Grouper Users - Open Discussion List

[David Langenberg <>]

I would argue that trying to automatically add the include & exclude groups for every systemOfRecord group is the wrong approach.  The need to have those exception groups rests solely on the use-case for why said group exists and thus why a person would have to be manually included/excluded.  In our setup here, the include/exclude combination is only setup for final groups who's memberships will be consumed by an application.  That leaves the vast majority of systemOfRecord groups clean.

Dave

On Fri, Oct 4, 2013 at 8:11 AM, Rob Gorrell <> wrote:

I've spent some time looking at others grouper environments and it seems a fairly common design principle is to create these composite groups consisting of systemofRecord and include/exclude groups. for example, the ITS department = ITS_systemofRecord + ITS_include - ITS_exclude. I've spend some time playing with the grouper loader to build the ITS_systemofRecord group, as well as do so on a one-to-many scale (like say across 200 departments with one loader object), but as to staging the empty include and exclude group objects and the composite group representing all of ITS department, I was wondering the best way to go about and sustain it on a mass scale? even though grouper loader can create group objects, i gather it would not be used in this sense... is there a typical way of approaching this in an efficient manner? would you look to just typical batch/shell commands with gsh? I was hoping for a way that when grouper loader made a new dept_sysofRecord group, the other pieces that go along with it could also automatically appear? curious if anyone has a clever way of dealing with this?

-Rob

--

Robert W. Gorrell
Middleware Engineer, Identity and Access Management

University of NC at Greensboro
336-334-5954

--
David Langenberg

Identity & Access Management

The University of Chicago