Grouper Users - Open Discussion List

["Guenther, Dean R." <>]

Hello folks,

I’m having trouble getting pspng to select a group to provision. It seems to think there are no groups to provision, even though I have enabled one group. When I ran PSPNG the first time these were auto-created:

 

2018-05-22:2018-05-22 16:10:09,423: [DefaultQuartzScheduler_Worker-2] WARN  GrouperCheckConfig.checkAttribute(1726) -  - auto-created attributeDefName: etc:pspng:provision_to

2018-05-22:2018-05-22 16:10:09,479: [DefaultQuartzScheduler_Worker-2] WARN  GrouperCheckConfig.checkAttribute(1726) -  - auto-created attributeDefName: etc:pspng:do_not_provision_to

 

And when I try and provision with pspng it says:

 

2018-05-25 16:26:00,073: [DefaultQuartzScheduler_Worker-3] DEBUG Provisioner.getAllGroupsForProvisioner(1252) -  - pspng_activedirectory: There are 0 groups that match etc:pspng:provision_to attribute

 

 

But I have created one test group test:ref:employee:hourly and enabled it for the loader. After enabling, the attributes look like this in LightUi:

 

Filter:

owner type = Group

attribute definition = etc:pspng:provision_to_def

attribute name = Grouper Administration:pspng:provision_to

owner group = test:ref:employee:hourly

enabled/disabled = Enabled only

 

Attribute Assignments:

owner group = hourly

attribute name =  provision_to

enabled? = enabled

assignment values = <null>

attribute definition = provision_to_def

assignment UUID = 30b45…..

 

 

But one peculiar thing is when I went to the LightUi to enable my test group, I successfully entered “etc:pspng:provision_to_def” for the Attribute definition. But when I entered “etc:pspng:provision_to” for the attribute name, instead in the pick list it showed as “Grouper Administration:pspng:provision_to”. Which is different than the “etc:pspng:provision_to” that was indicated from the “auto-created” above. Perhaps this is because I asked the original Grouper install process to include the test data?

 

I thought maybe if I changed the groupSelectionExpression from “etc:pspng:provision_to” to “Grouper Administration:pspng:provision_to” that maybe it would take care of it. It didn’t help, it still says zero groups that match. This was the override:

 

changeLog.consumer.pspng_activedirectory.groupSelectionExpression = ${utils.containedWithin(provisionerName, stemAttributes['Grouper Administration:pspng:provision_to'], groupAttributes['Grouper Administration:pspng:provision_to']) && !utils.containedWithin(provisionerName, stemAttributes['Grouper Administration:pspng:do_not_provision_to'], groupAttributes['Grouper Administration:pspng:do_not_provision_to'])}

 

 

But that’s probably not the right approach anyway. Should I be somehow changing the “Grouper Adminitration:pspng:provision_to” tag to “etc:pspng:provision_to”? How do I get my test group to show up in provision_to?

 

I’m not certain what else I should include from the log. I can see that there are 7,000+ users in the test group “hourly” built by the loader.

 

 startTime: Fri May 25 08:02:20 PDT 2018, jobName: CHANGE_LOG_consumer_pspng_activedirectory, dryRun: false, quartzCron: 15 * * * * ?, status: SUCCESS,

…

2018-05-25 08:02:21,057: [DefaultQuartzScheduler_Worker-3] DEBUG ProvisionerConfiguration.readConfiguration(177) -  - Provisioner pspng_activedirectory - Setting groupSelectionExpression to ${utils.containedWithin(provisionerName, stemAttributes['etc:pspng:provision_to'], groupAttributes['etc:pspng:provision_to']) && !utils.containedWithin(provisionerName, stemAttributes['etc:pspng:do_not_provision_to'], groupAttributes['etc:pspng:do_not_provision_to'])}

2018-05-25 08:02:21,058: [DefaultQuartzScheduler_Worker-3] DEBUG ProvisionerConfiguration.readConfiguration(196) -  - Provisioner pspng_activedirectory - Setting attributesUsedInGroupSelectionExpression to [etc:pspng:provision_to, etc:pspng:do_not_provision_to]

2018-05-25 08:02:21,058: [DefaultQuartzScheduler_Worker-3] DEBUG ProvisionerConfiguration.readConfiguration(200) -  - Provisioner pspng_activedirectory - Setting attributesUsedInGroupSelectionExpressionAreComparedToProvisionerName to true

…

 

Thanks – Dean

 

 

 

Dean Guenther                          
Washington State University    Phone:    509 335-0433
Pullman, WA. 99164-1222        fax:      509 335-0540
Identity and Access Management Manager