Subjects
- How are subjects namespaced?
- How is a subject represented? What attributes are built in? (e.g. Grouper has built in name, description, id, source, and can be searched by identifier or id or either). Or does the group service communicate with an id, and subject information is retrieved from another system.
- Can you get netId's back from the service or just opaque id's?
Protocol
- Initial assumption is web service based with pluggable authentication
- Do we need a messaging design (xmpp)?
- REST? (if REST, then XML, JSON, and/or XHTML)?
- SOAP?
- Simple calls?
- Batched calls (e.g. replace all members of a group with the attached list)? (if batched, can you pass a TX type)?
- Simple responses or complex responses (e.g. for groups a subject is in, return just the ID (KIM) or return group information(Grouper))?
- How are results communicated back? Result code, description, warnings, errors, success_TF, etc?
- If you add a member to a group who is already a member, is that a success, and is there a result code that represents that? (same with delete)
- Paging and sorting for results?
- Is the client and server version transmitted in the request/response?
Security
- Act as another user?
- Do privileges on groups factor in? Can you assign a privilege on a group to someone (e.g. someone can edit the memberships of the group)?
Structure
- Simple API (like OpenSymphony), or complex
- More operations that are well defined (KIM), or fewer operations with options (Grouper)?
- Should we separate out the consumption vs the management of groups (i.e. read groups from subject vs add subject to group)
Group namespaces
- Is a Group a Subject? i.e. can you add a group to a group with the same operation as add user to group?
- Deep namespace or one level namespace?
- Besides group namespace (folders), is there some sort of "source" for a group (e.g. group system, dynamic, group system B, etc)
- Can you filter operations by namespace (i.e. groups a subject is in that are in a certain namespace directly or indirectly)?
Group structure
- Do groups have lists (e.g. add a member to list X of Group Y)? i.e. this is a triple assignment, instead of a tuple, though there could be a default for simple things (e.g. "members" list)
- Do groups have an ID and name, or an ID / display name / system name? (or other)
- How are group searches done (e.g. boolean logic, e.g. group name is X and in folder Y)
- Can groups have types (labels)?
- Are composites in scope (e.g. someone is in this group if they are also in another group)?
- Do groups have enabled/disabled dates?
- Can you add a member to a group by ID or system name? Or lookup the group first and use ID?
Memberships
...
To help establish the initial design of a Groups API, please first add a brief description of your project to this page. Then, answer the questions on each of these pages:
| Child pages (Children Display) |
|---|
COmanage
COmanage is an Identity Management System for Collaborative (Virtual) Organizations. COmanage Gears is the core IdMS, and is written in PHP. COmanage uses groups in the following ways:
- To manage authorizations within COmanage Gears (eg: who can add and remove members of a CO).
- To manage group memberships for domesticated applications (eg: wikis, mailing lists, domain-specific apps) within the COmanage ecosystem.
NAU Enterprise Groups
Northern Arizona University uses Grouper to implement an Enterprise Group System to handle formation and management of groups across the institution. Using a custom designed interface, campus users can create and manage pesonal and organizational groups which are automatically provisioned to LDAP and Active Directory.