Grouper Users - Open Discussion List

["Peter St. Onge" <>]

I've been quietly playing with Grouper over the last year to the point 
where we are now managing some groups and memberships from it  via 
Shibboleth (thanks to Bryan Wooten for help with the configurations and 
Michael White for help with Shibboleth integration!)

I'm running into a curious problem with the PSP, in that while 
memberships in user records are properly provisioned and de-provisioned 
as these change, I note that groups are created but aren't later updated 
as their memberships change (I note that the groups aren't empty when 
they are first provisioned, my gsh scripts put people and/or groups as 
members at build time).

I can also manually call ./gsh -psp -sync $id against a specific user id 
successfully (the appropriate member fields in the user record are 
updated), and the grouper_error.log shows a successful lookupResponse / 
diffResponse / syncResponse.

When I try to sync a group, however, using ./gsh -psp -sync $id, where 
id is a group like 'apps:es:qa:portal-access', the attempt fails and I 
see this in the grouper_error.log ...

<psp:syncRequest xmlns:psp='http://grouper.internet2.edu/psp' 
returnData='everything'>
  <psp:id ID='apps:es:qa:portal-access'/>
</psp:syncRequest>

2016-01-27 10:10:48,476: [main] INFO  Psp.execute(1152) -  - Psp 'psp' - 
Diff 
DiffRequest[id=apps:es:qa:portal-access,requestID=2016/01/27-10:10:48.476,returnData=everything]
2016-01-27 10:10:48,477: [main] INFO  Psp.execute(1156) -  - Psp 'psp' - 
Diff XML:
<psp:diffRequest xmlns:psp='http://grouper.internet2.edu/psp' 
requestID='2016/01/27-10:10:48.476' returnData='everything'>
  <psp:id ID='apps:es:qa:portal-access'/>
</psp:diffRequest>

2016-01-27 10:10:48,479: [main] INFO  Psp.execute(980) -  - Psp 'psp' - 
Calc 
CalcRequest[id=apps:es:qa:portal-access,requestID=2016/01/27-10:10:48.479,returnData=everything]
2016-01-27 10:10:48,479: [main] INFO  Psp.execute(984) -  - Psp 'psp' - 
Calc XML:
<psp:calcRequest xmlns:psp='http://grouper.internet2.edu/psp' 
requestID='2016/01/27-10:10:48.479' returnData='everything'>
  <psp:id ID='apps:es:qa:portal-access'/>
</psp:calcRequest>

2016-01-27 10:10:48,666: [main] INFO  Psp.execute(1020) -  - Psp 'psp' - 
Calc 
CalcResponse[id=apps:es:qa:portal-access,status=failure,error=noSuchIdentifier,errorMessages={Unable 
to calculate provisioned object.},requestID=2016/01/27-10:10:48.479]
2016-01-27 10:10:48,668: [main] INFO  Psp.execute(1022) -  - Psp 'psp' - 
Calc XML:
<psp:calcResponse xmlns:psp='http://grouper.internet2.edu/psp' 
status='failure' requestID='2016/01/27-10:10:48.479' 
error='noSuchIdentifier'>
  <errorMessage>Unable to calculate provisioned object.</errorMessage>
  <psp:id ID='apps:es:qa:portal-access'/>
</psp:calcResponse>

2016-01-27 10:10:48,669: [main] ERROR Psp.execute(1187) -  - Psp 'psp' - 
Diff 
DiffResponse[id=apps:es:qa:portal-access,status=failure,error=noSuchIdentifier,errorMessages={Unable 
to calculate provisioned object.},requestID=2016/01/27-10:10:48.476]
2016-01-27 10:10:48,670: [main] ERROR Psp.execute(1189) -  - Psp 'psp' - 
Diff XML:
<psp:diffResponse xmlns:psp='http://grouper.internet2.edu/psp' 
status='failure' requestID='2016/01/27-10:10:48.476' 
error='noSuchIdentifier'>
  <errorMessage>Unable to calculate provisioned object.</errorMessage>
  <psp:id ID='apps:es:qa:portal-access'/>
</psp:diffResponse>

2016-01-27 10:10:48,670: [main] ERROR Psp.execute(1452) -  - Psp 'psp' - 
Sync 
SyncResponse[id=apps:es:qa:portal-access,status=failure,error=noSuchIdentifier,errorMessages={Unable 
to calculate provisioned object.},requestID=2016/01/27-10:10:48.475]
2016-01-27 10:10:48,670: [main] ERROR Psp.execute(1454) -  - Psp 'psp' - 
Sync SPML:
<psp:syncResponse xmlns:psp='http://grouper.internet2.edu/psp' 
status='failure' requestID='2016/01/27-10:10:48.475' 
error='noSuchIdentifier'>
  <errorMessage>Unable to calculate provisioned object.</errorMessage>
  <psp:id ID='apps:es:qa:portal-access'/>
</psp:syncResponse>

No doubt this is a configuration issue, but am at a loss to find it at 
this point.

Any and all questions/pointers appreciated.

Thanks and best, -- pete

--
Peter St. Onge                           

Information Security Architect                     (416)978-5030
Business Continuity and Communications
Information + Technology Services          University of Toronto