Grouper Users - Open Discussion List

[David Langenberg <>]

Yeah, using MINUS filters would work too.

Dave

On Fri, Mar 14, 2014 at 9:19 AM, Chris Hyzer <> wrote:

I think with the filters you can push all the loader groups and minus (filter out) the ones with _systemOfRecord, _includes, _excludes, and _systemOfRecordAndIncludes, right?  Then you are left with the overall groups.  Maybe that is what Dave said…  J

 

Thanks

Chris

 

From: [mailto:] On Behalf Of David Langenberg
Sent: Friday, March 14, 2014 11:04 AM
To: Bryan E. Wooten
Cc:
Subject: Re: [grouper-users] PSP baseStem vs Loader Jobs

 

Hi Bryan,

 

One suggestion would be to put those groups you want pushed one layer down.

 

loader:courses:groupa

loader:courses:groupb

loader:courses:push:groupc

 

loader:staff:groupa

loader:staff:push:groupb

 

I'd suggest you look at the psp-resolver.xml and modify the grouper:Filters a little bit to look for the groups you care about.  An example:

 

<resolver:DataConnector

    id="GroupDataConnector"

    xsi:type="grouper:GroupDataConnector">

    <!-- The MINUS filter matches stems which match the first child filter and not the second. -->

    <grouper:Filter xsi:type="grouper:MINUS">

      <!-- The GroupInStem filter matches groups which are children of the given stem. -->

      <grouper:Filter

        xsi:type="grouper:GroupInStem"

        name="${edu.internet2.middleware.psp.baseStem}"

        scope="SUB" />

      <grouper:Filter

        xsi:type="grouper:GroupInStem"

        name="etc"

        scope="SUB" />

    </grouper:Filter>

    <!-- The "members" attribute values are equivalent to group.getMembers(). -->

    <grouper:Attribute id="members" />

    <!-- The "groups" attribute values are equivalent to group.getGroups(). -->

    <grouper:Attribute id="groups" />

  </resolver:DataConnector>

 

In the above, you're looking for all groups under baseStem minus those in etc (incase etc happens to be in the baseStem).  Let's assume you also want to include groups either under baseStem or a stem with the name "push".  What you'd want to do is OR the above filter with the "push" filter:

 

<resolver:DataConnector

    id="GroupDataConnector"

    xsi:type="grouper:GroupDataConnector">

 

<grouper:Filter xsi:type="grouper:OR">   

<grouper:Filter xsi:type="grouper:NameInStem" name="push" scope="SUB" />

 

 

 <!-- The MINUS filter matches stems which match the first child filter and not the second. -->

    <grouper:Filter xsi:type="grouper:MINUS">

      <!-- The GroupInStem filter matches groups which are children of the given stem. -->

      <grouper:Filter

        xsi:type="grouper:GroupInStem"

        name="${edu.internet2.middleware.psp.baseStem}"

        scope="SUB" />

      <grouper:Filter

        xsi:type="grouper:GroupInStem"

        name="etc"

        scope="SUB" />

    </grouper:Filter>

 

</grouper:Filter>

 

    <!-- The "members" attribute values are equivalent to group.getMembers(). -->

    <grouper:Attribute id="members" />

    <!-- The "groups" attribute values are equivalent to group.getGroups(). -->

    <grouper:Attribute id="groups" />

  </resolver:DataConnector>

 

That, combined with a few other relevant updates should cause all groups under baseStem to be pushed as well as groups with the word push in the stem.

 

Dave

 

 

On Thu, Mar 13, 2014 at 9:46 AM, Bryan E. Wooten <> wrote:

I have a Grouper loader job that is an addIncludeExclude type. It puts all the groups (systemORecord, includes, excludes and overall group) in the same stem.

 

That stem is NOT under the baseStem for the PSP. If I put the loader groups under the baseStem the PSP will provision ALL the groups to AD. But I just want the overall group provisioned to AD.

 

Is there any way to accomplish this?

 

All I can think to do is to create another loader job that creates a group for each overall group with the overall group as its member. And this group created under the base stem so the PSP will provision it. But I have no clue as to what the SQL would look like to accomplish this.

 

Thoughts?

 

-Bryan

 

--
David Langenberg

Identity & Access Management

The University of Chicago

--
David Langenberg

Identity & Access Management

The University of Chicago