Grouper Users - Open Discussion List

["Crawford, Jeffrey" <>]

Hi Andre,

 

So are you trying to create a provisioner and keep the group list flat? But have a distinct provisioner for different folders in the structure? In that case, when you are creating the changelog entries i.e. a provisioning point like pspsng_GroupA as “changelog.consumer.pspng_GroupA…” and then apply the etc:pspng:provision_to attribute with the value pspng_GroupA to structure in grouper were you want it to start provisioning.

 

Then add the a second provisioner entry for pspng_GroupB like above and apply the provision_to attribute to the other folder in the grouper org. Then each of the changelog.consumer.pspng_GroupA.groupSearchBaseDN = ou=groupa,ou=groups,… and changelog.consumer.pspng_GroupA.groupSearchBaseDN = ou=groupb,ou=groups,… We assume the other configuration points would otherwise be the same between the GroupA and GroupB loader definitions.

 

As an example of how to apply the attributes in a grouper shell, (not sure we should be attaching images here for how to do this on the ui) would look something like:

grouperSession = GrouperSession.startRootSession();

attributeDefName = AttributeDefNameFinder.findByName("etc:pspng:provision_to", true);

stem = StemFinder.findByName(grouperSession, "path:to:GroupA");

stem.getAttributeDelegate().assignAttribute(attributeDefName);

stem.getAttributeValueDelegate().assignValueString(attributeDefName.getName(), "pspng_GroupA");

stem = StemFinder.findByName(grouperSession, "path:to:GroupB");

stem.getAttributeDelegate().removeAttribute(attributeDefName);

stem.getAttributeDelegate().assignAttribute(attributeDefName);

stem.getAttributeValueDelegate().assignValueString(attributeDefName.getName(), "pspng_GroupB");

 

Jeffrey C.

 

From: <> on behalf of Andre Daniels <>
Reply-To: "" <>
Date: Friday, January 25, 2019 at 5:48 PM
To: "" <>
Subject: [grouper-users] Grouper

 

Hello,

 

I am a not sure how to best configure pspng to provision to an ldap ou that has a folder-like hierarchy and groups with similar names. The groupSearchBaseDn does not appear to accept a jexl _expression_, so how does one prevent name collision? If I set the baseDn to allGroups, how does the provisioner determine whether a given update is for the allGroups:groupA:admins or allGroups:groupB:admins?

 

Thanks,

Andre

 

--

Andre Daniels 

Sr. Developer/Security Analyst

University of California Santa Cruz

(831) 459-1980