Grouper Users - Open Discussion List

[Andrew Morgan <>]

On Thu, 12 Jan 2017, Scott Koranda wrote:

> > > Hi,
> > >
> > > This question concerns Grouper 2.2.2 PSP.
> > >
> > > I am attempting to provision only groups from a particular
> > > base stem. So I have set
> > >
> > > edu.internet2.middleware.psp.baseStem=My Stem
> > >
> > > That has no effect however. Running
> > >
> > > ./bin/gsh.sh -psp -calc username
> > >
> > > shows that it picks up all groups to provision to OpenLDAP,
> > > not just those under "My Stem".
> > >
> > > (As does -sync username)
> > >
> > > Directly substituting "My Stem" into the appropriate places in
> > > psp-resolver.xml does not have any effect either.
> > >
> > > Other than this, the PSP is provisioning as I expect to
> > > OpenLDAP.
> > >
> > > Can anybody confirm that 'baseStem' is something other than a
> > > no-op?
> >
> > Scott,
> >
> > We are running v2.3 now (with PSP), but the baseStem setting has been
> > working for us for a long time, including with v2.2.  It is somewhat
> > confusing because you'll still see some PSP messages in the logs for groups
> > outside of baseStem.  I think it just filters them out later in the
> > processing.  You should *not* see those groups actually provisioned in LDAP.
>
> Thanks Andy.
>
> I am seeing the values provisioned into LDAP, not in log
> messages.
>
> But what I am looking at is the isMemberOf value provisioned
> the PSP on the person record, not the group record itself.
>
> Looking in detail at psp-resolver.xml it does not appear that
> the normal filtering associated with baseStem is applied to
> the "MemberDataConnector", and is only part of the
> "GroupDataConnector".
>
> Are you seeing filtering for isMemberOf (or its equivalent) in
> the person record or only for the group records themselves?
>
> I am attempting now to extend the MemberDataConnector to
> include filtering.

We use Oracle DSEE for LDAP, so I'm not provisioning the isMemberOf 
attribute with the PSP - the LDAP software generates it automatically as 
an operational attribute.

It sounds like you're on the right track though.

        Andy