Grouper Users - Open Discussion List

["William G. Thompson, Jr." <>]

Thanks, Chris. This is exactly the kind of input we're looking for.
We're planning on discussing this a little more on the TIER-API call
this Friday, Jan 5th. This is an open call and anyone who's interested
in sharing and discussing the grouper security model is welcome to
join.

Friday, Jan 5th
10 am Eastern, 7 am Pacific, 3 pm London, 4 pm Amsterdam
Video: https://bluejeans.com/678543210/browser

To join via Phone:
1) Dial one of these numbers or see all numbers - http://bluejeans.com/numbers
+1.408.740.7256
+1.888.240.2560(US Toll Free)
+1.408.317.9253 (Alternate number)
2) Enter Conference ID: 678543210#

A very rough draft of the deployment guide section is available here:
https://docs.google.com/document/d/1Zgb708hFJjk49kw6SGCfP1ZrcHYEka5i5GRni0z7iyA/edit#heading=h.napqasj1xusx

We currently have two goals in mind for this section: 1) concise
description of the grouper privileges model, 2) TIER recommendations
on how to manage those.

Please feel free to add comments to the doc. Appreciate any thoughts or input.

Best,
Bill


On Fri, Dec 22, 2017 at 2:30 PM, Hyzer, Chris 
<>
 wrote:
>
>
>
>> If you have a long standing or a newish Grouper deployment, how are
>> you managing Grouper privileges? Have you adopted any organizing
>> principles to help maintain them? Running any scripts or Grouper rules
>> to enforce a security model? Adopted a naming convention for grouper
>> security groups? Doing any audit of grouper privileges?
>
> At Penn we assign privs to groups, and generally in an etc folder, and with 
> inherited privs (whichever ones are needed).  We default all groups to not 
> viewable or readable.  We have a descriptive name extension.  If one is 
> read/update we call it "managers".
>
> e.g.
>
> [Folder] :penn:[...]:apps:secureSpace
> [Group] :penn:[...]:apps:secureSpace:etc:secureSpaceAdmins   (can ADMIN 
> inherited the secureSpace folders/groups/attributeDefs and subobjects)
> [Group] :penn:[...]:apps:secureSpace:etc:secureSpaceManagers  (can 
> READ/UPDATE inherited the secureSpace folders/groups/attributeDefs and 
> subobjects)
> (could have Readers, Viewers, Optins, or whatever is needed)
>
> Those groups are dependent usually on activeEmployee as a rule, or have a 
> rule to email the school/center admins if an org changes of someone in 
> those groups...
>
> Thanks
> Chris
>
>