Grouper Users - Open Discussion List

["Gettes, Michael" <>]

Hi Dean,

I see 2 issues here.  It would appear you have given a Folder name: Grouper Administration to the folder with a folder id: etc.  So the Grouper Administration showing for the attribute name is just showing that Folder name.  If you go to that folder, which is really the etc folder, and change the Folder name to ‘etc’ you will see the more normal/documented behavior of things.

The 2nd thing is - it’s unclear to me from what you are showing that you have assigned the value of pspng_activedirectory (the PSPNG provisioner name) to any folder or group so it will be selected.  You do this in the lite UI.  It must be spelled the same with the same case as what you defined for PSPNG in grouper-loader.properties.  If you assign pspng_activedirectory to a folder then all groups below that folder will be provisioned to pspng_activedirectory.

See "How do I assign PSPNG attribute definitions?” in https://spaces.internet2.edu/display/Grouper/Grouper+Provisioning%3A+PSPNG

I hope this helps.

/mrg

On May 30, 2018, at 5:36 PM, Guenther, Dean R. <> wrote:

Hello folks,

I’m having trouble getting pspng to select a group to provision. It seems to think there are no groups to provision, even though I have enabled one group. When I ran PSPNG the first time these were auto-created:

 

2018-05-22:2018-05-22 16:10:09,423: [DefaultQuartzScheduler_Worker-2] WARN  GrouperCheckConfig.checkAttribute(1726) -  - auto-created attributeDefName: etc:pspng:provision_to

2018-05-22:2018-05-22 16:10:09,479: [DefaultQuartzScheduler_Worker-2] WARN  GrouperCheckConfig.checkAttribute(1726) -  - auto-created attributeDefName: etc:pspng:do_not_provision_to

 

And when I try and provision with pspng it says:

 

2018-05-25 16:26:00,073: [DefaultQuartzScheduler_Worker-3] DEBUG Provisioner.getAllGroupsForProvisioner(1252) -  - pspng_activedirectory: There are 0 groups that match etc:pspng:provision_to attribute

 

 

But I have created one test group test:ref:employee:hourly and enabled it for the loader. After enabling, the attributes look like this in LightUi:

 

Filter:

owner type = Group

attribute definition = etc:pspng:provision_to_def

attribute name = Grouper Administration:pspng:provision_to

owner group = test:ref:employee:hourly

enabled/disabled = Enabled only

 

Attribute Assignments:

owner group = hourly

attribute name =  provision_to

enabled? = enabled

assignment values = <null>

attribute definition = provision_to_def

assignment UUID = 30b45…..

 

 

But one peculiar thing is when I went to the LightUi to enable my test group, I successfully entered “etc:pspng:provision_to_def” for the Attribute definition. But when I entered “etc:pspng:provision_to” for the attribute name, instead in the pick list it showed as “Grouper Administration:pspng:provision_to”. Which is different than the “etc:pspng:provision_to” that was indicated from the “auto-created” above. Perhaps this is because I asked the original Grouper install process to include the test data?

 

I thought maybe if I changed the groupSelectionExpression from “etc:pspng:provision_to” to “Grouper Administration:pspng:provision_to” that maybe it would take care of it. It didn’t help, it still says zero groups that match. This was the override:

 

changeLog.consumer.pspng_activedirectory.groupSelectionExpression = ${utils.containedWithin(provisionerName, stemAttributes['Grouper Administration:pspng:provision_to'], groupAttributes['Grouper Administration:pspng:provision_to']) && !utils.containedWithin(provisionerName, stemAttributes['Grouper Administration:pspng:do_not_provision_to'], groupAttributes['Grouper Administration:pspng:do_not_provision_to'])}

 

 

But that’s probably not the right approach anyway. Should I be somehow changing the “Grouper Adminitration:pspng:provision_to” tag to “etc:pspng:provision_to”? How do I get my test group to show up in provision_to?

 

I’m not certain what else I should include from the log. I can see that there are 7,000+ users in the test group “hourly” built by the loader.

 

 startTime: Fri May 25 08:02:20 PDT 2018, jobName: CHANGE_LOG_consumer_pspng_activedirectory, dryRun: false, quartzCron: 15 * * * * ?, status: SUCCESS, 

…

2018-05-25 08:02:21,057: [DefaultQuartzScheduler_Worker-3] DEBUG ProvisionerConfiguration.readConfiguration(177) -  - Provisioner pspng_activedirectory - Setting groupSelectionExpression to ${utils.containedWithin(provisionerName, stemAttributes['etc:pspng:provision_to'], groupAttributes['etc:pspng:provision_to']) && !utils.containedWithin(provisionerName, stemAttributes['etc:pspng:do_not_provision_to'], groupAttributes['etc:pspng:do_not_provision_to'])}

2018-05-25 08:02:21,058: [DefaultQuartzScheduler_Worker-3] DEBUG ProvisionerConfiguration.readConfiguration(196) -  - Provisioner pspng_activedirectory - Setting attributesUsedInGroupSelectionExpression to [etc:pspng:provision_to, etc:pspng:do_not_provision_to]

2018-05-25 08:02:21,058: [DefaultQuartzScheduler_Worker-3] DEBUG ProvisionerConfiguration.readConfiguration(200) -  - Provisioner pspng_activedirectory - Setting attributesUsedInGroupSelectionExpressionAreComparedToProvisionerName to true

…

 

Thanks – Dean

 

 

 

Dean Guenther                          
Washington State University    Phone:    509 335-0433
Pullman, WA. 99164-1222        fax:      509 335-0540
Identity and Access Management Manager