Skip to Content.
Sympa Menu

grouper-users - Re: [grouper-users] PSP update samAccountName

Subject: Grouper Users - Open Discussion List

List archive

Re: [grouper-users] PSP update samAccountName

Chronological Thread 
  • From: David Langenberg <>
  • To: Andrew Morgan <>
  • Cc: Gouper Users <>
  • Subject: Re: [grouper-users] PSP update samAccountName
  • Date: Wed, 17 Jun 2015 08:50:36 -0600

Yeah, that should work.  Try turning up the logging on edu.internet2.middleware.shibboleth and seeing if that script is firing during the update?


On Wed, Jun 10, 2015 at 5:38 PM, Andrew Morgan <> wrote:
On Wed, 10 Jun 2015, David Langenberg wrote:

Have you looked at:

For sAMAccountName config?  The PSO needs to reference both the DN and the
ChangeLogDN resolvers (so that renames work off the changelog).  If you
bulkSync does the sAMAccountName change?  If so, then there's your problem
(lack of the ChangeLogDN as an AlternateIdentifier on the PSO.

I do have both resolver references:

  <!-- Provision a grouper group as an AD group. -->
  <pso id="ADgroup"

    <!-- The AD group DN. -->
    <identifier ref="ADgroupDn" targetId="activeDirectory"
      containerId="${edu.internet2.middleware.psp.ADgroupsBaseDn}" />

    <!-- Identifies AD group objects which exist on the target by objectClass attribute value. -->
    <identifyingAttribute name="objectClass"
      value="${edu.internet2.middleware.psp.ADgroupObjectClass}" />

    <!-- The "old" AD group DN if a group has been renamed. -->
    <alternateIdentifier ref="ADgroupDnAlternate" />

    <!-- The "old" AD group DN calculated from group update change log events. -->
    <alternateIdentifier ref="ADgroupDnAlternateChangeLog" />

    <!-- The AD group "objectClass" attribute. -->
    <attribute name="objectClass" ref="ADgroupObjectClass" />

    <!-- The AD group "cn" attribute. -->
    <attribute name="cn" />

    <!-- The AD group "description" attribute. -->
    <attribute name="description" ref="groupDescription" />

    <!-- See -->
    <attribute name="samAccountName" ref="testsamAccountName" />

    <!-- The AD group "member" attribute. -->
    <references name="member" caseSensitive="false">
      <reference ref="membersLdap" toObject="ADmember" />
      <reference ref="membersGsa" toObject="group" />

The DN ("cn" attribute) is being correctly updated during bulksync and changelog operations.

The samAccountName is the complete group ID with path (for example "psp:osu:org:iam:folder1newid:andy10" with the colons replaced with underscores.  The samAccountName is correctly updated during bulksync but not during changelog operations.

My "testsamAccountName" attribute definition:

    <resolver:Dependency ref="GroupWithoutMembershipsDataConnector" />
    <resolver:Dependency ref="UpdateGroupNameChangeLogDataConnector" />
                // Create the attribute to be returned.
                testsamAccountName = new BasicAttribute("testsamAccountName");
                tmp = new BasicAttribute("tmp");

                if (name.getValues().size() > 0) {
                        // Strip the baseStem off the front
                        var regex = /^${edu.internet2.middleware.psp.baseStem}:/;
                        var tmp = new String(name.getValues().get(0));
                        var tmp2 = tmp.replace(regex, "");

Why are the DN and "cn" attribute updated, but the samAccountName attribute is not updated?


David Langenberg
Identity & Access Management Architect
The University of Chicago

Archive powered by MHonArc 2.6.16.

Top of Page