Skip to Content.
Sympa Menu

grouper-users - Re: [grouper-users] [PSPNG] Renaming a folder trigger a full sync

Subject: Grouper Users - Open Discussion List

List archive

Re: [grouper-users] [PSPNG] Renaming a folder trigger a full sync

Chronological Thread 
  • From: Yoann Delattre <>
  • To: "Bee-Lindgren, Bert" <>, Jeffrey Williams <>
  • Cc: "" <>, Grouper-Users <>
  • Subject: Re: [grouper-users] [PSPNG] Renaming a folder trigger a full sync
  • Date: Tue, 11 Sep 2018 10:54:47 +0200
  • Arc-authentication-results: i=1;; auth=pass
  • Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed;; s=aclille-dkim; t=1536656093; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jb+tKV1iuy2SpXJPQlqmSfAa9//K0eEYswfWnkBuo4s=; b=Fi8riPLN0H1x9FBAJMZ+3t2pyyyuMew3SVKsMIicieaja9FbSRSPy1PmjpOqLR3kgUUWl5 yYUL7jR/cwmMS0Z8yu3/LJcopF5J0IJJ0RArIBn+wiUohxi4+6NJYyg/4D+hPbp9gFIym3 D4mt7OzSvIJ5D8J0YDiNYKkiltLJBT8=
  • Arc-seal: i=1; s=aclille-dkim;; t=1536656093; a=rsa-sha256; cv=none; b=Yo+d1MviukXr7Fq4cOUKvj28JvVLNtAXTcNScVGGEJ0XcP05GpoHroKPeEZFvkBOckHO4HK0GicH1x71ZlsYm9tcVdr30ZjXR8fbKCzJ/5aCo/3THE8wvvPwTt0+xtSAJhf6lIdXjhY0irTvxbVOMPGvqw2jkgdnfHzmGm7+hvw=
  • Authentication-results:; auth=pass
  • Ironport-phdr: 9a23:Ltc1XBybwTKu2AjXCy+O+j09IxM/srCxBDY+r6Qd2u8WIJqq85mqBkHD//Il1AaPAd2Eraocw8Pt8InYEVQa5piAtH1QOLdtbDQizfssogo7HcSeAlf6JvO5JwYzHcBFSUM3tyrjaRsdF8nxfUDdrWOv5jAOBBr/KRB1JuPoEYLOksi7ze+/94HRbglSmDaxfa55IQmrownWqsQYm5ZpJLwryhvOrHtIeuBWyn1tKFmOgRvy5dq+8YB6/ShItP0v68BPUaPhf6QlVrNYFygpM3o05MLwqxbOSxaE62YGXWUXlhpIBBXF7A3/U5zsvCb2qvZx1S+HNsDtU7s6RSqt4LtqSB/wiScIKTg58H3MisdtiK5XuQ+tqwBjz4LRZoyeKfhwcb7Hfd4CWGRPQMhRWSxCDI2yYYQAAOgOMvpDoobnu1cDtwGzCRWiCe7tzDJDm3/43bc90+QkCQzJ3gsgEMgIsHTSsd77OrkdUeSvw6nU0TXDde1Z0ir65YnIdRAuu/eMXbRqfcXM10YvExnKjkmMqYz/ITyYzf4CvHSC4+pkVOKvj2onpB9rrjih3Mchk4/EjZ8bxFDD8CV22oc1JdugRU56Z96kDIVftzucN4RoXsMuXXtktzgnxb0boZK7ZjYFyJI9yB7DdfOHaZKE4hz5VOqJPDd4gm5qeL2lixms7Eeg1+vxXdS33lZStidJj93Bu3AX2xHX6cWLUOVx8lmu1DqVyQzf9P1ILEYpnqTBMZEh2KQ/lp8LvETDACD2nEL2gbeYd0o64eeo7v7oYrTippOGLYB7lhjyMqAvmsy7BeQ3LBICX2aB+eik1b3j+1P2QKlSg/ErlqTUsIrWKMAYq6KjHQNZzIku5wyhAzu4zNgUhXwHI0hEeBKDgYjpIVbOIPXgAPa/hFSjijFrx/bcMrL8HJrNKmLMkKv9fbZn9UFR0xA8wsxG65JQC7EBJPbzVVHruNzWFB81Kxa0zPr/CNVhyoMeXnqCAqCDMKPVrF+I/vwgI/OVaI8IozbyNeIl5+X1gH89mF8dZrWp3YAJZHyiH/RmJVmZbmT2gtcHD2gKohQyQPb0h1KfTD4AL0q1CugW6zx+LIOgAYjZS4bpyJaMxjvxVslca3paTFqBHDLsdoOIVO0BbgqVI9MnnTUYWLOhDYItyEfq/C33xbR9I/ucxSwcsZPq0cM9s+/dihA28T19J9mb2G7LQm1pyDAmXTgziZF4qEp7gnuO1aFkn+ZVXYhC4PpPVEE2OJrV0/BgBvj7UUfFf9ONRRCoWIP1UnkKUtstzopWMA5GENK4g0WGhnLyWeVHnqGXBJEy7qPX1mTwIMA40Xvdya09lAB/HplQOGejj697sQHYQorIl0GU0aiwJsF+vSfQ6GfW1WOVpwlDVRJoF6zYQXBKd0fbqd3l+lnPFZexBL4iOwpFj8eJb69Lbtnky1tcDOzmJMyYZmuwn2mqAhPd17SFaoysd2gZ1TnBEkUsmgtW+XeCMQV4CD2s

First : thanks everyone for your help :)
I'll try to answer as clearly as possible, i'm not really good in english !

Here the structure of the parent folder i renamed :
app:test-pspng-du-10092018 ---> folder renamed
-- app:test-pspng-du-10092018:test-renommage
-- app:test-pspng-du-10092018:habil:test
-- app:test-pspng-du-10092018:habil:test10092018
-- app:test-pspng-du-10092018:habil:test-titi
-- app:test-pspng-du-10092018:habil:test-titi2

So when i renamed the folder, just 2 provisioners should have been affected : pspng_attrFrEduLilHabilitation and pspng_brancheGrouper

Therefore, editing a group's name would do an independent full-sync of that group in each of the provisioning targets the group was selected for.
That's the problem, this is not the behavior I had : a full sync was started for all the provisioners and not only for the groups concerned but for all groups...(so it takes a lot of time...)

If it can help, an extract from my log when the full sync was triggered :


Le 10/09/2018 à 21:25, Bee-Lindgren, Bert a écrit :

Presently, PSPNG #21 does a synchronous[1], high-priority full-sync of a group that has had changed attributes/name/etc. Therefore, editing a group's name would do an independent full-sync of that group in each of the provisioning targets the group was selected for.

[1]-Synchronous means that incremental changes wait for that full-sync to occur so that the relevant Changelog event can be Done'd/Error'ed accurately.

There are two ways that I think PSPNG could be optimized:
a) Start the full-sync in the background and 'done' the Changelog row, or [Easy]
b) Create a specialized group-update sync that doesn't need to read all the memberships from the Grouper DB nor the Target system  [Harder, see below]

As background, there are (at least) 5 theoretical types of provisioning invocations that could be written:
1- Incremental changes thrown quickly at the provisioning target, now with decent error recovery if they change happens to already be there
2- Full-Sync of a group's membership attribute(s)
3- Provisioning of a group's non-membership attributes
4- Full-sync following an incremental error or on request (messaging)
5- Fixing a Subject's membership in a Group

The desire for provisioners to be fast but also easy to write has led PSPNG to implement two flows: (1) [The fast flow] and (2-5) [The complete-correction flow]. Creating a third provisioning flow for GroupUpdates (3) will add a noticeable amount of complexity to each Provisioner's implementation. Also, there's a possibility that a renamed group might be hard to find by subsequent incremental changes to that group.


Are you seeing the changelog queues fall behind with slow GroupUpdates of big groups?

If so, would you like to the Changelog events be forwarded to a Best-Effort, Asynchronous, Group-Updating full sync?

Or, is the next step to instrument the synchronous full-syncs so that the logs help understand the effects?

Thanks much,



From: on behalf of Jeffrey Williams
Sent: Monday, September 10, 2018 10:12 AM
To: Yoann Delattre
Cc: ; Grouper-Users
Subject: Re: [grouper-users] [PSPNG] Renaming a folder trigger a full sync

It is!  I was curious to see if all of the provisioners normally sync that renamed folder, or did the rename cause an unrelated provisioner, where the folder would be out-of-scope for it, to sync its own groups as well.

The former would make sense since the provisioners run independently of each other and if an event causes a full-sync for one provisioner, it would happen for the others as well.  The latter would be interesting.

For updating stems(i.e. folders), does PSPNG call the full-sync engine to do a targeted sync of the renamed folder?  

On Mon, Sep 10, 2018 at 9:36 AM Yoann Delattre <> wrote:

pspng_attrFrEduLilHabilitation use groupSelectionExpression parameter :

changeLog.consumer.pspng_attrFrEduLilHabilitation.groupSelectionExpression = ${name.startsWith("app:") && name.contains(":habil:")}

pspng_brancheGrouper : provision_to attribute is set on practically all root folder.

pspng_brancheListes : provision_to attribute is only set on a specific folder.

i'm not sure if this is what you're asking for ?

Anyway thanks for your help !

Le 10/09/2018 à 15:22, Jeffrey Williams a écrit :
I'm also curious as to how you're setting your provisioning attributes: immediate folder, parent or *parent folder?  Individual groups?


On Mon, Sep 10, 2018 at 9:20 AM Yoann Delattre <> wrote:

with the last patch : 21.

Le 10/09/2018 à 15:15, Julio Macavilca a écrit :
Just curious, in which patch are you noticing this?


On Mon, Sep 10, 2018 at 9:02 AM, Yoann Delattre <> wrote:

I'm currently testing PSPNG.
During my tests, rename a folder (with some groups in it) triggered a full sync for all the provisioners :

2018-09-10 13:57:00,594: [DefaultQuartzScheduler_Worker-1] INFO FullSyncProvisioner.queueAllGroupsForFullSync(551) -  - FullSyncer(pspng_attrFrEduLilHabilitation): Queuing all groups for full sync. (Work item invokes full sync: ProvisioningWorkItem[done=false,clog=clog #3931352 / ChangeLog type: stem: updateStem])
2018-09-10 13:57:00,613: [DefaultQuartzScheduler_Worker-2] INFO FullSyncProvisioner.queueAllGroupsForFullSync(551) -  - FullSyncer(pspng_brancheListes): Queuing all groups for full sync. (Work item invokes full sync: ProvisioningWorkItem[done=false,clog=clog #3931352 / ChangeLog type: stem: updateStem])
2018-09-10 13:57:02,047: [DefaultQuartzScheduler_Worker-3] INFO FullSyncProvisioner.queueAllGroupsForFullSync(551) -  - FullSyncer(pspng_brancheGrouper): Queuing all groups for full sync. (Work item invokes full sync: ProvisioningWorkItem[done=false,clog=clog #3931352 / ChangeLog type: stem: updateStem])

Is this the expected behavior ?

i'm a little concern because if a full sync of all provisioners is started during work time, provisioning will take more time than usual.

Thanks for your help,

Jeffrey Williams 
Identity Engineer
Identity & Access Services

Jeffrey Williams 
Identity Engineer
Identity & Access Services

Archive powered by MHonArc 2.6.19.

Top of Page