Skip to Content.
Sympa Menu

grouper-users - Re: [grouper-users] problem getting PSPNG to select a group to provision

Subject: Grouper Users - Open Discussion List

List archive

Re: [grouper-users] problem getting PSPNG to select a group to provision

Chronological Thread 
  • From: "Gettes, Michael" <>
  • To: "" <>
  • Subject: Re: [grouper-users] problem getting PSPNG to select a group to provision
  • Date: Wed, 30 May 2018 23:38:54 +0000
  • Accept-language: en-US
  • Ironport-phdr: 9a23:/pyUkxVY7QZo1w3k4fcz2EEq0JXV8LGtZVwlr6E/grcLSJyIuqrYbBGFt8tkgFKBZ4jH8fUM07OQ7/i9HzRYqb+681k6OKRWUBEEjchE1ycBO+WiTXPBEfjxciYhF95DXlI2t1uyMExSBdqsLwaK+i764jEdAAjwOhRoLerpBIHSk9631+ev8JHPfglEnjWwba9yIRmssQndqtQdjJd/JKo21hbHuGZDdf5MxWNvK1KTnhL86dm18ZV+7SleuO8v+tBZX6nicKs2UbJXDDI9M2Ao/8LrrgXMTRGO5nQHTGoblAdDDhXf4xH7WpfxtTb6tvZ41SKHM8D6Uaw4VDK/5KptVRTmijoINyQh/W/XlMJ+kb5brhyiqRxxwYHaZ4CVO+Zxca7GZ9wWWW9BU9xRVyBdAI6xaZYEAeobPeZfqonwv1UCoxqgCgmwGOPg1CRIimfr1qM90uQuDQHG0xY+ENIKvnjfsdL4NKgMXuCp0KnH0y7DYuhL2Tfz7IjEaA4uruyRXb9pd8fa1EchFwTAjlqKqIzlOSuY1uULs2iH8eVgT+SvhHA7qw1vuDSg2NojipTPi4kIyV7E7T10zJsrKdC7UkJ3f8CoHZlKuyyYOIZ6WN0uT390tCoi17EKpYS3cSYLxZg92hLSZfOKf5KV7h/sTOqRLyl3iXF5dL+6ghu/8kytxvHgWcSxzFlFtTBKn9nJu3wT1RHc8daLR/5g8Ui6xzqC1Qbe4fxeL08uj6rUMZshz6YwlpUNtUTDGTf7mF7zjK+KbkUo4PWo6+rjYrn8uJCTKpJ0hhn/MqQohMO/Hfw1PhUQU2WY4+iwyqPv8E/jTLhIgfA6iLfVvI7GKcgDo662GQ5V0oIt6xalCDem1cwVnXYZI1JZZBKIkZPpNkrTIPD2CfezmUqjnyp2x/zeJL3uHo3NLmTfkLfmZbt95FRcyA0uzdBH+Z1UEKgNIO/oWkDvrtzYFQQ0Mwi1w+b8FNV9zZ0SVXiOAq+fLKPdr0WI5uQxLOmQeoMZoijyJOU4562msXhs01AHerSx0IFSdWu1BO9OIkOFbGDqj8tbV2oGo0B2GOPwj0CaXCQWem2/RbkU5zcnBZigAJuZAI2hnerS8j28G8gcSW1aFl2XVT/Ndo6EUvoIImrGLcJ9jjEffaWvT8ks2Qz451yy8KZuMueBon5QjpnkztUgv+A=

Hi Dean,

I see 2 issues here.  It would appear you have given a Folder name: Grouper Administration to the folder with a folder id: etc.  So the Grouper Administration showing for the attribute name is just showing that Folder name.  If you go to that folder, which is really the etc folder, and change the Folder name to ‘etc’ you will see the more normal/documented behavior of things.

The 2nd thing is - it’s unclear to me from what you are showing that you have assigned the value of pspng_activedirectory (the PSPNG provisioner name) to any folder or group so it will be selected.  You do this in the lite UI.  It must be spelled the same with the same case as what you defined for PSPNG in  If you assign pspng_activedirectory to a folder then all groups below that folder will be provisioned to pspng_activedirectory.

See "How do I assign PSPNG attribute definitions?” in

I hope this helps.


On May 30, 2018, at 5:36 PM, Guenther, Dean R. <> wrote:

Hello folks,
I’m having trouble getting pspng to select a group to provision. It seems to think there are no groups to provision, even though I have enabled one group. When I ran PSPNG the first time these were auto-created:
2018-05-22:2018-05-22 16:10:09,423: [DefaultQuartzScheduler_Worker-2] WARN  GrouperCheckConfig.checkAttribute(1726) -  - auto-created attributeDefName: etc:pspng:provision_to
2018-05-22:2018-05-22 16:10:09,479: [DefaultQuartzScheduler_Worker-2] WARN  GrouperCheckConfig.checkAttribute(1726) -  - auto-created attributeDefName: etc:pspng:do_not_provision_to
And when I try and provision with pspng it says:
2018-05-25 16:26:00,073: [DefaultQuartzScheduler_Worker-3] DEBUG Provisioner.getAllGroupsForProvisioner(1252) -  - pspng_activedirectory: There are 0 groups that match etc:pspng:provision_to attribute
But I have created one test group test:ref:employee:hourly and enabled it for the loader. After enabling, the attributes look like this in LightUi:
owner type = Group
attribute definition = etc:pspng:provision_to_def
attribute name = Grouper Administration:pspng:provision_to
owner group = test:ref:employee:hourly
enabled/disabled = Enabled only
Attribute Assignments:
owner group = hourly
attribute name =  provision_to
enabled? = enabled
assignment values = <null>
attribute definition = provision_to_def
assignment UUID = 30b45…..
But one peculiar thing is when I went to the LightUi to enable my test group, I successfully entered “etc:pspng:provision_to_def” for the Attribute definition. But when I entered “etc:pspng:provision_to” for the attribute name, instead in the pick list it showed as “Grouper Administration:pspng:provision_to”. Which is different than the “etc:pspng:provision_to” that was indicated from the “auto-created” above. Perhaps this is because I asked the original Grouper install process to include the test data?
I thought maybe if I changed the groupSelectionExpression from “etc:pspng:provision_to” to “Grouper Administration:pspng:provision_to” that maybe it would take care of it. It didn’t help, it still says zero groups that match. This was the override:
changeLog.consumer.pspng_activedirectory.groupSelectionExpression = ${utils.containedWithin(provisionerName, stemAttributes['Grouper Administration:pspng:provision_to'], groupAttributes['Grouper Administration:pspng:provision_to']) && !utils.containedWithin(provisionerName, stemAttributes['Grouper Administration:pspng:do_not_provision_to'], groupAttributes['Grouper Administration:pspng:do_not_provision_to'])}
But that’s probably not the right approach anyway. Should I be somehow changing the “Grouper Adminitration:pspng:provision_to” tag to “etc:pspng:provision_to”? How do I get my test group to show up in provision_to?
I’m not certain what else I should include from the log. I can see that there are 7,000+ users in the test group “hourly” built by the loader.
 startTime: Fri May 25 08:02:20 PDT 2018, jobName: CHANGE_LOG_consumer_pspng_activedirectory, dryRun: false, quartzCron: 15 * * * * ?, status: SUCCESS, 
2018-05-25 08:02:21,057: [DefaultQuartzScheduler_Worker-3] DEBUG ProvisionerConfiguration.readConfiguration(177) -  - Provisioner pspng_activedirectory - Setting groupSelectionExpression to ${utils.containedWithin(provisionerName, stemAttributes['etc:pspng:provision_to'], groupAttributes['etc:pspng:provision_to']) && !utils.containedWithin(provisionerName, stemAttributes['etc:pspng:do_not_provision_to'], groupAttributes['etc:pspng:do_not_provision_to'])}
2018-05-25 08:02:21,058: [DefaultQuartzScheduler_Worker-3] DEBUG ProvisionerConfiguration.readConfiguration(196) -  - Provisioner pspng_activedirectory - Setting attributesUsedInGroupSelectionExpression to [etc:pspng:provision_to, etc:pspng:do_not_provision_to]
2018-05-25 08:02:21,058: [DefaultQuartzScheduler_Worker-3] DEBUG ProvisionerConfiguration.readConfiguration(200) -  - Provisioner pspng_activedirectory - Setting attributesUsedInGroupSelectionExpressionAreComparedToProvisionerName to true
Thanks – Dean
Dean Guenther                          
Washington State University    Phone:    509 335-0433
Pullman, WA. 99164-1222        fax:      509 335-0540
Identity and Access Management Manager

Archive powered by MHonArc 2.6.19.

Top of Page