LdapGroupProvisioner.fetchTargetSystemGroups is written to only handle a single batch-sized list of groups. However, the FullSync provisioner calls it with all the groups defined for the provisioner.
This leads to:
[From Feb 2017 grouper-users list]
> I have an LdapGroupProvisioner configured with grouperIsAuthoritative
> set to true. It was working fine in my test stem that has a whopping 12
> groups in it. Once I tried to attach the provisioner to a larger stem
> however, I started to hit an error during group cleanup saying there
> were too many groups to fetch.
> Poking around the code, it seems to be generated by the
> fetchTargetSystemGroups call when the number of groups in the
> provisioning item is larger than groupSearch_batchSize. I confirmed that
> by going back to just my test stem and dialing down the batch size to
> 10. Sure enough, I get the same error now. Stack trace below:
> 2017-02-27 15:21:52,500: [pspng_groupOfUniqueNames-FullSync] ERROR
> FullSyncProvisioner.processGroupCleanup(356) - -
> pspng_groupOfUniqueNames: Problem doing group cleanup
> LdapGroupProvisioner.fetchTargetSystemGroups: invoked with too many
> groups to fetch
> at java.lang.Thread.run(Thread.java:745)
> The groupSearch_batchSize defaults to 50. It doesn't seem right to bump
> the batch size up to be greater than my total number of groups in any
> given provisioning item, which can number in the thousands.
> Has anyone else seen this?
> Paul Engle
> Office of Information Technology