Grouper Users - Open Discussion List

[Shaun Koh <>]

Hi there,

We are experiencing some issues while testing PSPNG against our Active Directory instance.

1. At times, LDAP 68: ENTRY_EXISTS errors are thrown when members are added to a new or existing group(s).

2018-06-26 12:29:10,351: [DefaultQuartzScheduler_Worker-5] ERROR LdapProvisioner.finishProvisioningBatch(307) -  - Simple ldap provisioning failed for ProvisioningWorkItem[clog=clog #12759602 / ChangeLog type: membership: addMembership,group=campus_card.auckland.ac.nz:PersonOfInterest,subject=123456789@jdbc]
edu.internet2.middleware.grouper.pspng.PspException: LDAP Provisioning failed: javax.naming.NameAlreadyBoundException: [LDAP: error code 68 - 00000562: UpdErr: DSID-031A11E2, problem 6005 (ENTRY_EXISTS), data 0
]; remaining name 'cn=personofinterest.campus_card,ou=campus_card,ou=groups,dc=uoadev,dc=auckland,dc=ac,dc=nz'
        at edu.internet2.middleware.grouper.pspng.LdapProvisioner.makeIndividualLdapChanges(LdapProvisioner.java:600)
        at edu.internet2.middleware.grouper.pspng.LdapProvisioner.finishProvisioningBatch(LdapProvisioner.java:304)
        at edu.internet2.middleware.grouper.pspng.Provisioner.provisionBatchOfItems(Provisioner.java:1405)
        at edu.internet2.middleware.grouper.pspng.PspChangelogConsumerShim.processChangeLogEntries(PspChangelogConsumerShim.java:71)
        at edu.internet2.middleware.grouper.changeLog.ChangeLogHelper.processRecords(ChangeLogHelper.java:245)
        at edu.internet2.middleware.grouper.app.loader.GrouperLoaderType$5.runJob(GrouperLoaderType.java:640)
        at edu.internet2.middleware.grouper.app.loader.GrouperLoaderJob.runJob(GrouperLoaderJob.java:465)
        at edu.internet2.middleware.grouper.app.loader.GrouperLoaderJob.execute(GrouperLoaderJob.java:345)
        at org.quartz.core.JobRunShell.run(JobRunShell.java:202)

Could this be related to https://bugs.internet2.edu/jira/browse/GRP-1588 as PSPNG keeps trying to recreate the same group despite our 

singleGroupSearchFilter working at other times (we filter by CN and objectclass not DN) ? We have applied the patch (15) but not configured enableBulkGroupSearching=false -- also, shouldn't these be logged as WARN and proceed with the next provisioning item instead of ERROR and blocking ?

2. Special characters like '$' and ':' are not being escaped during the provisioning process to AD. This seems related to

https://bugs.internet2.edu/jira/browse/GRP-1533 though progress on the ticket seem to have stagnated since 03/09/2017 -- are they any timelines planed for this fix ?

Any help or suggestions would be appreciated.

Regards,

Shaun K.