Grouper Users - Open Discussion List

["Bee-Lindgren, Bert A" <>]

Pete,

There was a thread in 2013 that saw a similar problem when sources.xml was 
changed after some members were added to grouper groups.
https://lists.internet2.edu/sympa/arc/grouper-users/2013-04/msg00040.html

I don't really think that this is your problem because the ID reported in 
that thread's log was a Subject Id, and the ID reported in your log is the 
stem:group. However, would you mind taking a look at the email thread to see 
if it helps at all?

If it isn't an orphaned subject config, I think PSP is having trouble finding 
the group apps:es:qa:portal-access. What happens when you run psp-sync with a 
blatantly bogus stem:group (gsh -psp -sync does:not:exist)? If it is the same 
message, we can then dive into why your group is not being found.

Sincerely,
  Bert

________________________________________
From: 

 
<>
 on behalf of Peter St. Onge 
<>
Sent: Wednesday, January 27, 2016 10:27 AM
To: 

Subject: [grouper-users] PSP Unable to calculate provisioned object (group 
entities)

I've been quietly playing with Grouper over the last year to the point
where we are now managing some groups and memberships from it  via
Shibboleth (thanks to Bryan Wooten for help with the configurations and
Michael White for help with Shibboleth integration!)

I'm running into a curious problem with the PSP, in that while
memberships in user records are properly provisioned and de-provisioned
as these change, I note that groups are created but aren't later updated
as their memberships change (I note that the groups aren't empty when
they are first provisioned, my gsh scripts put people and/or groups as
members at build time).

I can also manually call ./gsh -psp -sync $id against a specific user id
successfully (the appropriate member fields in the user record are
updated), and the grouper_error.log shows a successful lookupResponse /
diffResponse / syncResponse.

When I try to sync a group, however, using ./gsh -psp -sync $id, where
id is a group like 'apps:es:qa:portal-access', the attempt fails and I
see this in the grouper_error.log ...

<psp:syncRequest xmlns:psp='http://grouper.internet2.edu/psp'
returnData='everything'>
   <psp:id ID='apps:es:qa:portal-access'/>
</psp:syncRequest>

2016-01-27 10:10:48,476: [main] INFO  Psp.execute(1152) -  - Psp 'psp' -
Diff
DiffRequest[id=apps:es:qa:portal-access,requestID=2016/01/27-10:10:48.476,returnData=everything]
2016-01-27 10:10:48,477: [main] INFO  Psp.execute(1156) -  - Psp 'psp' -
Diff XML:
<psp:diffRequest xmlns:psp='http://grouper.internet2.edu/psp'
requestID='2016/01/27-10:10:48.476' returnData='everything'>
   <psp:id ID='apps:es:qa:portal-access'/>
</psp:diffRequest>

2016-01-27 10:10:48,479: [main] INFO  Psp.execute(980) -  - Psp 'psp' -
Calc
CalcRequest[id=apps:es:qa:portal-access,requestID=2016/01/27-10:10:48.479,returnData=everything]
2016-01-27 10:10:48,479: [main] INFO  Psp.execute(984) -  - Psp 'psp' -
Calc XML:
<psp:calcRequest xmlns:psp='http://grouper.internet2.edu/psp'
requestID='2016/01/27-10:10:48.479' returnData='everything'>
   <psp:id ID='apps:es:qa:portal-access'/>
</psp:calcRequest>

2016-01-27 10:10:48,666: [main] INFO  Psp.execute(1020) -  - Psp 'psp' -
Calc
CalcResponse[id=apps:es:qa:portal-access,status=failure,error=noSuchIdentifier,errorMessages={Unable
to calculate provisioned object.},requestID=2016/01/27-10:10:48.479]
2016-01-27 10:10:48,668: [main] INFO  Psp.execute(1022) -  - Psp 'psp' -
Calc XML:
<psp:calcResponse xmlns:psp='http://grouper.internet2.edu/psp'
status='failure' requestID='2016/01/27-10:10:48.479'
error='noSuchIdentifier'>
   <errorMessage>Unable to calculate provisioned object.</errorMessage>
   <psp:id ID='apps:es:qa:portal-access'/>
</psp:calcResponse>

2016-01-27 10:10:48,669: [main] ERROR Psp.execute(1187) -  - Psp 'psp' -
Diff
DiffResponse[id=apps:es:qa:portal-access,status=failure,error=noSuchIdentifier,errorMessages={Unable
to calculate provisioned object.},requestID=2016/01/27-10:10:48.476]
2016-01-27 10:10:48,670: [main] ERROR Psp.execute(1189) -  - Psp 'psp' -
Diff XML:
<psp:diffResponse xmlns:psp='http://grouper.internet2.edu/psp'
status='failure' requestID='2016/01/27-10:10:48.476'
error='noSuchIdentifier'>
   <errorMessage>Unable to calculate provisioned object.</errorMessage>
   <psp:id ID='apps:es:qa:portal-access'/>
</psp:diffResponse>

2016-01-27 10:10:48,670: [main] ERROR Psp.execute(1452) -  - Psp 'psp' -
Sync
SyncResponse[id=apps:es:qa:portal-access,status=failure,error=noSuchIdentifier,errorMessages={Unable
to calculate provisioned object.},requestID=2016/01/27-10:10:48.475]
2016-01-27 10:10:48,670: [main] ERROR Psp.execute(1454) -  - Psp 'psp' -
Sync SPML:
<psp:syncResponse xmlns:psp='http://grouper.internet2.edu/psp'
status='failure' requestID='2016/01/27-10:10:48.475'
error='noSuchIdentifier'>
   <errorMessage>Unable to calculate provisioned object.</errorMessage>
   <psp:id ID='apps:es:qa:portal-access'/>
</psp:syncResponse>

No doubt this is a configuration issue, but am at a loss to find it at
this point.

Any and all questions/pointers appreciated.

Thanks and best, -- pete

--
Peter St. Onge                           

Information Security Architect                     (416)978-5030
Business Continuity and Communications
Information + Technology Services          University of Toronto