Grouper Users - Open Discussion List

[Pregash J Devasagayam <>]

Hi Bert,

 

Thank you for the response.  We could use a more detailed explanation. Or could you send us an example?

 

Thanks again.

 

-Pregash

 

From: Bee-Lindgren, Bert [mailto:]
Sent: Friday, March 24, 2017 1:40 PM
To: Pregash J Devasagayam <>
Cc:
Subject: Re: [grouper-users] Prevent PSPNG from provision include/exclude/sor to AD

 

Hello,

 

Here is a quick answer; I can write a more complete one later if necessary. 

 

The answer is to define override the group selection _expression_ with a copy/paste of the default _expression_ with clauses added that compare names (or a custom attribute) to the patterns you don't want. 

 

Again, I'll provide an exact _expression_ when I'm at a computer. 

 

--Bert

On Mar 24, 2017, at 11:58 AM, Pregash J Devasagayam <> wrote:

Hi all,

 

We had thought we had seen a configuration setting that prevented groups with certain suffixes from being provisioned to a resource in the past, but can’t seem to find it now.  We are using the include/exclude group type on a number of groups, and we are in the middle of transitioning from our own in-house group provisioning logic to using pspng for our Active Directory.  In our testing we see that the _includes, _excludes, _systemOfRecord, and the _systemOfRecordAndIncludes groups all get provisioned to the active directory along with the final composite group.  We just want the final composite group to be provisioned and anything with those suffixes to be ignored. 

 

Any ideas?

 

Thanks,

 

Pregash Devasagayam

OIT Identity and Access Management

University of Colorado Boulder