Grouper Users - Open Discussion List

["Lomax, Erica" <>]

We currently are working on how to deprovision users from Box.  Unlike 
services where we just cut off access when eligibility ends, we want to allow 
a grace period to allow users to retrieve content.  During that grace period, 
we want to send warnings about the loss of access on a specified schedule 
(30d, 14d, etc).  After the grace period, the account would remain in Box in 
a deactivated state for 90d prior to deletion.

At a high level, our group for Box eligibility rolls up as follows:  
(Employee eligibility calculation group + Student eligibility calculation 
group + Associate eligibility calculation group + ad hoc adds group) - 
excludes group.  We automatically provision employee accounts in Box via API, 
students and associates and ad hocs provision on demand via SAML.  On loss of 
all eligibility, you may or may not have a Box account.

Trying to drive this deprovisioning logic out of Grouper is proving a very 
challenging, but maybe we're over complicating it.  Before we make our final 
plans, can anyone offer advice on how they've solved similar issues or have 
solutions we could review?

Thanks!
Erica Lomax
Director, Identity & Infrastructure
Information Services | Oregon State University | 541-737-3619