Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 2 Next »

What is Grouper?

  • Grouper makes groups
  • based on URN namespaces to make sure group names don't collide
  • main objective is large scale admin and delegation of a common store
  • many people have authority over many other people's information
  • all those different agencies can source a knowledge system based on a common service that many agencies can plug into

Grouper Plumbing

  • Grouper can list subjects which is an abstraction (how to integrate a thing with God knows what?)
  • Subject API with packaged JNDI and JDBC
  • Grouper ships with it's own presentation of subjects
  • Main point of integration, point it at your LDAP directory or SOA implementation etc.
  • Other points of integration can assign privileges
  • There is a loader that can load people's LDAP entries, a dynamic group based on attributes
  • Get information reflected from outside of Grouper for maintenance tasks
  • Web Services interface, 4 varieties, light and heavy, SOAP and RESTful (2x2 matrix)
  • WS for query and management
  • You must use subject interfaces, WS interfaces are popular for putting things into Grouper like hierarchies of class membership or department structures
  • LDAP provisioning connector, selects a variety of group information and tailors the way the information is handled
  • Current LDAP provisioning connector is being replaced with a faster solution for large implementations like 1 million + groups
  • New connector will have asynchronous notifications, subscribe to the Loader, coming in 1.5 in November
  • New connector starts out with the Shibboleth attribute resolver
  • Delivery mechanism based on SPML
  • Will enable Shib to look up information directly from Grouper (potentially)
  • From the app perspective, you want to gather information from the enterprise data store or you can put a Grouper client in your cron and make it available to your app in a legacy way.
  • User interface for admin.
  • Command line interface exposes 100% of the api
  • XML import and export plumbing, don't do this but it's possible and sometimes even handy
  • Current interface is not the one for general use but a new one is coming but for the most part you want users to set up the access from within the application that is consuming the Grouper services
  • Far more coming in the attribute space in the new version

Success Stories

  • National Cancer Institute, 80 Cancer research centres is federated and uses PKI, Grouper is the access management component.
    • Central group registry and most sites have their own, but it provides a way for you to link your app to their grid while maintaining access
  • U of Chicago uses it to solve ordinary use cases, over time you amass a new asset of who can access what, provides an alternative to creating application level access control

Contributors

  • University of Washington
  • University of Pennsylvania
  • University of Chicago
  • No labels