Grouper Users - Open Discussion List

[Mark Cairney <>]

Hi,

After my rather hasty email yesterday I've made a little bit of progress
and now have PSPNG connecting to LDAP. It's currently failign to
add/modify groups due to lack of members:

2017-12-06 11:34:00,182: [DefaultQuartzScheduler_Worker-3] ERROR
GrouperLoaderJob.runJob(485) -  - Error on job:
CHANGE_LOG_consumer_pspng_cauth
java.lang.RuntimeException: Error in loader job: null, check logs:
Error: java.lang.RuntimeException: No entries provisioned. Batch-Start
failed: LDAP problem creating object: LDAPException(resultCode=65
(object class violation), errorMessage='object class 'groupOfNames'
requires attribute 'member'', diagnosticMessage='object class
'groupOfNames' requires attribute 'member'')
        at
edu.internet2.middleware.grouper.pspng.Provisioner.provisionBatchOfItems(Provisioner.java:1020)
        at
edu.internet2.middleware.grouper.pspng.PspChangelogConsumerShim.processChangeLogEntries(PspChangelogConsumerShim.java:71)
        at
edu.internet2.middleware.grouper.changeLog.ChangeLogHelper.processRecords(ChangeLogHelper.java:245)
        at
edu.internet2.middleware.grouper.app.loader.GrouperLoaderType$5.runJob(GrouperLoaderType.java:720)
        at
edu.internet2.middleware.grouper.app.loader.GrouperLoaderJob.runJob(GrouperLoaderJob.java:465)
        at
edu.internet2.middleware.grouper.app.loader.GrouperLoaderJob.execute(GrouperLoaderJob.java:345)
        at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
        at
org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)
Caused by: edu.internet2.middleware.grouper.pspng.PspException: LDAP
problem creating object: LDAPException(resultCode=65 (object class
violation), errorMessage='object class 'groupOfNames' requires attribute
'member'', diagnosticMessage='object class 'groupOfNames' requires
attribute 'member'')
        at
edu.internet2.middleware.grouper.pspng.LdapProvisioner.performLdapAdd(LdapProvisioner.java:254)
        at
edu.internet2.middleware.grouper.pspng.LdapGroupProvisioner.createGroup(LdapGroupProvisioner.java:226)
        at
edu.internet2.middleware.grouper.pspng.LdapGroupProvisioner.createGroup(LdapGroupProvisioner.java:54)
        at
edu.internet2.middleware.grouper.pspng.Provisioner.prepareGroupCache(Provisioner.java:581)
        at
edu.internet2.middleware.grouper.pspng.Provisioner.startProvisioningBatch(Provisioner.java:356)
        at
edu.internet2.middleware.grouper.pspng.Provisioner.provisionBatchOfItems(Provisioner.java:1015)
        ... 7 more



And on the LDAP side the error is:

dn="cn=adhoc:MCTest:Mark 1,cn=Mark
1,ou=MCTest,ou=adhoc,ou=grouper2,dc=authorise-dev,dc=ed,dc=ac,dc=uk"
Dec  6 11:45:00 bonsai slapd[34260]: Entry (cn=adhoc:MCTest:Mark
1,cn=Mark
1,ou=MCTest,ou=adhoc,ou=grouper2,dc=authorise-dev,dc=ed,dc=ac,dc=uk):
object class 'groupOfNames' requires attribute 'member'


1. As provisioned by PSP the DN of the group is:
cn=Mark
1,ou=MCTest,ou=adhoc,ou=grouper2,dc=authorise-dev,dc=ed,dc=ac,dc=uk" so
this should actually be a modify rather than an add.

My PSPNG currently contains the line:
dn: cn=${group.name},${utils.bushyDn(group.name, "cn", "ou")}||cn:
${group.name}||objectclass: posixGroup||objectclass:
groupOfNames||gidNumber: ${group.idIndex}

How should this be modified to replicate the previous behaviour for the DN?

2. I've got the following in my grouper-loader.properties:
changeLog.consumer.pspng_cauth.memberAttributeName = member
changeLog.consumer.pspng_cauth.memberAttributeValueFormat =
${ldapUser.getDn()}

However I don't see any attempts at looking up users in LDAP, only the
group. Also is there a way to define a "placeholder" member for empty
groups? How does PSPNG resolve grouper members with LDAP/AD users?

Sorry for all the questions- I'm sure there  will be more though once I
get over this particular speed-bump!


-- 
/****************************

Mark Cairney
ITI Enterprise Services
Information Services
University of Edinburgh

Tel: 0131 650 6565
Email: 

PGP: 0x435A9621

*******************************/

The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.