Skip to Content.
Sympa Menu

grouper-users - Re: [grouper-users] PSP update samAccountName

Subject: Grouper Users - Open Discussion List

List archive

Re: [grouper-users] PSP update samAccountName

Chronological Thread 
  • From: David Langenberg <>
  • To: Andrew Morgan <>
  • Cc: Gouper Users <>
  • Subject: Re: [grouper-users] PSP update samAccountName
  • Date: Wed, 10 Jun 2015 09:11:20 -0600

Have you looked at:

For sAMAccountName config?  The PSO needs to reference both the DN and the ChangeLogDN resolvers (so that renames work off the changelog).  If you bulkSync does the sAMAccountName change?  If so, then there's your problem (lack of the ChangeLogDN as an AlternateIdentifier on the PSO.


On Tue, Jun 9, 2015 at 7:30 PM, Andrew Morgan <> wrote:
I'm having trouble configuring the PSP to update the AD samAccountName attribute when a group's ID (name) is changed.  I'm building the samAccountName value on the fly using a script.  When I change a group's ID, the cn attribute is correctly updated.  However, the samAccountName is unchanged.

In psp.xml:

      name="samAccountName" />

In psp-resolver.xml:

        <resolver:Dependency ref="groupNameInStem" />
                // Create the attribute to be returned.
                samAccountName = new BasicAttribute("samAccountName");
                tmp = new BasicAttribute("tmp");

                if(groupNameInStem.getValues().size() > 0){
                        // Strip the baseStem off the front
                        var regex = /^${edu.internet2.middleware.psp.baseStem}:/;
                        var tmp = new String(groupNameInStem.getValues().get(0));
                        var tmp2 = tmp.replace(regex, "");

The log messages show no change in samAccountName being generated by the PSP.

I'm guessing I have something wrong with the resolver:Dependency refs, but I've been looking at these config files for so long.

Does anyone have a working config with the right dependencies?  The active directory example included with the PSP doesn't even have samAccountName in psp-resolver.xml!

I promise to document a working configuration when I'm done.  :)


David Langenberg
Identity & Access Management Architect
The University of Chicago

Archive powered by MHonArc 2.6.16.

Top of Page