Skip to Content.
Sympa Menu

grouper-users - Re: [grouper-users] Re: Bushy PSPNG to AD provisioning question

Subject: Grouper Users - Open Discussion List

List archive

Re: [grouper-users] Re: Bushy PSPNG to AD provisioning question

Chronological Thread 
  • From: Jeffrey Williams <>
  • To: "Bee-Lindgren, Bert" <>
  • Cc: "" <>
  • Subject: Re: [grouper-users] Re: Bushy PSPNG to AD provisioning question
  • Date: Wed, 29 Nov 2017 14:30:21 -0500
  • Ironport-phdr: 9a23:kvEijRH9BWzAvgoaFkdIZJ1GYnF86YWxBRYc798ds5kLTJ7zocWwAkXT6L1XgUPTWs2DsrQf2rqQ6/iocFdDyK7JiGoFfp1IWk1NouQttCtkPvS4D1bmJuXhdS0wEZcKflZk+3amLRodQ56mNBXdrXKo8DEdBAj0OxZrKeTpAI7SiNm82/yv95HJbQhFgDmwbaluIBmqsA7cqtQYjYx+J6gr1xDHuGFIe+NYxWNpIVKcgRPx7dqu8ZBg7ipdpesv+9ZPXqvmcas4S6dYDCk9PGAu+MLrrxjDQhCR6XYaT24bjwBHAwnB7BH9Q5fxri73vfdz1SWGIcH7S60/VC+85Kl3VhDnlCYHNyY48G7JjMxwkLlbqw+lqxBm3oLYfJ2ZOP94c6jAf90VWHBBU95TWCxPAo2yYYgBAfcfM+lEtITyvUcCoAGkCAWwGO/iyDlFjWL2060g1OQhFBnL0gg+ENIAvnTUtsv6NacPWu+1zanIyTHDb/JM1jf484jDbxcsofOCXbN+cMrRzU0vFwLfgViLtIzlOS+a1usXv2eF8uVgSPuihmg6oA9/pTivw90jiojPho8NxVDE7yJ5wJstJdGiTk50e9ukH4VWuiqHNIV2WtsvT39ptSomyLALvJC7cSsRx5g7whPSZOCLf5SU7R/mSOmdPTd1iXdgdb6hmRq96k6twfDmWMauylZFtC9Fn8HMtn8T0xzT7dCKSv5n8Ueg3TaDzh7T6uJYLUwtmqvXNYAtzaUqmpoctkTDGSD2mEHog6OMakok/e2o5/zmYrXguJCcK5d5hh//P6gymMGyBOo4PwsVUGSH/Omx26Hv8VHlT7hPkvI6jqnUvZXfKMgFuKK2GBdZ0oM55Ba+Czem3s4YnX4CLF9dehKHgYboO1DKIPD8DPewmU+hkCptx//aMb3tGIvCIWXekLv5Z7Zy91ZcyBYvzdBY/59UBasBIPXuWk/pqtPYFAY1MxGvw+n5EtV9zZgTWWaOAq+CLKPSqkGE6vguI+mKeI8apiz9K/476P7yk3M1g0EScrS03chfVHftVN5rLgC9YHzgjc0MFyNClAckUKai3FePSyIVbXu/GqY94D00Eo+gJYDCWsaiiaCM1yf9E5FLMDNoEFeJRFXleYueVuZEVyOWJs5olydMAbqvVI4l0RCnnBL8wLUhI+bJrH5L/an/3cR4srWA3So58iZ5WoHEizmA

Hi Bert,

That's an interesting/cool way to handle the limitation.  If you're doing a bushy provisioning model with that idea, is this being applied to the OU's in AD as well, or only group objects?  When this occurs in provisioning, is the group/folder name in Grouper updated to reflect the change? 

On Wed, Nov 29, 2017 at 11:57 AM, Bee-Lindgren, Bert <> wrote:

Let's see if this makes sense. If so, we can add a jexl utility function to help or make it automatic in AD provisioners...

In my experience with Georgia Tech's Active-Directory provisioning (not a grouper process, but a ldap-to-ad process), CN's in Active Directory are limited to 64 characters. Within this GT process, we put the whole group path in the CN which means we semi-often run into the 64-character limit.

Here is how we dealt with that limit:

a) Don't do anything unusual with the cn if it is <=64 chars

b) If the desired CN is >64 characters, we shorten the string to 59 characters (which might not be unique, of course) and then add -HASH where HASH is the first few characters of a hash of the entire CN.

So, for this example:

Let's say the group cn wants to be


At GT, this results in a group something like:

cn=Class-A_GROUPNAME_MUCHTOOLONG-FOR-FLAT-IN-ACTIVE-DIRECTORY--e15 (because e15 are the first characters of the hash of all 84 characters).

Obviously, the gobbly-gook at the end could confuse someone, but the beginning of the group's cn tends to be informative enough. In fact, we've been doing this for 5-10 years and no one has asked me.

So... what do people think? Or, how would people like to otherwise shorten CNs?

From: <> on behalf of Jeffrey Williams <>
Sent: Wednesday, November 29, 2017 11:35 AM
Subject: [grouper-users] Re: Bushy PSPNG to AD provisioning question
Another line of particular interest from the logs:

2017-11-29 15:40:14,526: [DefaultQuartzScheduler_Worker-5] ERROR LdapSystem.performLdapAdd(336) -  - Problem while creating new ldap object: [dn=cn=Class-A_GROUPNAME_MUCHTOOLONG-FORFLATINAD,ou=appName,ou=apps,ou=uncg,ou=devgroups,dc=devauth,dc=uncg,dc=edu[[ou[Class-A_GROUPNAME_MUCHTOOLONG-FORFLATINAD]], [cn[Class-A_GROUPNAME_MUCHTOOLONG-FORFLATINAD]], [objectclass[organizationalunit]]]]

I'm pretty new to Grouper, so I may be missing something obvious to the more experienced eye.  I can provide more info upon request.



On Tue, Nov 28, 2017 at 5:39 PM, Jeffrey Williams <> wrote:
I'm working on switching to a bushy hierarchy in grouper and am encountering this sort of error:

[LDAP: error code 64 - 00002073: NameErr: DSID-03050E53, problem 2005 (NAMING_VIOLATION), data 0, best match of: 'cn=Class-A_GROUPNAME_MUCHTOOLONG-FORFLATINAD,ou=appName,ou=apps,ou=uncg,ou=devgroups,dc=devauth,dc=uncg,dc=edu'

I based the PSPNG config off of the AD template and the bushy configuration suggestion. This is what I'm currently using for the groupCreationLdifTemplate = dn: cn=${},${utils.bushyDn(, "cn", "ou")}||cn: ${}||objectclass: group

The flat version works fine(except for a 64-char DN limit):
groupCreationLdifTemplate = dn: cn=${}||cn: ${}||objectclass: group

I switch back to flat and it works just fine.  Any ideas what I might be missing here?

Jeffrey Williams, Identity Management Specialist
Identity Architecture, ITS
University of North Carolina at Greensboro
256-TECH (256-8324)

Jeffrey Williams, Identity Management Specialist
Identity Architecture, ITS
University of North Carolina at Greensboro
256-TECH (256-8324)

Jeffrey Williams, Identity Management Specialist
Identity Architecture, ITS
University of North Carolina at Greensboro
256-TECH (256-8324)

Archive powered by MHonArc 2.6.19.

Top of Page