Grouper Users - Open Discussion List

["William G. Thompson, Jr." <>]

On Wed, May 30, 2018 at 2:15 PM Alan Crosswell 
<>
 wrote:
>
> http://www.nmi-edit.org/CAMP/EDIT_IdM/docs/internet2-mi-best-practices-00.html

Fun read from the turn of the century!

Much of it still rings true. Might be fun to work on an updated
version in the context of TIER.

Two favorite quotes from the doc:
"Supply key institutional groups centrally." (i.e. subject attribute
management is an enterprise concern)

"Get ready for XML."  You ain't kidding! :)

Best,
Bill

>
>
> On Wed, May 30, 2018 at 7:49 PM Steven Carmody 
> <>
>  wrote:
>>
>> I *think* that V1 of Grouper was modeled on the functionality provided
>> by Brown Grouper. Brown's system supported a hierarchical namespace,
>> included support for set arithmetic, and provided a set of APIs to query
>> and update groups. Brown Grouper was implemented by James Mathiesen; it
>> was developed BEFORE the ldap protocol was defined.
>>
>> That said, let me be the first to state that Tom, Chris, Shilen, Blair,
>> GW Brown, Bert, Caleb, and many others have designed and built, in
>> future versions of Grouper, an absolutely *amazing* system. It does
>> groups in a stupendous way. And it also does so many other things in an
>> amazing way that we continue to explore it, find new features, and
>> become amazed by it. When we need to solve a problem, we start by
>> looking at Grouper. Thank you team !
>>
>> and here's the oldest email that I have in my Grouper folder. Note the
>> date -- 21 May 2001
>>
>>
>> Message-ID: 
>> <>
>> Date: Mon, 21 May 2001 23:55:30 -0500
>> From: Tom Barton 
>> <>
>> Organization: The University of Memphis
>> X-Mailer: Mozilla 4.75 [en] (Win98; U)
>> X-Accept-Language: en
>> MIME-Version: 1.0
>> To: 
>> 
>> Subject: draft group practices solicitation
>>
>> mace-dir,
>>
>> During the last conference call I was asked to send a solicitation to
>> this list asking people to describe what they're doing or planning in
>> relation to groups. I thought it might be best if I first circulated a
>> draft of that solicitation to ask for your comments & criticisms to help
>> ensure that the final solicitation is effective at promoting informative
>> responses. Below is that draft.
>>
>> Tom
>>
>> DRAFT GROUP PRACTICES SOLICITATION
>>
>> We would like to solicit information on current or anticipated practices
>> and issues related to provisioning and using group objects in X.500 or
>> ldap capable directories. An outline is provided below to which you
>> might refer when describing your group practices. The information you
>> provide will be used to help determine the direction mace ought to take
>> with regard to group related middleware matters.
>>
>> A. Please list current or planned applications using directory groups
>> and provide a brief description of each.
>>
>> B. Please address each of the following items. It would be especially
>> interesting to relate how the nature of any of the above applications
>> constrains your choices in each of these areas.
>>
>> B.1. How is group membership represented? Are any of the following types
>> used? What led you to decide on the membership representation(s) you've
>> chosen?
>>
>> Static, ie, a group object is instantiated with an attribute listing the
>> (person or other) objects which are members.
>>
>> Dynamic, ie, defined by evaluating an ldap URL. A group object may, but
>> need not, exist.
>>
>> Dynamic forward reference, a special case of dynamic representation in
>> which an object's group memberships are listed as the values of an
>> attribute designated for that purpose.
>>
>> B.2. What object class(es) are you using to instantiate group objects,
>> if you are indeed instantiating group objects: groupOfNames,
>> groupOfUniqueNames, groupOfURLs, other object class(es)? If the latter,
>> what functional requirements drive the design of the group schema?
>>
>> B.3. How are group memberships maintained? Automated processes? By hand?
>> Using what tools?
>>
>> B.4. Can group objects be members of groups? What object types can be
>> members of groups?
>>
>> B.5. Do you have a mechanism for representing a group whose membership
>> is the result of an automated process together with a manually
>> maintained set of exceptions (either inclusive or exclusive)?
>>
>> B.6. What policy pertains to administration of group membership? Is
>> administration of groups delegated? How is the set of groups groomed
>> (stale ones made to go away eventually)?
>>
>> B.7. What privacy or security policy pertains to any of your groups? Are
>> there policies that prohibit or inhibit the exsitence of certain types
>> of groups?
>>
>> B.8. What conventions for group names exist? What motivates them?
>>
>> C. Are you tracking "roles"? What does that mean to you? Are you
>> implementing something like "role based access control"?
>>
>> D. Thanks for sharing that information. In addition, we'd appreciate
>> your direct advice on the direction mace ought to take in this area.
>>
>>
>>
>> On 5/30/18 12:48 PM, Gettes, Michael wrote:
>> > When was grouper actually born?  I know it was hatched from Tom Barton’s 
>> > head - but I am failing to recall exactly when.
>> >
>> > /mrg
>> >
>>
> --
> Alan Crosswell
> Associate VP & CTO
>