Grouper Users - Open Discussion List

[Gail H Lift <>]

We didn't see any LDAP errors. Also, we were querying a no-limit server, which was responding quickly (that attribute is indexed). Using a query on the same attribute to simply populate a single group works fine.

We are new to Grouper, and might have something dumb in our group definition.

On Dec 27, 2016 2:14 PM, "Julio Polo" <> wrote:

Check your LDAP server logs for any error (error message or LDAP error code) associated with that particular query:

(|(umichInstRoles=FacultyAA)(umichInstRoles=StudentAA))

Maybe it timed out (either on the LDAP server or client side) or it exceeded some threshold on the number of entries it can return or search through.

-julio

Julio Polo
Enterprise Middleware, Identity and Access Management
University of Hawaii

On Fri, Dec 23, 2016 at 7:32 AM, Liam Hoekenga <> wrote:

We're just starting to explore grouper.  Based on the example at https://spaces.internet2.edu/display/Grouper/Grouper+Loader+LDAP+examples#GrouperLoaderLDAPexamples-LDAPgroupsfromattributes, we tried to set up a "groups from attributes" definition:

LDAP filter (|(umichInstRoles=FacultyAA)(umichInstRoles=StudentAA))

LDAP group attribute name umichInstRoles

LDAP group name _expression_ groupsFromAttributes:${groupAttribute}

LDAP search base DN ou=People,dc=umich,dc=edu

LDAP server ID mcommDir

LDAP source ID mcommDir

LDAP subject ID type subjectIdentifier

LDAP subject attribute name entityid

LDAP type LDAP_GROUPS_FROM_ATTRIBUTES

We see the searches:

2016-12-23 12:17:54,281: [ajp-apr-8009-exec-4] DEBUG GrouperLoaderConfig.retrieveLdapProfile(317) -  - LDAP config for server id: mcommDir: GrouperLoaderLdapServer [batchSize=-1, configFileFromClasspath: , countLimit=-1, driver=null, expirationTime=-1, maxPoolSize=-1, minPoolSize=-1, pagedResultsSize=-1, pass=XXXXX, pruneTimerPeriod=-1, referral=, saslAuthorizationId=null, saslRealm=null, timeLimit=-1, timeout=-1, tls=false, url="ldaps://ldap.umich.edu, user=cn=Grouper,ou=Applications,o=Services, validateOnCheckIn=false, validateOnCheckOut=true, validatePeriodically=false, validateTimerPeriod=-1]

Then we get back a stacktrace that's not particularly helpful (at the end of the message).

Can anyone point us in the right direction?

Liam

-------------------------------------

2016-12-23 12:17:55,441: [ajp-apr-8009-exec-4] ERROR UiV2Group.updateLoaderGroup(4479) -  - Error running loader job from ui for group: umich.edu:umichInstRolesAA

java.lang.RuntimeException: java.lang.NullPointerException: Problem with ldap conection: mcommDir,

Error querying ldap server id: mcommDir, searchDn: ou=People,dc=umich,dc=edu, filter: '(|(umichInstRoles=FacultyAA)(umichInstRoles=StudentAA))', returning subject attribute: entityid

at edu.internet2.middleware.grouper.app.loader.GrouperLoader.runJobOnceForGroup(GrouperLoader.java:1542)

at edu.internet2.middleware.grouper.grouperUi.serviceLogic.UiV2Group$6.callback(UiV2Group.java:4473)

at edu.internet2.middleware.grouper.GrouperSession.callbackGrouperSession(GrouperSession.java:974)

at edu.internet2.middleware.grouper.GrouperSession.internal_callbackRootGrouperSession(GrouperSession.java:1022)

at edu.internet2.middleware.grouper.grouperUi.serviceLogic.UiV2Group.updateLoaderGroup(UiV2Group.java:4470)

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

at java.lang.reflect.Method.invoke(Method.java:498)

at edu.internet2.middleware.grouper.util.GrouperUtil.invokeMethod(GrouperUtil.java:4112)

at edu.internet2.middleware.grouper.util.GrouperUtil.callMethod(GrouperUtil.java:4063)

at edu.internet2.middleware.grouper.j2ee.GrouperUiRestServlet.doGet(GrouperUiRestServlet.java:291)

at edu.internet2.middleware.grouper.j2ee.GrouperUiRestServlet.doPost(GrouperUiRestServlet.java:163)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:648)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:729)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:291)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

at org.owasp.csrfguard.CsrfGuardFilter.doFilter(CsrfGuardFilter.java:110)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

at edu.internet2.middleware.grouper.ui.GrouperUiFilter.doFilter(GrouperUiFilter.java:1025)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:217)

at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106)

at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:614)

at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:142)

at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)

at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:616)

at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88)

at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:518)

at org.apache.coyote.ajp.AbstractAjpProcessor.process(AbstractAjpProcessor.java:844)

at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:673)

at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.doRun(AprEndpoint.java:2503)

at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.run(AprEndpoint.java:2492)

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)

at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)

at java.lang.Thread.run(Thread.java:745)