Grouper Users - Open Discussion List

["Gettes, Michael" <>]

AND… something that shouldn’t be lost… the value to the “business” people at our institutions who are sold on services like docusign.  Forget the technical view… if the biz has bought into it then there is value for integrating things like Grouper.  Not doing so is hubris.  It’s not about the geeks anymore.  We have to be cognizant of all that is around us and be smart about key integrations to demonstrate the value of the key tools we have to help with managing access at our institutions.

+1M to Chris and the Grouper team.

/mrg

On Sep 11, 2018, at 2:24 PM, Hyzer, Chris <> wrote:

The added value is:

 

1. *Easy way to make forms (word doc, pdf, etc)
2. Easy way to place editable fields on the forms
3. Externalized workflow
4. Document repository to store exactly the form as the user saw it, and as the approver approved it
5. Notifications to sign forms
6. *UI for end users, approvers to very easily pull up a form and fill it out and approve it
7. UI for admins and auditors to look at forms
8. WS API to get events to kick off other non-grouper logic

 

Yes, we could do this grouper.  We might do a default implementation in grouper but an externalized one of docusign or hellosign or google or Microsoft flow would be more user friendly

 

Thanks

Chris

 

* are the most important…

 

From: Black, Carey M. <> 
Sent: Tuesday, September 11, 2018 2:17 PM
To:  Mailing List <>
Cc: David Langenberg <>; Gettes, Michael <>; Hyzer, Chris <>
Subject: RE: [grouper-users] RE: grouper and workflow / access forms

 

NOTE: I am not a lawyer. And I don’t play one on mailing lists.

 

I don’t really get the “added value” of these “E-signature” services.

I am sure there is some legal definition out there that makes this matter more than I think it should.

                IMHO:   “Signature” ( should )  = “Authenticated and they clicked ‘Yes/Accept/Agree/Make it so/etc…./No/Deny/etc…’ at this time. “

 

If you agree with that:

                Then this seems to become a “process” of a series of “messages to the next group(s) to do the next step(s)”. ( Which the “DocuSign” services do with email and links.)

                Yes the “process” can get complicated (only one must approve, all must approve, etc…) but that can be done with group math models.

                The “punch line” of the process (normally) is “when enough ‘Yes’ votes are recorded’ then and only then the Member “is permitted”.

 

 

IMHO:

The valuable part to me is the definition of the “process” (Group math.. order of flow, gates, etc…) and the end result that grants (or not) the user’s access.

                Maybe I am under thinking the complexity of the process model and not seeing how it could be modeled in Grouper?

 

 

Maybe grouper could:

1. Have a way to tag a group such that when a membership is added an email is sent to a list of “next group(s)” members and/or admins? (To request the addition of “the member” to the other group(s).)

        If you want to be really “helpful” send a link in the email ( with the Member and “next group” in question ) so the email recipient “opens the UI at the Add Membership UI” with the right values.

                ( To cover some of the “Why” questions…. )

2. When a Membership is added, maybe there could be a “Why are you adding this membership?” text blob on the membership. ( Think Membership Description field. Maybe make it optionally required based on the group meta properties? )
3. Add a “Deny” button (to this new UI page) and other “group members and/or admins” (from the source list) could be emailed that “User Bob denied Member access” ( So others can not bother to approve/deny. )

 

Then use the grouper audit data as “proof” (by time and person) granted/denied decisions.

 

Wouldn’t that be (about?) the same thing without the external dependencies/costs?

 

-- 

Carey Matthew 

 

From:  <> On Behalf Of David Langenberg
Sent: Tuesday, September 11, 2018 9:00 AM
To: Gettes, Michael <>
Cc: Chris Hyzer <>;  Mailing List <>
Subject: RE: [grouper-users] RE: grouper and workflow / access forms

 

Thanks Michael for getting to the root of the issue.

 

Dave

 

--

David Langenberg

Asst Director, Identity Management

The University of Chicago

 

From: Gettes, Michael <> 
Sent: Monday, September 10, 2018 1:41 PM
To: David Langenberg <>
Cc: Chris Hyzer <>;  Mailing List <>
Subject: Re: [grouper-users] RE: grouper and workflow / access forms

 

If you agree it can be done with GSuite and O365 then this is really all about the capability to integrate with forms/signing/workflow products and not so much about which one.  As long as this is done in a fashion making it easier to integrate the bevy of these products, I’m all for it. 

 

Thanks Chris!

 

/mrg

 

On Sep 10, 2018, at 2:35 PM, David Langenberg <> wrote:

 

Ok, I see the desire, still, I’m not 100% sold on the docusign thing, esp when you can do the same thing free with GSuite (Forms+AppsScripts) or O365 (Sharepoint + Flow).  How hard would it be to put in special Grouper support for those non-subscription-ish (yeah yeah O365 is not free) instead?  Would those meet the need?

 

Dave

 

--

David Langenberg

Asst Director, Identity Management

The University of Chicago

 

From: Hyzer, Chris <> 
Sent: Monday, September 10, 2018 12:51 PM
To: David Langenberg <>;  Mailing List <>
Subject: Re: grouper and workflow / access forms

 

 

> From: Greg Haverkamp <>

 

Hellosign is interesting, thanks for mentioning

 

> From: David Langenberg <>

 

> Other than “gee, isn’t this neat?” what’s the use-case? 

 

We have a lot of use cases.  e.g. Someone wants access to warehouse student data, they fill out a form, their manager approves, the data steward approves, gets routed to something automatic or to someone to grant something.  Should also be put in Grouper either way.  We are implementing a new student system and they have a lot of requirements like this.  Its nice to have a paper trail of who requested access, when, who approved it, when it was granted, etc.  Sometimes the form needs comments about why access is needed, maybe some qualifiers like which rows or columns of data to see, etc.

 

Ive been thinking about a built-in way to do this, and I think it needs some sort of form. We could do this with PDFs in S3 buckets but it seems a little clunky and users would have an easier time with something like Docusign or Hellosign, and we wouldnt have to make all the stuff that manages the forms when done...

 

thanks

Chris

 

---

From: David Langenberg <>
Sent: Monday, September 10, 2018 1:19 PM
To: Hyzer, Chris;  Mailing List
Subject: RE: grouper and workflow / access forms

 

Other than “gee, isn’t this neat?” what’s the use-case?  I know Docusign is a Net+ offering, but it’s definitely not on a deployment level that, say, Duo or AWS is.  Wouldn’t it be easier (and cheaper) to just extend attestation to include a more robust approval workflow with approvals stored in the grouper audit logs?

 

Dave

 

--

David Langenberg

Asst Director, Identity Management

The University of Chicago

 

From:  <> On Behalf Of Hyzer, Chris
Sent: Monday, September 10, 2018 11:36 AM
To:  Mailing List <>
Subject: [grouper-users] grouper and workflow / access forms

 

Im not 100% sure it’s the right choice, but hypothetically lets say we integrated Grouper with Docusign.

 

- Someone clicks on a form in the Grouper UI

- It calls a Docusign API to setup an instance of the form

- User fills out basic form fields and e-signs the document

- The approvers at various roles would be sourced from groups (e.g. the student-data steward group [registrar]).  One from each group signs the form

- At the end the requestor would be added to a group or groups

- Docusign stores the history of the forms

 

I don’t know if they have discounts for higherEd/nonprofit, but it seems like the cost for this would be for the Basic API, about $1/form ($600/year for 500 forms/year) or ($5k/year for 6k forms/year)

 

https://www.docusign.com/products-and-pricing/api-plans

 

Might need to buy some user licenses to make/manage forms: ($1k for 2-3 users depending on standard or pro)

 

https://www.docusign.com/products-and-pricing

 

Who would be interested in using this if we integrated with Docusign?  Any other ideas for forms/workflow products where the licensing is reasonable and there is a full featured REST API?  We would try to make this pluggable of course…

 

Thanks

Chris