Skip to Content.
Sympa Menu

grouper-users - Re: [grouper-users] Update on my AD PSP issue, some progress

Subject: Grouper Users - Open Discussion List

List archive

Re: [grouper-users] Update on my AD PSP issue, some progress

Chronological Thread 
  • From: Shilen Patel <>
  • To: "Bryan E. Wooten" <>, "" <>
  • Subject: Re: [grouper-users] Update on my AD PSP issue, some progress
  • Date: Thu, 20 Jun 2013 22:08:36 +0000
  • Accept-language: en-US
  • Authentication-results:; dkim=neutral (message not signed) header.i=none

From the logs, what does the <addRequest> look like?


-- Shilen

From: "Bryan E. Wooten" <>
Date: Thursday, June 20, 2013 4:20 PM
To: "" <>
Subject: [grouper-users] Update on my AD PSP issue, some progress

In case anyone is interested.


Thanks to Shilen I am able to have an LDAP subject source and use the PSP to provision stems as an OU to AD.

The trick was to NOT change the <Service> id=”ldap”. I had thought I could change it to id=”ad” and make adjustments in the other psp xml files.


My next was to create a group in my new stem and provision that group to AD. The good news is that the PSP tried. The bad news is that I get an LDAP error:


2013-06-20 13:35:24,604: [main] ERROR BaseSpmlProvider.execute(188) -  - Target 'ldap' - Add AddResponse[pso=<null>,status=failure,error=customError,errorMessages={cn=g9,ou=bryan23,ou=uofu,OU=groups,OU=grouper,DC=testad,DC=utah,DC=edu: [LDAP: error code 34 - 00002081: NameErr: DSID-03050C42, problem 2003 (BAD_ATT_SYNTAX), data 0, best match of:



I traced the request with wireshark and can see the add request and returned error. Looking at the request packet I don’t see anything wrong (but I am not an expert at decoding the LDAP protocol).


I have successfully created groups in AD using the PSP (with an AD subject source), so I know the PSP can do it. As usual I have no clue what is causing this given that Grouper/PSP can successfully bind and create an OU.


Thanks for listening.



Archive powered by MHonArc 2.6.16.

Top of Page