Subject: Grouper Users - Open Discussion List
- From: "Klug, Lawrence" <>
- To: Chris Hyzer <>, Tom Barton <>, "" <>
- Subject: [grouper-users] Plone integration design
- Date: Thu, 23 Aug 2012 18:11:40 +0000
- Accept-language: en-US
I’ve gotten a bit more clarification about the Plone integration requirements. We want to manage all Plone Groups and Roles in Grouper and “Push” the data to Plone in near real time. So data will move from
Grouper to Plone only. We figure on some custom development on both sides. So we might develop a Change Log consumer to listen for changes on a Plone stem/group and then call Plone API to populate the changes in Plone. Another possibility is a dedicated
LDAP server – we could provision Plone data using PSP and Plone could read data from the LDAP server. What are your thoughts about these ideas?
I just quickly read this:
It seems like the “context” in plone, will be resources in Grouper permissions. When someone creates objects in plone, can there be a trigger to create the resource in Grouper in the right place and assign the permission implications (parents
imply children). Note, this is now possible to do in Grouper WS 2.1.
The “permissions” in plone (View, Modify) could be “actions” in Grouper on the permission definition for the resources above. These seem like they would be configured one time and not change much.
The roles and groups in plone are roles and groups in Grouper.
Finally, you need to decide when you will retrieve the user’s permissions. I would suggest either on login or provision all the permissions to plone so plone doesn’t think they are externalized. Similar to this:
If you do it on login, it could be from Grouper WS, LDAP (concatenate the action and resource into an attribute), or SAML assertion (might still need to concatenate the action/resource).
My gut feel is that to avoid performance problems and maximize uptime to just provision everything to plone and keep it in sync real time (XMPP? Stomp? Other messaging?).
Let us know what you decide to do or if you have more questions
Yes, we are trying to determine how UCLA Service Providers could best leverage Grouper. Will eduMember attributes be sufficiently fine-grained for our applications? If not, how do we approach implementing Grouper
Roles and Permissions? Our pilot project will most likely be the Content Management System. We are using a Zope-based product called “Plone.” What are the steps for moving Plone Roles and Permissions management into Grouper? LDAP delivery via Shibboleth
is an elegant solution, but Roles and Permissions may require another strategy. Thinking this through now could prevent future pain.
We are defining our long-term access management strategy with Grouper. We have tested “eduMember” for transmitting membership info through Shibboleth. Roles and Permissions are internal Grouper attributes
that would not live in the Enterprise Directory(?) Trying to focus on exactly how Roles and Permissions attributes can be consumed by a University Web application now and in the future.
We have two examples where we sync all the permissions to the application since it does DB joins on the assignments, or we dont want grouper as a performance bottleneck or
a runtime dependency. The change log consumer and grouper client handle real time updates (tells it to do a full resync)
 on behalf of Klug, Lawrence 
We created a simple demo app to consume isMemberOf attribute via Shibboleth and make a few simple Web Service calls. It works fine. What if we want to use Role and Permission attributes? How would they be transmitted to the Client application?
Could they be released as Shibboleth attributes or direct Web Service call? What are other universities doing?
- [grouper-users] Plone integration design, Klug, Lawrence, 08/23/2012
- [grouper-users] RE: Plone integration design, Chris Hyzer, 08/24/2012
Archive powered by MHonArc 2.6.16.