grouper-users - [grouper-users] JEXL syntax with PSPNG filters

Subject: Grouper Users - Open Discussion List

List archive

[grouper-users] JEXL syntax with PSPNG filters

From: "Coleman, Erik C" <>
To: "" <>
Subject: [grouper-users] JEXL syntax with PSPNG filters
Date: Wed, 10 Jul 2019 20:21:57 +0000

Hi all,

Some of you may have seen my post over on the Slack channel, but I have not been able to resolve this, so I’m casting to a wider audience. I have our PSP-NG configuration set to match users to be placed in LDAP groups using a filter as follows in grouper-loader.properties:

changeLog.consumer.uofi_urbana.userSearchFilter = samaccountname=${subject.getAttributeValue('samaccountname')}

changeLog.consumer.uofi_urbana.userSearchAttributes = cn,distinguishedName,uiucEduUIN,displayName,samaccountname,objectClass

This filter was working, but somewhere along the line (I’m still trying to track down a patch/date where this changed) it seems to be failing the JEXL parsing when trying to resolve subjects, now I get the following exception stack shown at the end of this message.

I was able to use a filter that matches our UIN (an immutable ID) with ${subject.id} without error, however that isn’t ideal because we have some accounts (such as app service accounts) that don’t have UINs. I’d like to be able to match on the subject Identifier (not the ID) as the AD attribute “samaccountname” is used as the subject Identifier and is guaranteed to be unique within the LDAP, but apparently something is awry with the JEXL parsing. Does anyone have some ideas or tricks?

Thanks,

Erik Coleman

--------------------------

Dump of exception:

grouper-daemon;grouper_daemon.log;aws-prod;617683844790;2019-06-19 11:09:36,980: [FullSyncer(uofi_urbana)-Thread] INFO ProgressMonitor.<init>(36) - - Fetching subjects Started: TotalWorkExpected=9

grouper-daemon;grouper_daemon.log;aws-prod;617683844790;2019-06-19 11:09:36,980: [TSUserFetcher-uofi_urbana-full-1] DEBUG LdapProvisioner.fetchTargetSystemUsers(200) - - Fetching 9 users from target system

grouper-daemon;grouper_daemon.log;aws-prod;617683844790;2019-06-19 11:09:36,981: [TSUserFetcher-uofi_urbana-full-1] ERROR Provisioner.evaluateJexlExpression(746) - - Jexl _expression_ UserSearchFilter 'samaccountname=${edu.internet2.middleware.subject.getAttributeValue('samaccountname')}' could not be evaluated for subject ''650772210'/'person'/'uofinetid'/null' and group 'null/null' which used variableMap '{userSearchBaseDn=dc=ad,dc=uillinois,dc=edu, provisionerType=LdapGroupProvisioner, groupCreationBaseDn=ou=AuthMan,ou=Urbana,dc=ad,dc=uillinois,dc=edu, utils=edu.internet2.middleware.grouper.pspng.PspJexlUtils@320ed7d7, subject='650772210'/'person'/'uofinetid', provisionerName=uofi_urbana, groupSearchBaseDn=ou=AuthMan,ou=Urbana,dc=ad,dc=uillinois,dc=edu}'

java.lang.RuntimeException: Error substituting string: '${edu.internet2.middleware.subject.getAttributeValue('samaccountname')}'

at edu.internet2.middleware.grouper.util.GrouperUtil.substituteExpressionLanguage(GrouperUtil.java:9401)

at edu.internet2.middleware.grouper.pspng.Provisioner.evaluateJexlExpression(Provisioner.java:702)

at edu.internet2.middleware.grouper.pspng.LdapProvisioner.getUserLdapFilter(LdapProvisioner.java:283)

at edu.internet2.middleware.grouper.pspng.LdapProvisioner.fetchTargetSystemUsers(LdapProvisioner.java:211)

at edu.internet2.middleware.grouper.pspng.Provisioner$2.call(Provisioner.java:847)

at edu.internet2.middleware.grouper.pspng.Provisioner$2.call(Provisioner.java:841)

at java.util.concurrent.FutureTask.run(FutureTask.java:266)

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)

at java.lang.Thread.run(Thread.java:748)

Caused by: org.apache.commons.jexl2.JexlException: edu.internet2.middleware.grouper.util.GrouperUtil.substituteExpressionLanguage@9346![33,68]: 'edu.internet2.middleware.subject.getAttributeValue('samaccountname');' method invocation error

at org.apache.commons.jexl2.Interpreter.call(Interpreter.java:1076)

at org.apache.commons.jexl2.Interpreter.visit(Interpreter.java:1100)

at org.apache.commons.jexl2.parser.ASTMethodNode.jjtAccept(ASTMethodNode.java:18)

at org.apache.commons.jexl2.Interpreter.visit(Interpreter.java:1317)

at org.apache.commons.jexl2.parser.ASTReference.jjtAccept(ASTReference.java:18)

at org.apache.commons.jexl2.Interpreter.interpret(Interpreter.java:232)

at org.apache.commons.jexl2.ExpressionImpl.evaluate(ExpressionImpl.java:65)

at edu.internet2.middleware.grouper.util.GrouperUtil.substituteExpressionLanguage(GrouperUtil.java:9352)

... 9 more

Caused by: java.lang.IllegalStateException: There is no open GrouperSession detected. Make sure to start a grouper session (e.g. GrouperSession.startRootSession() if you want to use a root session ) before calling this method

at edu.internet2.middleware.grouper.GrouperSession.staticGrouperSession(GrouperSession.java:1150)

at edu.internet2.middleware.grouper.GrouperSession.staticGrouperSession(GrouperSession.java:1098)

at edu.internet2.middleware.grouper.subj.SourcesXmlResolver.find(SourcesXmlResolver.java:316)

at edu.internet2.middleware.grouper.subj.CachingResolver.find(CachingResolver.java:143)

at edu.internet2.middleware.grouper.subj.ValidatingResolver.find(ValidatingResolver.java:105)

at edu.internet2.middleware.grouper.SubjectFinder.findByIdAndSource(SubjectFinder.java:504)

at edu.internet2.middleware.grouper.subj.LazySubject.getSubject(LazySubject.java:215)

at edu.internet2.middleware.grouper.subj.LazySubject.getAttributeValue(LazySubject.java:139)

at sun.reflect.GeneratedMethodAccessor985.invoke(Unknown Source)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

at java.lang.reflect.Method.invoke(Method.java:498)

at org.apache.commons.jexl2.internal.MethodExecutor.execute(MethodExecutor.java:64)

at org.apache.commons.jexl2.internal.AbstractExecutor$Method.invoke(AbstractExecutor.java:327)

at org.apache.commons.jexl2.Interpreter.call(Interpreter.java:1068)

... 16 more

grouper-daemon;grouper_daemon.log;aws-prod;617683844790;2019-06-19 11:09:36,981: [TSUserFetcher-uofi_urbana-full-1] WARN Provisioner$2.call(849) - - Batch-fetching subject information failed. Trying fetching information for each subject individually

edu.internet2.middleware.grouper.pspng.PspException: Jexl evaluation failed: Error substituting string: '${edu.internet2.middleware.subject.getAttributeValue('samaccountname')}'

at edu.internet2.middleware.grouper.pspng.Provisioner.evaluateJexlExpression(Provisioner.java:751)