Skip to Content.
Sympa Menu

grouper-users - Re: [grouper-users] Poll: Grouper 2.4 and (Old) PSP

Subject: Grouper Users - Open Discussion List

List archive

Re: [grouper-users] Poll: Grouper 2.4 and (Old) PSP

Chronological Thread 
  • From: Jeffrey Williams <>
  • To: "Bee-Lindgren, Bert" <>
  • Cc: , Grouper-Users <>
  • Subject: Re: [grouper-users] Poll: Grouper 2.4 and (Old) PSP
  • Date: Thu, 20 Sep 2018 13:54:32 -0400
  • Ironport-phdr: 9a23:u23/ExU8O5hyxnXaMW/z8d0CwejV8LGtZVwlr6E/grcLSJyIuqrYbRSAt8tkgFKBZ4jH8fUM07OQ7/i/HzRYqb+681k6OKRWUBEEjchE1ycBO+WiTXPBEfjxciYhF95DXlI2t1uyMExSBdqsLwaK+i764jEdAAjwOhRoLerpBIHSk9631+ev8JHPfglEnjWwba9wIRmssQndqtQdjJd/JKo21hbHuGZDdf5MxWNvK1KTnhL86dm18ZV+7SleuO8v+tBZX6nicKs2UbJXDDI9M2Ao/8LrrgXMTRGO5nQHTGoblAdDDhXf4xH7WpfxtTb6tvZ41SKHM8D6Uaw4VDK/5KpwVhTmlDkIOCI48GHPi8x/kqRboA66pxdix4LYeZyZOOZicq/Ye94RWGhPUdtLVyFZDYy8YYkAAeoPM+hbsofzuUcBoACkCgWwHu7i0CNEimP00KA8zu8vERvG3AslH98WtHrbstv1NKkIUe+rzKjD0DXMb/JS2Tf56YjHaBUhoeqRVr93c8rRx0cuFwLBjlWUqIzqJSiY1vkLs2eH4OpsT/yghHM6qwxopDWk28kiio7Mho0Py1DE8z10wIEvJdKiVEF7ZcCrHIFMuCGdMot6WswiQ3tvuCYn0r0Ko5i7czIPyJs53xLfdvqHfJSH4h75SumePCp4iXR4c7y8nxa/6Vasx+zgWsS21VtKoClIncLQun0I2BHe6cmKR/R480u/xTqC0gXe5f9KLE07k6fQNoQvzaQqlpUJtETOBi/2l1vyjK+Rbkgk//Kn6+XjYrn/uJ+cLJJ4hhjxM6swlMGyDv40MgcJX2ic9uS80KPs8VflT7VNi/06iqjZsJbEKsQHvqO1HQ5Y3poh5hu6ATer088XkWUCIV9Kex+KjofkNlTQLPzkCPqyhkqjnTlkyvzeO73uGJTNLnzNkLf7erZ97lZRyAg9zdFR5pJUDrUBIPPpVULqqdzYCAM2MwOuz+n5Fdp9y5sSWXiTDa+BLKPSrViI6/ogI+mWY48VpS79JOY/5/L3kH85gkESfbOy3ZYMbHC4H+9mI1mCYXbymNsBEGEKvhYgQ+zwjl2NTyJTa2ioU60i+z47FdHuMYCWDKqgjfml3SG3EYdbYCQOIF2WDT2gI4+JQetKYi+fZ8tglDALT7WnY4ggyVehvRP3wLohI+bJrH42r5Xmgfp46ePJmAB6yj1wC8WU1nrFG2N6gWIMQz4/9L15qkM7x1ueh/sry8dEHMBesqsaGjwxMoTRmqkjU4j/

Interestingly enough, I have an example of doing just that in PSPNG for bushy group provisioning to strip out the org stem from

changeLog.consumer.pspng_personBushyLdap.groupCreationLdifTemplate = dn: ${utils.bushyDn(,"cn","ou").replace(",ou=uncg","")}||cn: ${group.extension}||objectclass: group

It'll accept regex as well.  Is that what you're looking for?

On Thu, Sep 20, 2018 at 1:25 PM Bee-Lindgren, Bert <> wrote:


I think provisionedAttributeValueFormat is the gateway to some existing solutions, or perhaps a place to add enhancements...

Since is a java string, some manipulations (like removing a prefix or some regex processing are possible).

I also wonder if there is a Pattern.compile(regex).matcher( _expression_ that would enable more regex manipulation. I'll have to test this to see what is possible and what might be missing.

Please let me know what you think.



From: <> on behalf of Scott Koranda <>
Sent: Thursday, September 20, 2018 10:52 AM
To: Bee-Lindgren, Bert
Subject: Re: [grouper-users] Poll: Grouper 2.4 and (Old) PSP

> What features do you use within PSP that are missing in PSPNG?

The PSP by its nature allows for finer grained control over how details
are provisioned. Because the PSP includes functionality from the
Shibboleth libraries one can configure sophisticated transformations on
the data before it is provisioned. I have used that functionality in a
couple of deployments to work around "interesting" challenges.

As a concrete example here is a snippet from a psp-resolver.xml file
that uses a regex to strip off a prefix from the group name before it is
provisioned as the value for the isMemberOf attribute on a person

    xsi:type="Mapped" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
    <resolver:Dependency ref="memberIsMemberOfUnfiltered" />

I do not immediately see how to do that with the PSPNG. I see the
'provisionedAttributeValueFormat' configuration option, but I do not see
how I can configure an arbitrary regex transformation.

I would be happy to learn how the PSPNG can currently provide the same


Scott K

Jeffrey Williams 
Identity Engineer
Identity & Access Services

Archive powered by MHonArc 2.6.19.

Top of Page