Grouper Users - Open Discussion List

[Paul Engle <>]

Not quite what I'm shooting for. The value I'm wanting is a grouper
attribute, defined on a group. Take that value and provision it as an
LDAP attribute value for the members' entries. Sort of like isMemberOf
is done in the examples, but using something other than the group name.
(Specifically, this is all for trying to handle eduPersonEntitlement.)

I think I have it worked out. I didn't know I could just use plain ol'
java calls inside the expression language. So this worked:

changeLog.consumer.pspng_attributes_entitlement.class =
edu.internet2.middleware.grouper.pspng.PspChangelogConsumerShim
changeLog.consumer.pspng_attributes_entitlement.type =
edu.internet2.middleware.grouper.pspng.LdapAttributeProvisioner
...
changeLog.consumer.pspng_attributes_entitlement.provisionedAttributeName
= eduPersonEntitlement
changeLog.consumer.pspng_attributes_entitlement.provisionedAttributeValueFormat
=
${group.getAttributeValueDelegate().retrieveValueString('etc:attribute:eduperson:entitlement')}


That is successfully grabbing the value and putting it where I want.

I never had it working the way I really wanted it to in the psp, but it
looked like it should be easy enough to do in pspng. And it is!

Kudos to Bert on all the work put into this. So far, I'm really liking
the pspng.

  -paul


On 2/16/2017 2:21 PM, Michael R Gettes wrote:
> Have tried something like ${ldapUser.getStringValue(“ATTRNAME”)} where
> ATTRNAME is the name of the LDAP attribute?  Make sure ATTRNAME is also
> in the userSearchAttrbiutes list.  I haven’t tested this yet but based on 
> some
> other stuff done I think this should work.  You could do 
> ou=${ldapUser.getStringValue(“ATTRNAME”)}
> I’d be interested in your results.
> 
> /mrg
> 
>> On Feb 16, 2017, at 11:34 AM, Paul Engle 
>> <>
>>  wrote:
>>
>> All,
>>
>> I'm finally making some headway on trying to port our provisioning from
>> psp to pspng in preparation for the move to 2.3.0. I've got a pretty
>> good feel for how things work in the new config, but I'm hitting a wall.
>>
>> The scenario: We have groups with user-defined attributes on them. What
>> I would like is to have the value of that attribute be populated as an
>> LDAP attribute on the members' LDAP entries. But I'm having trouble
>> figuring out the magic to use for the provisionedAttributeValueFormat
>> property that will access a user-defined group attribute instead of the
>> built-ins, like ${group.name}. Has anyone done anything similar and can
>> offer any pointers?
>>
>>  -paul
>>
>> -- 
>> Paul Engle
>> Office of Information Technology
>> 
>> 713-348-4702
> 
> 

-- 
Paul Engle
Office of Information Technology

713-348-4702