Grouper Users - Open Discussion List

[Yoann Delattre <>]

Hello everyone,

for summarise :

When grouperIsAuthoritative is set to true, a group deleted in Grouper are not deleted in LDAP.
No problem when i create groups or delete members : all this changes are provisioned correctly in the LDAP.

Has anyone ran into this issue?

Thanks,
Yoann.

Le 11/12/2017 à 16:02, Yoann Delattre a écrit :

grouperIsAuthoritative was set to true.
So i tried set it to false, and now it works...Strange :-/

maybe something wrong with my conf ?

changeLog.consumer.pspng_brancheGrouper.class = edu.internet2.middleware.grouper.pspng.PspChangelogConsumerShim
changeLog.consumer.pspng_brancheGrouper.type = edu.internet2.middleware.grouper.pspng.LdapGroupProvisioner
changeLog.consumer.pspng_brancheGrouper.quartzCron = 0 * * * * ?
changeLog.consumer.pspng_brancheGrouper.ldapPoolName = aclille
changeLog.consumer.pspng_brancheGrouper.memberAttributeName = uniqueMember
changeLog.consumer.pspng_brancheGrouper.memberAttributeValueFormat = ${ldapUser.getDn()}
changeLog.consumer.pspng_brancheGrouper.groupSearchBaseDn = ou=Grouper,ou=xxxxx,o=yyyy,c=zz
changeLog.consumer.pspng_brancheGrouper.allGroupsSearchFilter = objectclass=groupOfUniqueNames
changeLog.consumer.pspng_brancheGrouper.singleGroupSearchFilter = (&(objectclass=groupOfUniqueNames)(cn=${group.name}))
changeLog.consumer.pspng_brancheGrouper.groupSearchAttributes = cn,objectclass
changeLog.consumer.pspng_brancheGrouper.groupCreationLdifTemplate = dn: cn=${group.name}||cn: ${group.name}||objectclass: groupOfUniqueNames||objectclass: educationnationale
changeLog.consumer.pspng_brancheGrouper.userSearchBaseDn = ou=people,ou=xxxxx,o=yyyy,c=zz
changeLog.consumer.pspng_brancheGrouper.userSearchFilter = uid=${subject.id}
changeLog.consumer.pspng_brancheGrouper.grouperIsAuthoritative = false

Thanks for your help !

Yoann

Le 11/12/2017 à 15:18, Jeffrey Williams a écrit :

Hi Yoann,

My first thought was whether you had grouperIsAuthoritative set?

from: https://spaces.internet2.edu/display/Grouper/Grouper+Provisioning%3A+PSPNG

Should groups in the groupSearchBaseDn/allGroupSearchFilter be removed if they no longer exist in Grouper?

By default, it is set to FALSE, which sounds like the behavior you're experiencing.

On Mon, Dec 11, 2017 at 9:11 AM, Yoann Delattre <> wrote:

Hello everyone,

i have a problem with the PSPNG : a group deleted in Grouper are not deleted in LDAP.
It's weird because i have c

I get this in the log :

2017-12-11 11:39:00,045: [DefaultQuartzScheduler_Worker-9] INFO  ProvisioningWorkItem.setStatus(143) -  - Work item handled: ProvisioningWorkItem[successful=true,msg=Ignoring work item because group is not provisioned,clog=clog #3921904 / ChangeLog type: group: deleteGroup,group=test-pspng4:test-2]

Anyone encounter this issue ?

Thanks for your help,
Yoann

--

--

Jeffrey Williams, Identity Management Specialist
Identity Architecture, ITS
University of North Carolina at Greensboro
256-TECH (256-8324)