Grouper Users - Open Discussion List

[Jeffrey Crawford <>]

I've tried the following with no success (pspng is still trying to provision everything and not cutting off any stems/ou

I added a new attribute definition "etc:attribute:userData:provisionDef" that was multivalued and assignable to Folders and Groups.

I then made the two attribute names "etc:attribute:userData:provision_to" and "etc:attribute:userData:do_not_provision_to"

I then added them to folders as follows:

etc - etc:attribute:userData:do_not_provision_to = groupOfNames

ucsc - etc:attribute:userData:do_not_provision_to = groupOfNames

ucsc:stem - etc:attribute:userData:provision_to = groupOfNames

Still it seems to be trying to provision all groups.

Jeffrey

Both pilots and IT professionals require training and currency before charging into clouds!

---------------------------------------

On Thu, May 26, 2016 at 1:40 PM, Jeffrey Crawford <> wrote:

Yea I wasn't sure if that is what would work. It's not clear what would need to be added to the attributes. Does anyone have an example? I need to do this in the LiteUI correct?

Jeffrey

Both pilots and IT professionals require training and currency before charging into clouds!

---------------------------------------

On Thu, May 26, 2016 at 1:33 PM, Hyzer, Chris <> wrote:

I believe this is supported with attributes on the stems to be provisioned or not.

 

https://spaces.internet2.edu/display/Grouper/Grouper+Provisioning%3A+PSPNG#GrouperProvisioning:PSPNG-GroupSelection

 

Thanks

Chris

 

From: Jeffrey Crawford [mailto:]
Sent: Thursday, May 26, 2016 2:54 PM
To: Hyzer, Chris <>
Cc: Bee-Lindgren, Bert A <>; Jared Hoffman <>; Yoann Delattre <>; ;

Subject: Re: [grouper-users] Getting ClassNotFoundException for PSPNG

 

Okay I hope I can explain this well. The old psp would allow you to specify from what location in the group structure to start provisioning. We don't want our entire grouper structure in LDAP, so we have dedicated stems where we start provisioning. I'm not seeing a way to perform that here. It looks like it want's to push the entire grouper directory.

Is there a pragma I'm missing? or is that behavior not supported yet in pspng?

Jeffrey

 

Both pilots and IT professionals require training and currency before charging into clouds!

---------------------------------------

 

On Thu, May 26, 2016 at 10:52 AM, Hyzer, Chris <> wrote:

I would do:

 

${ grouperUtil.extensionFromName(name) }

 

This would also work if the group wasn’t deleted and in point in time so I wouldn’t use it:

 

${group.extension}

 

 

Thanks,

Chris

 

From: Jeffrey Crawford [mailto:]
Sent: Thursday, May 26, 2016 1:09 PM
To: Bee-Lindgren, Bert A <>
Cc: Hyzer, Chris <>; Jared Hoffman <>; Yoann Delattre <>; ;

Subject: Re: [grouper-users] Getting ClassNotFoundException for PSPNG

 

I'm getting a connection but with the caveat below. However I'm trying to discover the different variables available, ${group.name} does seem to be the name of the group behind the stem "base:stem:group" but when I try to use ${group.id} it looks the same as ${group.uuid}. In the interface "id" is the name of the group without the stem (needed for bushy configurations). I also tried ${groupAttributes['name']}, but that gave me an error that looks like the following:
------------------------------------------------------------------------------
2016-05-26 09:43:00,478: [DefaultQuartzScheduler_Worker-10] WARN  GrouperUtil.substituteExpressionLanguage(9287) -  - _expression_ ret
urned null: groupAttributes['name'], in pattern: '(&(objectclass=groupOfNames)(cn=${groupAttributes['name']}))', available variables
 are: KeySet size: 12: [0]: isActiveDirectory
[1]: idIndex
[2]: userSearchBaseDn
[3]: groupAttributes
[4]: groupCreationBaseDn
[5]: stemAttributes
[6]: utils
[7]: groupSearchBaseDn
[8]: name
[9]: provisionerName
[10]: group
[11]: provisionerType

Jeffrey

 

Both pilots and IT professionals require training and currency before charging into clouds!

---------------------------------------

 

On Thu, May 26, 2016 at 12:19 AM, Bee-Lindgren, Bert A <> wrote:

It looks like I failed to document the correct ldap properties that our upgrade to ldaptive has changed. This should work:

ldap.groupOfNames.ldapUrl = ldaps://ldaphost.ucsc.edu/dc=ucsc,dc=edu

ldap.groupOfNames.useStartTLS = false #probably not necessary
ldap.groupOfNames.bindDn = cn=serviceacct,ou=apps,dc=ucsc,dc=edu
ldap.groupOfNames.bindCredential = xxxxxxxxxxxxxxxxxxxxx

 

​For some reason using ldaps give me a message in my LDAP logs that the SSL handshake failed because it looks like a "plaintext connection". however using ldap://xxx and useStartTLS=true works​

 

When going beyond ldaptive's short property-configuration tutorial <1>, I found ldaptive's property-reading classes <2> abstract and opaque. In developing pspng's configuration, I had to decide whether to slog through the properties ldaptive implements or just read our own (or vtldap's) properties and initialize the connections appropriately. I was very tempted, but I knew some folks want lots of configuration knobs (eg, pooling or sasl) that we probably can't keep up with or test sufficiently. 

 

So, all that said, we certainly need documentation and, perhaps, some vtldap-property aliases (eg, url copied into ldapUrl). I hope you can try the above properties and let us know if it helps. I've updated the wiki page <3> as well as created a jira <4> about vtldap-compatible properties. 

 

Thanks for your help and patience,

  Bert

 

<1> http://www.ldaptive.org/docs/guide/properties.html

<2> http://www.ldaptive.org/javadocs/org/ldaptive/props/package-frame.html

<3> https://spaces.internet2.edu/display/Grouper/Grouper+Provisioning%3A+PSPNG

<4> https://bugs.internet2.edu/jira/browse/GRP-1306

---

From: Jeffrey Crawford <>
Sent: Friday, May 20, 2016 3:32 PM
To: Hyzer, Chris
Cc: Jared Hoffman; Bee-Lindgren, Bert A; Yoann Delattre; ;

Subject: Re: [grouper-users] Getting ClassNotFoundException for PSPNG

 

It looks like it's at least loading, however when trying to use the provisioner I'm gettin "LDAP URL cannot be null". Am I understaing the relationship between the ldap.groupOfNames.xxx and ldapPoolNames correctly?

but I have something like the following:
ldap.groupOfNames.url = "ldaps://ldaphost.ucsc.edu/dc=ucsc,dc=edu
ldap.groupOfNames.tls = false
ldap.groupOfNames.user = cn=serviceacct,ou=apps,dc=ucsc,dc=edu
ldap.groupOfNames.pass = xxxxxxxxxxxxxxxxxxxxx
changeLog.consumer.pspng_groupOfUniqueNames.class = edu.internet2.middleware.grouper.pspng.PspChangelogConsumerShim
changeLog.consumer.pspng_groupOfUniqueNames.type = edu.internet2.middleware.grouper.pspng.LdapGroupProvisioner
changeLog.consumer.pspng_groupOfUniqueNames.quartzCron = 0 * * * * ?
changeLog.consumer.pspng_groupOfUniqueNames.ldapPoolName = groupOfNames
changeLog.consumer.pspng_groupOfUniqueNames.memberAttributeName = member
changeLog.consumer.pspng_groupOfUniqueNames.memberAttributeValueFormat = ${ldapUser.getDn()}
changeLog.consumer.pspng_groupOfUniqueNames.groupSearchBaseDn = ou=groups,dc=example,dc=edu
changeLog.consumer.pspng_groupOfUniqueNames.allGroupsSearchFilter = objectclass=groupOfNames
changeLog.consumer.pspng_groupOfUniqueNames.singleGroupSearchFilter = (&(objectclass=groupOfNames)(cn=${group.name}))
changeLog.consumer.pspng_groupOfUniqueNames.groupCreationLdifTemplate = dn: utils.bushyDn(group.name, "cn", "ou") cn=${group.name}||objectclass: groupOfNames
changeLog.consumer.pspng_groupOfUniqueNames.userSearchBaseDn = ou=people,dc=example,dc=edu
changeLog.consumer.pspng_groupOfUniqueNames.userSearchFilter = ucscID=${subject.id}

Jeffrey E. Crawford
ITS Application Administrator (IdM)
831-459-4365

 

Both pilots and IT professionals require training and currency before charging into clouds!

---------------------------------------

 

On Fri, May 20, 2016 at 6:09 AM, Hyzer, Chris <> wrote:

Not sure if this is the right response, but I will say that Bert created script that generates a pspng tarball.  You can copy the dist pspng jar and dependent jars to the loader lib/custom and see if it helps?  J

 

http://software.internet2.edu/grouper/release/2.3.0/grouper.pspng-2.3.0.tar.gz

 

thanks,

Chris

 

From: [mailto:] On Behalf Of Jeffrey Crawford
Sent: Thursday, May 19, 2016 1:05 PM
To: Jared Hoffman <>
Cc: Bee-Lindgren, Bert A <>; Yoann Delattre <>; ;

Subject: Re: [grouper-users] Getting ClassNotFoundException for PSPNG

 

running into this one too, any way to just stick a jar file in the email thread so we can at least get our configurations squared away?

Jeffrey

 

Both pilots and IT professionals require training and currency before charging into clouds!

---------------------------------------

 

On Tue, May 17, 2016 at 1:25 PM, Jared Hoffman <> wrote:

Is there an update for this problem? We are having it, too, while trying to set up 2.3.

 

 

 

Thanks.

Jared

 

On Wed, May 4, 2016 at 6:44 AM, Bee-Lindgren, Bert A <> wrote:

Good morning,

 

This is a quick email to let you know that we've also duplicated the problem and will reply with a fix asap.

 

Sincerely,

  Bert

---

From: <> on behalf of Yoann Delattre <>
Sent: Wednesday, May 4, 2016 3:25 AM
To:
Subject: Re: [grouper-users] Getting ClassNotFoundException for PSPNG

 

Hello,

same problem here :

2016-05-03 10:57:24,161: [main] ERROR GrouperCheckConfig.checkGrouperLoaderConsumers(1041) -  - problem finding class: changeLog.consumer.pspng_groupOfUniqueNames.class from grouper-loader.properties: edu.internet2.middleware.grouper.pspng.PspChangelogConsumerShim, java.lang.RuntimeException: Problem loading class: edu.internet2.middleware.grouper.pspng.PspChangelogConsumerShim
        at edu.internet2.middleware.grouper.util.GrouperUtil.forName(GrouperUtil.java:1783)
        at edu.internet2.middleware.grouper.misc.GrouperCheckConfig.checkGrouperLoaderConsumers(GrouperCheckConfig.java:1029)
        at edu.internet2.middleware.grouper.app.loader.GrouperLoader.main(GrouperLoader.java:115)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:606)
        at edu.internet2.middleware.grouper.app.gsh.GrouperShell.handleSpecialCase(GrouperShell.java:204)
        at edu.internet2.middleware.grouper.app.gsh.GrouperShell.main(GrouperShell.java:144)
        at edu.internet2.middleware.grouper.app.gsh.GrouperShellWrapper.main(GrouperShellWrapper.java:31)
Caused by: java.lang.ClassNotFoundException: edu.internet2.middleware.grouper.pspng.PspChangelogConsumerShim
        at java.net.URLClassLoader$1.run(URLClassLoader.java:366)
        at java.net.URLClassLoader$1.run(URLClassLoader.java:355)
        at java.security.AccessController.doPrivileged(Native Method)
        at java.net.URLClassLoader.findClass(URLClassLoader.java:354)
        at java.lang.ClassLoader.loadClass(ClassLoader.java:425)
        at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:308)
        at java.lang.ClassLoader.loadClass(ClassLoader.java:358)
        at java.lang.Class.forName0(Native Method)
        at java.lang.Class.forName(Class.java:195)
        at edu.internet2.middleware.grouper.util.GrouperUtil.forName(GrouperUtil.java:1781)
        ... 9 more

 

Where can we find the missing jar ?

Thanks,
Yoann

Le 02/05/2016 à 19:34, Kumi Hagimoto a écrit :

Hello,

I just did a fresh install of grouper 2.3 and am trying to configure PSPNG. 

(https://spaces.internet2.edu/display/Grouper/Grouper+Provisioning%3A+PSPNG)

I'm getting the following in grouper_error.log (see below), so I'm obviously

missing a jar somewhere.  Could someone please point me in the right

direction?

Thanks,

Kumi

-- grouper_error.log ---

2016-05-02 10:19:54,928: [DefaultQuartzScheduler_Worker-1] ERROR

GrouperLoaderJob.runJob(436) -  - Error on job: PSP_FULL_SYNC.runAtStartup

java.lang.RuntimeException: Problem loading class:

edu.internet2.middleware.grouper.pspng.FullSyncStarter

        at

edu.internet2.middleware.grouper.util.GrouperUtil.forName(GrouperUtil.java:178

3)

        at

edu.internet2.middleware.grouper.app.loader.GrouperLoaderType$10.runJob(Groupe

rLoaderType.java:1174)

        at

edu.internet2.middleware.grouper.app.loader.GrouperLoaderJob.runJob(GrouperLoa

derJob.java:416)

        at

edu.internet2.middleware.grouper.app.loader.GrouperLoaderJob.execute(GrouperLo

aderJob.java:318)

        at org.quartz.core.JobRunShell.run(JobRunShell.java:202)

        at

org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)

Caused by: java.lang.ClassNotFoundException:

edu.internet2.middleware.grouper.pspng.FullSyncStarter

        at java.net.URLClassLoader$1.run(URLClassLoader.java:366)

        at java.net.URLClassLoader$1.run(URLClassLoader.java:355)

        at java.security.AccessController.doPrivileged(Native Method)

        at java.net.URLClassLoader.findClass(URLClassLoader.java:354)

        at java.lang.ClassLoader.loadClass(ClassLoader.java:425)

        at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:308)

        at java.lang.ClassLoader.loadClass(ClassLoader.java:358)

        at java.lang.Class.forName0(Native Method)

        at java.lang.Class.forName(Class.java:195)

        at

edu.internet2.middleware.grouper.util.GrouperUtil.forName(GrouperUtil.java:178

1)

        ... 5 more

2016-05-02 10:19:54,958: [DefaultQuartzScheduler_Worker-1] ERROR

GrouperLoaderJob.execute(321) -  - Error running up job

java.lang.RuntimeException: Problem loading class:

edu.internet2.middleware.grouper.pspng.FullSyncStarter

        at

edu.internet2.middleware.grouper.util.GrouperUtil.forName(GrouperUtil.java:178

3)

        at

edu.internet2.middleware.grouper.app.loader.GrouperLoaderType$10.runJob(Groupe

rLoaderType.java:1174)

        at

edu.internet2.middleware.grouper.app.loader.GrouperLoaderJob.runJob(GrouperLoa

derJob.java:416)

        at

edu.internet2.middleware.grouper.app.loader.GrouperLoaderJob.execute(GrouperLo

aderJob.java:318)

        at org.quartz.core.JobRunShell.run(JobRunShell.java:202)

        at

org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)

Caused by: java.lang.ClassNotFoundException:

edu.internet2.middleware.grouper.pspng.FullSyncStarter

        at java.net.URLClassLoader$1.run(URLClassLoader.java:366)

        at java.net.URLClassLoader$1.run(URLClassLoader.java:355)

        at java.security.AccessController.doPrivileged(Native Method)

        at java.net.URLClassLoader.findClass(URLClassLoader.java:354)

        at java.lang.ClassLoader.loadClass(ClassLoader.java:425)

        at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:308)

        at java.lang.ClassLoader.loadClass(ClassLoader.java:358)

        at java.lang.Class.forName0(Native Method)

        at java.lang.Class.forName(Class.java:195)

        at

edu.internet2.middleware.grouper.util.GrouperUtil.forName(GrouperUtil.java:178

1)

        ... 5 more

 

 

--

Jared Hoffman • Associate Director for Enterprise Infrastructure

Kenyon College LBIS •  • 740.427.5948