grouper-users - Re: [grouper-users] PSPNG creates group in AD with random samaccountname

Subject: Grouper Users - Open Discussion List

List archive

Re: [grouper-users] PSPNG creates group in AD with random samaccountname

From: "Bee-Lindgren, Bert A" <>
To: "Sawyer, Mona Zarei" <>, "" <>
Cc: "Coleman, Erik C" <>, "" <>
Subject: Re: [grouper-users] PSPNG creates group in AD with random samaccountname
Date: Mon, 23 Oct 2017 17:36:55 +0000
Accept-language: en-US
Authentication-results: spf=none (sender IP is ) ;
Ironport-phdr: 9a23:VNbJhxepOZrZ0zJnT25c3/QwlGMj4u6mDksu8pMizoh2WeGdxc24ZhSN2/xhgRfzUJnB7Loc0qyN4vCmATRIyK3CmUhKSIZLWR4BhJdetC0bK+nBN3fGKuX3ZTcxBsVIWQwt1Xi6NU9IBJS2PAWK8TW94jEIBxrwKxd+KPjrFY7OlcS30P2594HObwlSijewZbB/IA+qoQnNq8IbnZZsJqEtxxXTv3BGYf5WxWRmJVKSmxbz+MK994N9/ipTpvws6ddOXb31cKokQ7NYCi8mM30u683wqRbDVwqP6WACXWgQjxFFHhLK7BD+Xpf2ryv6qu9w0zSUMMHqUbw5Xymp4rx1QxH0ligIKz858HnWisNuiqJbvAmhrAF7z4LNfY2ZKOZycqbbcNgHR2ROQ9xRWjRBDI2icoUPE+QPM+VWr4b/plsBsRSxCBK2BO/z1jNFnGP60bE63uknDArI3BYgH9ULsHnMotn4KbkdXv6swKfOzDXDae5Z2Tjn6IfWdBAtueyHUK9ufsrL1UkkCh/IgluNooHiJDyayP4Ns3SB4+V7S+2glXcrqwVwojip28gshZPJiZwTyl3f8iV5wZo1Kce3SEFhfd6rDodftyGAO4RoX8wiXnhltSAnwbMIvp67eTIFyJUhxxPHbPyHbpSI4hbkVOaWIjd0nmhpd664hxa36USgxer8Vs670FZOsCVJiMXDtncI1xDL9siHSuF98Vm71jmSzQzT8PxEIUYsmarUMZ4hxaMwloIJvUTFBCD2nVv5gLeRdkU55uio7+PnYrLlppOGK4B0jQT+Prwqmsy4DuQ4PRYBX3KB9euiybLj4Ev0S6hJgP0uiqTVrorVKdgGqqO8HgNZz5sv5hOxDzqpzNgUgXwKLFxbdx+IjIXkPlTDLfLmAfijm1igjjZmy+3aMrDkH5nAIXvOnbL8cbZz90JQ1g8+wc1R6p5IF70MJfz+VlH+udHbCxI0Mw65zubnBdh42Y4TW22CDrKcPa/Pv1+E+OwiLu+Rb4EPojn9MeIq5/v2gH85h1Adea6p0IMPZn2kGfpqP0uUbWPyj9kYDGsGpw0+Q/f0h1GYVj5TemqyULk75jEmDoKpEJ3PRpi3gLyGwCe0AIFZZnxHClCLF3fkbYKEW+oQaCKWJc9hlT8EWaK9RI8m0BGirA76y7x5IerI4iAUq4js2MRo6+DWiB0+6CF4AsGT02yCU214gmYFRzEo061wokFwz1KO3Kpmj/NEDdBT4ulGUgY+NZ7S1ex6DNXyVxracdiXUlamXs+qDiovQd0v2tMOZ0d9G9O/gRDMxSqlHbkVmqeMBJw17qLQxXfxKNxhy3nYyKYhj0MqTdVSOm27nqJ/7RTcB5bVk0WFkKanbasc3DTK9Gee1WqBoltYXBdtUaXeQ38ffFDWoM/95kPDVL+uFa8nPhVbxc6DLKtKdsPmjU9ARPj9JNTSfXi9lHmtChaVlfuwa9+gQGwCzSjHTAAhlAYatUSPLwU/TG/1pmXYBS5GEFPmZkKq/OVj/jfzBE0pywCNR0twyvy49gNfzaieVvcS2ZoCqTpnpjlpSgWTxdXTXpCqqgckWKRabdwn7VEDnUjUrRA1F9boe6pvnEJYeQl6+kfv0Rl4EIhGuc8rsDUlxRZ/IqLe3V9cIWDLlavsM6HafzGhtCukbLTbjxSHiI6b
Spamdiagnosticmetadata: NSPM
Spamdiagnosticoutput: 1:99

Maybe some whitespace issues?

Remove the space before the ||

dn:cn=${ grouperUtil.extensionFromName(group.name) } ||

Add a space after the colon:

samAccountName:${grouperUtil.extensionFromName(name)}

If one or both of these help, please create a jira so we can make the configuration more resilient.

Thanks,

Bert

From: <> on behalf of Sawyer, Mona Zarei <>
Sent: Monday, October 23, 2017 12:37 PM
To:
Cc: Coleman, Erik C;
Subject: RE: [grouper-users] PSPNG creates group in AD with random samaccountname

Ii made the change, but got the same error: groupCreationLdifTemplate = dn:cn=${ grouperUtil.extensionFromName(group.name) } ||objectclass: group ||samAccountName:${grouperUtil.extensionFromName(name)}

2017-10-23 12:33:29,055: [pspng_activedirectory-FullSync-Thread] DEBUG Provisioner.evaluateJexlExpression(538) - - Evaluated Jexl _expression_: testsamacc FROM ${ grouperUtil.extensionFromName(group.name) } WITH variables {idIndex=10183, userSearchBaseDn=CN=Users,DC=cgcent,DC=miami,DC=edu, groupAttributes={etc:pspng:provision_to=[pspng_activedirectory]}, groupCreationBaseDn=CN=Users,DC=cgcent,DC=miami,DC=edu, stemAttributes={}, utils=edu.internet2.middleware.grouper.pspng.PspJexlUtils@3149a59d, groupSearchBaseDn=CN=Users,DC=cgcent,DC=miami,DC=edu, name=UM_External_Groups:testsamacc, provisionerName=pspng_activedirectory, group=Group[name=UM_External_Groups:testsamacc,uuid=48c65309d6934eaca8143a2dbf97a436], provisionerType=LdapGroupProvisioner}

2017-10-23 12:33:29,056: [pspng_activedirectory-FullSync-Thread] DEBUG LdapGroupProvisioner.fetchTargetSystemGroups(388) - - pspng_activedirectory: Searching for 1 groups with:: (|(&(objectclass=group)(cn=testsamacc)))

2017-10-23 12:33:29,056: [pspng_activedirectory-FullSync-Thread] DEBUG LdapSystem.performLdapSearchRequest(424) - - Doing ldap search: [org.ldaptive.SearchFilter@-2105838738::filter=(|(&(objectclass=group)(cn=testsamacc))), parameters={}] / CN=Users,DC=cgcent,DC=miami,DC=edu / [cn, gidNumber, samAccountName, objectclass, member]

2017-10-23 12:33:29,057: [pspng_activedirectory-FullSync-Thread] DEBUG LdapSystem.performLdapSearchRequest(434) - - Using attribute-value paging

2017-10-23 12:33:29,057: [pspng_activedirectory-FullSync-Thread] DEBUG LdapSystem.performLdapSearchRequest(443) - - Using ldap search-result paging

2017-10-23 12:33:29,059: [pspng_activedirectory-FullSync-Thread] DEBUG LdapGroupProvisioner.fetchTargetSystemGroups(402) - - pspng_activedirectory: Group search returned 0 groups

2017-10-23 12:33:29,082: [pspng_activedirectory-FullSync-Thread] DEBUG Provisioner.evaluateJexlExpression(538) - - Evaluated Jexl _expression_: testsamacc FROM ${ grouperUtil.extensionFromName(group.name) } WITH variables {idIndex=10183, userSearchBaseDn=CN=Users,DC=cgcent,DC=miami,DC=edu, groupAttributes={etc:pspng:provision_to=[pspng_activedirectory]}, groupCreationBaseDn=CN=Users,DC=cgcent,DC=miami,DC=edu, stemAttributes={}, utils=edu.internet2.middleware.grouper.pspng.PspJexlUtils@3efd0ac2, groupSearchBaseDn=CN=Users,DC=cgcent,DC=miami,DC=edu, name=UM_External_Groups:testsamacc, provisionerName=pspng_activedirectory, group=Group[name=UM_External_Groups:testsamacc,uuid=48c65309d6934eaca8143a2dbf97a436], provisionerType=LdapGroupProvisioner}

2017-10-23 12:33:29,105: [pspng_activedirectory-FullSync-Thread] DEBUG Provisioner.evaluateJexlExpression(538) - - Evaluated Jexl _expression_: true FROM ${utils.containedWithin(provisionerName, stemAttributes['etc:pspng:provision_to'], groupAttributes['etc:pspng:provision_to']) && !utils.containedWithin(provisionerName, stemAttributes['etc:pspng:do_not_provision_to'], groupAttributes['etc:pspng:do_not_provision_to'])} WITH variables {idIndex=10183, userSearchBaseDn=CN=Users,DC=cgcent,DC=miami,DC=edu, groupAttributes={etc:pspng:provision_to=[pspng_activedirectory]}, groupCreationBaseDn=CN=Users,DC=cgcent,DC=miami,DC=edu, stemAttributes={}, utils=edu.internet2.middleware.grouper.pspng.PspJexlUtils@343ad075, groupSearchBaseDn=CN=Users,DC=cgcent,DC=miami,DC=edu, name=UM_External_Groups:testsamacc, provisionerName=pspng_activedirectory, group=Group[name=UM_External_Groups:testsamacc,uuid=48c65309d6934eaca8143a2dbf97a436], provisionerType=LdapGroupProvisioner}

2017-10-23 12:33:29,105: [pspng_activedirectory-FullSync-Thread] DEBUG Provisioner.shouldGroupBeProvisioned(1318) - - pspng_activedirectory: Group UM_External_Groups:testsamacc matches group-selection filter.

2017-10-23 12:33:29,105: [pspng_activedirectory-FullSync-Thread] INFO LdapGroupProvisioner.createGroup(299) - - Creating LDAP group for GrouperGroup: UM_External_Groups:testsamacc

2017-10-23 12:33:29,129: [pspng_activedirectory-FullSync-Thread] DEBUG Provisioner.evaluateJexlExpression(538) - - Evaluated Jexl _expression_: testsamacc FROM ${ grouperUtil.extensionFromName(group.name) } WITH variables {idIndex=10183, userSearchBaseDn=CN=Users,DC=cgcent,DC=miami,DC=edu, groupAttributes={etc:pspng:provision_to=[pspng_activedirectory]}, groupCreationBaseDn=CN=Users,DC=cgcent,DC=miami,DC=edu, stemAttributes={}, utils=edu.internet2.middleware.grouper.pspng.PspJexlUtils@56608c0, groupSearchBaseDn=CN=Users,DC=cgcent,DC=miami,DC=edu, name=UM_External_Groups:testsamacc, provisionerName=pspng_activedirectory, group=Group[name=UM_External_Groups:testsamacc,uuid=48c65309d6934eaca8143a2dbf97a436], provisionerType=LdapGroupProvisioner}

2017-10-23 12:33:29,129: [pspng_activedirectory-FullSync-Thread] DEBUG Provisioner.evaluateJexlExpression(538) - - Evaluated Jexl _expression_: testsamacc FROM ${grouperUtil.extensionFromName(name)} WITH variables {idIndex=10183, userSearchBaseDn=CN=Users,DC=cgcent,DC=miami,DC=edu, groupAttributes={etc:pspng:provision_to=[pspng_activedirectory]}, groupCreationBaseDn=CN=Users,DC=cgcent,DC=miami,DC=edu, stemAttributes={}, utils=edu.internet2.middleware.grouper.pspng.PspJexlUtils@56608c0, groupSearchBaseDn=CN=Users,DC=cgcent,DC=miami,DC=edu, name=UM_External_Groups:testsamacc, provisionerName=pspng_activedirectory, group=Group[name=UM_External_Groups:testsamacc,uuid=48c65309d6934eaca8143a2dbf97a436], provisionerType=LdapGroupProvisioner}

2017-10-23 12:33:29,131: [pspng_activedirectory-FullSync-Thread] DEBUG LdapGroupProvisioner.createGroup(329) - - pspng_activedirectory: LDIF for new group (with partial DN): dn:cn=testsamacc ||objectclass: group ||samAccountName:testsamacc

2017-10-23 12:33:29,131: [pspng_activedirectory-FullSync-Thread] DEBUG LdapGroupProvisioner.createGroup(338) - - pspng_activedirectory: Adding group: [dn=cn=testsamacc ,CN=Users,DC=cgcent,DC=miami,DC=edu[[samAccountName[testsamacc]], [objectclass[group ]]]]

2017-10-23 12:33:29,131: [pspng_activedirectory-FullSync-Thread] INFO LdapProvisioner.performLdapAdd(722) - - pspng_activedirectory: Creating LDAP object: cn=testsamacc ,CN=Users,DC=cgcent,DC=miami,DC=edu

2017-10-23 12:33:29,132: [pspng_activedirectory-FullSync-Thread] INFO LdapSystem.performLdapAdd(329) - - umldap: Creating LDAP object: cn=testsamacc ,CN=Users,DC=cgcent,DC=miami,DC=edu

2017-10-23 12:33:29,134: [pspng_activedirectory-FullSync-Thread] ERROR LdapSystem.performLdapAdd(337) - - Problem while creating new ldap object: [dn=cn=testsamacc ,CN=Users,DC=cgcent,DC=miami,DC=edu[[samAccountName[testsamacc]], [objectclass[group ]]]]

[org.ldaptive.LdapException@1841854468::resultCode=NO_SUCH_ATTRIBUTE, matchedDn=null, responseControls=null, referralURLs=null, messageId=-1, message=javax.naming.directory.NoSuchAttributeException: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C090DB1, comment: Error in attribute conversion operation, data 0, v2580 ]; remaining name 'cn=testsamacc ,CN=Users,DC=cgcent,DC=miami,DC=edu', providerException=javax.naming.directory.NoSuchAttributeException: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C090DB1, comment: Error in attribute conversion operation, data 0, v2580 ]; remaining name 'cn=testsamacc ,CN=Users,DC=cgcent,DC=miami,DC=edu']

at org.ldaptive.provider.ProviderUtils.throwOperationException(ProviderUtils.java:55)

at org.ldaptive.provider.jndi.JndiConnection.processNamingException(JndiConnection.java:619)

at org.ldaptive.provider.jndi.JndiConnection.add(JndiConnection.java:326)

at edu.internet2.middleware.grouper.pspng.LdapSystem.performLdapAdd(LdapSystem.java:335)

at edu.internet2.middleware.grouper.pspng.LdapProvisioner.performLdapAdd(LdapProvisioner.java:725)

at edu.internet2.middleware.grouper.pspng.LdapGroupProvisioner.createGroup(LdapGroupProvisioner.java:340)

at edu.internet2.middleware.grouper.pspng.LdapGroupProvisioner.createGroup(LdapGroupProvisioner.java:47)

at edu.internet2.middleware.grouper.pspng.Provisioner.prepareGroupCache(Provisioner.java:749)

at edu.internet2.middleware.grouper.pspng.Provisioner.startProvisioningBatch(Provisioner.java:475)

at edu.internet2.middleware.grouper.pspng.FullSyncProvisioner.processGroup(FullSyncProvisioner.java:598)

at edu.internet2.middleware.grouper.pspng.FullSyncProvisioner.thread_manageFullSyncProcessing(FullSyncProvisioner.java:256)

at edu.internet2.middleware.grouper.pspng.FullSyncProvisioner$1.run(FullSyncProvisioner.java:188)

at java.lang.Thread.run(Thread.java:745)

Caused by: javax.naming.directory.NoSuchAttributeException: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C090DB1, comment: Error in attribute conversion operation, data 0, v2580 ]; remaining name 'cn=testsamacc ,CN=Users,DC=cgcent,DC=miami,DC=edu'

at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3110)

at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3035)

at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2841)

at com.sun.jndi.ldap.LdapCtx.c_createSubcontext(LdapCtx.java:812)

at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_createSubcontext(ComponentDirContext.java:337)

at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.createSubcontext(PartialCompositeDirContext.java:266)

at org.ldaptive.provider.jndi.JndiConnection.add(JndiConnection.java:315)

... 10 more

2017-10-23 12:33:29,135: [pspng_activedirectory-FullSync-Thread] ERROR LdapGroupProvisioner.createGroup(346) - - Problem while creating new group: dn:cn=testsamacc

objectclass: group

samAccountName:testsamacc

edu.internet2.middleware.grouper.pspng.PspException: LDAP problem creating object: javax.naming.directory.NoSuchAttributeException: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C090DB1, comment: Error in attribute conversion operation, data 0, v2580 ]; remaining name 'cn=testsamacc ,CN=Users,DC=cgcent,DC=miami,DC=edu'

at edu.internet2.middleware.grouper.pspng.LdapSystem.performLdapAdd(LdapSystem.java:338)