Grouper Users - Open Discussion List

[David B Langenberg <>]

Hi Erica,

We do exactly what you’re looking to do.  The way we accomplish it is to not 
touch the eligibility factors for Box (or any service for that matter) until 
lock day.  So, our finite-state-machine that handles closure and all the 
associated warnings waits until closure day before pulling (in our case) the 
eduPersonAffiliation which causes all the grouper magic to revoke access.  
The FSM then also issues the box API calls to delete the account or spin it 
to a private account (in the case of alumni).

Dave

-- 
David Langenberg
Asst Director, Identity Management
The University of Chicago

On 5/25/17, 1:17 PM, 
"
 on behalf of Lomax, Erica" 
<
 on behalf of 
>
 wrote:

    We currently are working on how to deprovision users from Box.  Unlike 
services where we just cut off access when eligibility ends, we want to allow 
a grace period to allow users to retrieve content.  During that grace period, 
we want to send warnings about the loss of access on a specified schedule 
(30d, 14d, etc).  After the grace period, the account would remain in Box in 
a deactivated state for 90d prior to deletion.
    
    At a high level, our group for Box eligibility rolls up as follows:  
(Employee eligibility calculation group + Student eligibility calculation 
group + Associate eligibility calculation group + ad hoc adds group) - 
excludes group.  We automatically provision employee accounts in Box via API, 
students and associates and ad hocs provision on demand via SAML.  On loss of 
all eligibility, you may or may not have a Box account.
    
    Trying to drive this deprovisioning logic out of Grouper is proving a 
very challenging, but maybe we're over complicating it.  Before we make our 
final plans, can anyone offer advice on how they've solved similar issues or 
have solutions we could review?
    
    Thanks!
    Erica Lomax
    Director, Identity & Infrastructure
    Information Services | Oregon State University | 541-737-3619

Attachment: smime.p7s
Description: S/MIME cryptographic signature