Grouper Users - Open Discussion List

["Bee-Lindgren, Bert" <>]

There is no way today to configure PSPNG to provision nested grouper groups as nested ldap groups.

There are three main reasons for this:

1) LDAP servers often do not unwind the nesting, so applications need to have code to identify and handle nested groups. I know Active Directory does flatten memberships for applications, so this doesn't apply to your use case, but just explains why other LDAP servers don't benefit.

2) The "only provision subject memberships" approach works across all groups (composite, etc) while other group types would need to be handled separately because group-math, etc cannot be represented within most (all?) ldap servers.

3) When groups are nested, they obviously all need to be provisioned into the target LDAP server, complicating the marking of groups for provisioning or making the resultant groups incomplete.

I understand the awesome transparency that comes from seeing group-nesting within the LDAP server. And there might be some performance benefits, as there are when nested-groups are used within grouper-loader-maintained groups. However, only policy groups "should" be provisioned into LDAP, and those tend to be downstream of Group Math and, therefore, need to be flattened. Also, with PSPNG doing the work, I'm not sure how "unwieldy" flattened provisioning really is.

In other words, a new setting can probably be added to nest groups when possible, but the many nestings within Grouper will not actually be able to be represented. 

Let us know what you think and create a Jira if you still wish to see the setting added.

Sincerely,

  Bert Bee-Lindgren

---

From: <> on behalf of Sam Erie <>
Sent: Friday, July 6, 2018 8:38 PM
To:
Subject: [grouper-users] PSPNG how to provision only direct members

 

I am bumping this in hopes a more clear subject will get me a response.

Is there a way to only provision direct memberships (immediateMembers)?

I have PSPNG set up for some Organizational Groups in AD. The provisioning is working correctly, however the AD Groups are getting all memberships from the Grouper Groups, direct and indirect.

These are major Organizational Groups that need to hold many groups of groups. It will get unwieldy very quickly if it adds every child (indirect member) as a member.