Grouper Users - Open Discussion List

[Tom Zeller <>]

1.4 ldappc doesn't have any new attribute provisioning features. As always, you can map a grouper attribute to an ldap attribute, but you can't resolve the subject of a custom list member to an ldap dn (I assume you want to provision the owner of a group as a dn).

The ability to provision a single member of a list or privilege, like "owners", would be nice for Active Directory's managedBy attribute.

I don't have an ETA regarding attribute provisioning using shibboleth's attribute resolver. We could roll this out in phases, though.

I'm going through some attribute provisioning scenarios on paper, e.g. eduCourseMember (thanks Tim from Arizona), and find myself needing to access grouper data from shibboleth in more complicated ways than a sourceAttributeID. I started cooking up some xml, and remembered on the last grouper-dev call that we might want to access grouper via the API or WS during provisioning, so I'm looking at incorporating grouper-ws rest xml in data connectors used by shib. I have to get up to speed with grouper-ws.

Are you willing to share your custom code for provisioning attributes ? How does your approach compare to the shibboleth attribute resolver ?

Thanks,

TomZ

On Mon, Jun 22, 2009 at 6:12 AM, Cramton, James <> wrote:

Greetings, folks,

 

My apologies for being out of the loop at a critical time in Grouper 1.4’s development. But I need clarification on the current capabilities of LDAPpc WRT provisioning group attributes from Grouper into LDAP. We have a use case where a Sympa mailing list or a Bedework calendar group needs to know a primary owner of a group. In the case of course groups, the logical choice might be an instructor group, except those groups tend to have multiple members, and that does not work well in the applications. We are weighing the benefits of creating an “owner” or “primary instructor” group vs. storing owner/primary instructor information in an attribute of the group in both Grouper and LDAP. We lean towards an attribute, because our custom LDAP provisioning code has good support for provisioning group attributes into LDAP. But we want to get back into the LDAPpc fold, so we want to be sure LDAPpc will support this functionality.

 

What are options for provisioning Grouper attributes into LDAP using the 1.4 version of LDAPpc?  I’ve seen chatter about support for this functionality via the attribute resolver in 1.5. What is the anticipated ETA for that?

 

Thanks!

 

James Cramton
Lead Programmer/Analyst
Brown University