
           xsi:type="grouper:GroupInStem"
           name="etc"
           scope="SUB" />
     </grouper:Filter>
    <grouper:Attribute id="etc:attribute:ldapSync:syncType" />
  </resolver:DataConnector>


For example, the following command

gsh.sh -psp -calc application:bpm-poc:bpm-oracle:workflow1:bpmpoc -out 
psp.out

produces the following output in psp.out:

<psp:calcResponse xmlns:psp='http://grouper.internet2.edu/psp' 
status='failure' requestID='2013/06/14-20:30:49.336' 
error='noSuchIdentifier'>
  <errorMessage>Unable to calculate provisioned object.</errorMessage>
  <psp:id ID='application:bpm-poc:bpm-oracle:workflow1:bpmpoc'/>
</psp:calcResponse>


- What am I doing wrong?
- How should the filter arguments be specified to enable a match?




Otherwise the psp-resolver.xml and psp.xml are OK:

It works if one changes in the above code "grouper:AND" to
"grouper:OR" and the same command produces the following output:

<psp:calcResponse xmlns:psp='http://grouper.internet2.edu/psp' 
status='success' requestID='2013/06/14-20:32:39.259'>
  <psp:id ID='application:bpm-poc:bpm-oracle:workflow1:bpmpoc'/>
  <psp:pso entityName='group'>
    <psoID 
ID='cn=bpmpoc,ou=workflow1,ou=bpm-oracle,ou=bpm-poc,ou=application,ou=Groups,dc=unige,dc=ch' 
targetID='ldap'/>
    <data>
      <dsml:attr xmlns:dsml='urn:oasis:names:tc:DSML:2:0:core' 
name='objectClass'>
        <dsml:value>top</dsml:value>
        <dsml:value>groupOfUniqueNames</dsml:value>
      </dsml:attr>
      <dsml:attr xmlns:dsml='urn:oasis:names:tc:DSML:2:0:core' name='cn'>
        <dsml:value>bpmpoc</dsml:value>
      </dsml:attr>
      <dsml:attr xmlns:dsml='urn:oasis:names:tc:DSML:2:0:core' 
name='description'>
        <dsml:value>to_group</dsml:value>
        <dsml:value>to_person</dsml:value>
      </dsml:attr>
    </data>
  </psp:pso>
</psp:calcResponse>


It works also, with the same result, if the filter is changed to use
the field "extension" instead of a "real" attribute: e.g.

         <grouper:Filter
             xsi:type="grouper:GroupExactAttribute"
             name="extension"
             value="bpmpoc" />



- May be a kind soul could provide me with a working example of 
psp-resolver.xml
  (and psp.xml) that filters groups on the base of "real" attributes?

Thanks in advance for your help!

Regards,
Dominique
--
Mr Dominique Petitpierre, user=Dominique.Petitpierre domain=unige.ch
IT Division, University of Geneva, Switzerland