Grouper Users - Open Discussion List

["Bee-Lindgren, Bert" <>]

Jeffrey,

In order to isolate the issue to the dual-daemon setup, is it possible to test your AD Config in a "normal," single daemon?

Thanks,

  Bert

---

From: Jeffrey Crawford <>
Sent: Wednesday, March 22, 2017 2:52 PM
To: Bee-Lindgren, Bert
Cc: Gouper Users List
Subject: Re: [grouper-users] Re: PSP (Original) Provisioning to LDAP and AD woes

 

This combination seems to be dependent on the order in which the daemons start which is weird. However I'm getting stuck on one thing where my AD config seems to no longer allow a psp full sync, it just hangs with no log output. Anybody have a tip on what may be wrong, which would not even allow logging to start? I know I had this working before but it's been a while since I touched this.

Sorry for the lack of info but no log output makes it hard to pinpoint.

Jeffrey E. Crawford
Enterprise Service Team

Both pilots and IT professionals require training and currency before charging into clouds!

---------------------------------------

On Tue, Mar 21, 2017 at 12:34 PM, Jeffrey Crawford <> wrote:

Thanks Bert,

I haven't tried the combination of what you suggested yet. I think the loader running twice is probably not the end of the world as long as it doesn't corrupt the data.

once PSPNG is working the way we need it, then we can have a party abandoning all this :)

Jeffrey E. Crawford
Enterprise Service Team

Both pilots and IT professionals require training and currency before charging into clouds!

---------------------------------------

On Tue, Mar 21, 2017 at 4:46 AM, Bee-Lindgren, Bert <> wrote:

Jeffrey,

While I've asked Shilen and Chris to verify my theory, I thought I'd sketch it out here before they have a chance so it's not further delayed by my training this week....

I think your two daemons don't have enough information nor enough separation to work together properly. I think you need you need to set up your grouper daemons as follows:

1) The "Main" daemon

-Runs the default jobs (change_log_temp to changelog, loaders, etc)

-Has changelog.consumer entries for _all_ the changelog listeners (including pspad)

-Has the pspad changelog listener disabled, perhaps with a blank schedule or with a schedule that specifies year=2010

-Runs the default psp that you've been using

2) The "PSP-AD" daemon

-Disables the default jobs, probably with changeLog.changeLogTempToChangeLog.enable = false and perhaps other properties

-I don't know how to disable this daemon from becoming a loader-job node
-Has the changelog.consumer entry for pspad as well as an active quartz schedule for it.

Hoping this helps,

  Bert

---

From: <> on behalf of Jeffrey Crawford <>
Sent: Monday, March 20, 2017 1:05 PM
To: Gouper Users List
Subject: [grouper-users] Re: PSP (Original) Provisioning to LDAP and AD woes

 

bump :)

Jeffrey E. Crawford
Enterprise Service Team

Both pilots and IT professionals require training and currency before charging into clouds!

---------------------------------------

On Fri, Mar 17, 2017 at 12:38 PM, Jeffrey Crawford <> wrote:

I'll try and keep this as simple as possible. We are not yet ready to move to PSPNG but we have an active project of provisioning groups to AD and have an existing provisioner to a couple of LDAP instances.

The LDAP servers use the same DN naming convention so we are able to split up the servers based on the multiple ldap psp-example. Now however we need to provision groups to AD which has a different DN. The following are the things I've tried:

running a second daemon that shows the sources.xml as being the AD server, however it seems like the daemon that hits the changelog first wins even if one had a different name for the psp changelog string:

grouper-loader.properties (LDAP)

changeLog.consumer.pspidm.class = edu.internet2.middleware.psp.grouper.PspChangeLogConsumer

grouper-loader.prperties (AD)

changeLog.consumer.pspad.class = edu.internet2.middleware.psp.grouper.PspChangeLogConsumer

I tried using a different source id in sources.xml but then you would have to update groups twice one from each source or provisioners based on the AD source would be blank

Is there some method I'm missing here?

Jeffrey E. Crawford
Enterprise Service Team

Both pilots and IT professionals require training and currency before charging into clouds!

---------------------------------------