Grouper Users - Open Discussion List

[Sam Erie <>]

Bert I really appreciate this explanation, it clears the why of this issue up for me. I am a student employee at the University here, and I am putting together a demo of Grouper with many functions, some which will most likely never see production. This particular function is not for policy groups, but for organization of policy and potentially other groupings. I only meant unwieldy in the way that the Organizational Groups I am provisioning are more for convenience of ldap viewers to see the organization of large groups and groups of groups, so flattened groups of say all UA_Employees would not be useful to the human eye.

I did add a property to the ProvisionerConfiguration class and added (and removed) some code to allow for provisioning of only direct groups when a directOnly property is set. These changes work well enough for my demo, though I still have a problem with removing the changelogs for indirect members that would have been provisioned and it creates a retry loop that is not fit for production.

I will be showcasing my demo soon to some people at the University who are much more experienced with LDAP and the way our University uses these group objects than myself. If it is determined that this particular function should move forward I will look into exactly what we need and why, and move forward with creating a Jira.

Thank you,

-Sam Erie

On Wed, Jul 25, 2018 at 7:47 AM, Bee-Lindgren, Bert <> wrote:

There is no way today to configure PSPNG to provision nested grouper groups as nested ldap groups.

There are three main reasons for this:

1) LDAP servers often do not unwind the nesting, so applications need to have code to identify and handle nested groups. I know Active Directory does flatten memberships for applications, so this doesn't apply to your use case, but just explains why other LDAP servers don't benefit.

2) The "only provision subject memberships" approach works across all groups (composite, etc) while other group types would need to be handled separately because group-math, etc cannot be represented within most (all?) ldap servers.

3) When groups are nested, they obviously all need to be provisioned into the target LDAP server, complicating the marking of groups for provisioning or making the resultant groups incomplete.

I understand the awesome transparency that comes from seeing group-nesting within the LDAP server. And there might be some performance benefits, as there are when nested-groups are used within grouper-loader-maintained groups. However, only policy groups "should" be provisioned into LDAP, and those tend to be downstream of Group Math and, therefore, need to be flattened. Also, with PSPNG doing the work, I'm not sure how "unwieldy" flattened provisioning really is.

In other words, a new setting can probably be added to nest groups when possible, but the many nestings within Grouper will not actually be able to be represented. 

Let us know what you think and create a Jira if you still wish to see the setting added.

Sincerely,

  Bert Bee-Lindgren

---

From: <> on behalf of Sam Erie <>
Sent: Friday, July 6, 2018 8:38 PM
To:
Subject: [grouper-users] PSPNG how to provision only direct members

 

I am bumping this in hopes a more clear subject will get me a response.

Is there a way to only provision direct memberships (immediateMembers)?

I have PSPNG set up for some Organizational Groups in AD. The provisioning is working correctly, however the AD Groups are getting all memberships from the Grouper Groups, direct and indirect.

These are major Organizational Groups that need to hold many groups of groups. It will get unwieldy very quickly if it adds every child (indirect member) as a member.