Grouper Users - Open Discussion List

[Chris Hyzer <>]

Ok, this is done.  If you get the latest API and WS from v2.1 branch, and build those, it should work fine.

 

https://bugs.internet2.edu/jira/browse/GRP-926

 

This is fixed.

 

The getMemberships and getMembershipsLite service can now lookup privileges for groups, stems, and attribute definitions.

 

The field param, can now take:

 

attrReaders, attrViewers, attrUpdaters, stemmers, creators, etc.

 

Note, by default only list memberships are returned.

 

If you want all privs in a certain type, pass in a fieldType: list, access, naming, attributeDef.

 

You can lookup stems, or attributeDefs to see privs by owner.

 

The result will return WsStems, or WsAttributeDefs if the query is by stem or attributeDef.

 

The Grouper Client can now take these inputs as well.

 

Note: privileges do not inherit actions, so if you want to see if someone can VIEW a group, you need to see if that user or GrouperAll can VIEW, READ, UPDATE, etc...

 

Let me know how it goes.

 

Thanks,

Chris

 

 

From: [mailto:] On Behalf Of Tim Darby
Sent: Friday, August 02, 2013 12:04 PM
To: Chris Hyzer
Cc:
Subject: Re: [grouper-users] REST interface performance

 

Thanks, and yes, I'm on 2.1.4.

Tim Darby
The University of Arizona
Mosaic, Systems Integration and Architecture

UITS, Rm 335, 520-626-3799

 

On Fri, Aug 2, 2013 at 9:01 AM, Chris Hyzer <> wrote:

I think the best bet is the getMemberships operation, but unfortunately it wont work for privileges right now.  I could make some edits and you could get latest and recompile if you like.  Are you on 2.1?  Let me know

 

Thanks,

Chris

 

From: [mailto:] On Behalf Of Tim Darby
Sent: Friday, August 02, 2013 11:24 AM
To: Chris Hyzer
Cc:
Subject: Re: [grouper-users] REST interface performance

 

I need a query that returns, for a given user, all stems where they have create privilege.  Again, I've tried the get privileges interface but it's too slow and the get subjects interface won't take a stems query.

Tim Darby
The University of Arizona
Mosaic, Systems Integration and Architecture

UITS, Rm 335, 520-626-3799

 

On Wed, Jul 31, 2013 at 8:28 AM, Chris Hyzer <> wrote:

Yeah, should have mentioned this earlier, sorry… the getGrouperPrivilegesLite WS uses the privilege resolver interface, and is not efficient at all for that type of query (groups for a user).  The other operations can do privilege fields, and should be quicker.  For instance, in this case, you could do something like this:

 

[mchyzer@flash pennGroupsClient-2.0.0]$ java -jar grouperClient.jar --operation=getGroupsWs --subjectIdentifiers=jsmith --fieldName=admins --debug=true

DEBUG: Reading resource: grouper.client.properties, from: /home/mchyzer/grouper/pennGroupsClient-2.0.0/grouper.client.properties

DEBUG: WebService: connecting as user: 'fast/medley.isc-seo.upenn.edu'

DEBUG: WebService: connecting to URL: 'https://grouperws.school.edu/grouperWs/servicesRest/v2_0_000/subjects'

 

################ REQUEST START (indented) ###############

 

POST /grouperWs/servicesRest/v2_0_000/subjects HTTP/1.1

Connection: close

Authorization: Basic xxxxxxxxxxxxxxxx

User-Agent: Jakarta Commons-HttpClient/3.1

Host: grouperws.school.edu:-1

Content-Length: 212

Content-Type: text/xml; charset=UTF-8

 

<WsRestGetGroupsRequest>

  <subjectLookups>

    <WsSubjectLookup>

      <subjectIdentifier>jsmith</subjectIdentifier>

    </WsSubjectLookup>

  </subjectLookups>

  <enabled>T</enabled>

  <fieldName>admins</fieldName>

</WsRestGetGroupsRequest>

 

################ REQUEST END ###############

 

 

 

################ RESPONSE START (indented) ###############

 

HTTP/1.1 201 Created

Date: Wed, 31 Jul 2013 15:25:11 GMT

Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8o proxy_html/3.1.2 mod_jk/1.2.31 PHP/5.2.17

Set-Cookie: JSESSIONID=xxxxxxxxxxxx; Secure

X-Grouper-resultCode: SUCCESS

X-Grouper-success: T

X-Grouper-resultCode2: NONE

Vary: Accept-Encoding

Content-Length: 3959

Connection: close

Content-Type: text/xml;charset=UTF-8

 

<WsGetGroupsResults>

  <results>

    <WsGetGroupsResult>

      <wsGroups>

        <WsGroup>

          <extension>penncard</extension>

          <displayExtension>penncard team</displayExtension>

          <description>penncard developers</description>

          <displayName>jsmith:penncard team</displayName>

          <name>jsmith:penncard</name>

          <uuid>88c6788504574e9ea853d4eaad3e1966</uuid>

        </WsGroup>

        <WsGroup>

          <extension>secureShareTest</extension>

          <displayExtension>secureShareTest</displayExtension>

          <description>SecureShare enabled group.  Any members in the group will be on the secureShare list for this group</description>

          <displayName>mchyzer:secureShareTest</displayName>

          <name>mchyzer:secureShareTest</name>

          <uuid>eff02b08-3669-4130-88cc-617de579fd9e</uuid>

        </WsGroup>

      </wsGroups>

      <resultMetadata>

        <resultCode>SUCCESS</resultCode>

        <success>T</success>

      </resultMetadata>

      <wsSubject>

        <identifierLookup>jsmith</identifierLookup>

        <resultCode>SUCCESS</resultCode>

        <success>T</success>

        <id>12345</id>

        <name>John Smith</name>

        <sourceId>pennperson</sourceId>

      </wsSubject>

    </WsGetGroupsResult>

  </results>

  <resultMetadata>

    <resultCode>SUCCESS</resultCode>

    <resultMessage>Success for: clientVersion: 2.0.0, subjectLookups: Array size: 1: [0]: WsSubjectLookup[subjectIdentifier=jsmith]

 

memberFilter: All, includeGroupDetail: false, actAsSubject: null

, params: null

fieldName1: admins

, scope: null, wsStemLookup: null

, stemScope: null, enabled: T, pageSize: null, pageNumber: null, sortString: null, ascending: null

, pointInTimeFrom: null, pointInTimeTo: null, field: admins</resultMessage>

    <success>T</success>

  </resultMetadata>

  <responseMetadata>

    <resultWarnings></resultWarnings>

    <millis>1827</millis>

    <serverVersion>2.1.1</serverVersion>

  </responseMetadata>

</WsGetGroupsResults>

 

################ RESPONSE END ###############

 

 

DEBUG: Output template: SubjectIndex ${subjectIndex}: success: ${resultMetadata.success}: code: ${resultMetadata.resultCode}: subject: ${wsSubject.id}: groupIndex: ${groupIndex}: ${wsGroup.name}

, available variables: wsGetGroupsResults, grouperClientUtils, subjectIndex, wsGetGroupsResult, resultMetadata, wsSubject, groupIndex, wsGroup

SubjectIndex 0: success: T: code: SUCCESS: subject: 12345: groupIndex: 0: jsmith:penncard

SubjectIndex 0: success: T: code: SUCCESS: subject: 12345: groupIndex: 1: mchyzer:secureShareTest

DEBUG: Elapsed time: 2959ms

[mchyzer@flash pennGroupsClient-2.0.0]$

 

 

From: [mailto:] On Behalf Of Tim Darby
Sent: Tuesday, July 30, 2013 8:09 PM
To:
Subject: [grouper-users] REST interface performance

 

I'm using the get grouper privileges lite interface to get a list of the groups that a given user has admin rights on and basically copied the sample query on the wiki, right down to using actAsSubjectId=GrouperSystem. For a user that has admin rights on 14 groups, this takes on average 3 minutes to return, which seems like a lot of time. Should this be faster?

Tim Darby
The University of Arizona
Mosaic, Systems Integration and Architecture

UITS, Rm 335, 520-626-3799