Grouper Users - Open Discussion List

[Shilen Patel <>]

It might need some tweaking if it’s going to run regularly and/or part of the 
bad membership job.  I’ll take a look.

- Shilen

On 10/8/19, 1:53 PM, " on behalf of Hyzer, 
Chris" < on behalf of 
> wrote:

    Shilen, if this is not in the fix bad memberships job, can it be added 
(and should it be added?)
    
    Note: stem sets are assumed to be there for everything, so even if you 
don’t use pspng or attestation, you need it to be correct.
    
    Thanks!
    
    -----Original Message-----
    From:  
<> On Behalf Of Christopher Bongaarts
    Sent: Tuesday, October 08, 2019 1:45 PM
    To:  Mailing List <>
    Subject: [grouper-users] Lurking issue: STEM_SETS table
    
    This email is part heads-up, and maybe a suggestion for adding an 
    upgrade task if it's not already there:
    
    We are in the process of upgrading from Grouper 2.2.1 to 2.4, and as 
    part of that upgrade, we are switching our method of LDAP provisioning 
    from a custom ChangeLogConsumer job to PSPNG.  One oddity we discovered 
    was that tagging a top or mid level folder with the provision_to 
    attributes would cause some, but not all, of the groups below it to be 
    provisioned during a full sync (and the others were helpfully(?) deleted).
    
    After nosing around in the source code, we discovered that the issue was 
    the STEM_SETS table had incomplete data in it.  On a previous upgrade 
    step (either from 1.5 or 2.0 to 2.2, I forget which), the STEM_SETS 
    table was not built for the groups that existed at the time.  I'm not 
    sure if that was a separate step we were supposed to perform, or if the 
    Grouper Installer was supposed to do it for us.  It didn't matter much 
    at the time, since it appears that the only things that use the 
    STEM_SETS table are PSPNG and attestation, neither of which we used in 
    2.2.  Folders that were added after the 2.2 upgrade "worked" for 
    provisioning, while those added before did not, because the new folders 
    had been added to STEM_SETS as they were created.
    
    Running SyncStemSets.fullSync() in gsh rebuilt the STEM_SETS table and 
    made everything work as expected.
    
    So if your PSPNG full sync does not seem to catch everything you think, 
    or attestation is not covering what you expect, you can try rebuilding 
    your STEM_SETS table.  And perhaps that rebuild should be added to the 
    tasks that the Grouper Loader/Daemon does by default, and/or as a step 
    in the Grouper Installer process.
    
    But mostly this is here as a future search engine landmark in case 
    someone encounters the same issue.
    
    -- 
    %%  Christopher A. Bongaarts   %%            %%
    %%  OIT - Identity Management  %%  
https://urldefense.proofpoint.com/v2/url?u=http-3A__umn.edu_-7Ecab&d=DwIGaQ&c=imBPVzF25OnBgGmVOlcsiEgHoG1i6YHLR0Sj_gZ4adc&r=sWqutME58phurE0oO57Icg&m=gYq4Zi_y20lLPgOUg0YDan4xKp7b7FjlyryIK2U7lJ4&s=EMwjFCWoy3weSuZxfhT-OgXcchKSBe1eURfByRMUpW8&e=
   %%
    %%  University of Minnesota    %%  +1 (612) 625-1809    %%