Grouper Users - Open Discussion List

[Alan Crosswell <>]

http://www.nmi-edit.org/CAMP/EDIT_IdM/docs/internet2-mi-best-practices-00.html

On Wed, May 30, 2018 at 7:49 PM Steven Carmody <> wrote:

I *think* that V1 of Grouper was modeled on the functionality provided
by Brown Grouper. Brown's system supported a hierarchical namespace,
included support for set arithmetic, and provided a set of APIs to query
and update groups. Brown Grouper was implemented by James Mathiesen; it
was developed BEFORE the ldap protocol was defined.

That said, let me be the first to state that Tom, Chris, Shilen, Blair,
GW Brown, Bert, Caleb, and many others have designed and built, in
future versions of Grouper, an absolutely *amazing* system. It does
groups in a stupendous way. And it also does so many other things in an
amazing way that we continue to explore it, find new features, and
become amazed by it. When we need to solve a problem, we start by
looking at Grouper. Thank you team !

and here's the oldest email that I have in my Grouper folder. Note the
date -- 21 May 2001


Message-ID: <>
Date: Mon, 21 May 2001 23:55:30 -0500
From: Tom Barton <>
Organization: The University of Memphis
X-Mailer: Mozilla 4.75 [en] (Win98; U)
X-Accept-Language: en
MIME-Version: 1.0
To:
Subject: draft group practices solicitation

mace-dir,

During the last conference call I was asked to send a solicitation to
this list asking people to describe what they're doing or planning in
relation to groups. I thought it might be best if I first circulated a
draft of that solicitation to ask for your comments & criticisms to help
ensure that the final solicitation is effective at promoting informative
responses. Below is that draft.

Tom

DRAFT GROUP PRACTICES SOLICITATION

We would like to solicit information on current or anticipated practices
and issues related to provisioning and using group objects in X.500 or
ldap capable directories. An outline is provided below to which you
might refer when describing your group practices. The information you
provide will be used to help determine the direction mace ought to take
with regard to group related middleware matters.

A. Please list current or planned applications using directory groups
and provide a brief description of each.

B. Please address each of the following items. It would be especially
interesting to relate how the nature of any of the above applications
constrains your choices in each of these areas.

B.1. How is group membership represented? Are any of the following types
used? What led you to decide on the membership representation(s) you've
chosen?

Static, ie, a group object is instantiated with an attribute listing the
(person or other) objects which are members.

Dynamic, ie, defined by evaluating an ldap URL. A group object may, but
need not, exist.

Dynamic forward reference, a special case of dynamic representation in
which an object's group memberships are listed as the values of an
attribute designated for that purpose.

B.2. What object class(es) are you using to instantiate group objects,
if you are indeed instantiating group objects: groupOfNames,
groupOfUniqueNames, groupOfURLs, other object class(es)? If the latter,
what functional requirements drive the design of the group schema?

B.3. How are group memberships maintained? Automated processes? By hand?
Using what tools?

B.4. Can group objects be members of groups? What object types can be
members of groups?

B.5. Do you have a mechanism for representing a group whose membership
is the result of an automated process together with a manually
maintained set of exceptions (either inclusive or exclusive)?

B.6. What policy pertains to administration of group membership? Is
administration of groups delegated? How is the set of groups groomed
(stale ones made to go away eventually)?

B.7. What privacy or security policy pertains to any of your groups? Are
there policies that prohibit or inhibit the exsitence of certain types
of groups?

B.8. What conventions for group names exist? What motivates them?

C. Are you tracking "roles"? What does that mean to you? Are you
implementing something like "role based access control"?

D. Thanks for sharing that information. In addition, we'd appreciate
your direct advice on the direction mace ought to take in this area.



On 5/30/18 12:48 PM, Gettes, Michael wrote:
> When was grouper actually born?  I know it was hatched from Tom Barton’s head - but I am failing to recall exactly when.
>
> /mrg
>

--

Alan Crosswell

Associate VP & CTO