Grouper provisioning incremental workflow

Grouper provisioners in Grouper 2.5 and above will be an "esb listener" and process EsbEvent objects.  However, unlike Grouper 2.4 listeners, the provisioner change log consumer will process multiple events at once, and not from a JSON representation.  This occurs in the provisioning framework.

Configure an incremental job

grouper-loader.properties

changeLog.consumer.<jobName>.class = edu.internet2.middleware.grouper.changeLog.esb.consumer.EsbConsumer
changeLog.consumer.<jobName>.publisher.class= edu.internet2.middleware.grouper.app.provisioning.ProvisioningConsumer
changeLog.consumer.<jobName>.quartzCron = 0 * * * * ?
changeLog.consumer.<jobName>.provisionerTarget = <provisionerConfigId>
changeLog.consumer.<jobName>.provisionerJobSyncType = incrementalProvisionChangeLog
changeLog.consumer.<jobName>.publisher.debug = false

Recalculate operations (stateful vs stateless)

When events are processed by the provisioning framework, they are one of two types:

1. Without recalculate (stateful)
   1. Take an "add member 123 to group a:b:c" and send that operation to the target
   2. This will check the state in grouper (is the user a member), and the cached target state (does grouper think the user is a member in the target group?)
      1. If the Grouper state doesnt match the event, e.g. an add member and the user is not a member of the group), this will be converted into a recalc event
      2. If the cached state of the target doesnt match the event, e.g. if grouper thinks the user is already a member of the group in the target, and its a "add member" event, convert the event to a recalc event
   3. This is used by default for change log events
   4. Best performance, since there are fewer target operations
   5. Edge cases could produce temporary incorrect results (the target could be blissfully out of sync until the next full sync)
2. Recalculate (stateless)
   1. There is no "add member" event, there is "check group a:b:c for subject 123". 
   2. Check the state on the target, compare with grouper, and issue the correct operation
   3. This is used for:
      1. Full sync, Group sync, User sync
      2. UI provision buttons pressed on full, group, user, or membership sync'ing
      3. Error correction.  If an operation produces an error, do a recalc on that object
      4. If state doesnt match in a stateful operation (described above)
   4. Performance not as good
   5. Target will be in the correct state
   6. Events can be replayed without problems.  Idempotent

If you want all operations to be stateless, you can change this provisioning setting:

grouper-loader.properties

provisioner.<provisionerConfigId>.recalculateAllOperations = true

Workflow

Here is the workflow of a provisioner

Messaging to control provisioning externally (e.g. from UI or WS)

You can send messages to provisioners to control provisioning, though there is no feedback about what happened.  Well, you could poll the messaging system to see if the message has been processed or deleted.  Generally this should take effect in a minute or two.  The default implementation will select all messages at once for all provisioners with the assumption that there arent that many at any given time.

Queue for provisioning: grouperProvisioningControl_provisionerName  (e.g. grouperProvisioningControl_myPspngProvisioner)

Java to send a message:

    ProvisioningMessage provisioningMessage = new ProvisioningMessage();
    provisioningMessage.setFullSync(true);
    String message = provisioningMessage.toJson();

    GrouperMessagingEngine.send(
        new GrouperMessageSendParam().assignGrouperMessageSystemName(GrouperBuiltinMessagingSystem.BUILTIN_NAME)
          .assignQueueType(GrouperMessageQueueType.queue)
          .assignQueueOrTopicName("grouperProvisioningControl_myPspngProvisioner")
          .assignAutocreateObjects(true)
          .addMessageBody(message));

Message to do a full sync:

{"fullSync":true,"fullSyncType":"optionalFullSyncType"}

Message to sync some groups:

{"groupIdsForSync":["abc123","def456"]}

Message to sync some users:

{"memberIdsForSync":["abc123","def456"]}

Message to sync from memberships:

{"membershipsForSync":[{"groupId":"abc123","memberId":"jkl789"},{"groupId":"def456","memberId":"qwe543"}]}