Uploaded image for project: 'Grouper'
  1. Grouper
  2. GRP-1588

PSPNG - Ldap Groups - "Entry already exists" errors when groups found by DN/EntryDn/DistinguishedName

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Minor
    • 2.3.0.patch
    • 2.3.0
    • provisioning
    • None

    Description

      LDAP-Group provisioning obviously requires that the configured singleGroupSearchFilter actually finds existing ldap groups. If it does not find the existing group, PSPNG will repeatedly try to create it, likely resulting in "LDAP: error code 68 - Entry Already Exists" errors

      For performance reasons, when PSPNG needs to work with multiple grouper groups, it combines multiple singleGroupSearchFilters into a single OR query and unwinds the (unordered) results with a second, fast in-memory search. Unfortunately, unboundid's in-memory search is not compatible with DN escaping. Therefore, filtering on dn/entryDn/DistinguishedName can lead to "Entry Already Exists" errors when the bulk ldap fetch works but unboundid's in-memory search fails and then PSPNG tries to create another copy of the group.

      Attachments

        Activity

          People

            bert.beelindgren@at.internet2.edu Bert Bee-Lindgren
            bert.beelindgren@at.internet2.edu Bert Bee-Lindgren
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: