Grouper Developers Forum

["Jessica Bibbee" <>]

Grouper Working Group Meeting
November 14, 2007

*Attendees*
Tom Barton, U. Chicago (chair)
Gary Brown, Bristol U.
Katherine Huxtable, Independent 
Shilen Patel, Duke U.
Bill Kasenchar, U. Pennsylvania
Chris Hyzer, U. Pennsylvania
Dave Donnelly, Stanford U.
Joy Veronneau, Cornell U.
James Cramton, Brown U.
Steve Olshansky, Internet2
Jessica Bibbee, Internet2 (scribe)

New *Action Items*
[AI] {Kathryn} will draft a proposal for future Ldappc work.
[AI] {Bill} will lead the drafting of an analysis of UI improvements.

Carry-over *Action Items*
[AI] {Tom} will email the Group with more information on potential Ldappc modifications. (31-Oct-07)

*Agenda*
1. Readying v1.2.1 for release. cf. attached v1.2.1-open-issues.jpg, or go to
<https://bugs.internet2.edu/jira/browse/GRP>, choose "Open Issues", and select "
1.2.1".

2. Ldappc Improvements

3. Roadmap Strawman & Project Resources, cf.
< https://wiki.internet2.edu/confluence/display/GrouperWG/Priorities+for+Functional+Enhancements
 >

v1.3 - April '08
  general 1.3 improvements
  Web Services interface
  Implement hooks infrastructure
  GridGrouper variant
  Unresolvable Subject deletion utility
  Ldappc v1.0.1
  Subject API v1.0

v1.3.1 - May '08
  1.3.1 fixes

v2.0 - Aug '08
  general 2.0 improvements
  I2MI integration #1
  I2MI integration #2
  Notification of changes
  Ldappc v2.0

v2.0.1 - Nov '08
  2.0.1 fixes

v? - Unassigned to a release as yet
  Namespace transition support
  I2MI integration #3
  History & audit
  Rule-based actions

*Discussion*

-Report on Completed Action Items-
{Shilen} has passed on his proposed API changes (GRP-53) for a future Grouper v1.3 release to {Gary}. They are continuing to explore what is feasible to include in the nearing v1.2.1, and how else privilege checking can be improved. 

{Shilen} also shared his thoughts with Gary on the pros and cons of a groupmember query class; {Gary} will investigate how it may improve My Searches. 

-Readying Grouper v1.2.1 for Release-

{Tom} said there are 3 open issues in JIRA (GRP-7, -53, -54), which will be resolved by this Friday; an API/UI code freeze will precede the announcement of a Grouper 
v1.2.1 Release Candidate-1 by Monday. The official v1.2.1 release is still expected to be in the first week of December.

{Gary} is concerned that some of the privilege checking is not as efficient as it could be. For example, code checks if you are a member of the wheel group and caches the results each time. Other items are not cached at all. He has checked one modification into CVS, but could not guarantee that all of these changes (for GRP--7, Simplify UI for Browsing) would make it into the Friday code freeze.

{Shilen} gave an update on GRP-53, Privilege checking in GrouperQuery. If there are many unions or intersections of groups, the issue is that there will be more checks if done individually, as opposed to in a filter. Another issue complicates the next steps here, as some privilege checking is not done in a filter, which means that the checking could happen twice. Some of this work may be in context of the 
v1.3 release.

{Gary} will try to find time to do more profiling related to GRP-54. If there is time, he will compare his results against Shilen's and re-check. {Gary} will focus on profiling code; {Tom} will focus on the packaging.

For more details, refer to < https://bugs.internet2.edu/jira/browse/GRP >, choose "Open Issues", and select "1.2.1".

-Ldappc Improvements-
The Group expressed continued concern around Ldappc and interest in contributing to development.  Currently, there are 4 JIRA items related to Ldappc. {James} has contributed some of the recent work, and {Kathryn} agreed to work with him. [AI] {Kathryn} will draft a proposal for future Ldappc work.

{Steve Edgar} of Cornell has posted a few scenarios as they work to replace their current AuthZ system, Permit Server, with Grouper. He has detailed issues arising from the use of Ldappc to provision a large group of 190K members.  Cf. (email on 13-Nov, subject: Grouper Concurrency and Ldappc) < 
https://mail.internet2.edu/wws/arc/grouper-dev/2007-11/msg00009.html > {Joy} also expressed a need for protection in the UI, i.e., limits that prevent people from using such a large group as part of a composite group.

{Kathryn} referenced her use of the RDBPC while at Kansas U. < https://wiki.internet2.edu/confluence/x/eS0 >. Once groups are provisioned, RDBPC would provision only the changes.

Another concern is if there are several people authorized to work with these large groups; how to ensure that they do not replicate composite groups, etc. How to know who is doing what, and where? {James} suggested that this issue is likely easier to be fixed if addressed as a process issue. He also said that it could be a namespace issue, 
i.e., if a person has access to the community.all group.

At a later point in the Ldappc development work, a script would be useful for generating groups.

-UI Improvements-
{Bill} mentioned there may be several quick fixes that could alleviate current UI navigation issues. {Tom} encouraged everyone to post suggestions and observations to the list. People have voiced that the UI should not expose all the capabilities of the API, nor should it be solely an individual Grouper UI (
e.g., web services.) Improvements to the UI will be added to the roadmap. [AI] {Bill} will lead the drafting of an analysis of UI improvements.

- Roadmap Strawman & Project Resources-
{Tom} opened discussion around resources and functional enhancements, their priority, and involving people to work on these items. The below roadmap gives the following dates as a guide, but is open to comments and is subject to change.

v1.3 - April '08
  general 1.3 improvements
  Web Services interface
  Implement hooks infrastructure
  GridGrouper variant
  Unresolvable Subject deletion utility
  Ldappc v1.0.1
  Subject API 
v1.0

A focus for the Grouper v1.3 release will be web services, as broad a definition as it may have. It will be especially important for people to contribute their requirements for developing this component.

{Tom} shared that {Steve Langella} is willing to contribute back to Grouper on their work regarding GridGrouper as a webservice. The GridGrouper website:
< 
http://www.cagrid.org/mwiki/index.php?title=GridGrouper:Main >

Grouper work on web services and hooks will coordinate with Signet. While the Subject API is close to resolution, other items will require much more specification.

v1.3.1 - May '08
  1.3.1 fixes

v2.0 - Aug '08
  general 2.0 improvements
  I2MI integration #1
  I2MI integration #2
  Notification of changes
  Ldappc v2.0

*I2MI integration #1* refers to the coordination of the Grouper, Signet, Shibboleth, Subject API, and Ldappc projects. The developer teams will look for areas of current overlap and will work on a common configuration framework. 

*I2MI integration #2* refers to the capabilities that are wanted in both Signet and Grouper. For example, how are common attributes used in Signet/Grouper? These should be met with the same means.

v2.0.1 - Nov '08
  2.0.1 fixes

v? - Unassigned to a release as yet
  Namespace transition support
  I2MI integration #3
  History & audit
  Rule-based actions

Cf.
< 
https://wiki.internet2.edu/confluence/display/GrouperWG/Priorities+for+Functional+Enhancements >

The next Grouper Working Group conference call will be held on Wednesday, November 28, 2007 at 12pm EST.


-- 
Jessica Bibbee, Technical Analyst
Internet2

mobile: +1-734-255-6644

The Internet2 Dynamic Circuit Network:
Unleash your Interdomain Imagination
http://www.internet2.edu/network/dc/