Grouper Users - Open Discussion List

["Redman, Chad" <>]

Hi Pete,

 

We took the original Unicon source code and modified it to a specific application need. You can see the write up at https://spaces.at.internet2.edu/display/Grouper/University+of+North+Carolina+-+Course+Groups+for+Office+365 . To summarize our customizations:

 

·         Allow an HTTP proxy configuration (our Grouper Loader server did not allow direct outgoing connections);

·         Add more configuration parameters: subject source, subject attribute, AD domain, group name EL _expression_, display name EL _expression_ (the EL expressions were used to craft environment specific names, as we had multiple non-production environments targeting the same testing O365 tenant);

·         The changelog consumer syncs either the O365 members or owners, depending on the group name;

·         The O365 group name is based on the parent folder of the group;

·         Removal of the sync attribute flag does not trigger deprovisioning of the O365 group, but rather removes the sync capability (this is controlled by the user through the web interface)

·         Adding the sync attribute flag performs a full sync with O365, in case the attribute was added to an existing group;

·         Upon group creation, along with setting an attribute for the O365 group guid, the consumer also stores the tenantId and the group name, which can be used to construct URL links to the group (outside of Sharepoint, the group’s guid is surprisingly not utilized in web links).

 

 

So we had some extensive changes to the functionality, by having a folder associated with O365, and then a member and owner groups that sync separately.

 

The REST client built into the code worked fine, as did the authentication logic, without any changes needed. So it may just work, depending on how your objects are set up. It does make some assumptions on what principal IDs are, so we needed to customize in order to construct the azure identity based on a Grouper subject attribute. The group lifecycle also works in a specific way -- it will create or deprovision the group based on the changelog consumer attribute, which didn't fit our needs.

 

-Chad

 

 

 

-----Original Message-----
From: [mailto:] On Behalf Of Pete St. Onge
Sent: Wednesday, October 16, 2019 3:35 PM
To:
Subject: [grouper-users] Grouper 2.4 and office365-and-azure-ad-grouper-provisioner

 

Hello all,

 

We're in the process of upgrading our existing Grouper implementation to

2.4, and we have it running nicely in our non-prod environment. There

are a lot of really useful new features that we look forward to putting

to good use going forward, kudos to all involved in building Grouper!

 

We are also looking at what would be involved to get connected to Azure

with the existing office365-and-azure-ad-grouper-provisioner and if

anyone has this set up this with 2.4.

 

Thanks and best, -- pete

 

--

Peter St. Onge                          

Information Security Architect                     (416)978-5030

Business Continuity and Communications

Information + Technology Services          University of Toronto