Grouper Users - Open Discussion List

["Morgan, Andrew Jason" <>]

I'm experimenting with PSPNG as a replacement for PSP, but I'm stuck on a specific use-case.  Is anyone using PSPNG with a non-AD LDAP server with bushy layout?

Following the examples, I configured PSPNG to provision to AD with the gidNumber attribute as a unique identifier for the group.  Here is a little snippet of the config for that:

changeLog.consumer.pspng_activedirectory.grouperIsAuthoritative = true

changeLog.consumer.pspng_activedirectory.allGroupsSearchFilter = (objectclass=group)

changeLog.consumer.pspng_activedirectory.singleGroupSearchFilter = (&(objectclass=group)(gidNumber=${group.idIndex}))

changeLog.consumer.pspng_activedirectory.groupCreationLdifTemplate = dn: ${utils.bushyDn(group.name.replaceFirst("^psp:",""), "cn", "ou")}

  ||cn: ${group.extension}

  ||objectclass: group

  ||gidNumber: ${group.idIndex}

  ||samAccountName: ${group.name.replaceFirst("^psp:","").replaceAll(":","_")}

  ||displayname:${group.displayName.replace(group.parentStemName.toString()+":","")}

  ||description:${org.apache.commons.lang3.StringUtils.abbreviate(group.description == null ? null : group.description.replaceAll("\\r\\n"," ").replaceAll("\\n"," ").replaceAll("\\r"," "), 900)}

There is some JEXL to remove the old baseStemDN ("psp:"), but otherwise it is a basic bushy layout config.

I'm trying to do the same thing for our Oracle DSEE LDAP server, but I don't see a clean way to do it.  I need to create a working singleGroupSearchFilter, but gidNumber is not an allowed attribute on objectclass=groupOfUniqueNames (or groupOfNames).  We want to keep our bushy layout.  Here are a couple ideas:

1. Stick the group.idIndex in the "description" attribute
2. Create the groups with objectclass=groupOfUniqueNames,posixGroup (not allowed by the schema, but ODSEE doesn't enforce it) and use gidNumber
   
3. Create a new Auxiliary objectclass "osuGrouperGroup" that allows gidNumber
4. Use bushyDN but stick the whole group name in the "cn" attribute so that cn is unique

Are there other ideas?  Is anyone else using bushy layout with ODSEE, OpenLDAP, etc?

Thanks,

Andy Morgan

Identity & Access Management

Oregon State University