Grouper Users - Open Discussion List

[Yoann Delattre <>]

Hi,

I try to provision an LDAP attribute by putting an attribute framework 
on the membership.
I can read that you already do something like that.

Actually, this is my PSP configuration :

<resolver:DataConnector id="groupFdvTemp" 
xsi:type="grouper:MemberDataConnector" >
   <grouper:Attribute id="etc:attribute:faits_violence" />
</resolver:DataConnector>

<resolver:AttributeDefinition id="groupFdv" xsi:type="ad:Simple" 
sourceAttributeID="etc:attribute:faits_violence">
  <resolver:Dependency ref="groupFdvTemp" />
</resolver:AttributeDefinition>

It works when i use a gsh command like :

gsh.sh -psp -diff ydelattre2 -entityName member

But not automatically with the PSP ChangeLogDataConnectors.

Can you help me ?

Thanks,
Yoann.

Le 07/01/2014 17:18, Paul Engle a écrit :
> Hi all,
>    I'm very close to moving forward and upgrading our 1.6.3
> infrastructure to 2.1.5. I have the psp configuration mostly where I
> need it to be (and it is sooooo much faster). But there is one thing
> that I'm trying to do that is failing.
>
> Basically, I've defined an attribute with the new framework, and
> assigned that attribute to a group. I'd like the provisioner to be able
> to take that attribute value and assign it to a group member's LDAP
> object as a custom LDAP attribute. Similar to the way the
> memberIsMemberOf attribute is done in the psp-resolver.xml for the
> psp-example-grouper-to-openldap example.
>
> The problem I'm running into is that, since this attribute doesn't exist
> on all groups (unlike the 'name' attribute for the memberIsMemberOf
> example), I get an 'operation not permitted' error when I try to define
> the attribute thusly:
>
>
> <resolver:AttributeDefinition
>    id="profileName"
>    xsi:type="grouper:Group"
>    sourceAttributeID="groups">
>    <resolver:Dependency ref="MemberDataConnector" />
>    <grouper:Attribute id="etc:attribute:vpn:name" />
> </resolver:AttributeDefinition>
>
>
> Would defining the attribute as a script be the way to go?
> Alternatively, should I be thinking about this some other way? I have
> successfully gotten the LDAP attribute provisioned by putting the
> etc:attribute:vpn:name on the Membership, rather than the group itself,
> but that entails many more steps for the end user. (Add person to group,
> add attribute to user as a group member, and then assign the value,
> using the same value for every group member). Or maybe I'm not
> understanding the new attribute framework very well.
>
>    -paul