Skip to Content.
Sympa Menu

grouper-users - Re: [grouper-users] Re: Bushy PSPNG to AD provisioning question

Subject: Grouper Users - Open Discussion List

List archive

Re: [grouper-users] Re: Bushy PSPNG to AD provisioning question

Chronological Thread 
  • From: "Bee-Lindgren, Bert" <>
  • To: Jeffrey Williams <>, "" <>
  • Subject: Re: [grouper-users] Re: Bushy PSPNG to AD provisioning question
  • Date: Wed, 29 Nov 2017 19:06:23 +0000
  • Accept-language: en-US
  • Authentication-results: spf=none (sender IP is ) ;
  • Ironport-phdr: 9a23:WjUJLxY7d173qPxMQEgjn8D/LSx+4OfEezUN459isYplN5qZpsy5ZB7h7PlgxGXEQZ/co6odzbGH4+a4ASQp2tWoiDg6aptCVhsI2409vjcLJ4q7M3D9N+PgdCcgHc5PBxdP9nC/NlVJSo6lPwWB6nK94iQPFRrhKAF7Ovr6GpLIj8Swyuu+54Dfbx9GiTe5Yr5+Ngm6oRnMvcQKnIVuLbo8xAHUqXVSYeRWwm1oJVOXnxni48q74YBu/SdNtf8/7sBMSar1cbg2QrxeFzQmLns65Nb3uhnZTAuA/WUTX2MLmRdVGQfF7RX6XpDssivms+d2xSeXMdHqQb0yRD+v9LlgRgP2hygbNj456GDXhdJ2jKJHuxKquhhzz5fJbI2JKPZye6XQds4YS2VcRMZcTyxPDJ2hYYsTAeQPPuhYoIv8p1QSohSzHhOjCP/qyjJSmnP6wa833uI8Gg/GxgwgGNcOvWzaoNjoKqgdT/m5wq/JzTXFcvxW1i3955bOchw5vPqBQKx/cdDNyUUhCgjIiU6fppL/PzOJzOgCqHaU4PR5WeKrim4nrRx+oje1xsgyjInEnYUVylHY9Sljz4Y6P8G4R1Bnbt6kCpdfqTyVN5ZvT84kXmpmtiE6yrgctp66eigH0JsnxwTYa/yaa4iE+BTjW/yUIThmgn9uZbGxhw6q/ES91uHxWdO43VlIoyZfnNTBtGoB2hjc58SfSPZw8F2t1SiT2w3R8O1JIV04mbDGJ5MuwLM9kIcYv17ZES/sgkr2ibebdkU69eis7OTqeq3oq4ObOYNolA3yK7ojlc6iDeghNQgBRHaU9f671L3+4U32W7JKjuAwkqbEqpzaPd4bpqmlAwBLzokj9xe/DzCg0NgCmnkHMU5FeBaAj4juOFHCOuz3DfC6g1i0kTdrwe7JPqH5D5nQMnTOn63tcLl/5kJGxgc+z8pT6pZbB70ZJfL8QE7xtNjWDh8jNAy0xv7qB85j2YMERWKDGLSWP73MvlOR4uIvIu+Ma5IauDbnNfcl4eXjjXg4mV8BZ6Wp0oEYaGymEft6I0WVe2TjjcocEWsSpAoxUPTqiEGeUT5Uf3uyULg85jYmCIK+E4jDXJmhgKGa3CilBJ1WfXtLClSNEXfza4WEQOkAZDiTIs9njjwLS6KhS4k/2hGyqgP20aRoIffJ+n5QiZW29tV76ffehFkN9DhwDs2YyCnZTW9rn2cMRjYewaZ0rgpwxkrVleAyjOZfCMRe/bZUSQogLrbdyfB3Edb/RliHc9uUAh7yTc+hHCk8VJcs2NIUeG58HcmvlBbOw3DsDrMIwe+lHpsxp+j20nW0A8d7x3nc2a9lx3MrWNcFfTmsi7RjsQLeCsvNkkOVmLync4wb3TKL+26fwGGO+kxUTVgjAu3+QXkDax6O/pzC7UTYQurrUOx/Pw==
  • Spamdiagnosticmetadata: NSPM
  • Spamdiagnosticoutput: 1:99

Even in the bushy example, the CN is still the full name. 

You can use group.extension in the template, but you might end up with duplicate CNs. 

Try ${group.extension} to see if that’s the current problem, and then let’s continue this thread for how to better shorten them. 

On Nov 29, 2017, at 11:57 AM, Bee-Lindgren, Bert <> wrote:

Let's see if this makes sense. If so, we can add a jexl utility function to help or make it automatic in AD provisioners...

In my experience with Georgia Tech's Active-Directory provisioning (not a grouper process, but a ldap-to-ad process), CN's in Active Directory are limited to 64 characters. Within this GT process, we put the whole group path in the CN which means we semi-often run into the 64-character limit.

Here is how we dealt with that limit:

a) Don't do anything unusual with the cn if it is <=64 chars

b) If the desired CN is >64 characters, we shorten the string to 59 characters (which might not be unique, of course) and then add -HASH where HASH is the first few characters of a hash of the entire CN.

So, for this example:

Let's say the group cn wants to be


At GT, this results in a group something like:

cn=Class-A_GROUPNAME_MUCHTOOLONG-FOR-FLAT-IN-ACTIVE-DIRECTORY--e15 (because e15 are the first characters of the hash of all 84 characters).

Obviously, the gobbly-gook at the end could confuse someone, but the beginning of the group's cn tends to be informative enough. In fact, we've been doing this for 5-10 years and no one has asked me.

So... what do people think? Or, how would people like to otherwise shorten CNs?

From: <> on behalf of Jeffrey Williams <>
Sent: Wednesday, November 29, 2017 11:35 AM
Subject: [grouper-users] Re: Bushy PSPNG to AD provisioning question
Another line of particular interest from the logs:

2017-11-29 15:40:14,526: [DefaultQuartzScheduler_Worker-5] ERROR LdapSystem.performLdapAdd(336) -  - Problem while creating new ldap object: [dn=cn=Class-A_GROUPNAME_MUCHTOOLONG-FORFLATINAD,ou=appName,ou=apps,ou=uncg,ou=devgroups,dc=devauth,dc=uncg,dc=edu[[ou[Class-A_GROUPNAME_MUCHTOOLONG-FORFLATINAD]], [cn[Class-A_GROUPNAME_MUCHTOOLONG-FORFLATINAD]], [objectclass[organizationalunit]]]]

I'm pretty new to Grouper, so I may be missing something obvious to the more experienced eye.  I can provide more info upon request.



On Tue, Nov 28, 2017 at 5:39 PM, Jeffrey Williams <> wrote:
I'm working on switching to a bushy hierarchy in grouper and am encountering this sort of error:

[LDAP: error code 64 - 00002073: NameErr: DSID-03050E53, problem 2005 (NAMING_VIOLATION), data 0, best match of: 'cn=Class-A_GROUPNAME_MUCHTOOLONG-FORFLATINAD,ou=appName,ou=apps,ou=uncg,ou=devgroups,dc=devauth,dc=uncg,dc=edu'

I based the PSPNG config off of the AD template and the bushy configuration suggestion. This is what I'm currently using for the groupCreationLdifTemplate = dn: cn=${},${utils.bushyDn(, "cn", "ou")}||cn: ${}||objectclass: group

The flat version works fine(except for a 64-char DN limit):
groupCreationLdifTemplate = dn: cn=${}||cn: ${}||objectclass: group

I switch back to flat and it works just fine.  Any ideas what I might be missing here?

Jeffrey Williams, Identity Management Specialist
Identity Architecture, ITS
University of North Carolina at Greensboro
256-TECH (256-8324)

Jeffrey Williams, Identity Management Specialist
Identity Architecture, ITS
University of North Carolina at Greensboro
256-TECH (256-8324)

Archive powered by MHonArc 2.6.19.

Top of Page