You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 17 Next »

Maintain

Run the incremental job from gsh

loaderRunOneJob("CHANGE_LOG_changeLogTempToChangeLog");
loaderRunOneJob("CHANGE_LOG_consumer_pspng_activedirectory");

Run full refresh from GSH (I think this works)

loaderRunOneJob("CHANGE_LOG_changeLogTempToChangeLog");
loaderRunOneJob("PSP_FULL_SYNC.runAtStartup");

 

Mark a group / folder as provisionable to AD

Assign an attribute at a group or folder level with a value of the config for AD

Setup

At Penn initially we would like to sync up a Grouper group with an AD group.  Later on we might want to sync up more groups.  We will use a flat namespace in AD.

In Grouper we have a group:

penn:isc:nandt:apps:vdi:vdiTechnicalUsers

In AD we have an OU for groups:

OU=Grouper,OU=LocalAuth,DC=kite-dev,DC=upenn,DC=edu

The group to go into AD should be:

CN=penn:isc:nandt:apps:vdi:vdiTechnicalUsers,OU=Grouper,OU=LocalAuth,DC=kite-dev,DC=upenn,DC=edu

We have the grouperLoader installed, we will install the PSPNG inside:

  1. Install pspng

    [appadmin@fasttest-mgmt-01 lib]$ pwd
/opt/appserv/tomcat/apps/grouperWs/loader/lib
[appadmin@fasttest-mgmt-01 lib]$ cp /tmp/grouper.pspng-2.3.0/lib/custom/* .
[appadmin@fasttest-mgmt-01 lib]$ cp /tmp/grouper.pspng-2.3.0/dist/grouper-pspng-2.3.0.jar .
[appadmin@fasttest-mgmt-01 lib]$ more /tmp/grouper.pspng-2.3.0/README.txt

  2. Patch pspng

    [appadmin@fasttest-mgmt-01 classes]$ cd /tmp
[appadmin@fasttest-mgmt-01 tmp]$ mkdir installer
[appadmin@fasttest-mgmt-01 tmp]$ cd installer/
[appadmin@fasttest-mgmt-01 installer]$ wget http://software.internet2.edu/grouper/release/2.3.0/grouper.installer-2.3.0.tar.gz
[appadmin@fasttest-mgmt-01 installer]$ tar xzf grouper.installer-2.3.0.tar.gz 
[appadmin@fasttest-mgmt-01 installer]$ cd grouper.installer-2.3.0
[appadmin@fasttest-mgmt-01 grouper.installer-2.3.0]$ java -jar grouperInstaller.jar 
Do you want to 'install' a new installation of grouper, 'upgrade' an existing installation,
  'patch' an existing installation, or 'createPatch' for Grouper developers
  (enter: 'install', 'upgrade', 'patch', 'createPatch' or blank for the default) [install]: patch
Enter in a Grouper temp directory to download tarballs (note: better if no spaces or special chars) [/tmp/installer/grouper.installer-2.3.0]: 
What do you want to patch?  api, ui, ws, pspng, or psp? [api]: pspng
Where is the grouper PSPNG installed? /opt/appserv/tomcat/apps/grouperWs/loader/

  3. Note, upgrade loader to java7 instead of java6

  4. Configure pspng (backup grouper-loader.properties first, then add this)

     
#note the URL should start with ldap: or ldaps: if it is SSL.                                                                       
#It should contain the server and port (optional if not default), and baseDn,                                                       
#e.g. ldaps://ldapserver.school.edu:636/dc=school,dc=edu                                                                            
ldap.pennKiteAd.url = ldaps://someServer.upenn.edu:636/DC=kite,DC=upenn,DC=edu                                                            
#optional, if authenticated                                                                                                         
ldap.pennKiteAd.user = someUserName
#optional, if authenticated, note the password can be stored encrypted in an external file                                          
ldap.pennKiteAd.pass = ************


 
####################################                                                                                                
## PSPNG                                                                                                                            
####################################                                                                                                
changeLog.consumer.pspng_activedirectory.class = edu.internet2.middleware.grouper.pspng.PspChangelogConsumerShim
changeLog.consumer.pspng_activedirectory.type = edu.internet2.middleware.grouper.pspng.LdapGroupProvisioner
changeLog.consumer.pspng_activedirectory.quartzCron = 0 * * * * ?
changeLog.consumer.pspng_activedirectory.ldapPoolName = pennKiteAd
changeLog.consumer.pspng_activedirectory.memberAttributeName = member
changeLog.consumer.pspng_activedirectory.memberAttributeValueFormat = ${ldapUser.getDn()}
changeLog.consumer.pspng_activedirectory.groupSearchBaseDn = OU=Grouper,OU=LocalAuth,DC=kite-dev,DC=upenn,DC=edu
changeLog.consumer.pspng_activedirectory.allGroupsSearchFilter = objectclass=group
changeLog.consumer.pspng_activedirectory.singleGroupSearchFilter = (&(objectclass=group)(cn=${group.name}))
changeLog.consumer.pspng_activedirectory.groupCreationLdifTemplate = dn: cn=${group.name}||cn: ${group.name}||objectclass: group
changeLog.consumer.pspng_activedirectory.userSearchBaseDn = DC=kite-dev,DC=upenn,DC=edu
changeLog.consumer.pspng_activedirectory.userSearchFilter = employeeID=${subject.id}
changeLog.consumer.pspng_activedirectory.userSearchAttributes = dn,cn,uid,mail,samAccountName, uidNumber,objectclass,employeeID
changeLog.psp.fullSync.class = edu.internet2.middleware.grouper.pspng.FullSyncStarter
changeLog.psp.fullSync.quartzCron = 0 0 5 * * ?
# This happens in the background, so should usually be enabled, and should _definitely_
# be enabled when new provisioners are added 
changeLog.psp.fullSync.runAtStartup = true

  5. Test LDAP connectivity via GSH, run a simple filter that returns a string

    edu.internet2.middleware.grouper.ldap.LdapSession.list(String.class, "pennKiteAd", "OU=UnivOfPennsylvania", LdapSearchScope.SUBTREE_SCOPE, "(CN=mchyzer)", "cn");
  6. sdf
  • No labels