Grouper allows you to assign tags (called types) to objects such as folders and groups. There can be metadata on the assignment. 

Grouper types helps support and clarify the usage of types as defined in the Grouper Deployment Guide

This is a more structured and consistent way of accomplishing what could also done through the attribute framework

Attribute definitions

DefinitionAssigned toPurposeValueCardinality
grouperObjectTypeDeffolder, groupidentify a group typemarkerMulti assign
grouperObjectTypeValueDeffolder assignment, group assignmentname/value pairsStringSingle assign, single valued

Attribute names





ref, basis, policy,etc, bundle, org, test, service, app. See the TIER Grouper Deployment Guide for descriptions.
grouperObjectTypeDataOwnergrouperObjectTypeValueDefe.g. Registrar's office owns this data
grouperObjectTypeMembersDescriptiongrouperObjectTypeValueDefhuman readable description
grouperObjectTypeDirectAssignmentgrouperObjectTypeValueDefif this is directly assigned or inherited
grouperObjectTypeServiceNamegrouperObjectTypeValueDefname of the service that this app falls under
grouperObjectTypeOwnerStemIdgrouperObjectTypeValueDefif this is not a direct assignment, then this is the stem id where it is inherited from

Assign type on UI

On a folder or group, a menu item under the "more actions" button will say "Type."  (Shown in screenshot below.) This "Type" option will only show if user can edit types.

Table should show which are assigned, if inherited or not.  There is also the option to add more assignments.  If assigned, call the keep inherited method below.

Note: implement the attributes like "Deprovisioning" used attributes

Group or Folder ADMINs can assign types

View on UI

Note, if a user can view a group, they can view this attribute assignment from a high level.

On the group or folder screen show what type(s) this group is

Show the data owner and service description if applicable

Show this all in one paragraph.  Show toolips on each type

As part of types, the loader summary should be moved from the loader "view" screen to this paragraph too.  It should read as follows:  This group is managed by loader group testSqlSimplelast fully loaded on Sat Dec 01 06:00:04 UTC 2018 with summary: 167 total, 0 inserted, 5 deleted, 2 updated.

E.g. shows on group UI:      Group types: ref, readonly.  The data owner is: the registrar's office.  The member description is: faculty, staff, temps.

If the type is "app", and it is an indirect assignment, and the folder which assigns it has a display extension of "Wiki", then followup with a sentence (note, the folder should be linkable to that folder): This is in the Wiki app.

If the type is "service", and it is an indirect assignment, and the folder which assigns it has a display extension of "Student systems", then followup with a sentence (note, the folder should be linkable to that folder): This is the Student systems service.

Available Types

TypeOwner typeTooltip
refgroup/folderReference groups are institutionally meaningful cohorts used in access policy.
basisgroup/folderBasis groups represent arcane codes or attributes from external systems are used generally in reference groups and not directly in access policy.
readonlygroup/folderRead-only groups should not have membership changes except by the process that manages the group; perhaps external from the central authorization system
policygroup/folderAccess policy groups are used by downstream systems to allow or deny users access to services or resources.
bundlegroup/folderBundles are reference groups which aggregate multiple other reference groups. Reference groups are institutionally meaningful cohorts used in access policy.
securitygroup/folderSecurity groups are collections of entities who have from access privilege on a group/folder/attribute, e.g. studentSystemAdmins.
orggroup/folder"Org" or organization groups or folders are delegated to and owned by organizations in the community.
testgroup/folderTest groups or folders are not used in production systems. They could be for dev, test, performance, etc environments.
appgroup/folderApp groups or folders exist to be used in a specific application.
servicegroup/folderA service is a collection of one or many apps that comprise of a service offered to users.


Use the "More actions" button to access Type. 

List of available Type settings for a folder

Assigning a Type setting to a folder

Shows Type setting and specifies if inherited or not.   
Note, we plan to add text that states that type assignments and metadata can be viewed by anyone who can VIEW a group.

 Type info is shown under the folder name to make it easily accessible.

The screenshots above show Types on folders. Similar Type configuration can be set on groups as well.

Keep inherited attributes up do date

A daemon should work like deprovisioning where inherited attributes are kept up to date. 
When an attribute is assigned, it should call the propagate method for this object and subobjects if a stem.

To do now

  • Put type name first, then direct/indirect
  • When settings changed, it should use logic like deprovisioning where it updates the hierarchy tree
  • Types and metadata should be displayed on object page under the description (not in "more")

To do later

  • Source basis and ref metadata from loader
  • Clarify the difference between app and service
  • If there is a blank attribute, it should be unassigned
  • Use this as a means to search for things