Uploaded image for project: 'Grouper'
  1. Grouper
  2. GRP-1588

PSPNG - Ldap Groups - "Entry already exists" errors when groups found by DN/EntryDn/DistinguishedName

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: 2.3.0
    • Fix Version/s: 2.3.0.patch
    • Component/s: provisioning
    • Labels:
      None

      Description

      LDAP-Group provisioning obviously requires that the configured singleGroupSearchFilter actually finds existing ldap groups. If it does not find the existing group, PSPNG will repeatedly try to create it, likely resulting in "LDAP: error code 68 - Entry Already Exists" errors

      For performance reasons, when PSPNG needs to work with multiple grouper groups, it combines multiple singleGroupSearchFilters into a single OR query and unwinds the (unordered) results with a second, fast in-memory search. Unfortunately, unboundid's in-memory search is not compatible with DN escaping. Therefore, filtering on dn/entryDn/DistinguishedName can lead to "Entry Already Exists" errors when the bulk ldap fetch works but unboundid's in-memory search fails and then PSPNG tries to create another copy of the group.

        Smart Checklist

          Attachments

            Activity

              People

              Assignee:
              bert.beelindgren@at.internet2.edu Bert Bee-Lindgren
              Reporter:
              bert.beelindgren@at.internet2.edu Bert Bee-Lindgren
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: