grouper-dev - Draft Minutes: Grouper Face-to-Face Meeting at SMM 26-Apr-10

Subject: Grouper Developers Forum

List archive

Draft Minutes: Grouper Face-to-Face Meeting at SMM 26-Apr-10

From: Emily Eisbruch <>
To: Grouper Dev <>
Subject: Draft Minutes: Grouper Face-to-Face Meeting at SMM 26-Apr-10
Date: Wed, 5 May 2010 09:36:41 -0400

Grouper Working Group Face-to-Face Session

Internet2 Spring Member Meeting, Arlington, VA

Monday, 26-Apr-10

*Introduction*

Tom Barton, working group chair, welcomed the attendees.

http://www.internet2.edu/presentations/spring10/20100426-Grouper-Barton.pdf

*Agenda*

Internet2 Intellectual Property Rights
Agenda bash, topics of interest
Duke: Delegating AD directory administration with Grouper (Rob Carter, Shilen Patel)
What's new in Grouper v1.6 (Chris Hyzer, Tom Zeller)
Roadmap (Tom Barton)

Topics suggested by attendees:

Globally unique group identifiers
Permissions management

*Delegating AD Directory Administration with Grouper*

http://www.internet2.edu/presentations/spring10/20100426-grouper-carter.pdf

Shilen Patel and Rob Carter presented a Duke use case on using Grouper to manage Active Directory permissions. The use case involved:

Big Picture: Duke has a campus-wide Active Directory forest into which departmental administrators wish to migrate departmental forest assets and ZenWorks assets

There are IdM-maintained user identities with "mix ins" by departments
There are departmentally-maintained resources and ad hoc affiliates

It's important to be able to provision high privilege for admins and managers and constrained privileges for users

The solution:

In Grouper, implemented some global groups (maintained by IT) and some dept-specific groups (maintained at the dept. level)
Developed resrouces to map Active Directory Organizational Units (OUs) permissions into Grouper permissionSets
The Grouper "Actions qualifier" was used.
Managers can modify persmissions on their OUs.
Includes and Excludes are used where there is a need to provision access to someone outside of the group.

Shilen and Rob successfully walked thru a demo in their test environment.

Q: How would you handle groups already established in Active Directory OUs that you want to import into Grouper?

A: This has not yet been built. In the future, we would like to be able to consume groups out of Active Directory into Grouper.

It was commented that Northwestern University has some similar challenges to Duke, with 20+ Active Directory forests.

*What's New in Grouper 1.6*

http://www.internet2.edu/presentations/spring10/20100426-grouper-hyzer.pdf

New Features in Grouper 1.6 (to be released in May, 2010) include:

XMPP Integration (messaging for "real time" updates)
Kuali Rice Integration

richer group model
allows addition of workflow to Grouper
Quickstart integration to Identity Management

SQL server support
Flattened memberships
Virtual subject attributes
Read-only mode for Grouper (for upgrades and data migrations)
New import/export
Web Services Enhancements

new central permissions management module
can assign or unassign attributes and permissions

UI Enhancements
Grouper ESB Connector (contributed by Cardiff University)

Cardiff use case involves using Mule and Drools
Events are synchronized between Grouper and LDAP (or other systems) via the ESB
Events are packaged as JSON and dispatched over appropriate interface - HTTP(S) or XMPP
The interface is defined in grouper-‐loader.properties

Ldappc-NG

Tom Zeller presented slides on Ldappc-NG: http://www.internet2.edu/presentations/spring10/20100426-grouper-Zeller.pdf
accepts input from Grouper or from Shib Data Connector
input passes throught the Shibboleth Attribute Resolver
features a generic LDAP
uses SPML to write to target
target can be LDAP or RDBMS
currently in batch mode; in future it will be real-time web service
U. Memphis will be an early user

Q: What was the problem we were trying to solve with the new Grouper permissions capabilities?

A: As one example, there is a use case at U. Chicago. There will be a portlet that allows people to view billing statements -- the ability to view will be scoped by where someone is in the accounting authority hierarchy.

Q: Are any organizations currently using Grouper to define their assets?

A: That is planned down the road.

*Chris Hyper presented demos illustrating new features in Grouper 1.6*

https://spaces.internet2.edu/download/attachments/13534357/xmpp.wmv

https://spaces.internet2.edu/download/attachments/11075978/kualiPermissions.wmv

https://spaces.internet2.edu/download/attachments/11075978/kualiPermissions.txt

https://spaces.internet2.edu/download/attachments/11076495/rice1.wmv

https://spaces.internet2.edu/download/attachments/11076495/rice2.wmv