Grouper Users - Open Discussion List

["Hyzer, Chris" <>]

 

> I have been trying to wrap my head around how Grouper deals with “local

> subjects”. Specifically for the use case of “Service Accounts”. Specifically

> for WebService clients to get data from Grouper.

>                 Note: I am not talking about how the authentication is done in

>                 this inquiry. Just how the “username”(AKA: Subject ID ?) is

>                 managed for this class of accounts.

>                 Note: I think I am getting wrapped around “old docs” and “old

>                 term in different contexts”

> ..

>

>

> I think I have stumbled into a confusion on my part and I am hopful that someone

> can answer a few questions for me.

>                 REF: https://spaces.internet2.edu/display/Grouper/Grouper+local+entities

>                 REF: https://spaces.internet2.edu/pages/viewpage.action?pageId=14517859   ( GSH page)

>

>

> I think there are two ways to make a “Local Subject” in grouper.

> 1)        Lite UI “Create or edit groups / roles / local entities”

> a.         Which looks like the result from the gsh EntitySave()

> .. functions

 

Yeah

 

>

> 2)        gsh via the “addSubject” (function?)

 

You could, though I think most people delete that subject source and make their own.  You can use it if you want.

 

At penn we have our own table and own subject source.  I wrote this up here:

 

https://spaces.internet2.edu/display/Grouper/Penn+service+principals+from+kerberos+and+web+service+authentication

 

 

>

>

> However, these two paths appear to result in rather different things. (Thus my confusion.)

>

> Option 1 appears to produce an object that is visible in Grouper( via the

> Grouper “new” UI ). However, it uses icons/language that implies that the

> thing that is created is a “Group” or some other type of object than a

> “person”.  ( The GSH output indicates this: type='application' )

>                 Example: I created a  Entity

 

Yeah, the icons probably aren’t consistent, but an entity is a “thing” (could be person or service or something), but not a group in this case

 

 

>

>

> Entity testEntity = new EntitySave(rsess).assignCreateParentStemsIfNotExist(true).assignName("

> :TEST-AGAIN").save();

> findSubject("

> :TEST-AGAIN");

> subject: id='734731

> ..ee9b' type='application' source='grouperEntities' name='

> :TEST-AGAIN'

>

>

> Option 2 appears to produce an object that is NOT visible in Grouper( via the

> Grouper “new” UI ). However, it (the New UI) uses icons/language that implies

> that it is a “person”. (more like a “real subject from a Subject API”.)

>                 Example: I “addSubject”’ed a user called “WS-TESTING” and I

>                 get this back from GSH

>                                 findSubject("

> :WS-TESTING");

>                                 id='

> :WS-TESTING’ type='person' source='jdbc' name='WS-TESTING”

>

>

>

>

>

> Personally I like the idea of the service accounts being a “first class citizen”

> (in the Grouper UI, AKA Option 1) but I am concerned that there is some subtle thing

> that I am not anticipating that will make me want to have gone the other way later.

> Due to the type value, or some other hang up down the road.

 

Yes, in the first way they are in the grouper folder namespace.  In the second way they are not.  If you want to search for something and not in a namespace, then option 1 might limit you.  In this case option2 or 3 (penns way) might be best.

 

 

>

>

> Can any one explain why one path would be better than the other?

> Can any one explain why these two paths appear to be so different?

 

The option 1 allows non grouper admins to have entities in their namespace

 

> Can anyone explain how to remove an entry that was added with “addSubject”?

 

Delete from database J

 

> (Since they are not “first class objects” in the Grouper UI I have not found

> the “delete/remove” gsh function/code yet.

 

We can add something for this if you like, those subject tables were for quick start which is why they are not fully fleshed out…  also, if you don’t delete them then they are never unresolvable J

 

Thanks

Chris