Grouper Users - Open Discussion List

[Paul Engle <>]

David,
  I think what's happening is that in the second case, you are just
assigning a new value to the existing "etc:pspng:provision_to"
attribute. What you need to happen is to have a second instance of the
"etc:pspng:provision_to" attribute added to the group, with a
different value. I'm not terribly proficient with gsh, so I'm afraid I
don't know the exact method calls to get that to happen. But hopefully
that gives enough information for you to investigate and get the
desired result.


-- 
Paul Engle
IAM Architect
Identity & Access Management
 713-348-4702

On Wed, Aug 18, 2021 at 7:42 AM David A. Kovacic <> wrote:
>
> We have a case where we are trying to provision two separate LDAP 
> attributes using pspng from within the same group, using gsh.
>
> We have the pspng provision_to attributes set up in our 
> grouper-loader.properties file, call the attr1 and attr2.  We are trying to 
> provision the same value (in this case the name of the group) to both 
> attributes.
>
> If we do:
> g = GroupFinder.findByName(s, "test:testGroups:groupA");
> g.getAttributeValueDelegate().assignValueString("etc:pspng:provision_to","attr1");
>
> and
>
> g = GroupFinder.findByName(s, "test:testGroups:groupB");
> g.getAttributeValueDelegate().assignValueString("etc:pspng:provision_to","attr2");
>
> individually for different groups, the LDAP gets provisioned as expected 
> and the UI shows each group set up correctly.
>
> If we do:
> g = GroupFinder.findByName(s, "test:testGroups:groupC");
> g.getAttributeValueDelegate().assignValueString("etc:pspng:provision_to","attr1");
>     .
>       .
>       .
> g = GroupFinder.findByName(s, "test:testGroups:groupC");
> g.getAttributeValueDelegate().assignValueString("etc:pspng:provision_to","attr2");
>
>
> Nothing complains when we run the script, however attr1 seems to get 
> overwritten by attr2 and attr2 is the only thing that gets provisioned.
>
> Doing this through the UI requires us to "add attribute 
> etc:pspng:provision_to" with value attr1 and then do the "add attribute 
> etc:pspng:provision_to" with value attr2.  When we do that, it provisions 
> correctly to both attributes, but we really want to be able to do that via 
> a gsh script.  What are we doing wrong in the script?
>
>
>
> --
> David A. Kovacic
> Sr. Technical Lead
> RCIS
> University Technology, [U]Tech
> Case Western Reserve University
> Email:
> Phone: 216.368.5892
>
>
>
>