Skip to Content.
Sympa Menu

grouper-users - [grouper-users] problem getting PSPNG to select a group to provision

Subject: Grouper Users - Open Discussion List

List archive

[grouper-users] problem getting PSPNG to select a group to provision


Chronological Thread 
  • From: "Guenther, Dean R." <>
  • To: "" <>
  • Subject: [grouper-users] problem getting PSPNG to select a group to provision
  • Date: Wed, 30 May 2018 21:36:06 +0000
  • Accept-language: en-US
  • Authentication-results: spf=none (sender IP is ) ;
  • Ironport-phdr: 9a23:B0ZmyxxoI2+ee4HXCy+O+j09IxM/srCxBDY+r6Qd2ugUIJqq85mqBkHD//Il1AaPAd2Graocw8Pt8InYEVQa5piAtH1QOLdtbDQizfssogo7HcSeAlf6JvO5JwYzHcBFSUM3tyrjaRsdF8nxfUDdrWOv5jAOBBr/KRB1JuPoEYLOksi7ze+/94HTbglSmDaxfa55IQmrownWqsQYm5ZpJLwryhvOrHtIeuBWyn1tKFmOgRvy5dq+8YB6/ShItP0v68BPUaPhf6QlVrNYFygpM3o05MLwqxbOSxaE62YGXWUXlhpIBBXF7A3/U5zsvCb2qvZx1S+HNsDwULs6Wymt771zRRHolikJKiI5/m/UhMN+jaJUvB2uqgdlzILIZYGYLuZyc7nfcN4cWGFPXtxRVytEAo6kYYcBDvcBMvher4nhp1sBswG+CRGxD+3h1DBHnHn21rAm3eg7Hw3NwQstH90TsHvKqtX1KKcSXv6vzKTTwzTDdO5W1S3j54fVbxAsuPeBVq9zf8rJ0UQjCRnKgkmNpYHgIj+Zy/kBvm2V7+dvSe6jl2sqqw9vrTWg28shj4zEi4MLxl/a7Sl0wYI4KcelREN6YNOoCpRduiCAO4drTM4uX3lkuCgkxbAFpZK2eS0HxIkpxxLCbvGIaZSE7xPgWeuUIzp1hGxqd6+6ihux/0WtzvHzW8+p21hQtCVFiMPDtnUV2hzT9MeHTvx981+51zuT0A7f9vxILVkpmKTDJZMt27kwmYENvkjZGS/2hVn2g7SRdkU5/Oin9v7rYq38pp+bK497lB3xMrgvmsy4B+Q0KA8OX3WH+eS4073j+k75TK9Wgf0xl6nVqJHaJcIFqa6lGwJZzJws5wqiAzqjzdgUgGQLIVdLeB+Ik4TlJ1TDIP7mAvqwnlihlTJmyvHYMrL/GpnNK2LMkLblfbZz8U5czw8zwMhQ55JJFL4BJu7zWk/vu9zCFRI4PRe0w/v9BNpjy4weRHqDArWFP6PKrV+I+uUvLvGDZI8Pvzb9NuAl6OD0jXMghF8dZrem3YEMaH2jGvRmIl6ZYWb3gtsfC2sKvww+TPD0h12YVz5ceWqyU7wm6j4lFY2mENSLeof4yrOb2zqjE4cTe3tLEEukEHH0ep+CVutWLi+eP4UpxjMeUqW5RpVkyAqjrhTSyrx7I/DS9zFC85/vyY4myffUkER42iF5Cdid3nvJB015l2VAfXl8lPRwvEF71leOy4BnmOEeGNBOsaAaGjwmPILRmrQpQ+v5XRjMK4+E
  • Spamdiagnosticmetadata: NSPM
  • Spamdiagnosticoutput: 1:99

Hello folks,

I’m having trouble getting pspng to select a group to provision. It seems to think there are no groups to provision, even though I have enabled one group. When I ran PSPNG the first time these were auto-created:

 

2018-05-22:2018-05-22 16:10:09,423: [DefaultQuartzScheduler_Worker-2] WARN  GrouperCheckConfig.checkAttribute(1726) -  - auto-created attributeDefName: etc:pspng:provision_to

2018-05-22:2018-05-22 16:10:09,479: [DefaultQuartzScheduler_Worker-2] WARN  GrouperCheckConfig.checkAttribute(1726) -  - auto-created attributeDefName: etc:pspng:do_not_provision_to

 

And when I try and provision with pspng it says:

 

2018-05-25 16:26:00,073: [DefaultQuartzScheduler_Worker-3] DEBUG Provisioner.getAllGroupsForProvisioner(1252) -  - pspng_activedirectory: There are 0 groups that match etc:pspng:provision_to attribute

 

 

But I have created one test group test:ref:employee:hourly and enabled it for the loader. After enabling, the attributes look like this in LightUi:

 

Filter:

owner type = Group

attribute definition = etc:pspng:provision_to_def

attribute name = Grouper Administration:pspng:provision_to

owner group = test:ref:employee:hourly

enabled/disabled = Enabled only

 

Attribute Assignments:

owner group = hourly

attribute name =  provision_to

enabled? = enabled

assignment values = <null>

attribute definition = provision_to_def

assignment UUID = 30b45…..

 

 

But one peculiar thing is when I went to the LightUi to enable my test group, I successfully entered “etc:pspng:provision_to_def” for the Attribute definition. But when I entered “etc:pspng:provision_to” for the attribute name, instead in the pick list it showed as “Grouper Administration:pspng:provision_to”. Which is different than the “etc:pspng:provision_to” that was indicated from the “auto-created” above. Perhaps this is because I asked the original Grouper install process to include the test data?

 

I thought maybe if I changed the groupSelectionExpression from “etc:pspng:provision_to” to “Grouper Administration:pspng:provision_to” that maybe it would take care of it. It didn’t help, it still says zero groups that match. This was the override:

 

changeLog.consumer.pspng_activedirectory.groupSelectionExpression = ${utils.containedWithin(provisionerName, stemAttributes['Grouper Administration:pspng:provision_to'], groupAttributes['Grouper Administration:pspng:provision_to']) && !utils.containedWithin(provisionerName, stemAttributes['Grouper Administration:pspng:do_not_provision_to'], groupAttributes['Grouper Administration:pspng:do_not_provision_to'])}

 

 

But that’s probably not the right approach anyway. Should I be somehow changing the “Grouper Adminitration:pspng:provision_to” tag to “etc:pspng:provision_to”? How do I get my test group to show up in provision_to?

 

I’m not certain what else I should include from the log. I can see that there are 7,000+ users in the test group “hourly” built by the loader.

 

 startTime: Fri May 25 08:02:20 PDT 2018, jobName: CHANGE_LOG_consumer_pspng_activedirectory, dryRun: false, quartzCron: 15 * * * * ?, status: SUCCESS,

2018-05-25 08:02:21,057: [DefaultQuartzScheduler_Worker-3] DEBUG ProvisionerConfiguration.readConfiguration(177) -  - Provisioner pspng_activedirectory - Setting groupSelectionExpression to ${utils.containedWithin(provisionerName, stemAttributes['etc:pspng:provision_to'], groupAttributes['etc:pspng:provision_to']) && !utils.containedWithin(provisionerName, stemAttributes['etc:pspng:do_not_provision_to'], groupAttributes['etc:pspng:do_not_provision_to'])}

2018-05-25 08:02:21,058: [DefaultQuartzScheduler_Worker-3] DEBUG ProvisionerConfiguration.readConfiguration(196) -  - Provisioner pspng_activedirectory - Setting attributesUsedInGroupSelectionExpression to [etc:pspng:provision_to, etc:pspng:do_not_provision_to]

2018-05-25 08:02:21,058: [DefaultQuartzScheduler_Worker-3] DEBUG ProvisionerConfiguration.readConfiguration(200) -  - Provisioner pspng_activedirectory - Setting attributesUsedInGroupSelectionExpressionAreComparedToProvisionerName to true

 

Thanks – Dean

 

 

 

Dean Guenther                          
Washington State University    Phone:    509 335-0433
Pullman, WA. 99164-1222        fax:      509 335-0540
Identity and Access Management Manager

 




Archive powered by MHonArc 2.6.19.

Top of Page