Grouper Users - Open Discussion List

[David Langenberg <>]

Right, the issue is the ':' in the sAMAccountName.  Take a look at your psp-resolver.xml and this example:

https://github.com/Internet2/grouper-psp/blob/master/psp-example-grouper-to-ldap-and-activedirectory/src/test/resources/psp-resolver.xml#L710

You'll need to adjust your psp-resolver.xml to make sAMAccountName use a different character than :.

Dave

On Tue, Jun 23, 2015 at 8:56 AM, Kukar, Yuvraj <> wrote:

Thanks Dave.

I tried in my Dev environment also where I have Grouper 2.2.0 installed. I am getting same error while provisioning data to AD with Flat structure. With Busy, it is importing fine.

This is a PSP Calc response looks like:

Grouper starting up: version: 2.2.0, build date: 2014/07/05 12:00:03, env: <no label configured>

grouper.properties read from: /opt/grouper/grouper.apiBinary-2.2.0/conf/grouper.properties

Grouper current directory is: /opt/grouper/grouper.apiBinary-2.2.0/bin

log4j.properties read from:   /opt/grouper/grouper.apiBinary-2.2.0/conf/log4j.properties

Grouper logs are not using log4j: class org.apache.commons.logging.impl.SLF4JLocationAwareLog

grouper.hibernate.properties: /opt/grouper/grouper.apiBinary-2.2.0/conf/grouper.hibernate.properties

grouper.hibernate.properties: grouperdb@jdbc:mysql://localhost:3306/grouper

sources.xml read from:        /opt/grouper/grouper.apiBinary-2.2.0/conf/sources.xml

sources.xml groupersource id: g:gsa

sources.xml ldap source id:   ldap: ldap.properties

sources.xml groupersource id: grouperEntities

<psp:bulkCalcResponse xmlns:psp='http://grouper.internet2.edu/psp' status='success' requestID='2015/06/23-10:49:13.729'>

  <psp:calcResponse status='success' requestID='2015/06/23-10:49:13.800'>

    <psp:id ID='GW_PSP:PSP_T1'/>

    <psp:pso entityName='group'>

      <psoID ID='CN=GW_PSP:PSP_T1,OU=GGroup,OU=Accounts,DC=G,DC=E' targetID='ldap'/>

      <data>

        <dsml:attr xmlns:dsml='urn:oasis:names:tc:DSML:2:0:core' name='objectClass'>

          <dsml:value>top</dsml:value>

          <dsml:value>group</dsml:value>

        </dsml:attr>

        <dsml:attr xmlns:dsml='urn:oasis:names:tc:DSML:2:0:core' name='cn'>

          <dsml:value>GW_PSP:PSP_T1</dsml:value>

        </dsml:attr>

        <dsml:attr xmlns:dsml='urn:oasis:names:tc:DSML:2:0:core' name='sAMAccountName'>

          <dsml:value>GW_PSP:PSP_T1</dsml:value>

        </dsml:attr>

      </data>

    </psp:pso>

  </psp:calcResponse>

</psp:bulkCalcResponse>

Error Logs:

2015-06-23 10:47:29,852: [main] ERROR Psp.execute(1452) -  - Psp 'psp' - Sync SyncResponse[id=GW_PSP:PSP_T1,status=failure,error=customError,errorMessages={[LDAP: error code 80 - 00000523: SysErr: DSID-031A11DB, problem 22 (Invalid argument), data 0

_]},requestID=2015/06/23-10:47:29.646,AddResponse[pso=<null>,status=failure,error=customError,errorMessages={[LDAP: error code 80 - 00000523: SysErr: DSID-031A11DB, problem 22 (Invalid argument), data 0

_]},requestID=2015/06/23-10:47:29.829]]

2015-06-23 10:47:29,852: [main] ERROR Psp.execute(1454) -  - Psp 'psp' - Sync SPML:

<psp:syncResponse xmlns:psp='http://grouper.internet2.edu/psp' status='failure' requestID='2015/06/23-10:47:29.646' error='customError'>

  <addResponse xmlns='urn:oasis:names:tc:SPML:2:0' status='failure' requestID='2015/06/23-10:47:29.829' error='customError'>

    <errorMessage>[LDAP: error code 80 - 00000523: SysErr: DSID-031A11DB, problem 22 (Invalid argument), data 0

_]</errorMessage>

  </addResponse>

  <errorMessage>[LDAP: error code 80 - 00000523: SysErr: DSID-031A11DB, problem 22 (Invalid argument), data 0

_]</errorMessage>

  <psp:id ID='GW_PSP:PSP_T1'/>

</psp:syncResponse>

2015-06-23 10:47:29,852: [main] ERROR Psp.execute(811) -  - Psp 'psp' - BulkSync BulkSyncResponse[id=<null>,status=failure,error=<null>,errorMessages={},requestID=2015/06/23-10:47:29.528,responses=1]

2015-06-23 10:47:29,853: [main] ERROR Psp.execute(813) -  - Psp 'psp' -  BulkSync SPML:

<psp:bulkSyncResponse xmlns:psp='http://grouper.internet2.edu/psp' status='failure' requestID='2015/06/23-10:47:29.528'>

  <psp:syncResponse status='failure' requestID='2015/06/23-10:47:29.646' error='customError'>

    <addResponse xmlns='urn:oasis:names:tc:SPML:2:0' status='failure' requestID='2015/06/23-10:47:29.829' error='customError'>

      <errorMessage>[LDAP: error code 80 - 00000523: SysErr: DSID-031A11DB, problem 22 (Invalid argument), data 0

_]</errorMessage>

    </addResponse>

    <errorMessage>[LDAP: error code 80 - 00000523: SysErr: DSID-031A11DB, problem 22 (Invalid argument), data 0

_]</errorMessage>

    <psp:id ID='GW_PSP:PSP_T1'/>

  </psp:syncResponse>

</psp:bulkSyncResponse>

On Mon, Jun 22, 2015 at 7:40 PM, David Langenberg <> wrote:

Ok, and what else is surrounding that error in the logs?  What is the PSP trying to do to AD?  What does the Calc response look like?

Dave

On Mon, Jun 22, 2015 at 2:48 PM, Kukar, Yuvraj <> wrote:

None..that is the only property file I have changed. 

On Mon, Jun 22, 2015 at 4:21 PM, David Langenberg <> wrote:

What else have you changed aside from bushy to flat & the cnSourceAttributeID?

Dave

On Mon, Jun 22, 2015 at 2:05 PM, Kukar, Yuvraj <> wrote:

Hi,

Need help on this. I am testing grouper version 2.2.1

I am using psp-example-grouper-to-active-directory files for provisioning groups and members to Active Directory. I am able to successfully provision if I use "Bushy" structure however if I change ldap.prop file to use "Flat" structure it is giving me below errors. 

<errorMessage>[LDAP: error code 80 - 00000523: SysErr: DSID-031A1202, problem 22 (Invalid argument), data 0

_]</errorMessage>

(It is provisioning folders but not groups and members)

Do I need to change some other config file other than ldap.properties to use flat structure?

This, I have changed in ldap.prop.

edu.internet2.middleware.psp.structure=flat

edu.internet2.middleware.psp.cnSourceAttributeID=name

Any suggestion?

--

Yuvraj Kukar

--

David Langenberg

Identity & Access Management Architect

The University of Chicago

--

Yuvraj Kukar

University Web & Identity Services

(571) 553-4314

--

David Langenberg

Identity & Access Management Architect

The University of Chicago

--

Yuvraj Kukar

University Web & Identity Services

(571) 553-4314

--

David Langenberg

Identity & Access Management Architect

The University of Chicago