Skip to Content.
Sympa Menu

grouper-users - RE: [grouper-users] PSPNG mostly working

Subject: Grouper Users - Open Discussion List

List archive

RE: [grouper-users] PSPNG mostly working

Chronological Thread 
  • From: "Black, Carey M." <>
  • To: "Weston, Todd" <>, "" <>
  • Subject: RE: [grouper-users] PSPNG mostly working
  • Date: Tue, 3 Mar 2020 18:14:44 +0000
  • Arc-authentication-results: i=1; 1; spf=pass; dmarc=pass action=none; dkim=pass; arc=none
  • Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed;; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4Z/nYHmQa2k66BfLEFNXjYnCjDmBrI5UQMPKkUVFrfU=; b=RZPgE/eCR/WrQdJ7JF9HYk1rdBFeYcdeCiw379G58kel5CnKjACT0OPxAln47u6v1hCrZ6sLrVclJGLD+BopDxXmxmYTI74kG2VMpO6h7DKsWXr5bN2p4LbCdwf+7pyQK4sA0bx0NSTo9/mScKXLxvMxXlFw72YIa70eQPvJ+jvqUlbPLZkFw1hkza9DkEfIxHcKqjk0CvpGDKr2TBFgjmw+BXXapmQs/tTm+pcsFtF5jvh/G4dq+U7xUfn2Ffsvg26Jv5H+vyRm/MBZeYEOXRezXSK20cb5L/td7cMGUARkjvn+V1fpL5Az5X/zvuyb8XVV8vevMO9EuzBZqTtoyA==
  • Arc-seal: i=1; a=rsa-sha256; s=arcselector9901;; cv=none; b=WB72e5EeBPLfrA5wpUwbEvtC4x5WFdzdRfzFehzpMcX4Puq3c1enudjIf7FubNtdDdzZzY2U8gXMHHTR3QXOK3d9lQJFhFR9ekIGx/dPM6BrJOj+eFGh0Mn9n0TgQ+MsCqDAZ0hHGFdztfiKhixlpfFRYxpYUIp8TRCxXSKPRFJNTTOOLMHI/iawQ8zLnmSUXVdNSJNYhbpLh8RwdoTudWIyco+0oaSTKZRmw4lN6ZbLZEGnnGrFxWnZ3AP/Z9nIxc/nHzYHHZBhDHKfO8PL9S9meO38P4F+VSMCjMRG/gn8cDz/aB2qNiKHohBmMCFPuXtvS94psXfmXoMAXExumw==



I would suggest you try to manually trigger a full sync and watch what happens with respect to those groups. ( Maybe an AD access restriction? Just a guess. )



NOTE: You might also want to turn up the log level too. See the section a bit farther down the page “Adjusting log level.” And you can set it in GSH before you manually start the full sync.



Carey Matthew


From: <> On Behalf Of Weston, Todd
Sent: Tuesday, March 3, 2020 11:34 AM
Subject: [grouper-users] PSPNG mostly working


So – I have figured out the majority of provisioning workflow into AD – but have 5 groups that will not provision users into AD. My pspng attribute assignments have been made at the folder level and we have three different pspng configs to push groups into different OUs:

The PSPNG attribute assignments are applied at the affiliates, employees and students folders. All but two of the groups in employees is provisioning users into the groups:

These two groups show membership in the Grouper database of 2063 and 1736, respectively. But their AD counterparts are empty. A similar issue presents in our student groups:

These groups show memberships in the database of 37,543, 1341 and 16,055, respectively, yet AD groups are empty.

All of the remaining groups in both folders have populated their AD groups with no issues and maintain their dynamic membership on a daily basis.


I’m pretty certain the PSPNG config in the is configured correctly as these other groups are provisioning properly and update regularly. And they are in the same folders as the ones that are not working. There are roll-up groups in the above output that we will populate with the child groups eventually, so most of the zero-membership groups in the list aren’t concerning – just the highlighted ones that should be getting memberships.


I have not gone as far as deleting the AD groups and allowing Grouper to recreate them as this is not a desirable method once we go into production. We which to retain the SIDs of these existing groups to make the transition from our current group populator to grouper as seamless as possible. We did empty all of these groups prior to turning on provisioning settings in Grouper – and it’s mostly worked…


One other note: we were running into memory issues originally (Java heap full in the logs) – went from 8GB to 16GB on the app server. The level memory consumption on the server is now close to 10GB, so I don’t believe we’re memory constrained any longer  and I don’t see the Java memory errors.


Any Ideas? I can post filtered logs fi I know what to look for (The grouper_error.log is incredibly noisy).



QR to scan into contacts

Todd Weston

Information Security Analyst, Identity |

Information Technology Services | Washington State University

Phone 509.335.4479 PO Box 641222 Pullman, WA  99164-1222




Archive powered by MHonArc 2.6.19.

Top of Page