Skip to Content.
Sympa Menu

grouper-users - Re: [Ext] Re: [grouper-users] More PSP-NG: custom user attributes in userSearchFilter

Subject: Grouper Users - Open Discussion List

List archive

Re: [Ext] Re: [grouper-users] More PSP-NG: custom user attributes in userSearchFilter

Chronological Thread 
  • From: Bryan Wooten <>
  • To: "Gettes, Michael" <>, "" <>
  • Cc: "" <>, "" <>
  • Subject: Re: [Ext] Re: [grouper-users] More PSP-NG: custom user attributes in userSearchFilter
  • Date: Tue, 5 Jun 2018 00:13:01 +0000
  • Accept-language: en-US
  • Ironport-phdr: 9a23:PIDJGxej3dR0EcL+mX1rBKJ/lGMj4u6mDksu8pMizoh2WeGdxcWyYx7h7PlgxGXEQZ/co6odzbaO7ua4ASQp2tWoiDg6aptCVhsI2409vjcLJ4q7M3D9N+PgdCcgHc5PBxdP9nC/NlVJSo6lPwWB6nK94iQPFRrhKAF7Ovr6GpLIj8Swyuu+54Dfbx9HiTahYb5+Ngm6oRnMvcQKnIVuLbo8xAHUqXVSYeRWwm1oJVOXnxni48q74YBu/SdNtf8/7sBMSar1cbg2QrxeFzQmLns65Nb3uhnZTAuA/WUTX2MLmRdVGQfF7RX6XpDssivms+d2xSeXMdHqQb0yRD+v9LlgRgP2hygbNj456GDXhdJ2jKJHuxKquhhzz5fJbI2JKPZye6XQds4YS2VcRMZcTyxPDJ2hYYsTAeQPPuhXr4jhqFQBthaxHxWgCfn1xzNUnHL73as32PkhHwHc2wwgGsoDvWnOrNT1LqgSV/2+w6nPzTXEc/NZxzH945XPfx86u/GNXah/cczLxUghEAPFiUmQppLjPz6Oy+QNr3KU7+p6We2xlmEnthh8rz6yzckijYnJg5gaylHC9Shh3ok1IcC4SFJ6Yd6gC5tcrTqaN4xuTsM6WWFovyE6yrMeuZ68fSgKzognywTDZPyAdoiE+hLjVPqNITdgnX5odqiwiA6q/ki71+3zTcu030hWoSpZiNXMt20C2hrO4caEUvtw5lqt1DaP2gzJ7uxJI1o4mbfUJpMu2LI9mYQfvVzdEiL5gkn6kbKael8k9+Wn8ejrfKvqqoKEO4NpiwzzNr4iltK/DOk3KAQDX3KX9OC42bDl4Eb3Wq9FjucsnancqJ3aJdoUpqq+AwJN04Yj8xG/AjW83NsEgXYLNk9FeA6dgIjpIV3BPu33Deqnj1Stljdk2ezGM6X8DpjNLnXPirPscLRn50JBxwc+wspT6p1KBr0ZJfL8QE7xtNjWDh8jNAy0xv7qB85n1oIeQ22PBLWVMa3VsV+P+uIgPe+MaZQIuDbhMfcl5+TigmEkll8AZaWpx4cYaGikHvR6JEWUeXXsgs0GEWcXpgoxUvbqhESfUT5IeXmyRbk86yo/CIKnFofDWputjKKb0Ce6GJ1Wen5JCkqKEXj2a4WIRe0AZzyPLc98wXQ4Uu3rZII9yRy18EffyrFnJ+fQsGVMup//yNVuz/DdkVc/+SEiS4zX3HuKUnl5hCYVXDIsx4h+p1Bw0FGOzfI+jvBFX5QH6OlOTx83L9vB1OFgEPjzXB7MZNGEVAzgT9m7V2IfVNU0lvUUck97U+qliQzO2WL+CaUEnrrNG5sz7q/a92XtLsY7xnrbgvpyx2I6S9dCYDX1zpV08BLeUsuQyx2U

Last week my co-work and I spent most of a day trying to figure out Jexl.

The wiki examples were trivial. But we had a use case to load AD groups into Grouper keeping the AD hierarchy. (cn=group1, ou=groups, ou=dept1, ou=majorOrg,dc=school,dc=edu) where all the ou’s become stems/folders and the cn is the group name).

Using a basic LDAP filter like (&(objectclass=group)(cn=hospital*))

So the wiki provided no complete list of methods available to the Java class LoaderLdap.ElUtils.

So we ended searching for the source (LoaderLdap.ElUtils) on Git. And found the exact method needed. It performed as expected! Victory.

Grouper can be made very functional via configuration only, if you know the subtleties of the syntax and relations to the various property files.

I know submissions to the wiki are encouraged, but sometimes I feel a grouper-documentation list could be a benefit. But I have had bad ideas before.


From: <> on behalf of "Gettes, Michael" <>
Date: Monday, June 4, 2018 at 3:46 PM
To: Paul Engle <>
Cc: "" <>, "" <>
Subject: [Ext] Re: [grouper-users] More PSP-NG: custom user attributes in userSearchFilter

WARNING: Stop. Think. Read. This is an external email.

+1 - this is part of where the documentation is lacking a little bit and what led to the questions I had about JEXL in grouper and how it is used.


On Jun 4, 2018, at 5:16 PM, Paul Engle <> wrote:

  Is this in an LdapGroupProvisioner or an LdapAttributeProvisioner? In the group provisioner, anytime I've needed something from the user entry, I've referenced it as ${ldapUser.getStringValue('foo')}.  I've only used the ${subject} reference in the attribute provisioner. I don't know if that makes a difference or not, or under what contexts each of those objects is available.

Paul Engle
Office of Information Technology

On Mon, Jun 4, 2018 at 3:44 PM Coleman, Erik C <> wrote:



As a follow-up to my two subject sources scenario, I’m having trouble with custom subject attributes. I now have PSP-NG turned on, and it successfully syncs groups that are set with the provision_to attribute, but when it comes time to add members, I’m getting this error in the logs:


grouper-api;grouper_error.log;2018-06-04 19:36:59,091: [uofi_urbana-FullSync-Thread] ERROR Provisioner.evaluateJexlExpression(556) - - Jexl _expression_ samAccountName=${subject.getAttributeValue("samAccountName")} could not be evaluated for subject ''650000001'/'person'/'uofinetid'/null' and group 'null/null' which used variableMap '{userSearchBaseDn=ou=people,dc=ad,dc=uillinois,dc=edu, provisionerType=LdapGroupProvisioner, groupCreationBaseDn=ou=AuthMan,ou=CITES-Services,ou=CITES,ou=Urbana,dc=ad,dc=uillinois,dc=edu, utils=edu.internet2.middleware.grouper.pspng.PspJexlUtils@4f7f3b36, subject='650000001'/'person'/'uofinetid', provisionerName=uofi_urbana, groupSearchBaseDn=ou=AuthMan,ou=CITES-Services,ou=CITES,ou=Urbana,dc=ad,dc=uillinois,dc=edu}'


Here’s what I have set in


changeLog.consumer.uofi_urbana.userSearchFilter = samAccountName=${subject.getAttributeValue("samAccountName")}


This used to work in our older “pre-TIER” test environment. I’ve considered alternatives:


samAccountName=${}  -- won’t work because we specify subject id using our own uiucEduUIN attribute as specified in the


uiucEduUIN=${} – won’t work because one of my subject sources doesn’t use uiucEduUIN for subject id, it uses samAccountName.


Switching to use samAccountName for subject id won’t work, because we have too many people changing netids quite often.


A look at my personal subject record in Grouper appears to have everything it’s trying to evaluate:


Unique ID:




Coleman, Erik C



Coleman, Erik C


uiuceduuin:        650000001

dn:        CN=ecc,ou=People,dc=ad,dc=uillinois,dc=edu

displayname:     Coleman, Erik C

department:      Technology Services

distinguishedname:              CN=ecc,OU=People,DC=ad,DC=uillinois,DC=edu

samaccountname:          ecc

Member ID:       6fe2e751a0e14e41b896ee6cb8e23e02

Source ID:          uofinetid

Source name:    UOFI AD People


Why is the JEXL _expression_ getting an error? What’s the right JEXL syntax for referencing a “custom” attribute in a subject?




Erik Coleman

University of Illinois at Urbana-Champaign



Archive powered by MHonArc 2.6.19.

Top of Page