1- Nov- 2010, Fall Member Mee2ng Chris Hyzer, Grouper developer

Size: px

Start display at page:

Download "1- Nov- 2010, Fall Member Mee2ng Chris Hyzer, Grouper developer"

Valentine Watts
5 years ago
Views:

1 1- Nov- 2010, Fall Member Mee2ng Chris Hyzer, Grouper developer

2 Rules Federated users CMU permissions users uportal integra2on Demo of Penn Grouper/Rice workflow 2 11/2/10, 2009 Internet2

4 4 11/2/10, 2009 Internet2

5 5 11/2/10, 2009 Internet2

6 6 11/2/10, 2009 Internet2

7 Hooks are Java plugins Loader is cron based on SQL (or soon LDAP) Rules are like hooks Rules don t require Java Rules can be configured by end users Rules do not have full access to API Rules can run as a daemon too 7 11/2/10, 2009 Internet2

8 Quickly configure automa2c ac2ons in Grouper End users can control their own rules 8 11/2/10, 2009 Internet2

9 If a subject is removed from the employee group, it will be removed from the PayrollSystemUsers group Nightly remove subjects from PayrollSystemUsers who are not employees 9 11/2/10, 2009 Internet2

10 If a subject is removed from the employee group, all payroll system permissions will be removed (e.g. READ Arts and Sciences payroll records) Nightly remove payroll permissions who are not employees 10 11/2/10, 2009 Internet2

11 If a subject is removed from any group in a folder in part of the org structure, it will be removed from the IT admins group Nightly daemon Composite org intersec2on permissions is same for permissions 11 11/2/10, 2009 Internet2

12 If a student is removed from a group for English 110, then adach an end date on the English 110 wiki group for one week from now Disabled- date permissions is the same for permissions 12 11/2/10, 2009 Internet2

13 no2fica2on on fladened membership add from stem no2fica2on on fladened membership remove no2fica2ons on disabled dates (will be removed 5 days from now) no2fica2ons permissions no2fica2ons permissions disabled dates 13 11/2/10, 2009 Internet2

14 Inherited privileges on adribute defini2ons Inherited privileges on folders Inherited privileges on groups Inherited privileges on groups with a name padern E.g. all Groups under folder school:courses will have school:etc:coursereaders with READ privilege 14 11/2/10, 2009 Internet2

15 Veto if not eligible (if not in a Group) Veto if not eligible in org (if not in a Group in a stem) Veto permission if not eligible 15 11/2/10, 2009 Internet2

16 API API abbreviated (for use cases, one call sets all adributes) WS client 16 11/2/10, 2009 Internet2

18 If your IdM supports federated users, use that If not, you can use Grouper federated (external) users Similar to comanage Stores some iden2ty informa2on in the Grouper DB (or pluggable storage, LDAP?) 18 11/2/10, 2009 Internet2

19 19 11/2/10, 2009 Internet2

20 externalsubjects.desc.el = ${grouperutil.appendifnotblankstring (externalsubject.name, ' - ', externalsubject.institution)} externalsubjects.desc.manual = false externalsubjects.calc.fields.cron = * *? externalsubjects.name.required = true externalsubjects. .required = false externalsubjects. .enabled = true externalsubjects.searchstringfields = name, institution, identifier, uuid, , jabber externalsubjects.institution.required = false externalsubjects.institution.enabled = true externalsubjects.attributes.jabber.friendlyname = Jabber ID 20 11/2/10, 2009 Internet2

21 21 11/2/10, 2009 Internet2

22 22 11/2/10, 2009 Internet2

23 We will make a UI for admins to query external users, add, edit, delete Current this can be done with GSH/SQL 23 11/2/10, 2009 Internet2

24 Grouper admins can be no2fied when registra2ons occur Inviters can be no2fied when invitees register All accesses are audited 24 11/2/10, 2009 Internet2

26 Rice request Rice server grouperrice.jar grouperclient.jar Grouper WS server Grouper.client.properties Kuali DB Grouper Registry 26 11/2/10, 2009 Internet2

27 1 Initiator starts workflow On login to Rice, get subject details Grouper web services 2 Routes to approver group One in group approves Get members to route 3 Routes to approver group2 4 Final Add a member to a Grouper group/role and/or assign permissions Grouper Registry Kuali DB Archive the document data, and workflow history 27 11/2/10, 2009 Internet2

28 Pilo2ng a dozen eforms in produc2on Planning a rollout of more forms Central IT will convert paper forms to eforms as a for- fee service for schools and centers (details not final) Demo movie Will have a more detailed presenta2on for the Kuali Days conference 28 11/2/10, 2009 Internet2

30 Similar to Kuali Rice integra2on Secure portlets to Grouper groups University of Chicago ini2ally developed a connector The Grouper team and Unicon are extending it In progress 30 11/2/10, 2009 Internet2

32 CMU has a billing use case on the paccman wiki Involves Groups / Roles / Permissions Can view own bill Can delegate access to bill to someone else Department admins can view bills of students in department Billing admins can view all bills 32 11/2/10, 2009 Internet2

33 Fully implemented on the Grouper demo server Command line client which runs all logic over web services using the grouper client Test data is loaded in server All commands to setup the permissions / roles / data are documented on the paccman wiki 33 11/2/10, 2009 Internet2

34 One gap is centrally hos2ng the decision logic (decision point) Grouper could have a generic Java pluggable decision point to centrally manage logic over Grouper WS 34 11/2/10, 2009 Internet2

35 1- Nov- 2010, Fall Member Mee2ng Chris Hyzer, Grouper developer For more informa2on, visit /2/10, 2009 Internet2

26- April- 2010, Spring Member Mee4ng Chris Hyzer, Grouper developer

26- April- 2010, Spring Member Mee4ng Chris Hyzer, Grouper developer XMPP integra4on XMPP and the Grouper loader XMPP and the Grouper client Kuali Rice integra4on Rice groups Rice subjects Automa4c workflow