Skip to Content.
Sympa Menu

grouper-users - Re: [grouper-users] Composite group problems

Subject: Grouper Users - Open Discussion List

List archive

Re: [grouper-users] Composite group problems

Chronological Thread 
  • From: "Waldbieser, Carl" <>
  • To: Dave Churchley <>
  • Cc: Shilen Patel <>, grouper-users <>
  • Subject: Re: [grouper-users] Composite group problems
  • Date: Mon, 23 Oct 2017 09:03:38 -0400 (EDT)
  • Ironport-phdr: 9a23:6cygrhxWO3goQSTXCy+O+j09IxM/srCxBDY+r6Qd0uoUKPad9pjvdHbS+e9qxAeQG96Ku7Qc06L/iOPJYSQ4+5GPsXQPItRndiQuroEopTEmG9OPEkbhLfTnPGQQFcVGU0J5rTngaRAGUMnxaEfPrXKs8DUcBgvwNRZvJuTyB4Xek9m72/q89pDXYAhEniaxba9vJxiqsAvdsdUbj5F/Iagr0BvJpXVIe+VSxWx2IF+Yggjx6MSt8pN96ipco/0u+dJOXqX8ZKQ4UKdXDC86PGAv5c3krgfMQA2S7XYBSGoWkx5IAw/Y7BHmW5r6ryX3uvZh1CScIMb7Vq4/Vyi84Kh3SR/okCYHOCA/8GHLkcx7kaZXrAu8qxBj34LYZYeYP+d8cKzAZ9MXXWRPUMZPWSJCAIy8YZYBAOUdMuhXronzoEcOoACiBQSuGOzj1iVFimP00KA8zu8vERvG3AslH98WvnjbrM/6NKMPXu+uzanH0y7DYO1M2Tvl9YPFbAouoeuIXb5+bMHczkcuGBnBjlqNsoPlPi2a2fgWvmif9eVgW/igim45pAFtvjig2N0ghZfUiYII013J8zhyzogyJd29UkF7YNikHYNRtyGcK4t5XNkiQ2d2tyYm1LEKo4C0czUXyJg/3x7fcfuHc4+G4hL7U+aRIDF4hG5/dL2jgBay9FCsxfbmWcapyVpGsDFKktzSuXAIzBPc9NKHSuB9/kegwTaDzh7f5fpKIUA1k6rUNoAuwqQpmpYNqkvDAzP2mETyjK+XakUl+u6l4PnkbLX+vpKQKoF5hwXkPqgzlcGyA/40PhUTU2SB5Oix1KDv8VXkTLhEivA6iLTVvZ/YKMgBu6K0AxVZ3pg/5xqjFzuqzdoVkH0dIF5Ydx+KjZLlN0zTLPziEPuyjUqgnTF2zP7cJLLhGI/CLn3bnbfhY7l970lcxRI2zdBD/Z1ZBasNIPbpVU//rtPZDgE2MxCow+n5EtlyyJ4RWX+XDq+YNqPdr0OI6/oyL+SCYIIZoivxJvcn6vL0kHM1hEURcbSp0JcKcHy4G+5pI0SdYXrimNcBFmIKsxIwTePwjF2NTCVcZ3esUK0g/Tw7DJipDYnZSYGtnrOBwDu7EYNMam9YF1+MDG/kd5+YVPcUdCKSPshhnyQLVbi7TI8hyAmuuxHgy7Z+M+rU4TMXtYj41NVu4+3TlAoy9SBvD8iDyW2NTmd0nn8WSD8s2qBwv1B9xkmZ3admnvNYCI8b2/Qcfg4kONb3z/FgAND2VxOJKvuAVlvgadW7GzoxSt8g69kDfE10AMmmg1bK1Gy3AOlGuaaMAcl+zavY03LwKt1w0TKO/6A7ixNuFtRGMWGsh6N03wzaCYfYnlmFmuCneblKj32Fz3uK0Wfb5BIQawV3S6iQGClHPkY=


We noticed this issue in Grouper 2.2 and had a shell script repeatedly run
the Bad Membership Finder and check the output until it didn't find any more

Carl Waldbieser
ITS Systems Programmer
Lafayette College

----- Original Message -----
From: "Dave Churchley"
To: "Shilen Patel"
Cc: "grouper-users"
Sent: Friday, October 20, 2017 10:12:32 AM
Subject: RE: [grouper-users] Composite group problems

Yes, that makes sense. I've now scheduled the Bad Membership Finder Utility
to run each morning, just after the Grouper loader groups are populated.

One more question, if you don't mind, do you know why it took four goes to
fix all the bad memberships this morning? Each time I ran it, it fixed the
majority that it had found, but not all of them.



On Behalf Of Shilen Patel
Sent: 20 October 2017 11:46
To: Dave Churchley

Subject: Re: [grouper-users] Composite group problems

OK cool. The scenario you described is a similar situation where you
probably have two threads running at the same time that deleted and added the
user from/to the groups under Group B. The thread that deleted the user from
the group under B would have thought the user wasn't an effective member of B
anymore and would have deleted the user from A. Meanwhile the thread that
added the user to the group under B would have seen that the user is already
in A (since the other transaction may not have committed yet) and therefore
wouldn't have done anything else. Does that at least explain the issue? We
created the bad membership daemon in 2.3 because of this issue but we may
need to handle it better.


- Shilen

Sent from my Verizon, Samsung Galaxy smartphone

-------- Original message --------
From: Dave Churchley
Date: 10/20/17 1:28 AM (GMT-08:00)
To: Shilen Patel
Subject: RE: [grouper-users] Composite group problems

Thanks again Shilen

The Bad Membership Finder Utility cleaned up 118 bad memberships this
morning. (I had to run it four times though until it found no membership
errors.) I'm sure this utility will be useful to us!

I don't know if you're able to explain why the composite group memberships go
wrong as in the example below?



On Behalf Of Dave Churchley
Sent: 19 October 2017 20:56
To: Shilen Patel
Subject: Re: [grouper-users] Composite group problems

Thanks Shilen, I'll take a look at that in the morning.

For at least one of the problem groups, however, this is definitely not the
issue. Group A is made up of Group B complement Group C. Person X was in B
and not C and so he rightly appeared in A. Two days ago he dropped out of A
but he remained in B and not in C. Those groups' memberships hadn't changed.
We did notice that Group B was built from several Grouper loader groups and
Person X had moved from one of them into another, but this meant that he was
still a member of B.

I hope I've managed to explain that!


From: Shilen Patel
Sent: Thursday, October 19, 2017 6:50:14 PM
To: Dave Churchley
Subject: Re: [grouper-users] Composite group problems

If both factors in the composite are being updated at about the same time for
the same subject, then a membership may be missed. For example, if Group A
is an intersection of Group B and Group C and you add the same person to B
and C at almost the same time, then due to the way the database transactions
work, the composite membership may not be added to Group A. Does that seem
like the problem you're having?

If so, this can be corrected using bad membership finder. You can
automatically run it (e.g. every hour) using a built-in daemon though that's
only available in 2.3. Prior to 2.3, it can be run manually.<>

- Shilen

On 10/19/17, 11:56 AM,
on behalf of Dave

on behalf of

Good afternoon

We've been using composite groups for a few years now, mainly using the
complement operation with exclusion groups. Since the summer, we've also had
a few intersection groups.

We've not noticed any problems with group memberships until a couple of
weeks ago. (That's not to say there definitely weren't any issues, but there
certainly was not a noticeable impact.) At first it was just with the
intersection groups but today we've seen it with a complement group, too.

It looks like the composite isn't calculating its membership correctly.
Editing the composite and resaving it forces it to recalculate the
membership. We've been using this as a workaround but it's obviously not
ideal. Some of these composite groups are critical to access control for
various systems across the University, including physical access into

Is this a known issue? Is there anything we can do about it? We're
running Grouper v2.2.2. Is there a patch or a better workaround?

Any help would be greatly appreciated as this is a big issue for us at
the moment.

Thanks in advance.

Dave Churchley
Newcastle University

Archive powered by MHonArc 2.6.19.

Top of Page