Grouper Users - Open Discussion List

[Shilen Patel <>]

>> For example, we might have a group representing staff in a certain
>>department which isn't provisioned to the AD. That group then might be a
>>member of another group which is provisioned to the AD. If someone
>>leaves the first group, they are automatically removed from the second
>>group in Grouper but they are not being taken out of the AD group.

Just making sure, the person isn't a member of the second group in any
other way?

It's possible that your point in time data is corrupt or out of sync.
What's the output of the following?

gsh 0% new 
edu.internet2.middleware.grouper.misc.SyncPITTables().syncAllPITTables()

Thanks!

- Shilen

On 12/16/15, 5:26 AM, "Dave Churchley" 
<>
wrote:

>Yeah, that's how it was set up, and there was no backlog, but sometimes
>things were going out of the temp table but not making into the change
>log table. 
>
>We've investigated this more this morning and it seems like it's working
>if we add/remove a member from a provisioned group and if we add/remove a
>group from a provisioned group.
>
>It's not working when we add/remove a member from a group which is a
>member of a provisioned group. For example, we might have a group
>representing staff in a certain department which isn't provisioned to the
>AD. That group then might be a member of another group which is
>provisioned to the AD. If someone leaves the first group, they are
>automatically removed from the second group in Grouper but they are not
>being taken out of the AD group. In those circumstances, we see an entry
>in the temp table which then disappears but nothing goes into the change
>log table.
>
>Thanks
>Dave
>
>________________________________________
>From: Chris Hyzer 
><>
>Sent: 15 December 2015 22:38
>To: Dave Churchley; 
>
>Subject: RE: [grouper-users] PSP incremental provisioning
>
>You have to make sure the grouper loader is running, and there isn't a
>backlog of things in the temp table.  The cron in the grouper loader
>properties move things from temp to change log, and kicks off loader
>jobs.  Not sure exactly how the PSP takes it from there, but that is the
>first step :)
>
>Thanks,
>Chris
>
>-----Original Message-----
>From: Dave Churchley 
>[mailto:]
>Sent: Tuesday, December 15, 2015 4:59 PM
>To: Chris Hyzer; 
>
>Subject: Re: [grouper-users] PSP incremental provisioning
>
>Hi Chris
>
>When it works, I see an entry in the change log temp table move to the
>change log table and get provisioned to AD.
>
>When it doesn't work, I've seen entries in change log temp which haven't
>made it to the change log table (but have still gone from the temp
>table). I've also seen changes not appear in either table, although I
>can't be completely certain that this wasn't just that I was too slow
>looking in the temp table and they'd already moved out.
>
>On the occasions when the changes haven't made it into the change log
>table, I've not seen anything in the logs.
>
>Thanks
>Dave
>
>________________________________________
>From: Chris Hyzer 
><>
>Sent: 15 December 2015 21:01
>To: Dave Churchley; 
>
>Subject: RE: [grouper-users] PSP incremental provisioning
>
>When you make changes, do you see the entries in the change log temp
>table move to the change log table?  Are there debug logs in the PSP
>process that show anything?
>
>Thanks,
>Chris
>
>-----Original Message-----
>From: 
>
>[mailto:]
> On Behalf Of Dave Churchley
>Sent: Tuesday, December 15, 2015 2:56 PM
>To: 
>
>Subject: [grouper-users] PSP incremental provisioning
>
>Hello
>
>We've had a bad couple of days with PSP provisioning to AD. Following on
>from the bulkSync issues I posted about yesterday, we're now seeing some
>unexpected behaviour with the incremental provisioning. It works
>sometimes but other times changes made through the Grouper UI don't make
>it into the change log and so are not reflected in the AD.
>
>Is there an obvious reason for this? Am I missing something?
>
>Thanks
>Dave Churchley
>Newcastle University