Skip to Content.
Sympa Menu

grouper-users - RE: [grouper-users] SQL Loader Groups Membership Persistence

Subject: Grouper Users - Open Discussion List

List archive

RE: [grouper-users] SQL Loader Groups Membership Persistence

Chronological Thread 
  • From: "Hyzer, Chris" <>
  • To: Stephen A Sazama <>
  • Cc: Dave Churchley <>, "" <>
  • Subject: RE: [grouper-users] SQL Loader Groups Membership Persistence
  • Date: Thu, 2 Mar 2017 19:28:09 +0000
  • Accept-language: en-US
  • Authentication-results:; dkim=none (message not signed) header.d=none;; dmarc=none action=none;
  • Ironport-phdr: 9a23:e+OnhxSqBzl529qCZzvuq1N8aNpsv+yvbD5Q0YIujvd0So/mwa6zZRCN2/xhgRfzUJnB7Loc0qyN4v2mAjZLuMza+Fk5M7V0HycfjssXmwFySOWkMmbcaMDQUiohAc5ZX0Vk9XzoeWJcGcL5ekGA6ibqtW1aFRrwLxd6KfroEYDOkcu3y/qy+5rOaAlUmTaxe71/IRG2oAnLuMQan4RuJrsvxhbHv3BFZ/lYyWR0KFyJgh3y/N2w/Jlt8yRRv/Iu6ctNWrjkcqo7ULJVEi0oP3g668P3uxbDSxCP5mYHXWUNjhVIGQnF4wrkUZr3ryD3q/By2CiePc3xULA0RTGv5LplRRP0lCsKMSMy/XrJgcJskq1UvBOhpwR+w4HKZoGVKOF+db7Zcd8DWGZNQtpdWylHD4ihbYUAEvABMP5YoYfjulUOsRWwCwqiBOztyz9HmnD50LYg3Og9DQ3LxhAsE84MvXnSsd77NL0SUeewzKTQwznNbfNX2Dbj54jSahwqvO+BXbJqccrQ0kkjGR7Og1KVqYP5PzOU1uUMvHaB7+d7VOKvkHIopxtsoji32MgsjI/JipgLxV/Z6CV02YA4LsC7Rk5jedOoDoFfuz2HO4ZzX88uXnxktSM0yrAJpZK3YC0HxZY5yBPQdfCKdo2F7gz/WOuSOTt0mXxodK6lixu27ESs0PPwWtSw3VpQsyZIkNjBu3YQ3BLJ8MeHUOFy/kK51DaPyQ/T7uZELFgsm6fHLJAt3qM8moMOvEvBACP6gUL2g7SIeUk+/eio9vjnba7hpp+BMY97lxvyMrw0msy4HeQ3LBQBX3Sa+eS70r3v50r5QKhWjv0ylanZt5PaKd4Hqa6+Bg9Zyocj6xChADe6yNkUg2MIIE5YdB+CkoTlJkzCLfX2Dfqwn1igjDJmyvLYMbDuHJnAK33OnKn9cbt+80JczRA8zdFb55JaELEBJ/fzV1f0tNPEDh84Mw21zPj9CNhm14MeQn6ADrWEMKPKr1CI4OQvL/OSa4AIpTbxM+Il6OL2jX8lhV8derGk3ZQNaHC/A/RmO1uWYWD1jtccCmcFoBA+TPfxhV2GUD5TfGqyX7ki6j0hCYKmC5vDSZ63gLyHwii7AoNaanpYBV+RDHe7P7mDDswQZTqSL8kpu3Q/XKqoToZpgQq1vR3zzrNPM+/YvCAUqMSw+sJy4riZtQAg+CYwR++dyWCWBSkgm2gIVi07xoh+ukc710+O164+jvBFQ48Ar8hVWxs3YMaPh9dxDMr/D0eYJo+E
  • Spamdiagnosticmetadata: NSPM
  • Spamdiagnosticoutput: 1:99

Yes, I wonder if there is a UI feature we could add in there where if you mark a folder as hierarchical it could help display the hierarchy.  Does that spark any ideas about what you would like?





From: Stephen A Sazama [mailto:]
Sent: Thursday, March 02, 2017 2:26 PM
To: Hyzer, Chris <>
Cc: Dave Churchley <>;
Subject: Re: [grouper-users] SQL Loader Groups Membership Persistence


Thanks for the update! I think I got it. The only downside would be that you don't have the nice hierarchical representation of orgs in the folder browser. If someone wanted to find the parent of an org group (assuming it's not obvious from the code or name) they need to view its memberships in other groups, right?




On Thu, Mar 2, 2017 at 1:21 PM, Hyzer, Chris <> wrote:

To explain another way:




There are groups:








These have the hierarchy:


penn:community:orgs:SOMETHING   has a member    penn:community:orgs:4972

penn:community:orgs:IT has a member  penn:community:orgs:SOMETHING (direct) and penn:community:orgs:4972  (indirect)


So as things get reorganized, a lot of the cases will not affect applications.






From: Stephen A Sazama [mailto:]
Sent: Thursday, March 02, 2017 11:43 AM
To: Hyzer, Chris <>
Cc: Dave Churchley <>;
Subject: Re: [grouper-users] SQL Loader Groups Membership Persistence


Thanks for the suggestions. Both of these look promising for helping our situation.


Chris, are you saying you got rid of the hierarchy-related folders entirely? What you said about using the code instead definitely makes sense (right now, we're using the org full name as the group ID, should change that to org code), but how is the hierarchical relationship maintained if you change penn:community:orgs:TOPU:OTHERPLACE:IT:SOMETHING:4972 to penn:community:orgs:4972? Is the fact that 4972 exists under SOMETHING still stored somewhere?





On Thu, Mar 2, 2017 at 10:24 AM, Hyzer, Chris <> wrote:

We had out groups setup in hierarchical folders.




Then IT moved to something else, which changed to:




this messed up a lot of things.


So we changed so that orgs are now:




Now if it is moved, then we are all good.  If it is renamed to a different org number, then the problem you describe will happen.  We only put the code in the group system name (well, its actually a folder and a group name).  So if an org is renamed to a different name, still good.  Only if the org code changes (which hopefully is rare) will there be problems.





From: [mailto:] On Behalf Of Dave Churchley
Sent: Thursday, March 02, 2017 3:48 AM
To: Stephen A Sazama <>;
Subject: RE: [grouper-users] SQL Loader Groups Membership Persistence


This scenario bit us a few years ago. Just as you describe, new groups were created, groups with the old names were deleted and, as a result, people lost access to resources. (This was before I was working with Grouper myself so some of the details might be a bit sketchy.)


We’ve now got it set up so that new groups are created but the old groups are not deleted so, in effect, we have two groups of the same set of people, one with the old name and one with the new name. At that point the membership of the old group becomes static (the loader ignores it) so any resources relying on that group are still available to the right people initially but over time, as people should join or leave the group, the membership becomes wrong. We then need a manual process to associate the resources with the new groups instead of the old groups and manually delete the old groups when they are no longer needed.


If anyone has a better way of handling this, I’d be very interested!




From: [] On Behalf Of Stephen A Sazama
Sent: 01 March 2017 21:04
Subject: [grouper-users] SQL Loader Groups Membership Persistence


Hi All,


We have an Org Hierarchy of groups generated by SQL Loaders, similar to the Penn structure described on the wiki. A big concern for us right now is what happens when one of those organizational units gets renamed in the source database. When the loader runs again, a new group would be created and the one with the old name would get deleted along with all of its memberships in other roles/groups. Grouper has no way of knowing that a rename happened.


Have others faced this problem and found any good solutions?



Stephen Sazama

University of Maryland, College Park



Archive powered by MHonArc 2.6.19.

Top of Page