Skip to Content.
Sympa Menu

grouper-users - RE: [grouper-users] Custom Rule Validation

Subject: Grouper Users - Open Discussion List

List archive

RE: [grouper-users] Custom Rule Validation


Chronological Thread 
  • From: "Hyzer, Chris" <>
  • To: "Waldbieser, Carl" <>
  • Cc: "" <>, "" <>
  • Subject: RE: [grouper-users] Custom Rule Validation
  • Date: Fri, 24 Mar 2017 20:15:22 +0000
  • Accept-language: en-US
  • Authentication-results: lafayette.edu; dkim=none (message not signed) header.d=none;lafayette.edu; dmarc=none action=none header.from=isc.upenn.edu;
  • Ironport-phdr: 9a23:jkkjiB37mJrA2IzhsmDT+DRfVm0co7zxezQtwd8ZseMUI/ad9pjvdHbS+e9qxAeQG96KtrQb1qGP6PqocFdDyK7JiGoFfp1IWk1NouQttCtkPvS4D1bmJuXhdS0wEZcKflZk+3amLRodQ56mNBXdrXKo8DEdBAj0OxZrKeTpAI7SiNm82/yv95HJbQhFgDqwbalwIRi2ogndq8cbjZV/Iast1xXFpWdFdf5Lzm1yP1KTmBj85sa0/JF99ilbpuws+c1dX6jkZqo0VbNXAigoPGAz/83rqALMTRCT6XsGU2UZiQRHDg7Y5xznRJjxsy/6tu1g2CmGOMD9UL45VSi+46ptVRTlkzkMOSIn/27Li8xwlKNbrwynpxxj2I7ffYWZOONjcq/BYd8WQGxMVdtTWSNcGIOxd4sBAfQcM+ZEoYfzpFUOohm/BQawC+3gxSRFhmPt0qEmz+gtDR3K0Q4mEtkTsHrUttL1NKIKXOy7zqfJzTTCYO1M2Tvl9YPFbBAhoeuNXbJrf8ba1E4iFwbZgVWQqY3kPi2a1v4Wvmia9OpvSfiji3M/qw5vpDivwN0ghZfUiYII013J8zhyzogyJd29UkF7YNikHYNRtyGcK4t5XNkiQ2d2tyYm1LEKo4C0czUXyJkh2hXRaOSHfpCW7h7+VeudOzl1iGx/dL6ihBu+7VKsxvPiWsWszVpHoDZJnsPIu3wQzRDf9NWLR/9n8ku82zuC1gbe4fxeL08uj6rUMZshz6YwlpUNtUTDGTf7ll3qgaGRakko5PGk5fn/bLn7v5OcMJR7hR/kPqQph8y/Hf83Mg8TX2id5OuwzqXj/Vf+QLVWkPI5jrXZsJHdJcQdvKK5BBJV0pon6xa4CDem084UkmUALFJAYB6Hjo7pNE/SIP3gE/uznlWhnC1lyvzYJLHtH5bAImTZnLv/Y7px80tcxxAyzdBb6ZJUELYBIPfrV0/0qNPYDh84Mg2qzOb9E9h915geVn6VDq+EKKPdr1mI5uQ1L+aSeYAVpS7xK+I56P72kX85hVgdcLGm3ZsNb3C4A+xmLFuDYXb1n9cBCnkFvhAlTOHxjF2CUCVTZ2qpX64i/D07CYSmDZvdSYC3hryOwju7EoNMam9YF1+MDCSgS4LREcgFbC6YI8J6nyZAHZOoUYtrnUWxvQv2wbtqJcLQ8yMRpJ//yNUz6uHOw0Ic7ztxWo69wnOAVSU8tWMSRiR8lPR6qkxs2FqZ+aljiLpFDdFV4bVEXhpsZs2U9PBzF92nAlGJRdyOUlvzB4z+WTw=
  • Spamdiagnosticmetadata: NSPM
  • Spamdiagnosticoutput: 1:99

Ok, I will add GRP-1377 to the list of things to do :)

You are saying you want an option to not allow non groups to have privileges?
:)

Thanks
Chris

-----Original Message-----
From: Waldbieser, Carl
[mailto:]

Sent: Friday, March 24, 2017 3:08 PM
To: Hyzer, Chris
<>
Cc:
;


Subject: Re: [grouper-users] Custom Rule Validation

Chris,

I think because we are still on Grouper v2.2, the issue was that GRP-1377
made rules behave in a somewhat unexpected way. The cron job cleanup
corrects that.
It might be nice if there was an option to prevent groups/permissions from
allowing individual subjects to be added as direct members (as opposed to
adding other groups). The Grouper deployment guide mentions that as a best
practice for policies on page 7, I think. If that could be enforced
technically, that could be useful ...

Thanks,
Carl

----- Original Message -----
From: "Hyzer, Chris"
<>
To: "waldbiec"
<>,


Cc:

Sent: Friday, March 24, 2017 2:45:23 PM
Subject: RE: [grouper-users] Custom Rule Validation

You could put these rules on your root stem to accomplish this:

https://spaces.internet2.edu/display/Grouper/Grouper+rules+use+case+-+Reassign+group+privileges+if+from+group
https://spaces.internet2.edu/display/Grouper/Grouper+rules+use+case+-+Reassign+folder+privileges+if+from+group
https://spaces.internet2.edu/display/Grouper/Grouper+rules+use+case+-+Reassign+attribute+definition+privileges+if+from+group

Or we could have something in grouper default to having this on and you could
disable it... thoughts?

Thanks
Chris

-----Original Message-----
From: Waldbieser, Carl
[mailto:]

Sent: Friday, March 24, 2017 1:44 PM
To:

Cc:
;
Hyzer, Chris
<>
Subject: Re: [grouper-users] Custom Rule Validation


At Lafayette College we take this approach to normalize the permissions for
our Grouper "apps" policies. When someone creates a policy group via the UI,
Grouper rules automatically add the correct administrator groups to the
permissions, However, the creator of the group is granted permissions by
default. A cron job sweeps through these folder trees each night and removes
permissions granted directly to subjects from our people LDAP source.

Thanks,
Carl Waldbieser
ITS Identity Management
Lafayette College

----- Original Message -----
From: "Hyzer, Chris"
<>
To:
,


Sent: Friday, March 24, 2017 1:27:24 PM
Subject: RE: [grouper-users] Custom Rule Validation

If you want a scheduled task, and you are in 2.3, you can configure something
in the grouper-loader.properties called "otherJob" which can have a cron
schedule and run like another grouper daemon or loader job or whatever.

However, in 2.2.2, that doesnt exist. Can I suggest just writing a java
program and running it with unix cron command line? :) It would be run
something like this:

java -Xmx500m -classpath
${GROUPER_HOME}/classes:${GROUPER_HOME}/lib/*:/location/to/your.jar
some.package.YourClass

Thanks
Chris

-----Original Message-----
From:


[mailto:]
On Behalf Of

Sent: Wednesday, March 08, 2017 2:30 PM
To:

Subject: [grouper-users] Custom Rule Validation

We are currently looking at a rule validation tool for Grouper v2.2.2. This
should run once a day and it would make sure that every folder down a certain
path contains groups X,Y and Z or every group has "these" privileges. If it
doesn't contain one of these, then it will fix it. We were wondering what is
the best way to do this.

The Grouper Rule Consumer uses the changelog and since we want this to run
daily, we may not have an event occurring at the time of day we want this to
occur, the tool should also check for preexisting groups. Would just creating
some grouper rules be the best way to do this?



Archive powered by MHonArc 2.6.19.

Top of Page