Grouper Users - Open Discussion List

[Tom Zeller <>]

I have a few questions about provisioning to AD using ldappc.

* Are people currently provisioning to AD with ldappc?
* If so, flat or bushy?
* If bushy, how is the uniqueness of the group name ensured?
* Are groups deleted in Grouper deleted in AD during provisioning or is
this prevented in AD to allow for some more caution deletion to take
place?

Without a built-in notion of disabled, deactivated, or expired, as there is with user objects in AD, it seems we would have to create our own way of gracefully deleting groups. A reasonably common approach is an attribute based ACL, however, my local AD admins have expressed uncertainty regarding potential effects on built-in applications. We're open to ideas or success stories. I assume that caution is desirable when deleting groups in order to preserve SIDs when recovering from accidental deletions.

 

I have had a look at
https://wiki.internet2.edu/confluence/display/GrouperWG/LDAPPC+Next
+Steps
but was wondering what the current status is.

We're still gathering feedback regarding priorities of desired features. I'm interested in what happened at the I2 meeting in DC this week. I also need to update the wiki :-)

TomZ