Skip to Content.
Sympa Menu

grouper-users - Re: [grouper-users] PSP Unable to calculate provisioned object (group entities)

Subject: Grouper Users - Open Discussion List

List archive

Re: [grouper-users] PSP Unable to calculate provisioned object (group entities)

Chronological Thread 
  • From: "Bee-Lindgren, Bert A" <>
  • To: "Peter St. Onge" <>, "" <>
  • Subject: Re: [grouper-users] PSP Unable to calculate provisioned object (group entities)
  • Date: Wed, 10 Feb 2016 18:14:40 +0000
  • Accept-language: en-US
  • Authentication-results:; dkim=none (message not signed) header.d=none;; dmarc=none action=none;
  • Spamdiagnosticmetadata: NSPM
  • Spamdiagnosticoutput: 1:23


There was a thread in 2013 that saw a similar problem when sources.xml was
changed after some members were added to grouper groups.

I don't really think that this is your problem because the ID reported in
that thread's log was a Subject Id, and the ID reported in your log is the
stem:group. However, would you mind taking a look at the email thread to see
if it helps at all?

If it isn't an orphaned subject config, I think PSP is having trouble finding
the group apps:es:qa:portal-access. What happens when you run psp-sync with a
blatantly bogus stem:group (gsh -psp -sync does:not:exist)? If it is the same
message, we can then dive into why your group is not being found.



on behalf of Peter St. Onge
Sent: Wednesday, January 27, 2016 10:27 AM

Subject: [grouper-users] PSP Unable to calculate provisioned object (group

I've been quietly playing with Grouper over the last year to the point
where we are now managing some groups and memberships from it via
Shibboleth (thanks to Bryan Wooten for help with the configurations and
Michael White for help with Shibboleth integration!)

I'm running into a curious problem with the PSP, in that while
memberships in user records are properly provisioned and de-provisioned
as these change, I note that groups are created but aren't later updated
as their memberships change (I note that the groups aren't empty when
they are first provisioned, my gsh scripts put people and/or groups as
members at build time).

I can also manually call ./gsh -psp -sync $id against a specific user id
successfully (the appropriate member fields in the user record are
updated), and the grouper_error.log shows a successful lookupResponse /
diffResponse / syncResponse.

When I try to sync a group, however, using ./gsh -psp -sync $id, where
id is a group like 'apps:es:qa:portal-access', the attempt fails and I
see this in the grouper_error.log ...

<psp:syncRequest xmlns:psp=''
<psp:id ID='apps:es:qa:portal-access'/>

2016-01-27 10:10:48,476: [main] INFO Psp.execute(1152) - - Psp 'psp' -
2016-01-27 10:10:48,477: [main] INFO Psp.execute(1156) - - Psp 'psp' -
Diff XML:
<psp:diffRequest xmlns:psp=''
requestID='2016/01/27-10:10:48.476' returnData='everything'>
<psp:id ID='apps:es:qa:portal-access'/>

2016-01-27 10:10:48,479: [main] INFO Psp.execute(980) - - Psp 'psp' -
2016-01-27 10:10:48,479: [main] INFO Psp.execute(984) - - Psp 'psp' -
Calc XML:
<psp:calcRequest xmlns:psp=''
requestID='2016/01/27-10:10:48.479' returnData='everything'>
<psp:id ID='apps:es:qa:portal-access'/>

2016-01-27 10:10:48,666: [main] INFO Psp.execute(1020) - - Psp 'psp' -
to calculate provisioned object.},requestID=2016/01/27-10:10:48.479]
2016-01-27 10:10:48,668: [main] INFO Psp.execute(1022) - - Psp 'psp' -
Calc XML:
<psp:calcResponse xmlns:psp=''
status='failure' requestID='2016/01/27-10:10:48.479'
<errorMessage>Unable to calculate provisioned object.</errorMessage>
<psp:id ID='apps:es:qa:portal-access'/>

2016-01-27 10:10:48,669: [main] ERROR Psp.execute(1187) - - Psp 'psp' -
to calculate provisioned object.},requestID=2016/01/27-10:10:48.476]
2016-01-27 10:10:48,670: [main] ERROR Psp.execute(1189) - - Psp 'psp' -
Diff XML:
<psp:diffResponse xmlns:psp=''
status='failure' requestID='2016/01/27-10:10:48.476'
<errorMessage>Unable to calculate provisioned object.</errorMessage>
<psp:id ID='apps:es:qa:portal-access'/>

2016-01-27 10:10:48,670: [main] ERROR Psp.execute(1452) - - Psp 'psp' -
to calculate provisioned object.},requestID=2016/01/27-10:10:48.475]
2016-01-27 10:10:48,670: [main] ERROR Psp.execute(1454) - - Psp 'psp' -
Sync SPML:
<psp:syncResponse xmlns:psp=''
status='failure' requestID='2016/01/27-10:10:48.475'
<errorMessage>Unable to calculate provisioned object.</errorMessage>
<psp:id ID='apps:es:qa:portal-access'/>

No doubt this is a configuration issue, but am at a loss to find it at
this point.

Any and all questions/pointers appreciated.

Thanks and best, -- pete

Peter St. Onge

Information Security Architect (416)978-5030
Business Continuity and Communications
Information + Technology Services University of Toronto

Archive powered by MHonArc 2.6.16.

Top of Page