Grouper Users - Open Discussion List

["Hyzer, Chris" <>]

We’ve done multiple things for various apps as well:

 

1.       The way that Peter said

 

penn:app:someApp

penn:app:someAppTest

penn:app:someAppDev

 

2.       We have a main folder “penn”, and another main folder “test”, which somewhat mirrors that.  So the folders would be:

 

test:app:someApp

 

3.       We also have a test env for grouper, which some apps use:

 

{prod endpoint} -> penn:app:someApp

{test endpoint} -> penn:app:someApp

 

I think the last option is not good because the test env is not up all the time e.g. during upgrades.

The second option is not good unless there are only two envs (prod and non prod)

First option works J

 

Thanks

Chris

 

From: [mailto:] On Behalf Of Peter DiCamillo
Sent: Friday, December 08, 2017 1:20 PM
To: Tomo O'BRIEN <>;
Subject: Re: [grouper-users] Web app environment-specific groups?

 

When we've done that, we've used folders for the different environments. The APP folder would contain PROD, QA, and DEV folders (or whatever environments you require.) In each environment folder there would be individual role groups, such as Owners, Developers, and Testers as you mentioned. So one group might be APP:QA:Testers. I don't know that there's any Grouper best practice for this. I'd like to know about it if there is.

Peter

On 12/8/17 12:49 PM, Tomo O'BRIEN wrote:

Hi folks,

 

We're interested in environment-specific groups like {APP}-Dev, {APP}-QA, {APP}-UAT, {APP}-Prod so we can have appropriate permission groups for each environment. 

 

I haven't seen this pattern described on the wiki but maybe I'm just not looking in the right places?  Has anyone developed a naming/composite structure for this situation?

 

I'm thinking about something like:

 

{APP}Owners (functional owners)

{APP}Developers 

{APP}Testers 

 

{APP}-DEV (union of Owners + Developers or maybe just Developers)

{APP}-QA (union of Owners + Testers)

{APP}-PROD (just Owners)

 

At some point we'd also have an intersection with our Employees + include - exclude group -- not sure where this is best positioned - after the ad hoc owners/developers/tests group or after the union of owners+testers or developers

 

Any thoughts or suggestions would be appreciated!

 

Thanks!

 

Tom O'Brien