Grouper Users - Open Discussion List

[Pascal Rigaux <>]

On 30/06/2017 23:22, Andrew Morgan wrote:
> On Fri, 30 Jun 2017, Jeffrey Crawford wrote:
>
> > Luckly we haven't gone too far using posix groups, but we've had at least
> > one system bark with posix names containing ':' in them. Is there a simple
> > way to have the psp create cn with something like '.' or '_' as a delimiter
> > as opposed to ':'? I know I could make a script but I was hoping there was
> > an easier way.

Hi, for the record we had the same issue (for our NAS) and we did something 
very similar:

--- a/conf/psp-resolver.xml
+++ b/conf/psp-resolver.xml
@@ -518,11 +518,11 @@
     <resolver:Dependency ref="groupNameInStem" />
   </resolver:AttributeDefinition>

-  <!-- The value of the "groupNameInStem" attribute is the name of the group 
of a change log entry. The name of the group
+  <!-- The value of the "groupNameInStemRaw" attribute is the name of the 
group of a change log entry. The name of the group
     is returned only if the group is a child of the stem whose name is the 
edu.internet2.middleware.psp.baseStem property. If
     the edu.internet2.middleware.psp.baseStem property is the root stem, groups under the 
"etc" stem are omitted. -->
   <resolver:AttributeDefinition
-    id="groupNameInStem"
+    id="groupNameInStemRaw"
     xsi:type="grouper:FilteredName"
     sourceAttributeID="name">
     <!-- Dependencies which return a "name" attribute whose value is the group 
name. -->
@@ -545,6 +545,26 @@
     </grouper:Filter>
   </resolver:AttributeDefinition>

+  <resolver:AttributeDefinition
+    id="groupNameInStem"
+    sourceAttributeID="groupNameInStemRaw"
+    xsi:type="ad:Script">
+    <resolver:Dependency ref="groupNameInStemRaw" />
+    <ad:Script><![CDATA[
+        // Import Shibboleth attribute provider.
+        
importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);
+
+        // Create the attribute to be returned.
+        groupNameInStem = new BasicAttribute("groupNameInStem");
+       if (!groupNameInStemRaw.getValues().isEmpty()) {
+            
groupNameInStem.getValues().add(groupNameInStemRaw.getValues().get(0).replace(":", 
"."));
+       }
+    ]]></ad:Script>
+  </resolver:AttributeDefinition>
+
+
   <!-- The alternate LDAP DN of a group. For example, the DN of a group before 
it is renamed. -->
   <resolver:AttributeDefinition
     id="groupDnAlternate"