Grouper Users - Open Discussion List

["Edwards, Kevin" <>]

Thanks Steven. That is very helpful information, especially the data flows 
that you describe below.  

Sounds like I'm missing a lot of relevant information missing EDUCAUSE and 
the Tech Exchange this year.  I will certainly stay connected to the 
information about TIER IDM/IAM as it emerges.  Is there an IDM/IAM project 
group already in existence, or is it too early for that?

Kevin Edwards
University of North Carolina at Charlotte

-----Original Message-----
From: 

 
[mailto:]
 On Behalf Of Steven Carmody
Sent: Wednesday, October 08, 2014 10:44 AM
To: 

Subject: Re: [grouper-users] Grouper Integration with Commercial Products

On 10/6/14 11:58 AM, Edwards, Kevin wrote:
> I'm a new-comer to the list.  I'm curious others experiences with 
> integrating Grouper into an enterprise IAM framework.
>
> Are you using Grouper as an alternative to commercial IAM products, or 
> is Grouper one component of an integrated IAM solution utilizing other 
> commercial/open source/in-house developed components?

Like you, we have a ancient locally developed IAM system (person registry, 
provisioning). Later this month, we will go live with Oracle OIM as a 
replacement. We have been using Grouper for a number of years, in production. 
We have determined that OIM does NOT contain functionality that is any way 
comparable to what grouper provides. We plan to continue using Grouper.

I would call your attention, tho, to I2's recently announced TIER effort. 
Over the next few years I2 expects to develop and make available an open 
source IDM/IAM system. That package will include Grouper as one of the 
components. There was lots of discussion last week at Educause about TIER. 
I'm sure there will be even more discussion about TIER later this month at 
TechX/Advanced CAMP.

>
> At UNC Charlotte, we have embarked on a multi-year effort to replace 
> 35+ years of home-grown utilities, community knowledge, and human 
> intervention with a commercial product for improved IAM business 
> practice automation.  As we get deeper into the project, it appears 
> that the group management features of Grouper are more robust than 
> what the commercial product currently supports.  Integration between 
> the two might be the best option.  The Grouper architecture diagrams 
> show that integration with a separate Identity Management system is 
> part of the overall scope, but I'm not finding specific references 
> where Grouper users have actually undertaken that, and I am curious 
> your experiences doing that.
>

We currently provide an overnight feed from our HR system (Workday) to 
Grouper. That feed is used to maintain the memberships of a wide variety of 
demographic groups; those groups slice and dice our community in a variety of 
ways. We currently have a real-time feed (via MSG BUS) from our Student 
system (Banner) to Grouper; this allows us to update Course groups within 
Grouper in real time. We have a pair of overnight feeds from our HR system 
and from our Faculty Information System to Grouper; these feeds are used to 
manage a set of People groups for every Dept.

Our Grouper instance uses a MSG BUS to provide real time updates to several 
target systems, including ldap, google, and Canvas (our LMS system).

Good luck !