You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@syncope.apache.org by Martin Goldstone <m....@keele.ac.uk> on 2016/03/17 18:12:55 UTC
LDAP synchronisation and User derived attribute as account ID with
database resource
Hi All,
I'm currently building a proof of concept using Apache Syncope 1.2.7. I've
managed to create a user by synchronising from our openLDAP directory, and
I've also managed to manually create a user and sync ldap to it. I've then
successfully synchronised with a database containing additional fields for
that user. The accountid field in the database is contained within the data
from LDAP, mapped to an attribute called roll_number.
I have another database that I want to synchronise additional data for this
user from, but its accountid is roll_number with a prefix of 'K'. If I
manually create another attribute for the user, populate it by hand with
the relevant value beginning with 'K', and set the mapping accordingly I
can synchronise this properly. However, if I set up a derived attribute for
this consisting of 'K'+roll_number, assign this attribute to the user and
set the mappings accordingly, it does not synchronise the data. The status
says success but the execution history shows it did nothing (Users
[created/failures]: 0/0 [updated/failures]: 0/0 [deleted/failures]: 0/0 [no
operation/ignored]: 0/0). I thought of creating a synchronisation policy,
but derived attributes are not listed when creating it.
Can anyone point me in the right direction? Unfortunately I am not in a
position to simply get rid of the 'K' prefix.
Thanks.
--
Martin Goldstone
IT Systems Administrator
IT Services, Innovation Centre 1 (IC1)
Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
Telephone: +44 1782 734457
G+: http://google.com/+MartinGoldstoneKeele
Re: LDAP synchronisation and User derived attribute as account ID
with database resource
Posted by Martin Goldstone <m....@keele.ac.uk>.
The only thing that pops up when I run the sync task is a message stating
"WARN org.apache.syncope.core.sync.impl.AbstractSyncopeResultHandler -
literals and values have different size"
On 18 March 2016 at 14:29, Marco Di Sabatino Di Diodoro <
marco.disabatino@tirasa.net> wrote:
>
>
> Il 18/03/2016 15:08, Martin Goldstone ha scritto:
>
> Yes, I can see the derived attribute when I look at the users after
> syncing from LDAP.
>
> Please, check in your core logs if there are some errors.
>
>
>
>
> On 18 March 2016 at 14:06, Marco Di Sabatino Di Diodoro <
> <ma...@tirasa.net> wrote:
>
>>
>>
>> Il 18/03/2016 11:55, Martin Goldstone ha scritto:
>>
>> roll_number (as stored as kdirUrn in LDAP and as HRID in staffdb) does
>> not ordinarily have the prefix of 'K'. It has a prefix within this
>> simplified carddb as in the real card database system, multiple systems
>> feed data into it and this field has various prefixes depending on the
>> source of the data (card users coming from the HR system have one prefix,
>> coming from Student Records they have another, and another prefix for a 3rd
>> system. Those individual systems do not have the prefix present in their
>> identifiers).
>>
>> Perhaps I have got things backwards. Given that I can't change there
>> being a prefix in carddb, what would be the best way to handle this?
>>
>>
>> In your sync task configurations, have you configured the Allow create
>> operations and Allow update operations?
>> When you sync from Ldap, the synched users have the derived attribute
>> populated on Syncope?
>>
>
>
>
>
>> M
>>
>>
>> On 18 March 2016 at 10:38, Marco Di Sabatino Di Diodoro <
>> marco.disabatino@tirasa.net> wrote:
>>
>>>
>>>
>>> Il 18/03/2016 10:28, Martin Goldstone ha scritto:
>>>
>>> Hi Marco,
>>>
>>> Attached are screenshots of these mappings.
>>>
>>> The second database (the one with the K prefix), is one in the
>>> carddb_mapping.
>>>
>>> I've also included the derived attribute (staff_ex_link)
>>>
>>>
>>> There is an error in your carddb resource mapping. If you need a
>>> mapping with a derived attribute, it's necessary that the attributes that
>>> compose it are present in the set of attributes that you pull from the
>>> resource (roll_number is not present in the resource).
>>>
>>> Why you add the "K" if the attribute already contains it?
>>>
>>> Marco
>>>
>>> Thanks.
>>>
>>> On 18 March 2016 at 08:32, Marco Di Sabatino Di Diodoro <
>>> <ma...@tirasa.net> wrote:
>>>
>>>> Hi Martin,
>>>>
>>>> Il 17/03/2016 18:12, Martin Goldstone ha scritto:
>>>>
>>>> Hi All,
>>>>
>>>> I'm currently building a proof of concept using Apache Syncope 1.2.7.
>>>> I've managed to create a user by synchronising from our openLDAP directory,
>>>> and I've also managed to manually create a user and sync ldap to it. I've
>>>> then successfully synchronised with a database containing additional fields
>>>> for that user. The accountid field in the database is contained within the
>>>> data from LDAP, mapped to an attribute called roll_number.
>>>>
>>>> I have another database that I want to synchronise additional data for
>>>> this user from, but its accountid is roll_number with a prefix of 'K'. If I
>>>> manually create another attribute for the user, populate it by hand with
>>>> the relevant value beginning with 'K', and set the mapping accordingly I
>>>> can synchronise this properly. However, if I set up a derived attribute for
>>>> this consisting of 'K'+roll_number, assign this attribute to the user and
>>>> set the mappings accordingly, it does not synchronise the data. The status
>>>> says success but the execution history shows it did nothing (Users
>>>> [created/failures]: 0/0 [updated/failures]: 0/0 [deleted/failures]: 0/0 [no
>>>> operation/ignored]: 0/0). I thought of creating a synchronisation policy,
>>>> but derived attributes are not listed when creating it.
>>>>
>>>> Can anyone point me in the right direction? Unfortunately I am not in a
>>>> position to simply get rid of the 'K' prefix.
>>>>
>>>> Please send me all your resource mapping configurations. I don't
>>>> understand if the derived attribute is configured in the first or second
>>>> (roll_number with a prefix of 'K') database.
>>>>
>>>> Marco
>>>>
>>>> Thanks.
>>>>
>>>> --
>>>> Martin Goldstone
>>>> IT Systems Administrator
>>>> IT Services, Innovation Centre 1 (IC1)
>>>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>>>> Telephone: +44 1782 734457 <%2B44%201782%20734457>
>>>> G+: <http://google.com/+MartinGoldstoneKeele>
>>>> http://google.com/+MartinGoldstoneKeele
>>>>
>>>>
>>>> --
>>>> Dott. Marco Di Sabatino Di Diodoro
>>>> Tel. +39 3939065570
>>>>
>>>> Tirasa S.r.l.
>>>> Viale D'Annunzio 267 - 65127 Pescara
>>>> Tel +39 0859116307 / FAX +39 0859111173http://www.tirasa.net
>>>>
>>>> Apache Syncope PMC Memberhttp://people.apache.org/~mdisabatino/
>>>>
>>>>
>>>
>>>
>>> --
>>> Martin Goldstone
>>> IT Systems Administrator
>>> IT Services, Innovation Centre 1 (IC1)
>>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>>> Telephone: +44 1782 734457 <%2B44%201782%20734457>
>>> G+: http://google.com/+MartinGoldstoneKeele
>>>
>>>
>>> --
>>> Dott. Marco Di Sabatino Di Diodoro
>>> Tel. +39 3939065570
>>>
>>> Tirasa S.r.l.
>>> Viale D'Annunzio 267 - 65127 Pescara
>>> Tel +39 0859116307 / FAX +39 0859111173http://www.tirasa.net
>>>
>>> Apache Syncope PMC Memberhttp://people.apache.org/~mdisabatino/
>>>
>>>
>>
>>
>> --
>> Martin Goldstone
>> IT Systems Administrator
>> IT Services, Innovation Centre 1 (IC1)
>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>> Telephone: +44 1782 734457 <%2B44%201782%20734457>
>> G+: <http://google.com/+MartinGoldstoneKeele>
>> http://google.com/+MartinGoldstoneKeele
>>
>>
>> --
>> Dott. Marco Di Sabatino Di Diodoro
>> Tel. +39 3939065570
>>
>> Tirasa S.r.l.
>> Viale D'Annunzio 267 - 65127 Pescara
>> Tel +39 0859116307 / FAX +39 0859111173http://www.tirasa.net
>>
>> Apache Syncope PMC Memberhttp://people.apache.org/~mdisabatino/
>>
>>
>
>
> --
> Martin Goldstone
> IT Systems Administrator
> IT Services, Innovation Centre 1 (IC1)
> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
> Telephone: +44 1782 734457
> G+: <http://google.com/+MartinGoldstoneKeele>
> http://google.com/+MartinGoldstoneKeele
>
>
> --
> Dott. Marco Di Sabatino Di Diodoro
> Tel. +39 3939065570
>
> Tirasa S.r.l.
> Viale D'Annunzio 267 - 65127 Pescara
> Tel +39 0859116307 / FAX +39 0859111173http://www.tirasa.net
>
> Apache Syncope PMC Memberhttp://people.apache.org/~mdisabatino/
>
>
--
Martin Goldstone
IT Systems Administrator
IT Services, Innovation Centre 1 (IC1)
Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
Telephone: +44 1782 734457
G+: http://google.com/+MartinGoldstoneKeele
Re: LDAP synchronisation and User derived attribute as account ID
with database resource
Posted by Marco Di Sabatino Di Diodoro <ma...@tirasa.net>.
Il 18/03/2016 15:08, Martin Goldstone ha scritto:
> Yes, I can see the derived attribute when I look at the users after
> syncing from LDAP.
>
Please, check in your core logs if there are some errors.
> On 18 March 2016 at 14:06, Marco Di Sabatino Di Diodoro
> <marco.disabatino@tirasa.net <ma...@tirasa.net>> wrote:
>
>
>
> Il 18/03/2016 11:55, Martin Goldstone ha scritto:
>> roll_number (as stored as kdirUrn in LDAP and as HRID in staffdb)
>> does not ordinarily have the prefix of 'K'. It has a prefix
>> within this simplified carddb as in the real card database
>> system, multiple systems feed data into it and this field has
>> various prefixes depending on the source of the data (card users
>> coming from the HR system have one prefix, coming from Student
>> Records they have another, and another prefix for a 3rd system.
>> Those individual systems do not have the prefix present in their
>> identifiers).
>>
>> Perhaps I have got things backwards. Given that I can't change
>> there being a prefix in carddb, what would be the best way to
>> handle this?
>
> In your sync task configurations, have you configured the Allow
> create operations and Allow update operations?
> When you sync from Ldap, the synched users have the derived
> attribute populated on Syncope?
>
>
> M
>>
>> On 18 March 2016 at 10:38, Marco Di Sabatino Di Diodoro
>> <marco.disabatino@tirasa.net
>> <ma...@tirasa.net>> wrote:
>>
>>
>>
>> Il 18/03/2016 10:28, Martin Goldstone ha scritto:
>>> Hi Marco,
>>>
>>> Attached are screenshots of these mappings.
>>>
>>> The second database (the one with the K prefix), is one in
>>> the carddb_mapping.
>>>
>>> I've also included the derived attribute (staff_ex_link)
>>>
>>
>> There is an error in your carddb resource mapping. If you
>> needa mapping with a derived attribute, it's necessary that
>> the attributes that compose it are present in the set of
>> attributes that you pull from the resource (roll_number is
>> not present in the resource).
>>
>> Why you add the "K" if the attribute already contains it?
>>
>> Marco
>>
>>> Thanks.
>>>
>>> On 18 March 2016 at 08:32, Marco Di Sabatino Di Diodoro
>>> <marco.disabatino@tirasa.net
>>> <ma...@tirasa.net>> wrote:
>>>
>>> Hi Martin,
>>>
>>> Il 17/03/2016 18:12, Martin Goldstone ha scritto:
>>>> Hi All,
>>>>
>>>> I'm currently building a proof of concept using Apache
>>>> Syncope 1.2.7. I've managed to create a user by
>>>> synchronising from our openLDAP directory, and I've
>>>> also managed to manually create a user and sync ldap to
>>>> it. I've then successfully synchronised with a database
>>>> containing additional fields for that user. The
>>>> accountid field in the database is contained within the
>>>> data from LDAP, mapped to an attribute called roll_number.
>>>>
>>>> I have another database that I want to synchronise
>>>> additional data for this user from, but its accountid
>>>> is roll_number with a prefix of 'K'. If I manually
>>>> create another attribute for the user, populate it by
>>>> hand with the relevant value beginning with 'K', and
>>>> set the mapping accordingly I can synchronise this
>>>> properly. However, if I set up a derived attribute for
>>>> this consisting of 'K'+roll_number, assign this
>>>> attribute to the user and set the mappings accordingly,
>>>> it does not synchronise the data. The status says
>>>> success but the execution history shows it did nothing
>>>> (Users [created/failures]: 0/0 [updated/failures]: 0/0
>>>> [deleted/failures]: 0/0 [no operation/ignored]: 0/0). I
>>>> thought of creating a synchronisation policy, but
>>>> derived attributes are not listed when creating it.
>>>>
>>>> Can anyone point me in the right direction?
>>>> Unfortunately I am not in a position to simply get rid
>>>> of the 'K' prefix.
>>>>
>>> Please send me all your resource mapping configurations.
>>> I don't understand if the derived attribute is
>>> configured in the first or second (roll_number with a
>>> prefix of 'K') database.
>>>
>>> Marco
>>>
>>>> Thanks.
>>>>
>>>> --
>>>> Martin Goldstone
>>>> IT Systems Administrator
>>>> IT Services, Innovation Centre 1 (IC1)
>>>> Keele University, Keele, Staffordshire, United Kingdom,
>>>> ST5 5NB
>>>> Telephone: +44 1782 734457 <tel:%2B44%201782%20734457>
>>>> G+: http://google.com/+MartinGoldstoneKeele
>>>
>>> --
>>> Dott. Marco Di Sabatino Di Diodoro
>>> Tel.+39 3939065570 <tel:%2B39%203939065570>
>>>
>>> Tirasa S.r.l.
>>> Viale D'Annunzio 267 - 65127 Pescara
>>> Tel+39 0859116307 <tel:%2B39%200859116307> / FAX+39 0859111173 <tel:%2B39%200859111173>
>>> http://www.tirasa.net
>>>
>>> Apache Syncope PMC Member
>>> http://people.apache.org/~mdisabatino/
>>> <http://people.apache.org/%7Emdisabatino/>
>>>
>>>
>>>
>>>
>>> --
>>> Martin Goldstone
>>> IT Systems Administrator
>>> IT Services, Innovation Centre 1 (IC1)
>>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>>> Telephone: +44 1782 734457 <tel:%2B44%201782%20734457>
>>> G+: http://google.com/+MartinGoldstoneKeele
>>
>> --
>> Dott. Marco Di Sabatino Di Diodoro
>> Tel.+39 3939065570 <tel:%2B39%203939065570>
>>
>> Tirasa S.r.l.
>> Viale D'Annunzio 267 - 65127 Pescara
>> Tel+39 0859116307 <tel:%2B39%200859116307> / FAX+39 0859111173 <tel:%2B39%200859111173>
>> http://www.tirasa.net
>>
>> Apache Syncope PMC Member
>> http://people.apache.org/~mdisabatino/
>> <http://people.apache.org/%7Emdisabatino/>
>>
>>
>>
>>
>> --
>> Martin Goldstone
>> IT Systems Administrator
>> IT Services, Innovation Centre 1 (IC1)
>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>> Telephone: +44 1782 734457 <tel:%2B44%201782%20734457>
>> G+: http://google.com/+MartinGoldstoneKeele
>
> --
> Dott. Marco Di Sabatino Di Diodoro
> Tel.+39 3939065570 <tel:%2B39%203939065570>
>
> Tirasa S.r.l.
> Viale D'Annunzio 267 - 65127 Pescara
> Tel+39 0859116307 <tel:%2B39%200859116307> / FAX+39 0859111173 <tel:%2B39%200859111173>
> http://www.tirasa.net
>
> Apache Syncope PMC Member
> http://people.apache.org/~mdisabatino/
> <http://people.apache.org/%7Emdisabatino/>
>
>
>
>
> --
> Martin Goldstone
> IT Systems Administrator
> IT Services, Innovation Centre 1 (IC1)
> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
> Telephone: +44 1782 734457
> G+: http://google.com/+MartinGoldstoneKeele
--
Dott. Marco Di Sabatino Di Diodoro
Tel. +39 3939065570
Tirasa S.r.l.
Viale D'Annunzio 267 - 65127 Pescara
Tel +39 0859116307 / FAX +39 0859111173
http://www.tirasa.net
Apache Syncope PMC Member
http://people.apache.org/~mdisabatino/
Re: LDAP synchronisation and User derived attribute as account ID
with database resource
Posted by Martin Goldstone <m....@keele.ac.uk>.
Yes, I can see the derived attribute when I look at the users after syncing
from LDAP.
On 18 March 2016 at 14:06, Marco Di Sabatino Di Diodoro <
marco.disabatino@tirasa.net> wrote:
>
>
> Il 18/03/2016 11:55, Martin Goldstone ha scritto:
>
> roll_number (as stored as kdirUrn in LDAP and as HRID in staffdb) does not
> ordinarily have the prefix of 'K'. It has a prefix within this simplified
> carddb as in the real card database system, multiple systems feed data into
> it and this field has various prefixes depending on the source of the data
> (card users coming from the HR system have one prefix, coming from Student
> Records they have another, and another prefix for a 3rd system. Those
> individual systems do not have the prefix present in their identifiers).
>
> Perhaps I have got things backwards. Given that I can't change there being
> a prefix in carddb, what would be the best way to handle this?
>
>
> In your sync task configurations, have you configured the Allow create
> operations and Allow update operations?
> When you sync from Ldap, the synched users have the derived attribute
> populated on Syncope?
>
> M
>
>
> On 18 March 2016 at 10:38, Marco Di Sabatino Di Diodoro <
> <ma...@tirasa.net> wrote:
>
>>
>>
>> Il 18/03/2016 10:28, Martin Goldstone ha scritto:
>>
>> Hi Marco,
>>
>> Attached are screenshots of these mappings.
>>
>> The second database (the one with the K prefix), is one in the
>> carddb_mapping.
>>
>> I've also included the derived attribute (staff_ex_link)
>>
>>
>> There is an error in your carddb resource mapping. If you need a mapping with
>> a derived attribute, it's necessary that the attributes that compose it
>> are present in the set of attributes that you pull from the resource
>> (roll_number is not present in the resource).
>>
>> Why you add the "K" if the attribute already contains it?
>>
>> Marco
>>
>> Thanks.
>>
>> On 18 March 2016 at 08:32, Marco Di Sabatino Di Diodoro <
>> marco.disabatino@tirasa.net> wrote:
>>
>>> Hi Martin,
>>>
>>> Il 17/03/2016 18:12, Martin Goldstone ha scritto:
>>>
>>> Hi All,
>>>
>>> I'm currently building a proof of concept using Apache Syncope 1.2.7.
>>> I've managed to create a user by synchronising from our openLDAP directory,
>>> and I've also managed to manually create a user and sync ldap to it. I've
>>> then successfully synchronised with a database containing additional fields
>>> for that user. The accountid field in the database is contained within the
>>> data from LDAP, mapped to an attribute called roll_number.
>>>
>>> I have another database that I want to synchronise additional data for
>>> this user from, but its accountid is roll_number with a prefix of 'K'. If I
>>> manually create another attribute for the user, populate it by hand with
>>> the relevant value beginning with 'K', and set the mapping accordingly I
>>> can synchronise this properly. However, if I set up a derived attribute for
>>> this consisting of 'K'+roll_number, assign this attribute to the user and
>>> set the mappings accordingly, it does not synchronise the data. The status
>>> says success but the execution history shows it did nothing (Users
>>> [created/failures]: 0/0 [updated/failures]: 0/0 [deleted/failures]: 0/0 [no
>>> operation/ignored]: 0/0). I thought of creating a synchronisation policy,
>>> but derived attributes are not listed when creating it.
>>>
>>> Can anyone point me in the right direction? Unfortunately I am not in a
>>> position to simply get rid of the 'K' prefix.
>>>
>>> Please send me all your resource mapping configurations. I don't
>>> understand if the derived attribute is configured in the first or second
>>> (roll_number with a prefix of 'K') database.
>>>
>>> Marco
>>>
>>> Thanks.
>>>
>>> --
>>> Martin Goldstone
>>> IT Systems Administrator
>>> IT Services, Innovation Centre 1 (IC1)
>>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>>> Telephone: +44 1782 734457 <%2B44%201782%20734457>
>>> G+: http://google.com/+MartinGoldstoneKeele
>>>
>>>
>>> --
>>> Dott. Marco Di Sabatino Di Diodoro
>>> Tel. +39 3939065570
>>>
>>> Tirasa S.r.l.
>>> Viale D'Annunzio 267 - 65127 Pescara
>>> Tel +39 0859116307 / FAX +39 0859111173http://www.tirasa.net
>>>
>>> Apache Syncope PMC Memberhttp://people.apache.org/~mdisabatino/
>>>
>>>
>>
>>
>> --
>> Martin Goldstone
>> IT Systems Administrator
>> IT Services, Innovation Centre 1 (IC1)
>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>> Telephone: +44 1782 734457 <%2B44%201782%20734457>
>> G+: <http://google.com/+MartinGoldstoneKeele>
>> http://google.com/+MartinGoldstoneKeele
>>
>>
>> --
>> Dott. Marco Di Sabatino Di Diodoro
>> Tel. +39 3939065570
>>
>> Tirasa S.r.l.
>> Viale D'Annunzio 267 - 65127 Pescara
>> Tel +39 0859116307 / FAX +39 0859111173http://www.tirasa.net
>>
>> Apache Syncope PMC Memberhttp://people.apache.org/~mdisabatino/
>>
>>
>
>
> --
> Martin Goldstone
> IT Systems Administrator
> IT Services, Innovation Centre 1 (IC1)
> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
> Telephone: +44 1782 734457
> G+: <http://google.com/+MartinGoldstoneKeele>
> http://google.com/+MartinGoldstoneKeele
>
>
> --
> Dott. Marco Di Sabatino Di Diodoro
> Tel. +39 3939065570
>
> Tirasa S.r.l.
> Viale D'Annunzio 267 - 65127 Pescara
> Tel +39 0859116307 / FAX +39 0859111173http://www.tirasa.net
>
> Apache Syncope PMC Memberhttp://people.apache.org/~mdisabatino/
>
>
--
Martin Goldstone
IT Systems Administrator
IT Services, Innovation Centre 1 (IC1)
Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
Telephone: +44 1782 734457
G+: http://google.com/+MartinGoldstoneKeele
Re: LDAP synchronisation and User derived attribute as account ID
with database resource
Posted by Marco Di Sabatino Di Diodoro <ma...@tirasa.net>.
Il 18/03/2016 11:55, Martin Goldstone ha scritto:
> roll_number (as stored as kdirUrn in LDAP and as HRID in staffdb) does
> not ordinarily have the prefix of 'K'. It has a prefix within this
> simplified carddb as in the real card database system, multiple
> systems feed data into it and this field has various prefixes
> depending on the source of the data (card users coming from the HR
> system have one prefix, coming from Student Records they have another,
> and another prefix for a 3rd system. Those individual systems do not
> have the prefix present in their identifiers).
>
> Perhaps I have got things backwards. Given that I can't change there
> being a prefix in carddb, what would be the best way to handle this?
In your sync task configurations, have you configured the Allow create
operations and Allow update operations?
When you sync from Ldap, the synched users have the derived attribute
populated on Syncope?
M
>
> On 18 March 2016 at 10:38, Marco Di Sabatino Di Diodoro
> <ma...@tirasa.net> wrote:
>
>
>
> Il 18/03/2016 10:28, Martin Goldstone ha scritto:
>> Hi Marco,
>>
>> Attached are screenshots of these mappings.
>>
>> The second database (the one with the K prefix), is one in the
>> carddb_mapping.
>>
>> I've also included the derived attribute (staff_ex_link)
>>
>
> There is an error in your carddb resource mapping. If you needa
> mapping with a derived attribute, it's necessary that the
> attributes that compose it are present in the set of attributes
> that you pull from the resource (roll_number is not present in the
> resource).
>
> Why you add the "K" if the attribute already contains it?
>
> Marco
>
>> Thanks.
>>
>> On 18 March 2016 at 08:32, Marco Di Sabatino Di Diodoro
>> <marco.disabatino@tirasa.net
>> <ma...@tirasa.net>> wrote:
>>
>> Hi Martin,
>>
>> Il 17/03/2016 18:12, Martin Goldstone ha scritto:
>>> Hi All,
>>>
>>> I'm currently building a proof of concept using Apache
>>> Syncope 1.2.7. I've managed to create a user by
>>> synchronising from our openLDAP directory, and I've also
>>> managed to manually create a user and sync ldap to it. I've
>>> then successfully synchronised with a database containing
>>> additional fields for that user. The accountid field in the
>>> database is contained within the data from LDAP, mapped to
>>> an attribute called roll_number.
>>>
>>> I have another database that I want to synchronise
>>> additional data for this user from, but its accountid is
>>> roll_number with a prefix of 'K'. If I manually create
>>> another attribute for the user, populate it by hand with the
>>> relevant value beginning with 'K', and set the mapping
>>> accordingly I can synchronise this properly. However, if I
>>> set up a derived attribute for this consisting of
>>> 'K'+roll_number, assign this attribute to the user and set
>>> the mappings accordingly, it does not synchronise the data.
>>> The status says success but the execution history shows it
>>> did nothing (Users [created/failures]: 0/0
>>> [updated/failures]: 0/0 [deleted/failures]: 0/0 [no
>>> operation/ignored]: 0/0). I thought of creating a
>>> synchronisation policy, but derived attributes are not
>>> listed when creating it.
>>>
>>> Can anyone point me in the right direction? Unfortunately I
>>> am not in a position to simply get rid of the 'K' prefix.
>>>
>> Please send me all your resource mapping configurations. I
>> don't understand if the derived attribute is configured in
>> the first or second (roll_number with a prefix of 'K') database.
>>
>> Marco
>>
>>> Thanks.
>>>
>>> --
>>> Martin Goldstone
>>> IT Systems Administrator
>>> IT Services, Innovation Centre 1 (IC1)
>>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>>> Telephone: +44 1782 734457 <tel:%2B44%201782%20734457>
>>> G+: http://google.com/+MartinGoldstoneKeele
>>
>> --
>> Dott. Marco Di Sabatino Di Diodoro
>> Tel.+39 3939065570 <tel:%2B39%203939065570>
>>
>> Tirasa S.r.l.
>> Viale D'Annunzio 267 - 65127 Pescara
>> Tel+39 0859116307 <tel:%2B39%200859116307> / FAX+39 0859111173 <tel:%2B39%200859111173>
>> http://www.tirasa.net
>>
>> Apache Syncope PMC Member
>> http://people.apache.org/~mdisabatino/
>> <http://people.apache.org/%7Emdisabatino/>
>>
>>
>>
>>
>> --
>> Martin Goldstone
>> IT Systems Administrator
>> IT Services, Innovation Centre 1 (IC1)
>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>> Telephone: +44 1782 734457 <tel:%2B44%201782%20734457>
>> G+: http://google.com/+MartinGoldstoneKeele
>
> --
> Dott. Marco Di Sabatino Di Diodoro
> Tel.+39 3939065570 <tel:%2B39%203939065570>
>
> Tirasa S.r.l.
> Viale D'Annunzio 267 - 65127 Pescara
> Tel+39 0859116307 <tel:%2B39%200859116307> / FAX+39 0859111173 <tel:%2B39%200859111173>
> http://www.tirasa.net
>
> Apache Syncope PMC Member
> http://people.apache.org/~mdisabatino/
> <http://people.apache.org/%7Emdisabatino/>
>
>
>
>
> --
> Martin Goldstone
> IT Systems Administrator
> IT Services, Innovation Centre 1 (IC1)
> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
> Telephone: +44 1782 734457
> G+: http://google.com/+MartinGoldstoneKeele
--
Dott. Marco Di Sabatino Di Diodoro
Tel. +39 3939065570
Tirasa S.r.l.
Viale D'Annunzio 267 - 65127 Pescara
Tel +39 0859116307 / FAX +39 0859111173
http://www.tirasa.net
Apache Syncope PMC Member
http://people.apache.org/~mdisabatino/
Re: LDAP synchronisation and User derived attribute as account ID
with database resource
Posted by Martin Goldstone <m....@keele.ac.uk>.
roll_number (as stored as kdirUrn in LDAP and as HRID in staffdb) does not
ordinarily have the prefix of 'K'. It has a prefix within this simplified
carddb as in the real card database system, multiple systems feed data into
it and this field has various prefixes depending on the source of the data
(card users coming from the HR system have one prefix, coming from Student
Records they have another, and another prefix for a 3rd system. Those
individual systems do not have the prefix present in their identifiers).
Perhaps I have got things backwards. Given that I can't change there being
a prefix in carddb, what would be the best way to handle this?
On 18 March 2016 at 10:38, Marco Di Sabatino Di Diodoro <
marco.disabatino@tirasa.net> wrote:
>
>
> Il 18/03/2016 10:28, Martin Goldstone ha scritto:
>
> Hi Marco,
>
> Attached are screenshots of these mappings.
>
> The second database (the one with the K prefix), is one in the
> carddb_mapping.
>
> I've also included the derived attribute (staff_ex_link)
>
>
> There is an error in your carddb resource mapping. If you need a mapping with
> a derived attribute, it's necessary that the attributes that compose it
> are present in the set of attributes that you pull from the resource
> (roll_number is not present in the resource).
>
> Why you add the "K" if the attribute already contains it?
>
> Marco
>
> Thanks.
>
> On 18 March 2016 at 08:32, Marco Di Sabatino Di Diodoro <
> <ma...@tirasa.net> wrote:
>
>> Hi Martin,
>>
>> Il 17/03/2016 18:12, Martin Goldstone ha scritto:
>>
>> Hi All,
>>
>> I'm currently building a proof of concept using Apache Syncope 1.2.7.
>> I've managed to create a user by synchronising from our openLDAP directory,
>> and I've also managed to manually create a user and sync ldap to it. I've
>> then successfully synchronised with a database containing additional fields
>> for that user. The accountid field in the database is contained within the
>> data from LDAP, mapped to an attribute called roll_number.
>>
>> I have another database that I want to synchronise additional data for
>> this user from, but its accountid is roll_number with a prefix of 'K'. If I
>> manually create another attribute for the user, populate it by hand with
>> the relevant value beginning with 'K', and set the mapping accordingly I
>> can synchronise this properly. However, if I set up a derived attribute for
>> this consisting of 'K'+roll_number, assign this attribute to the user and
>> set the mappings accordingly, it does not synchronise the data. The status
>> says success but the execution history shows it did nothing (Users
>> [created/failures]: 0/0 [updated/failures]: 0/0 [deleted/failures]: 0/0 [no
>> operation/ignored]: 0/0). I thought of creating a synchronisation policy,
>> but derived attributes are not listed when creating it.
>>
>> Can anyone point me in the right direction? Unfortunately I am not in a
>> position to simply get rid of the 'K' prefix.
>>
>> Please send me all your resource mapping configurations. I don't
>> understand if the derived attribute is configured in the first or second
>> (roll_number with a prefix of 'K') database.
>>
>> Marco
>>
>> Thanks.
>>
>> --
>> Martin Goldstone
>> IT Systems Administrator
>> IT Services, Innovation Centre 1 (IC1)
>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>> Telephone: +44 1782 734457
>> G+: <http://google.com/+MartinGoldstoneKeele>
>> http://google.com/+MartinGoldstoneKeele
>>
>>
>> --
>> Dott. Marco Di Sabatino Di Diodoro
>> Tel. +39 3939065570
>>
>> Tirasa S.r.l.
>> Viale D'Annunzio 267 - 65127 Pescara
>> Tel +39 0859116307 / FAX +39 0859111173http://www.tirasa.net
>>
>> Apache Syncope PMC Memberhttp://people.apache.org/~mdisabatino/
>>
>>
>
>
> --
> Martin Goldstone
> IT Systems Administrator
> IT Services, Innovation Centre 1 (IC1)
> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
> Telephone: +44 1782 734457
> G+: <http://google.com/+MartinGoldstoneKeele>
> http://google.com/+MartinGoldstoneKeele
>
>
> --
> Dott. Marco Di Sabatino Di Diodoro
> Tel. +39 3939065570
>
> Tirasa S.r.l.
> Viale D'Annunzio 267 - 65127 Pescara
> Tel +39 0859116307 / FAX +39 0859111173http://www.tirasa.net
>
> Apache Syncope PMC Memberhttp://people.apache.org/~mdisabatino/
>
>
--
Martin Goldstone
IT Systems Administrator
IT Services, Innovation Centre 1 (IC1)
Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
Telephone: +44 1782 734457
G+: http://google.com/+MartinGoldstoneKeele
Re: LDAP synchronisation and User derived attribute as account ID
with database resource
Posted by Marco Di Sabatino Di Diodoro <ma...@tirasa.net>.
Il 18/03/2016 10:28, Martin Goldstone ha scritto:
> Hi Marco,
>
> Attached are screenshots of these mappings.
>
> The second database (the one with the K prefix), is one in the
> carddb_mapping.
>
> I've also included the derived attribute (staff_ex_link)
>
There is an error in your carddb resource mapping. If you needa mapping
with a derived attribute, it's necessary that the attributes that
compose it are present in the set of attributes that you pull from the
resource (roll_number is not present in the resource).
Why you add the "K" if the attribute already contains it?
Marco
> Thanks.
>
> On 18 March 2016 at 08:32, Marco Di Sabatino Di Diodoro
> <marco.disabatino@tirasa.net <ma...@tirasa.net>> wrote:
>
> Hi Martin,
>
> Il 17/03/2016 18:12, Martin Goldstone ha scritto:
>> Hi All,
>>
>> I'm currently building a proof of concept using Apache Syncope
>> 1.2.7. I've managed to create a user by synchronising from our
>> openLDAP directory, and I've also managed to manually create a
>> user and sync ldap to it. I've then successfully synchronised
>> with a database containing additional fields for that user. The
>> accountid field in the database is contained within the data from
>> LDAP, mapped to an attribute called roll_number.
>>
>> I have another database that I want to synchronise additional
>> data for this user from, but its accountid is roll_number with a
>> prefix of 'K'. If I manually create another attribute for the
>> user, populate it by hand with the relevant value beginning with
>> 'K', and set the mapping accordingly I can synchronise this
>> properly. However, if I set up a derived attribute for this
>> consisting of 'K'+roll_number, assign this attribute to the user
>> and set the mappings accordingly, it does not synchronise the
>> data. The status says success but the execution history shows it
>> did nothing (Users [created/failures]: 0/0 [updated/failures]:
>> 0/0 [deleted/failures]: 0/0 [no operation/ignored]: 0/0). I
>> thought of creating a synchronisation policy, but derived
>> attributes are not listed when creating it.
>>
>> Can anyone point me in the right direction? Unfortunately I am
>> not in a position to simply get rid of the 'K' prefix.
>>
> Please send me all your resource mapping configurations. I don't
> understand if the derived attribute is configured in the first or
> second (roll_number with a prefix of 'K') database.
>
> Marco
>
>> Thanks.
>>
>> --
>> Martin Goldstone
>> IT Systems Administrator
>> IT Services, Innovation Centre 1 (IC1)
>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>> Telephone: +44 1782 734457
>> G+: http://google.com/+MartinGoldstoneKeele
>
> --
> Dott. Marco Di Sabatino Di Diodoro
> Tel.+39 3939065570 <tel:%2B39%203939065570>
>
> Tirasa S.r.l.
> Viale D'Annunzio 267 - 65127 Pescara
> Tel+39 0859116307 <tel:%2B39%200859116307> / FAX+39 0859111173 <tel:%2B39%200859111173>
> http://www.tirasa.net
>
> Apache Syncope PMC Member
> http://people.apache.org/~mdisabatino/
> <http://people.apache.org/%7Emdisabatino/>
>
>
>
>
> --
> Martin Goldstone
> IT Systems Administrator
> IT Services, Innovation Centre 1 (IC1)
> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
> Telephone: +44 1782 734457
> G+: http://google.com/+MartinGoldstoneKeele
--
Dott. Marco Di Sabatino Di Diodoro
Tel. +39 3939065570
Tirasa S.r.l.
Viale D'Annunzio 267 - 65127 Pescara
Tel +39 0859116307 / FAX +39 0859111173
http://www.tirasa.net
Apache Syncope PMC Member
http://people.apache.org/~mdisabatino/
Re: LDAP synchronisation and User derived attribute as account ID
with database resource
Posted by Fabio Martelli <fa...@gmail.com>.
Il 23/03/2016 09:47, Martin Goldstone ha scritto:
> Hi Fabio,
>
> I'm a bit confused. I'm already setting card_link with a user template
> on staff_db sync. I have not set anything in the user template for
> carddb sync. I have also tried populating the user with the derived
> card_link attribute manually. Every time I've attempted a carddb sync,
> I've verified that the derived attribute is shown on that user's record.
Hi Martin, you are right. Sorry if I confused the name in the log.
I'll try to perform some changes on one of my internal projects in order
to stress the feature and reproduce your issue.
I'll come back to you as soon as possible.
Regards,
F.
>
> Thanks
>
> On 23 March 2016 at 08:39, Fabio Martelli <fabio.martelli@gmail.com
> <ma...@gmail.com>> wrote:
>
> Hi Martin, now it is clearer.
> I see from your logs you are trying to assign card_link attribute
> via a user template associated to carddb itself.
> This is not correct because carddb specify the account id on
> card_link: user template is evaluated after profile resolution.
>
> Maybe you can specify card_link attribute before by assigning a
> user template to ldap or staff_db sync.
> The user has to be populated yet with derived attribute card_link
> before running carddb sync.
>
> Please, try out in this sense and let me know.
> Kind regards,
> F.
>
>
> Il 22/03/2016 18:26, Martin Goldstone ha scritto:
>>
>> On 22 March 2016 at 16:38, Fabio Martelli
>> <fabio.martelli@gmail.com <ma...@gmail.com>> wrote:
>>
>> Hi Martin, resources and connectors configurations seem to be
>> correct.
>> Provided logs are not useful: please, change debug level and
>> perform a new synchronization; collect logs and forward again.
>>
>>
>> Attached are new logs with the logging level turned up to debug
>> for everything. The file sizes are quite large, would it be
>> better if I repeat the task with reduced logging levels for
>> certain loggers?
>>
>>
>> Let's try to summarize...
>>
>> 1. you have the provided configuration in place
>> 2. you created a (sample) new user providing card_link
>> derived attribute for him
>> 3. you synchronized from carddb but no operation has been
>> performed locally
>>
>> Right?
>>
>> That's correct, yes. Card_link is assigned with the user template
>> for the staff_db sync task, but I have also tried adding it
>> manually.
>>
>> Did you try out without propagation and synchronization
>> action classes?
>>
>> I've just taken out all propagation and synchronization action
>> classes, there was no difference.
>>
>>
>>
>> --
>> Martin Goldstone
>> IT Systems Administrator
>> IT Services, Innovation Centre 1 (IC1)
>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>> Telephone: +44 1782 734457
>> G+: http://google.com/+MartinGoldstoneKeele
>
>
> --
> Fabio Martelli
> https://it.linkedin.com/pub/fabio-martelli/1/974/a44
> http://blog.tirasa.net/author/fabio/index.html
>
> Tirasa - Open Source Excellence
> http://www.tirasa.net/
>
> Apache Syncope PMC
> http://people.apache.org/~fmartelli/
> <http://people.apache.org/%7Efmartelli/>
>
>
>
>
> --
> Martin Goldstone
> IT Systems Administrator
> IT Services, Innovation Centre 1 (IC1)
> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
> Telephone: +44 1782 734457
> G+: http://google.com/+MartinGoldstoneKeele
--
Fabio Martelli
https://it.linkedin.com/pub/fabio-martelli/1/974/a44
http://blog.tirasa.net/author/fabio/index.html
Tirasa - Open Source Excellence
http://www.tirasa.net/
Apache Syncope PMC
http://people.apache.org/~fmartelli/
Re: LDAP synchronisation and User derived attribute as account ID
with database resource
Posted by Fabio Martelli <fa...@gmail.com>.
Il 23/03/2016 12:41, Martin Goldstone ha scritto:
> Hi Fabio,
>
> I've looked at your configuration. I noticed that your card_link
> attribute is the same as your user's username. I've replicated this:
> I've added a row into the carddb with HRID set to cca37, and added new
> attributes to the schema and to the user as in the attached
> screenshots. It now synchronises the card number across with this set
> up. On further testing, I've been able to make it synchronise only
> when adding a suffix using a derived attribute as you have done in
> your configuration. I've changed card_link_test to be unameprefix +
> '38', created a row in carddb with 'cca38' as hrid and verified that
> the user had the new value for this derived attribute, which led to a
> successful synchronisation. However, when I changed card_link_test to
> have a prefix (I set it to 'k' + unameprefix + '39') and created a row
> in carddb with 'kcca39' as hrid, no syncronisation occurs.
Hi Martin,thanks for reporting.
Bug is confirmed. Please watch the issue [SYNCOPE-800], it will be fixed
ASAP.
Kind regards,
F.
[SYNCOPE-800] https://issues.apache.org/jira/browse/SYNCOPE-800
>
> Thanks
>
> On 23 March 2016 at 10:37, Fabio Martelli <fabio.martelli@gmail.com
> <ma...@gmail.com>> wrote:
>
> Hi Martin, I performed several attempts (by changing configuration
> every time) without reproducing your issue.
> Please, take a look at the attached configuration. It is working fine.
>
> Check your configuration against mine, perform some other check
> and, if you have, provide some other detail.
>
> Best regards,
> F.
>
> Il 23/03/2016 09:47, Martin Goldstone ha scritto:
>> Hi Fabio,
>>
>> I'm a bit confused. I'm already setting card_link with a user
>> template on staff_db sync. I have not set anything in the user
>> template for carddb sync. I have also tried populating the user
>> with the derived card_link attribute manually. Every time I've
>> attempted a carddb sync, I've verified that the derived attribute
>> is shown on that user's record.
>>
>> Thanks
>>
>> On 23 March 2016 at 08:39, Fabio Martelli
>> <fabio.martelli@gmail.com <ma...@gmail.com>> wrote:
>>
>> Hi Martin, now it is clearer.
>> I see from your logs you are trying to assign card_link
>> attribute via a user template associated to carddb itself.
>> This is not correct because carddb specify the account id on
>> card_link: user template is evaluated after profile resolution.
>>
>> Maybe you can specify card_link attribute before by assigning
>> a user template to ldap or staff_db sync.
>> The user has to be populated yet with derived attribute
>> card_link before running carddb sync.
>>
>> Please, try out in this sense and let me know.
>> Kind regards,
>> F.
>>
>>
>> Il 22/03/2016 18:26, Martin Goldstone ha scritto:
>>>
>>> On 22 March 2016 at 16:38, Fabio Martelli
>>> <fabio.martelli@gmail.com <ma...@gmail.com>>
>>> wrote:
>>>
>>> Hi Martin, resources and connectors configurations seem
>>> to be correct.
>>> Provided logs are not useful: please, change debug level
>>> and perform a new synchronization; collect logs and
>>> forward again.
>>>
>>>
>>> Attached are new logs with the logging level turned up to
>>> debug for everything. The file sizes are quite large, would
>>> it be better if I repeat the task with reduced logging
>>> levels for certain loggers?
>>>
>>>
>>> Let's try to summarize...
>>>
>>> 1. you have the provided configuration in place
>>> 2. you created a (sample) new user providing card_link
>>> derived attribute for him
>>> 3. you synchronized from carddb but no operation has
>>> been performed locally
>>>
>>> Right?
>>>
>>> That's correct, yes. Card_link is assigned with the user
>>> template for the staff_db sync task, but I have also tried
>>> adding it manually.
>>>
>>> Did you try out without propagation and synchronization
>>> action classes?
>>>
>>> I've just taken out all propagation and synchronization
>>> action classes, there was no difference.
>>>
>>>
>>>
>>> --
>>> Martin Goldstone
>>> IT Systems Administrator
>>> IT Services, Innovation Centre 1 (IC1)
>>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>>> Telephone: +44 1782 734457 <tel:%2B44%201782%20734457>
>>> G+: http://google.com/+MartinGoldstoneKeele
>>
>>
>> --
>> Fabio Martelli
>> https://it.linkedin.com/pub/fabio-martelli/1/974/a44
>> http://blog.tirasa.net/author/fabio/index.html
>>
>> Tirasa - Open Source Excellence
>> http://www.tirasa.net/
>>
>> Apache Syncope PMC
>> http://people.apache.org/~fmartelli/
>> <http://people.apache.org/%7Efmartelli/>
>>
>>
>>
>>
>> --
>> Martin Goldstone
>> IT Systems Administrator
>> IT Services, Innovation Centre 1 (IC1)
>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>> Telephone: +44 1782 734457 <tel:%2B44%201782%20734457>
>> G+: http://google.com/+MartinGoldstoneKeele
>
>
> --
> Fabio Martelli
> https://it.linkedin.com/pub/fabio-martelli/1/974/a44
> http://blog.tirasa.net/author/fabio/index.html
>
> Tirasa - Open Source Excellence
> http://www.tirasa.net/
>
> Apache Syncope PMC
> http://people.apache.org/~fmartelli/
> <http://people.apache.org/%7Efmartelli/>
>
>
>
>
> --
> Martin Goldstone
> IT Systems Administrator
> IT Services, Innovation Centre 1 (IC1)
> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
> Telephone: +44 1782 734457
> G+: http://google.com/+MartinGoldstoneKeele
--
Fabio Martelli
https://it.linkedin.com/pub/fabio-martelli/1/974/a44
http://blog.tirasa.net/author/fabio/index.html
Tirasa - Open Source Excellence
http://www.tirasa.net/
Apache Syncope PMC
http://people.apache.org/~fmartelli/
Re: LDAP synchronisation and User derived attribute as account ID
with database resource
Posted by Martin Goldstone <m....@keele.ac.uk>.
Hi Fabio,
I've looked at your configuration. I noticed that your card_link attribute
is the same as your user's username. I've replicated this: I've added a row
into the carddb with HRID set to cca37, and added new attributes to the
schema and to the user as in the attached screenshots. It now synchronises
the card number across with this set up. On further testing, I've been
able to make it synchronise only when adding a suffix using a derived
attribute as you have done in your configuration. I've changed
card_link_test to be unameprefix + '38', created a row in carddb with
'cca38' as hrid and verified that the user had the new value for this
derived attribute, which led to a successful synchronisation. However, when
I changed card_link_test to have a prefix (I set it to 'k' + unameprefix +
'39') and created a row in carddb with 'kcca39' as hrid, no syncronisation
occurs.
Thanks
On 23 March 2016 at 10:37, Fabio Martelli <fa...@gmail.com> wrote:
> Hi Martin, I performed several attempts (by changing configuration every
> time) without reproducing your issue.
> Please, take a look at the attached configuration. It is working fine.
>
> Check your configuration against mine, perform some other check and, if
> you have, provide some other detail.
>
> Best regards,
> F.
>
> Il 23/03/2016 09:47, Martin Goldstone ha scritto:
>
> Hi Fabio,
>
> I'm a bit confused. I'm already setting card_link with a user template on
> staff_db sync. I have not set anything in the user template for carddb
> sync. I have also tried populating the user with the derived card_link
> attribute manually. Every time I've attempted a carddb sync, I've verified
> that the derived attribute is shown on that user's record.
>
> Thanks
>
> On 23 March 2016 at 08:39, Fabio Martelli <fa...@gmail.com>
> wrote:
>
>> Hi Martin, now it is clearer.
>> I see from your logs you are trying to assign card_link attribute via a
>> user template associated to carddb itself.
>> This is not correct because carddb specify the account id on card_link:
>> user template is evaluated after profile resolution.
>>
>> Maybe you can specify card_link attribute before by assigning a user
>> template to ldap or staff_db sync.
>> The user has to be populated yet with derived attribute card_link before
>> running carddb sync.
>>
>> Please, try out in this sense and let me know.
>> Kind regards,
>> F.
>>
>>
>> Il 22/03/2016 18:26, Martin Goldstone ha scritto:
>>
>>
>> On 22 March 2016 at 16:38, Fabio Martelli < <fa...@gmail.com>
>> fabio.martelli@gmail.com> wrote:
>>
>>> Hi Martin, resources and connectors configurations seem to be correct.
>>> Provided logs are not useful: please, change debug level and perform a
>>> new synchronization; collect logs and forward again.
>>>
>>
>> Attached are new logs with the logging level turned up to debug for
>> everything. The file sizes are quite large, would it be better if I repeat
>> the task with reduced logging levels for certain loggers?
>>
>>
>>>
>>> Let's try to summarize...
>>>
>>>
>>> 1. you have the provided configuration in place
>>> 2. you created a (sample) new user providing card_link derived
>>> attribute for him
>>> 3. you synchronized from carddb but no operation has been performed
>>> locally
>>>
>>> Right?
>>>
>> That's correct, yes. Card_link is assigned with the user template for the
>> staff_db sync task, but I have also tried adding it manually.
>>
>>> Did you try out without propagation and synchronization action classes?
>>>
>> I've just taken out all propagation and synchronization action classes,
>> there was no difference.
>>
>>
>>
>> --
>> Martin Goldstone
>> IT Systems Administrator
>> IT Services, Innovation Centre 1 (IC1)
>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>> Telephone: +44 1782 734457
>> G+: <http://google.com/+MartinGoldstoneKeele>
>> http://google.com/+MartinGoldstoneKeele
>>
>>
>>
>> --
>> Fabio Martellihttps://it.linkedin.com/pub/fabio-martelli/1/974/a44http://blog.tirasa.net/author/fabio/index.html
>>
>> Tirasa - Open Source Excellencehttp://www.tirasa.net/
>>
>> Apache Syncope PMChttp://people.apache.org/~fmartelli/
>>
>>
>
>
> --
> Martin Goldstone
> IT Systems Administrator
> IT Services, Innovation Centre 1 (IC1)
> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
> Telephone: +44 1782 734457
> G+: <http://google.com/+MartinGoldstoneKeele>
> http://google.com/+MartinGoldstoneKeele
>
>
>
> --
> Fabio Martellihttps://it.linkedin.com/pub/fabio-martelli/1/974/a44http://blog.tirasa.net/author/fabio/index.html
>
> Tirasa - Open Source Excellencehttp://www.tirasa.net/
>
> Apache Syncope PMChttp://people.apache.org/~fmartelli/
>
>
--
Martin Goldstone
IT Systems Administrator
IT Services, Innovation Centre 1 (IC1)
Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
Telephone: +44 1782 734457
G+: http://google.com/+MartinGoldstoneKeele
Re: LDAP synchronisation and User derived attribute as account ID
with database resource
Posted by Fabio Martelli <fa...@gmail.com>.
Hi Martin, I performed several attempts (by changing configuration every
time) without reproducing your issue.
Please, take a look at the attached configuration. It is working fine.
Check your configuration against mine, perform some other check and, if
you have, provide some other detail.
Best regards,
F.
Il 23/03/2016 09:47, Martin Goldstone ha scritto:
> Hi Fabio,
>
> I'm a bit confused. I'm already setting card_link with a user template
> on staff_db sync. I have not set anything in the user template for
> carddb sync. I have also tried populating the user with the derived
> card_link attribute manually. Every time I've attempted a carddb sync,
> I've verified that the derived attribute is shown on that user's record.
>
> Thanks
>
> On 23 March 2016 at 08:39, Fabio Martelli <fabio.martelli@gmail.com
> <ma...@gmail.com>> wrote:
>
> Hi Martin, now it is clearer.
> I see from your logs you are trying to assign card_link attribute
> via a user template associated to carddb itself.
> This is not correct because carddb specify the account id on
> card_link: user template is evaluated after profile resolution.
>
> Maybe you can specify card_link attribute before by assigning a
> user template to ldap or staff_db sync.
> The user has to be populated yet with derived attribute card_link
> before running carddb sync.
>
> Please, try out in this sense and let me know.
> Kind regards,
> F.
>
>
> Il 22/03/2016 18:26, Martin Goldstone ha scritto:
>>
>> On 22 March 2016 at 16:38, Fabio Martelli
>> <fabio.martelli@gmail.com <ma...@gmail.com>> wrote:
>>
>> Hi Martin, resources and connectors configurations seem to be
>> correct.
>> Provided logs are not useful: please, change debug level and
>> perform a new synchronization; collect logs and forward again.
>>
>>
>> Attached are new logs with the logging level turned up to debug
>> for everything. The file sizes are quite large, would it be
>> better if I repeat the task with reduced logging levels for
>> certain loggers?
>>
>>
>> Let's try to summarize...
>>
>> 1. you have the provided configuration in place
>> 2. you created a (sample) new user providing card_link
>> derived attribute for him
>> 3. you synchronized from carddb but no operation has been
>> performed locally
>>
>> Right?
>>
>> That's correct, yes. Card_link is assigned with the user template
>> for the staff_db sync task, but I have also tried adding it
>> manually.
>>
>> Did you try out without propagation and synchronization
>> action classes?
>>
>> I've just taken out all propagation and synchronization action
>> classes, there was no difference.
>>
>>
>>
>> --
>> Martin Goldstone
>> IT Systems Administrator
>> IT Services, Innovation Centre 1 (IC1)
>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>> Telephone: +44 1782 734457
>> G+: http://google.com/+MartinGoldstoneKeele
>
>
> --
> Fabio Martelli
> https://it.linkedin.com/pub/fabio-martelli/1/974/a44
> http://blog.tirasa.net/author/fabio/index.html
>
> Tirasa - Open Source Excellence
> http://www.tirasa.net/
>
> Apache Syncope PMC
> http://people.apache.org/~fmartelli/
> <http://people.apache.org/%7Efmartelli/>
>
>
>
>
> --
> Martin Goldstone
> IT Systems Administrator
> IT Services, Innovation Centre 1 (IC1)
> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
> Telephone: +44 1782 734457
> G+: http://google.com/+MartinGoldstoneKeele
--
Fabio Martelli
https://it.linkedin.com/pub/fabio-martelli/1/974/a44
http://blog.tirasa.net/author/fabio/index.html
Tirasa - Open Source Excellence
http://www.tirasa.net/
Apache Syncope PMC
http://people.apache.org/~fmartelli/
Re: LDAP synchronisation and User derived attribute as account ID
with database resource
Posted by Martin Goldstone <m....@keele.ac.uk>.
Hi Fabio,
I'm a bit confused. I'm already setting card_link with a user template on
staff_db sync. I have not set anything in the user template for carddb
sync. I have also tried populating the user with the derived card_link
attribute manually. Every time I've attempted a carddb sync, I've verified
that the derived attribute is shown on that user's record.
Thanks
On 23 March 2016 at 08:39, Fabio Martelli <fa...@gmail.com> wrote:
> Hi Martin, now it is clearer.
> I see from your logs you are trying to assign card_link attribute via a
> user template associated to carddb itself.
> This is not correct because carddb specify the account id on card_link:
> user template is evaluated after profile resolution.
>
> Maybe you can specify card_link attribute before by assigning a user
> template to ldap or staff_db sync.
> The user has to be populated yet with derived attribute card_link before
> running carddb sync.
>
> Please, try out in this sense and let me know.
> Kind regards,
> F.
>
>
> Il 22/03/2016 18:26, Martin Goldstone ha scritto:
>
>
> On 22 March 2016 at 16:38, Fabio Martelli <fa...@gmail.com>
> wrote:
>
>> Hi Martin, resources and connectors configurations seem to be correct.
>> Provided logs are not useful: please, change debug level and perform a
>> new synchronization; collect logs and forward again.
>>
>
> Attached are new logs with the logging level turned up to debug for
> everything. The file sizes are quite large, would it be better if I repeat
> the task with reduced logging levels for certain loggers?
>
>
>>
>> Let's try to summarize...
>>
>>
>> 1. you have the provided configuration in place
>> 2. you created a (sample) new user providing card_link derived
>> attribute for him
>> 3. you synchronized from carddb but no operation has been performed
>> locally
>>
>> Right?
>>
> That's correct, yes. Card_link is assigned with the user template for the
> staff_db sync task, but I have also tried adding it manually.
>
>> Did you try out without propagation and synchronization action classes?
>>
> I've just taken out all propagation and synchronization action classes,
> there was no difference.
>
>
>
> --
> Martin Goldstone
> IT Systems Administrator
> IT Services, Innovation Centre 1 (IC1)
> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
> Telephone: +44 1782 734457
> G+: <http://google.com/+MartinGoldstoneKeele>
> http://google.com/+MartinGoldstoneKeele
>
>
>
> --
> Fabio Martellihttps://it.linkedin.com/pub/fabio-martelli/1/974/a44http://blog.tirasa.net/author/fabio/index.html
>
> Tirasa - Open Source Excellencehttp://www.tirasa.net/
>
> Apache Syncope PMChttp://people.apache.org/~fmartelli/
>
>
--
Martin Goldstone
IT Systems Administrator
IT Services, Innovation Centre 1 (IC1)
Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
Telephone: +44 1782 734457
G+: http://google.com/+MartinGoldstoneKeele
Re: LDAP synchronisation and User derived attribute as account ID
with database resource
Posted by Fabio Martelli <fa...@gmail.com>.
Hi Martin, now it is clearer.
I see from your logs you are trying to assign card_link attribute via a
user template associated to carddb itself.
This is not correct because carddb specify the account id on card_link:
user template is evaluated after profile resolution.
Maybe you can specify card_link attribute before by assigning a user
template to ldap or staff_db sync.
The user has to be populated yet with derived attribute card_link before
running carddb sync.
Please, try out in this sense and let me know.
Kind regards,
F.
Il 22/03/2016 18:26, Martin Goldstone ha scritto:
>
> On 22 March 2016 at 16:38, Fabio Martelli <fabio.martelli@gmail.com
> <ma...@gmail.com>> wrote:
>
> Hi Martin, resources and connectors configurations seem to be correct.
> Provided logs are not useful: please, change debug level and
> perform a new synchronization; collect logs and forward again.
>
>
> Attached are new logs with the logging level turned up to debug for
> everything. The file sizes are quite large, would it be better if I
> repeat the task with reduced logging levels for certain loggers?
>
>
> Let's try to summarize...
>
> 1. you have the provided configuration in place
> 2. you created a (sample) new user providing card_link derived
> attribute for him
> 3. you synchronized from carddb but no operation has been
> performed locally
>
> Right?
>
> That's correct, yes. Card_link is assigned with the user template for
> the staff_db sync task, but I have also tried adding it manually.
>
> Did you try out without propagation and synchronization action
> classes?
>
> I've just taken out all propagation and synchronization action
> classes, there was no difference.
>
>
>
> --
> Martin Goldstone
> IT Systems Administrator
> IT Services, Innovation Centre 1 (IC1)
> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
> Telephone: +44 1782 734457
> G+: http://google.com/+MartinGoldstoneKeele
--
Fabio Martelli
https://it.linkedin.com/pub/fabio-martelli/1/974/a44
http://blog.tirasa.net/author/fabio/index.html
Tirasa - Open Source Excellence
http://www.tirasa.net/
Apache Syncope PMC
http://people.apache.org/~fmartelli/
Re: LDAP synchronisation and User derived attribute as account ID
with database resource
Posted by Martin Goldstone <m....@keele.ac.uk>.
On 22 March 2016 at 16:38, Fabio Martelli <fa...@gmail.com> wrote:
> Hi Martin, resources and connectors configurations seem to be correct.
> Provided logs are not useful: please, change debug level and perform a new
> synchronization; collect logs and forward again.
>
Attached are new logs with the logging level turned up to debug for
everything. The file sizes are quite large, would it be better if I repeat
the task with reduced logging levels for certain loggers?
>
> Let's try to summarize...
>
>
> 1. you have the provided configuration in place
> 2. you created a (sample) new user providing card_link derived
> attribute for him
> 3. you synchronized from carddb but no operation has been performed
> locally
>
> Right?
>
That's correct, yes. Card_link is assigned with the user template for the
staff_db sync task, but I have also tried adding it manually.
> Did you try out without propagation and synchronization action classes?
>
I've just taken out all propagation and synchronization action classes,
there was no difference.
--
Martin Goldstone
IT Systems Administrator
IT Services, Innovation Centre 1 (IC1)
Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
Telephone: +44 1782 734457
G+: http://google.com/+MartinGoldstoneKeele
Re: LDAP synchronisation and User derived attribute as account ID
with database resource
Posted by Fabio Martelli <fa...@gmail.com>.
Il 22/03/2016 17:10, Martin Goldstone ha scritto:
> Hi Fabio et al,
>
> I've recreated everything from scratch, still without success. Please
> find attached screenshots detailing the current configuration of the
> LDAP, staff db, and card db mappings, and the capabilities of the
> connectors. Also attached are the log files requested.
Hi Martin, resources and connectors configurations seem to be correct.
Provided logs are not useful: please, change debug level and perform a
new synchronization; collect logs and forward again.
Let's try to summarize...
1. you have the provided configuration in place
2. you created a (sample) new user providing card_link derived
attribute for him
3. you synchronized from carddb but no operation has been performed locally
Right?
Did you try out without propagation and synchronization action classes?
Please, let me know.
Best regards,
F.
>
> Thanks.
>
> On 21 March 2016 at 11:17, Fabio Martelli <fabio.martelli@gmail.com
> <ma...@gmail.com>> wrote:
>
> Hi Marting, find my comments in-line.
> Regards,
> F.
>
> Il 21/03/2016 11:31, Martin Goldstone ha scritto:
>> Hi Fabio,
>>
>> I've completely re-created this resource and no longer have the
>> account link configured. Unfortunately synchronising still does
>> nothing.
> Would you provide your new configuration?
>>
>> Interestingly, if I add it as a resource to the user, I see some
>> errors in the log where it tries to propagate a null entry to the
>> card number field for the record, but when I click the button to
>> see the resource data for the user, I can see the cad number as
>> listed in the database (see attached screenshot). However, the
>> card number does not appear on the attributes page for the user,
>> either before or after running another synchronisation.
> This shouldn't be a problem.
> If I well understood you assigned carddb resource to user
> manually, didn't you?
> When you generate a propagation directly (by submitting user
> profile changes) or indirectly (by synchronizing from another
> resource) Syncope will try to update carddb remote account.
> Unfortunately, looking at your previously provided screenshots,
> card number has been flagged as "read-only" field into its
> mapping (see "Mapping purposes" at [1]). In this case card number
> won't be provided during propagation.
>
> Be sure to use mapping purposes correctly.
>
> Furthermore, provide resource and connector configuration
> screenshots as well. In particular, provide the first tab of
> resource configuration page and the last one (Capabilities) of
> connectors.
> I do think logs could be useful: core-rest.log, core-connid.log,
> core.log.
>
> You shouldn't have any trouble with your specific requirements: I
> personally know about some installations which are working by
> implementing exactly this behaviour.
> .... configuration matter for sure.
>
> [1]
> https://cwiki.apache.org/confluence/display/SYNCOPE/Schema,+attributes+and+mapping#Schema,attributesandmapping-SchemaMapping
>
>
>>
>> On 21 March 2016 at 08:52, Fabio Martelli
>> <fabio.martelli@gmail.com <ma...@gmail.com>> wrote:
>>
>> Hi Martin, try out removing/disabling Account Link into
>> carddb-mapping.
>> AccountId mapping is enough.
>>
>> Best regards,
>> F.
>>
>>
>> Il 18/03/2016 10:28, Martin Goldstone ha scritto:
>>> Hi Marco,
>>>
>>> Attached are screenshots of these mappings.
>>>
>>> The second database (the one with the K prefix), is one in
>>> the carddb_mapping.
>>>
>>> I've also included the derived attribute (staff_ex_link)
>>>
>>> Thanks.
>>>
>>> On 18 March 2016 at 08:32, Marco Di Sabatino Di Diodoro
>>> <marco.disabatino@tirasa.net
>>> <ma...@tirasa.net>> wrote:
>>>
>>> Hi Martin,
>>>
>>> Il 17/03/2016 18:12, Martin Goldstone ha scritto:
>>>> Hi All,
>>>>
>>>> I'm currently building a proof of concept using Apache
>>>> Syncope 1.2.7. I've managed to create a user by
>>>> synchronising from our openLDAP directory, and I've
>>>> also managed to manually create a user and sync ldap to
>>>> it. I've then successfully synchronised with a database
>>>> containing additional fields for that user. The
>>>> accountid field in the database is contained within the
>>>> data from LDAP, mapped to an attribute called roll_number.
>>>>
>>>> I have another database that I want to synchronise
>>>> additional data for this user from, but its accountid
>>>> is roll_number with a prefix of 'K'. If I manually
>>>> create another attribute for the user, populate it by
>>>> hand with the relevant value beginning with 'K', and
>>>> set the mapping accordingly I can synchronise this
>>>> properly. However, if I set up a derived attribute for
>>>> this consisting of 'K'+roll_number, assign this
>>>> attribute to the user and set the mappings accordingly,
>>>> it does not synchronise the data. The status says
>>>> success but the execution history shows it did nothing
>>>> (Users [created/failures]: 0/0 [updated/failures]: 0/0
>>>> [deleted/failures]: 0/0 [no operation/ignored]: 0/0). I
>>>> thought of creating a synchronisation policy, but
>>>> derived attributes are not listed when creating it.
>>>>
>>>> Can anyone point me in the right direction?
>>>> Unfortunately I am not in a position to simply get rid
>>>> of the 'K' prefix.
>>>>
>>> Please send me all your resource mapping configurations.
>>> I don't understand if the derived attribute is
>>> configured in the first or second (roll_number with a
>>> prefix of 'K') database.
>>>
>>> Marco
>>>
>>>> Thanks.
>>>>
>>>> --
>>>> Martin Goldstone
>>>> IT Systems Administrator
>>>> IT Services, Innovation Centre 1 (IC1)
>>>> Keele University, Keele, Staffordshire, United Kingdom,
>>>> ST5 5NB
>>>> Telephone: +44 1782 734457 <tel:%2B44%201782%20734457>
>>>> G+: http://google.com/+MartinGoldstoneKeele
>>>
>>> --
>>> Dott. Marco Di Sabatino Di Diodoro
>>> Tel.+39 3939065570 <tel:%2B39%203939065570>
>>>
>>> Tirasa S.r.l.
>>> Viale D'Annunzio 267 - 65127 Pescara
>>> Tel+39 0859116307 <tel:%2B39%200859116307> / FAX+39 0859111173 <tel:%2B39%200859111173>
>>> http://www.tirasa.net
>>>
>>> Apache Syncope PMC Member
>>> http://people.apache.org/~mdisabatino/
>>> <http://people.apache.org/%7Emdisabatino/>
>>>
>>>
>>>
>>>
>>> --
>>> Martin Goldstone
>>> IT Systems Administrator
>>> IT Services, Innovation Centre 1 (IC1)
>>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>>> Telephone: +44 1782 734457 <tel:%2B44%201782%20734457>
>>> G+: http://google.com/+MartinGoldstoneKeele
>>
>>
>> --
>> Fabio Martelli
>> https://it.linkedin.com/pub/fabio-martelli/1/974/a44
>> http://blog.tirasa.net/author/fabio/index.html
>>
>> Tirasa - Open Source Excellence
>> http://www.tirasa.net/
>>
>> Apache Syncope PMC
>> http://people.apache.org/~fmartelli/
>> <http://people.apache.org/%7Efmartelli/>
>>
>>
>>
>>
>> --
>> Martin Goldstone
>> IT Systems Administrator
>> IT Services, Innovation Centre 1 (IC1)
>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>> Telephone: +44 1782 734457 <tel:%2B44%201782%20734457>
>> G+: http://google.com/+MartinGoldstoneKeele
>
>
> --
> Fabio Martelli
> https://it.linkedin.com/pub/fabio-martelli/1/974/a44
> http://blog.tirasa.net/author/fabio/index.html
>
> Tirasa - Open Source Excellence
> http://www.tirasa.net/
>
> Apache Syncope PMC
> http://people.apache.org/~fmartelli/
> <http://people.apache.org/%7Efmartelli/>
>
>
>
>
> --
> Martin Goldstone
> IT Systems Administrator
> IT Services, Innovation Centre 1 (IC1)
> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
> Telephone: +44 1782 734457
> G+: http://google.com/+MartinGoldstoneKeele
--
Fabio Martelli
https://it.linkedin.com/pub/fabio-martelli/1/974/a44
http://blog.tirasa.net/author/fabio/index.html
Tirasa - Open Source Excellence
http://www.tirasa.net/
Apache Syncope PMC
http://people.apache.org/~fmartelli/
Re: LDAP synchronisation and User derived attribute as account ID
with database resource
Posted by Martin Goldstone <m....@keele.ac.uk>.
Hi Fabio et al,
I've recreated everything from scratch, still without success. Please find
attached screenshots detailing the current configuration of the LDAP, staff
db, and card db mappings, and the capabilities of the connectors. Also
attached are the log files requested.
Thanks.
On 21 March 2016 at 11:17, Fabio Martelli <fa...@gmail.com> wrote:
> Hi Marting, find my comments in-line.
> Regards,
> F.
>
> Il 21/03/2016 11:31, Martin Goldstone ha scritto:
>
> Hi Fabio,
>
> I've completely re-created this resource and no longer have the account
> link configured. Unfortunately synchronising still does nothing.
>
> Would you provide your new configuration?
>
>
> Interestingly, if I add it as a resource to the user, I see some errors in
> the log where it tries to propagate a null entry to the card number field
> for the record, but when I click the button to see the resource data for
> the user, I can see the cad number as listed in the database (see attached
> screenshot). However, the card number does not appear on the attributes
> page for the user, either before or after running another synchronisation.
>
> This shouldn't be a problem.
> If I well understood you assigned carddb resource to user manually, didn't
> you?
> When you generate a propagation directly (by submitting user profile
> changes) or indirectly (by synchronizing from another resource) Syncope
> will try to update carddb remote account.
> Unfortunately, looking at your previously provided screenshots, card
> number has been flagged as "read-only" field into its mapping (see
> "Mapping purposes" at [1]). In this case card number won't be provided
> during propagation.
>
> Be sure to use mapping purposes correctly.
>
> Furthermore, provide resource and connector configuration screenshots as
> well. In particular, provide the first tab of resource configuration page
> and the last one (Capabilities) of connectors.
> I do think logs could be useful: core-rest.log, core-connid.log, core.log.
>
> You shouldn't have any trouble with your specific requirements: I
> personally know about some installations which are working by implementing
> exactly this behaviour.
> .... configuration matter for sure.
>
> [1]
> https://cwiki.apache.org/confluence/display/SYNCOPE/Schema,+attributes+and+mapping#Schema,attributesandmapping-SchemaMapping
>
>
> On 21 March 2016 at 08:52, Fabio Martelli <fa...@gmail.com>
> wrote:
>
>> Hi Martin, try out removing/disabling Account Link into carddb-mapping.
>> AccountId mapping is enough.
>>
>> Best regards,
>> F.
>>
>>
>> Il 18/03/2016 10:28, Martin Goldstone ha scritto:
>>
>> Hi Marco,
>>
>> Attached are screenshots of these mappings.
>>
>> The second database (the one with the K prefix), is one in the
>> carddb_mapping.
>>
>> I've also included the derived attribute (staff_ex_link)
>>
>> Thanks.
>>
>> On 18 March 2016 at 08:32, Marco Di Sabatino Di Diodoro <
>> marco.disabatino@tirasa.net> wrote:
>>
>>> Hi Martin,
>>>
>>> Il 17/03/2016 18:12, Martin Goldstone ha scritto:
>>>
>>> Hi All,
>>>
>>> I'm currently building a proof of concept using Apache Syncope 1.2.7.
>>> I've managed to create a user by synchronising from our openLDAP directory,
>>> and I've also managed to manually create a user and sync ldap to it. I've
>>> then successfully synchronised with a database containing additional fields
>>> for that user. The accountid field in the database is contained within the
>>> data from LDAP, mapped to an attribute called roll_number.
>>>
>>> I have another database that I want to synchronise additional data for
>>> this user from, but its accountid is roll_number with a prefix of 'K'. If I
>>> manually create another attribute for the user, populate it by hand with
>>> the relevant value beginning with 'K', and set the mapping accordingly I
>>> can synchronise this properly. However, if I set up a derived attribute for
>>> this consisting of 'K'+roll_number, assign this attribute to the user and
>>> set the mappings accordingly, it does not synchronise the data. The status
>>> says success but the execution history shows it did nothing (Users
>>> [created/failures]: 0/0 [updated/failures]: 0/0 [deleted/failures]: 0/0 [no
>>> operation/ignored]: 0/0). I thought of creating a synchronisation policy,
>>> but derived attributes are not listed when creating it.
>>>
>>> Can anyone point me in the right direction? Unfortunately I am not in a
>>> position to simply get rid of the 'K' prefix.
>>>
>>> Please send me all your resource mapping configurations. I don't
>>> understand if the derived attribute is configured in the first or second
>>> (roll_number with a prefix of 'K') database.
>>>
>>> Marco
>>>
>>> Thanks.
>>>
>>> --
>>> Martin Goldstone
>>> IT Systems Administrator
>>> IT Services, Innovation Centre 1 (IC1)
>>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>>> Telephone: +44 1782 734457 <%2B44%201782%20734457>
>>> G+: http://google.com/+MartinGoldstoneKeele
>>>
>>>
>>> --
>>> Dott. Marco Di Sabatino Di Diodoro
>>> Tel. +39 3939065570
>>>
>>> Tirasa S.r.l.
>>> Viale D'Annunzio 267 - 65127 Pescara
>>> Tel +39 0859116307 / FAX +39 0859111173http://www.tirasa.net
>>>
>>> Apache Syncope PMC Memberhttp://people.apache.org/~mdisabatino/
>>>
>>>
>>
>>
>> --
>> Martin Goldstone
>> IT Systems Administrator
>> IT Services, Innovation Centre 1 (IC1)
>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>> Telephone: +44 1782 734457 <%2B44%201782%20734457>
>> G+: <http://google.com/+MartinGoldstoneKeele>
>> http://google.com/+MartinGoldstoneKeele
>>
>>
>>
>> --
>> Fabio Martellihttps://it.linkedin.com/pub/fabio-martelli/1/974/a44http://blog.tirasa.net/author/fabio/index.html
>>
>> Tirasa - Open Source Excellencehttp://www.tirasa.net/
>>
>> Apache Syncope PMChttp://people.apache.org/~fmartelli/
>>
>>
>
>
> --
> Martin Goldstone
> IT Systems Administrator
> IT Services, Innovation Centre 1 (IC1)
> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
> Telephone: +44 1782 734457
> G+: <http://google.com/+MartinGoldstoneKeele>
> http://google.com/+MartinGoldstoneKeele
>
>
>
> --
> Fabio Martellihttps://it.linkedin.com/pub/fabio-martelli/1/974/a44http://blog.tirasa.net/author/fabio/index.html
>
> Tirasa - Open Source Excellencehttp://www.tirasa.net/
>
> Apache Syncope PMChttp://people.apache.org/~fmartelli/
>
>
--
Martin Goldstone
IT Systems Administrator
IT Services, Innovation Centre 1 (IC1)
Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
Telephone: +44 1782 734457
G+: http://google.com/+MartinGoldstoneKeele
Re: LDAP synchronisation and User derived attribute as account ID
with database resource
Posted by Fabio Martelli <fa...@gmail.com>.
Hi Marting, find my comments in-line.
Regards,
F.
Il 21/03/2016 11:31, Martin Goldstone ha scritto:
> Hi Fabio,
>
> I've completely re-created this resource and no longer have the
> account link configured. Unfortunately synchronising still does nothing.
Would you provide your new configuration?
>
> Interestingly, if I add it as a resource to the user, I see some
> errors in the log where it tries to propagate a null entry to the card
> number field for the record, but when I click the button to see the
> resource data for the user, I can see the cad number as listed in the
> database (see attached screenshot). However, the card number does not
> appear on the attributes page for the user, either before or after
> running another synchronisation.
This shouldn't be a problem.
If I well understood you assigned carddb resource to user manually,
didn't you?
When you generate a propagation directly (by submitting user profile
changes) or indirectly (by synchronizing from another resource) Syncope
will try to update carddb remote account.
Unfortunately, looking at your previously provided screenshots, card
number has been flagged as "read-only" field into its mapping (see
"Mapping purposes" at [1]). In this case card number won't be provided
during propagation.
Be sure to use mapping purposes correctly.
Furthermore, provide resource and connector configuration screenshots as
well. In particular, provide the first tab of resource configuration
page and the last one (Capabilities) of connectors.
I do think logs could be useful: core-rest.log, core-connid.log, core.log.
You shouldn't have any trouble with your specific requirements: I
personally know about some installations which are working by
implementing exactly this behaviour.
.... configuration matter for sure.
[1]
https://cwiki.apache.org/confluence/display/SYNCOPE/Schema,+attributes+and+mapping#Schema,attributesandmapping-SchemaMapping
>
> On 21 March 2016 at 08:52, Fabio Martelli <fabio.martelli@gmail.com
> <ma...@gmail.com>> wrote:
>
> Hi Martin, try out removing/disabling Account Link into
> carddb-mapping.
> AccountId mapping is enough.
>
> Best regards,
> F.
>
>
> Il 18/03/2016 10:28, Martin Goldstone ha scritto:
>> Hi Marco,
>>
>> Attached are screenshots of these mappings.
>>
>> The second database (the one with the K prefix), is one in the
>> carddb_mapping.
>>
>> I've also included the derived attribute (staff_ex_link)
>>
>> Thanks.
>>
>> On 18 March 2016 at 08:32, Marco Di Sabatino Di Diodoro
>> <marco.disabatino@tirasa.net
>> <ma...@tirasa.net>> wrote:
>>
>> Hi Martin,
>>
>> Il 17/03/2016 18:12, Martin Goldstone ha scritto:
>>> Hi All,
>>>
>>> I'm currently building a proof of concept using Apache
>>> Syncope 1.2.7. I've managed to create a user by
>>> synchronising from our openLDAP directory, and I've also
>>> managed to manually create a user and sync ldap to it. I've
>>> then successfully synchronised with a database containing
>>> additional fields for that user. The accountid field in the
>>> database is contained within the data from LDAP, mapped to
>>> an attribute called roll_number.
>>>
>>> I have another database that I want to synchronise
>>> additional data for this user from, but its accountid is
>>> roll_number with a prefix of 'K'. If I manually create
>>> another attribute for the user, populate it by hand with the
>>> relevant value beginning with 'K', and set the mapping
>>> accordingly I can synchronise this properly. However, if I
>>> set up a derived attribute for this consisting of
>>> 'K'+roll_number, assign this attribute to the user and set
>>> the mappings accordingly, it does not synchronise the data.
>>> The status says success but the execution history shows it
>>> did nothing (Users [created/failures]: 0/0
>>> [updated/failures]: 0/0 [deleted/failures]: 0/0 [no
>>> operation/ignored]: 0/0). I thought of creating a
>>> synchronisation policy, but derived attributes are not
>>> listed when creating it.
>>>
>>> Can anyone point me in the right direction? Unfortunately I
>>> am not in a position to simply get rid of the 'K' prefix.
>>>
>> Please send me all your resource mapping configurations. I
>> don't understand if the derived attribute is configured in
>> the first or second (roll_number with a prefix of 'K') database.
>>
>> Marco
>>
>>> Thanks.
>>>
>>> --
>>> Martin Goldstone
>>> IT Systems Administrator
>>> IT Services, Innovation Centre 1 (IC1)
>>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>>> Telephone: +44 1782 734457 <tel:%2B44%201782%20734457>
>>> G+: http://google.com/+MartinGoldstoneKeele
>>
>> --
>> Dott. Marco Di Sabatino Di Diodoro
>> Tel.+39 3939065570 <tel:%2B39%203939065570>
>>
>> Tirasa S.r.l.
>> Viale D'Annunzio 267 - 65127 Pescara
>> Tel+39 0859116307 <tel:%2B39%200859116307> / FAX+39 0859111173 <tel:%2B39%200859111173>
>> http://www.tirasa.net
>>
>> Apache Syncope PMC Member
>> http://people.apache.org/~mdisabatino/
>> <http://people.apache.org/%7Emdisabatino/>
>>
>>
>>
>>
>> --
>> Martin Goldstone
>> IT Systems Administrator
>> IT Services, Innovation Centre 1 (IC1)
>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>> Telephone: +44 1782 734457 <tel:%2B44%201782%20734457>
>> G+: http://google.com/+MartinGoldstoneKeele
>
>
> --
> Fabio Martelli
> https://it.linkedin.com/pub/fabio-martelli/1/974/a44
> http://blog.tirasa.net/author/fabio/index.html
>
> Tirasa - Open Source Excellence
> http://www.tirasa.net/
>
> Apache Syncope PMC
> http://people.apache.org/~fmartelli/
> <http://people.apache.org/%7Efmartelli/>
>
>
>
>
> --
> Martin Goldstone
> IT Systems Administrator
> IT Services, Innovation Centre 1 (IC1)
> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
> Telephone: +44 1782 734457
> G+: http://google.com/+MartinGoldstoneKeele
--
Fabio Martelli
https://it.linkedin.com/pub/fabio-martelli/1/974/a44
http://blog.tirasa.net/author/fabio/index.html
Tirasa - Open Source Excellence
http://www.tirasa.net/
Apache Syncope PMC
http://people.apache.org/~fmartelli/
Re: LDAP synchronisation and User derived attribute as account ID
with database resource
Posted by Martin Goldstone <m....@keele.ac.uk>.
Hi Fabio,
I've completely re-created this resource and no longer have the account
link configured. Unfortunately synchronising still does nothing.
Interestingly, if I add it as a resource to the user, I see some errors in
the log where it tries to propagate a null entry to the card number field
for the record, but when I click the button to see the resource data for
the user, I can see the cad number as listed in the database (see attached
screenshot). However, the card number does not appear on the attributes
page for the user, either before or after running another synchronisation.
On 21 March 2016 at 08:52, Fabio Martelli <fa...@gmail.com> wrote:
> Hi Martin, try out removing/disabling Account Link into carddb-mapping.
> AccountId mapping is enough.
>
> Best regards,
> F.
>
>
> Il 18/03/2016 10:28, Martin Goldstone ha scritto:
>
> Hi Marco,
>
> Attached are screenshots of these mappings.
>
> The second database (the one with the K prefix), is one in the
> carddb_mapping.
>
> I've also included the derived attribute (staff_ex_link)
>
> Thanks.
>
> On 18 March 2016 at 08:32, Marco Di Sabatino Di Diodoro <
> <ma...@tirasa.net> wrote:
>
>> Hi Martin,
>>
>> Il 17/03/2016 18:12, Martin Goldstone ha scritto:
>>
>> Hi All,
>>
>> I'm currently building a proof of concept using Apache Syncope 1.2.7.
>> I've managed to create a user by synchronising from our openLDAP directory,
>> and I've also managed to manually create a user and sync ldap to it. I've
>> then successfully synchronised with a database containing additional fields
>> for that user. The accountid field in the database is contained within the
>> data from LDAP, mapped to an attribute called roll_number.
>>
>> I have another database that I want to synchronise additional data for
>> this user from, but its accountid is roll_number with a prefix of 'K'. If I
>> manually create another attribute for the user, populate it by hand with
>> the relevant value beginning with 'K', and set the mapping accordingly I
>> can synchronise this properly. However, if I set up a derived attribute for
>> this consisting of 'K'+roll_number, assign this attribute to the user and
>> set the mappings accordingly, it does not synchronise the data. The status
>> says success but the execution history shows it did nothing (Users
>> [created/failures]: 0/0 [updated/failures]: 0/0 [deleted/failures]: 0/0 [no
>> operation/ignored]: 0/0). I thought of creating a synchronisation policy,
>> but derived attributes are not listed when creating it.
>>
>> Can anyone point me in the right direction? Unfortunately I am not in a
>> position to simply get rid of the 'K' prefix.
>>
>> Please send me all your resource mapping configurations. I don't
>> understand if the derived attribute is configured in the first or second
>> (roll_number with a prefix of 'K') database.
>>
>> Marco
>>
>> Thanks.
>>
>> --
>> Martin Goldstone
>> IT Systems Administrator
>> IT Services, Innovation Centre 1 (IC1)
>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>> Telephone: +44 1782 734457
>> G+: <http://google.com/+MartinGoldstoneKeele>
>> http://google.com/+MartinGoldstoneKeele
>>
>>
>> --
>> Dott. Marco Di Sabatino Di Diodoro
>> Tel. +39 3939065570
>>
>> Tirasa S.r.l.
>> Viale D'Annunzio 267 - 65127 Pescara
>> Tel +39 0859116307 / FAX +39 0859111173http://www.tirasa.net
>>
>> Apache Syncope PMC Memberhttp://people.apache.org/~mdisabatino/
>>
>>
>
>
> --
> Martin Goldstone
> IT Systems Administrator
> IT Services, Innovation Centre 1 (IC1)
> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
> Telephone: +44 1782 734457
> G+: <http://google.com/+MartinGoldstoneKeele>
> http://google.com/+MartinGoldstoneKeele
>
>
>
> --
> Fabio Martellihttps://it.linkedin.com/pub/fabio-martelli/1/974/a44http://blog.tirasa.net/author/fabio/index.html
>
> Tirasa - Open Source Excellencehttp://www.tirasa.net/
>
> Apache Syncope PMChttp://people.apache.org/~fmartelli/
>
>
--
Martin Goldstone
IT Systems Administrator
IT Services, Innovation Centre 1 (IC1)
Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
Telephone: +44 1782 734457
G+: http://google.com/+MartinGoldstoneKeele
Re: LDAP synchronisation and User derived attribute as account ID
with database resource
Posted by Fabio Martelli <fa...@gmail.com>.
Hi Martin, try out removing/disabling Account Link into carddb-mapping.
AccountId mapping is enough.
Best regards,
F.
Il 18/03/2016 10:28, Martin Goldstone ha scritto:
> Hi Marco,
>
> Attached are screenshots of these mappings.
>
> The second database (the one with the K prefix), is one in the
> carddb_mapping.
>
> I've also included the derived attribute (staff_ex_link)
>
> Thanks.
>
> On 18 March 2016 at 08:32, Marco Di Sabatino Di Diodoro
> <marco.disabatino@tirasa.net <ma...@tirasa.net>> wrote:
>
> Hi Martin,
>
> Il 17/03/2016 18:12, Martin Goldstone ha scritto:
>> Hi All,
>>
>> I'm currently building a proof of concept using Apache Syncope
>> 1.2.7. I've managed to create a user by synchronising from our
>> openLDAP directory, and I've also managed to manually create a
>> user and sync ldap to it. I've then successfully synchronised
>> with a database containing additional fields for that user. The
>> accountid field in the database is contained within the data from
>> LDAP, mapped to an attribute called roll_number.
>>
>> I have another database that I want to synchronise additional
>> data for this user from, but its accountid is roll_number with a
>> prefix of 'K'. If I manually create another attribute for the
>> user, populate it by hand with the relevant value beginning with
>> 'K', and set the mapping accordingly I can synchronise this
>> properly. However, if I set up a derived attribute for this
>> consisting of 'K'+roll_number, assign this attribute to the user
>> and set the mappings accordingly, it does not synchronise the
>> data. The status says success but the execution history shows it
>> did nothing (Users [created/failures]: 0/0 [updated/failures]:
>> 0/0 [deleted/failures]: 0/0 [no operation/ignored]: 0/0). I
>> thought of creating a synchronisation policy, but derived
>> attributes are not listed when creating it.
>>
>> Can anyone point me in the right direction? Unfortunately I am
>> not in a position to simply get rid of the 'K' prefix.
>>
> Please send me all your resource mapping configurations. I don't
> understand if the derived attribute is configured in the first or
> second (roll_number with a prefix of 'K') database.
>
> Marco
>
>> Thanks.
>>
>> --
>> Martin Goldstone
>> IT Systems Administrator
>> IT Services, Innovation Centre 1 (IC1)
>> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
>> Telephone: +44 1782 734457
>> G+: http://google.com/+MartinGoldstoneKeele
>
> --
> Dott. Marco Di Sabatino Di Diodoro
> Tel.+39 3939065570 <tel:%2B39%203939065570>
>
> Tirasa S.r.l.
> Viale D'Annunzio 267 - 65127 Pescara
> Tel+39 0859116307 <tel:%2B39%200859116307> / FAX+39 0859111173 <tel:%2B39%200859111173>
> http://www.tirasa.net
>
> Apache Syncope PMC Member
> http://people.apache.org/~mdisabatino/
> <http://people.apache.org/%7Emdisabatino/>
>
>
>
>
> --
> Martin Goldstone
> IT Systems Administrator
> IT Services, Innovation Centre 1 (IC1)
> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
> Telephone: +44 1782 734457
> G+: http://google.com/+MartinGoldstoneKeele
--
Fabio Martelli
https://it.linkedin.com/pub/fabio-martelli/1/974/a44
http://blog.tirasa.net/author/fabio/index.html
Tirasa - Open Source Excellence
http://www.tirasa.net/
Apache Syncope PMC
http://people.apache.org/~fmartelli/
Re: LDAP synchronisation and User derived attribute as account ID
with database resource
Posted by Martin Goldstone <m....@keele.ac.uk>.
Hi Marco,
Attached are screenshots of these mappings.
The second database (the one with the K prefix), is one in the
carddb_mapping.
I've also included the derived attribute (staff_ex_link)
Thanks.
On 18 March 2016 at 08:32, Marco Di Sabatino Di Diodoro <
marco.disabatino@tirasa.net> wrote:
> Hi Martin,
>
> Il 17/03/2016 18:12, Martin Goldstone ha scritto:
>
> Hi All,
>
> I'm currently building a proof of concept using Apache Syncope 1.2.7. I've
> managed to create a user by synchronising from our openLDAP directory, and
> I've also managed to manually create a user and sync ldap to it. I've then
> successfully synchronised with a database containing additional fields for
> that user. The accountid field in the database is contained within the data
> from LDAP, mapped to an attribute called roll_number.
>
> I have another database that I want to synchronise additional data for
> this user from, but its accountid is roll_number with a prefix of 'K'. If I
> manually create another attribute for the user, populate it by hand with
> the relevant value beginning with 'K', and set the mapping accordingly I
> can synchronise this properly. However, if I set up a derived attribute for
> this consisting of 'K'+roll_number, assign this attribute to the user and
> set the mappings accordingly, it does not synchronise the data. The status
> says success but the execution history shows it did nothing (Users
> [created/failures]: 0/0 [updated/failures]: 0/0 [deleted/failures]: 0/0 [no
> operation/ignored]: 0/0). I thought of creating a synchronisation policy,
> but derived attributes are not listed when creating it.
>
> Can anyone point me in the right direction? Unfortunately I am not in a
> position to simply get rid of the 'K' prefix.
>
> Please send me all your resource mapping configurations. I don't
> understand if the derived attribute is configured in the first or second
> (roll_number with a prefix of 'K') database.
>
> Marco
>
> Thanks.
>
> --
> Martin Goldstone
> IT Systems Administrator
> IT Services, Innovation Centre 1 (IC1)
> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
> Telephone: +44 1782 734457
> G+: <http://google.com/+MartinGoldstoneKeele>
> http://google.com/+MartinGoldstoneKeele
>
>
> --
> Dott. Marco Di Sabatino Di Diodoro
> Tel. +39 3939065570
>
> Tirasa S.r.l.
> Viale D'Annunzio 267 - 65127 Pescara
> Tel +39 0859116307 / FAX +39 0859111173http://www.tirasa.net
>
> Apache Syncope PMC Memberhttp://people.apache.org/~mdisabatino/
>
>
--
Martin Goldstone
IT Systems Administrator
IT Services, Innovation Centre 1 (IC1)
Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
Telephone: +44 1782 734457
G+: http://google.com/+MartinGoldstoneKeele
Re: LDAP synchronisation and User derived attribute as account ID
with database resource
Posted by Marco Di Sabatino Di Diodoro <ma...@tirasa.net>.
Hi Martin,
Il 17/03/2016 18:12, Martin Goldstone ha scritto:
> Hi All,
>
> I'm currently building a proof of concept using Apache Syncope 1.2.7.
> I've managed to create a user by synchronising from our openLDAP
> directory, and I've also managed to manually create a user and sync
> ldap to it. I've then successfully synchronised with a database
> containing additional fields for that user. The accountid field in the
> database is contained within the data from LDAP, mapped to an
> attribute called roll_number.
>
> I have another database that I want to synchronise additional data for
> this user from, but its accountid is roll_number with a prefix of 'K'.
> If I manually create another attribute for the user, populate it by
> hand with the relevant value beginning with 'K', and set the mapping
> accordingly I can synchronise this properly. However, if I set up a
> derived attribute for this consisting of 'K'+roll_number, assign this
> attribute to the user and set the mappings accordingly, it does not
> synchronise the data. The status says success but the execution
> history shows it did nothing (Users [created/failures]: 0/0
> [updated/failures]: 0/0 [deleted/failures]: 0/0 [no
> operation/ignored]: 0/0). I thought of creating a synchronisation
> policy, but derived attributes are not listed when creating it.
>
> Can anyone point me in the right direction? Unfortunately I am not in
> a position to simply get rid of the 'K' prefix.
>
Please send me all your resource mapping configurations. I don't
understand if the derived attribute is configured in the first or second
(roll_number with a prefix of 'K') database.
Marco
> Thanks.
>
> --
> Martin Goldstone
> IT Systems Administrator
> IT Services, Innovation Centre 1 (IC1)
> Keele University, Keele, Staffordshire, United Kingdom, ST5 5NB
> Telephone: +44 1782 734457
> G+: http://google.com/+MartinGoldstoneKeele
--
Dott. Marco Di Sabatino Di Diodoro
Tel. +39 3939065570
Tirasa S.r.l.
Viale D'Annunzio 267 - 65127 Pescara
Tel +39 0859116307 / FAX +39 0859111173
http://www.tirasa.net
Apache Syncope PMC Member
http://people.apache.org/~mdisabatino/