Grouper Users - Open Discussion List

[Robert Bradley <>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hi all,

Yesterday, one of our users was running automated tests via Grouper's
Web Services that deleted two groups, added them, and then made one
group a member of the other group.  The equivalent in gsh would be:

delGroup("test:group1");
delGroup("test:group2");
addGroup("test", "group1", "Group 1");
addGroup("test", "group2", "Group 2");
addGroup("test", "group1", "Group 1");
g2s = SubjectFinder.findByIdentifierAndSource("test:group2", "g:gsa",
true);
addMember("test:group1", g2s.getId());

The actual addMember REST query looks like:

PUT /ws/servicesRest/v2_2_000/groups/test%3Agroup1/members HTTP/1.1
<headers here>

{
  "WsRestAddMemberRequest": {
    "replaceAllExisting": "F",
    "subjectLookups": [
      {
        "subjectIdentifier": "test:group2"
      }
    ]
  }
}

For the first run, this is fine.  However, if this is re-run quickly
after the first run, the addMember() call will fail, since the subject
cannot be found.  This seems to be due to the web service's subject
resolver cache retaining the old group's uuid:

- ----
{u'WsAddMemberResults': {u'wsGroupAssigned': {u'displayName':
u"Robert's test folder:group1", u'uuid':
u'aa4d862c8b1f4b188fcc5fcf0264dacb', u'extension': u'group1',
u'typeOfGroup': u'group', u'displayExtension': u'group1', u'name':
u'test:group1'}, u'resultMetadata': {u'resultCode':
u'PROBLEM_WITH_ASSIGNMENT', u'resultMessage': u'There were 0 successes
and 1 failures of users added to the group.', u'success': u'F'},
u'results': [{u'resultMetadata': {u'resultCode': u'EXCEPTION',
u'resultMessage': u'java.lang.RuntimeException:
edu.internet2.middleware.grouper.exception.MemberAddException: Cant
find (or possibly view) group: 2eb1920a964a4396ae8a9876fd890d6c,
membership: group: test:group1, subject:
2eb1920a964a4396ae8a9876fd890d6c, field: members, uuid: null,
startDate: null, endDate: null,\n, group name: test:group1, subject:
Subject groupName: test:group2, sourceId: g:gsa, field:
members,\nProblem in HibernateSession: HibernateSession (70127d49):
notNew, notReadonly, READ_WRITE_NEW, activeTransaction, session
(20e5d308),\nProblem in HibernateSession: HibernateSession (42536133):
new, notReadonly, READ_WRITE_NEW, notActiveTransaction, session
(20e5d308)\n\tat
edu.internet2.middleware.grouper.Group$4.callback(Group.java:1410)\n\tat
edu.internet2.middleware.grouper.hibernate.HibernateSession.callbackHibe
rnateSession(HibernateSession.java:687)\n\tat
edu.internet2.middleware.grouper.Group.internal_addMember(Group.java:136
4)\n\tat
edu.internet2.middleware.grouper.Group.addMember(Group.java:938)\n\tat
edu.internet2.middleware.grouper.ws.GrouperServiceLogic$1$1.callback(Gro
uperServiceLogic.java:310)\n\tat
edu.internet2.middleware.grouper.hibernate.HibernateSession.callbackHibe
rnateSession(HibernateSession.java:687)\n\tat
edu.internet2.middleware.grouper.ws.GrouperServiceLogic$1.callback(Group
erServiceLogic.java:303)\n\tat
edu.internet2.middleware.grouper.internal.dao.hib3.Hib3TransactionDAO$1.
callback(Hib3TransactionDAO.java:66)\n\tat
edu.internet2.middleware.grouper.hibernate.HibernateSession.callbackHibe
rnateSession(HibernateSession.java:687)\n\tat
edu.internet2.middleware.grouper.internal.dao.hib3.Hib3TransactionDAO.tr
ansactionCallback(Hib3TransactionDAO.java:56)\n\tat
edu.internet2.middleware.grouper.hibernate.GrouperTransaction.callbackGr
ouperTransaction(GrouperTransaction.java:87)\n\tat
edu.internet2.middleware.grouper.ws.GrouperServiceLogic.addMember(Groupe
rServiceLogic.java:237)\n\tat
edu.internet2.middleware.grouper.ws.coresoap.GrouperService.addMember(Gr
ouperService.java:1263)\n\tat
edu.internet2.middleware.grouper.ws.rest.GrouperServiceRest.addMember(Gr
ouperServiceRest.java:315)\n\tat
edu.internet2.middleware.grouper.ws.rest.method.GrouperWsRestPutGroup$1.
service(GrouperWsRestPutGroup.java:63)\n\tat
edu.internet2.middleware.grouper.ws.rest.method.GrouperWsRestPut$1.servi
ce(GrouperWsRestPut.java:110)\n\tat
edu.internet2.middleware.grouper.ws.rest.method.GrouperRestHttpMethod$3.
service(GrouperRestHttpMethod.java:104)\n\tat
edu.internet2.middleware.grouper.ws.rest.GrouperRestServlet.service(Grou
perRestServlet.java:199)\n\tat
javax.servlet.http.HttpServlet.service(HttpServlet.java:723)\n\tat
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Applica
tionFilterChain.java:290)\n\tat
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilt
erChain.java:206)\n\tat
edu.internet2.middleware.grouper.ws.GrouperServiceJ2ee.doFilter(GrouperS
erviceJ2ee.java:661)\n\tat
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Applica
tionFilterChain.java:235)\n\tat
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilt
erChain.java:206)\n\tat
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValv
e.java:233)\n\tat
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValv
e.java:191)\n\tat
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java
:127)\n\tat
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java
:103)\n\tat
org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:615
)\n\tat
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.
java:109)\n\tat
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:2
93)\n\tat
org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:223)\n\
tat
org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:311)\n\ta
t
org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:793)\n\tat
org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:
722)\n\tat
org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.
java:915)\n\tat
org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool
.java:690)\n\tat
java.lang.Thread.run(Thread.java:745)\nCaused by:
edu.internet2.middleware.grouper.exception.MemberAddException: Cant
find (or possibly view) group: 2eb1920a964a4396ae8a9876fd890d6c,
membership: group: test:group1, subject:
2eb1920a964a4396ae8a9876fd890d6c, field: members, uuid: null,
startDate: null, endDate: null\n\tat
edu.internet2.middleware.grouper.Membership.internal_addImmediateMembers
hip(Membership.java:1262)\n\tat
edu.internet2.middleware.grouper.Group$4.callback(Group.java:1392)\n\t..
.
37 more\nCaused by:
edu.internet2.middleware.grouper.exception.MemberNotFoundException:
Cant find (or possibly view) group:
2eb1920a964a4396ae8a9876fd890d6c\n\tat
edu.internet2.middleware.grouper.MemberFinder.internal_findReadableMembe
rBySubject(MemberFinder.java:601)\n\tat
edu.internet2.middleware.grouper.Membership.internal_addImmediateMembers
hip(Membership.java:1230)\n\t...
38 more\nCaused by:
edu.internet2.middleware.grouper.exception.GroupNotFoundException:
Cant find group by uuid: 2eb1920a964a4396ae8a9876fd890d6c\n\tat
edu.internet2.middleware.grouper.internal.dao.hib3.Hib3GroupDAO.findByUu
id(Hib3GroupDAO.java:1285)\n\tat
edu.internet2.middleware.grouper.internal.dao.hib3.Hib3GroupDAO.findByUu
id(Hib3GroupDAO.java:1253)\n\tat
edu.internet2.middleware.grouper.internal.dao.hib3.Hib3GroupDAO.findByUu
id(Hib3GroupDAO.java:1244)\n\tat
edu.internet2.middleware.grouper.MemberFinder.internal_findReadableMembe
rBySubject(MemberFinder.java:598)\n\t...
39 more', u'success': u'F'}, u'wsSubject': {u'name': u'test:group2',
u'success': u'T', u'sourceId': u'g:gsa', u'resultCode': u'SUCCESS',
u'id': u'2eb1920a964a4396ae8a9876fd890d6c', u'identifierLookup':
u'test:group2'}}], u'responseMetadata': {u'serverVersion': u'2.2.2',
u'millis': u'32'}}}
- ----

Reducing the timeToIdle for ...CachingResolver.FindByIdentifier and
...CachingResolver.FindByIdOrIdentifier to 1 second will works, but I
am worried that that will show down LDAP sujects by increasing
lookups.  One interesting observation is that the getSubjects REST
call returns the correct details regardless.  Caching the UUIDs from
the groupSave request may also work.

While I have to admit that using Grouper this way is not exactly
intended behaviour, is there any good way to prevent this sort of
thing occurring on the server side?  For example, would it make sense
for group deletions to invalidate the CachingResolver caches?

Regards,

Robert

- -- 
Dr Robert Bradley
Identity and Access Management Team, IT Services, University of Oxford
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJXtHk1AAoJEJRhp8p2r+O+WIUQAILT3weDXFM1fZzO4Rgsnpui
09HSZr0k73WCOx7WL1pSIEmHz3n6dVOrBeDcWwY2PL/LGj0Jfx5tJRh4zB+LUiom
/RftJIxZuoQgYtXnr8Fs2TrH8UB+ImomE5Or1lahx2PlxKn4SJr46VsKAoePVYIE
FJ1vtDtKEcf33wIa262cdDZjSiIG3k05qKU+la0eOB98ooEgalvF019oF7WPvnD/
Mldz+a02Rdl1CbTmJ7wz7HNjDyTgxvp4VItUOyhzFcMfen2xWaVt/y3rJIYENtXS
mxrDcCqYiGVklr9E6PrF7DfliyKrUh8ulzvEf86Bs2iMIOXdrZ+gfc5/A+jI5Itj
iLbKNNaKbTjX0QvVannfA/nE18aIqvjveKsMyAkZBPdXZOw7v8TLl0O3Uc2/Dc4/
X7HDKqR2s4JHgSFAxf9UiyNpoZct+pBW1CQxRTvjcRlosQ2oYg6dS9HM+ane1UqB
0uHqvhKQLq8USYAT2ksKy/QaGSbG3TbGvUn7Yw481t0PIlCerhD6JAABLJWVWRAg
iC+RuXS5c3dZ46vdFS6dKH5Iy/rwrmmR0ENKquXxXQ21mCNzSpb15s2hVsZe4kTn
/3sMQcGpv1YbeKCdnUY3Atkl7Qph2CfM9OpZXDX2jwR/eW4qhFrmwX3agdLmG1b3
Y3H7rx1yv2Or+OtZ9dPl
=5ZdI
-----END PGP SIGNATURE-----