...
Grouper attestation means marking a group or folder so that owners must review the membership list periodically. This is useful in ad hoc groups where deprovisioning is not automatic. Owners will be reminded by email to review the memberships. After reviewing the memberships, the group owner will click a button on the group indicating that it has been reviewed.
This Attestation is available in the a Grouper 2.3 .0 API path #64 and UI patch #24patch and in Grouper 2.4 and above.
Note after installing the patches you should run from GSH:
...
Child pages:
| Children Display |
|---|
Outline:
| Table of Contents |
|---|
Attest a group as reviewed
...
On the membership screen you will see a note and a button:
If you are on the attestation screen, you will see a menu item Attestation actions → Attest group as reviewed
Attestation menu
You will notice a new menu item Attestation in the More actions dropdown for groups and folders as shown in the screenshots:
...
- Daemon runs daily (via cron) and look for groups which have not been attested. Should group by email address. Send each user who get an email their own email with a list of groups and linked to be attested. Remind the user about clicking the button saying it is certified.
Email logic: Take each email to each user (by email address), and only send one email to that user. If there are more than 100 (configured in grouper.properties) attestations, just show 100 in the message but say there are 5432 others so email isn’t too big. Also, add at the bottom of each message who was CC’ed since you email will be sent directly to a person.
e.g.
school:groupA needs attestation: emails to: jsmith@school.edu, and bgreen@school.edu
school:groupB needs attestation: emails to: jsmith@school.edu, and kwilson@school.edu
send 3 emails:
FIRST EMAIL: To jsmith@school.edu
Subject: you have 2 grouper groups that require attestation.
Body:
You need to attest the memberships of the following groups:
- 1. school:groupA (cc’d bgreen@school.edu)
<link to membership>
- 2. school:groupB (cc’d kwilson@school.edu)
<link to membership>
SECOND EMAIL: To bgreen@school.edu
Subject: you have 1 grouper groups that require attestation.
Body:
You need to attest the memberships of the following groups:
- 1. school:groupA (cc’d jsmith@school.edu)
<link to membership>
THIRD EMAIL: To kwilson@school.edu
Subject: you have 1 grouper groups that require attestation.
Body:
You need to attest the memberships of the following groups:
- 1. school:groupB (cc’d jsmith@school.edu)
<link to membership>
...
| Code Block |
|---|
#put the URL which will be used e.g. in emails to users. include the webappname at the end, and nothing after that. #e.g. https://server.school.edu/grouper/ grouper.ui.url = http://localhost:8088/grouper/ #smtp server is a domain name or dns name. set to "testing" if you want to log instead of send (e.g. for testing) mail.smtp.server = localhost #this is the default email address where mail from grouper will come from mail.smtp.from.address = noreply@school.edu # OPTIONAL FOR ATTESTION, WILL BE BLANK IN PROD #this is the subject prefix of emails, which will help differentiate prod vs test vs dev etc mail.smtp.subject.prefix = DEV: |
Note, might want to leave these as defaults. grouper.properties
| Code Block |
|---|
######################################### ## Attestation ######################################### #default value of attestation days until recertify. Every group/folder can define their own days until recertify value and if they don't provide, use the following one. attestation.default.daysUntilRecertify = 180 #number of groups shown in the body of attestation email attestation.email.group.count = 100 #attestation reminder email subject attestation.reminder.email.subject = You have $groupCount$$objectCount$ groups that require attestation #attestation reminder email body (links and groups are added dynamically) attestation.reminder.email.body = You need to attest the memberships of the following groups. Review the memberships of each group and click: More actions -> Attestation -> Members of this group have been reviewed attestation.reminder.email.body.greaterThan100 = There are $remaining$ more groups to be attested. |
...
At the start up time, attestationDef and attestationValueDef attribute definitions will be added to the system as shown in the screenshots. 
Design
- Attributes on folders, groups: (two attributeDefs) (note, autocreate these attributeDefs and attributeNames on startup)
- Note, edit these in the Grouper UI, do not edit them by hand
- attestation (main flag, other attributes assigned to this assignment, no value, single assign)
- attestationDirectAssignment (true | false) (on group only) default to false. If true then dont look at a folder for attestation attributes
- attestationHasAttestation (true | false) (on groups and folders). If true then this group or folder has attestation assigned. On groups then it is directly or indirectly assigned. If on a folder, then it is directly assigned. i.e. if a folder doesnt have this, it doesnt mean that there isnt attestation inherited from a parent folder.
- attestationSendEmail (String, true | false) default to true if not set
- attestationEmailAddresses (String) comma separated email addresses to send reminders to. If not set, then get email addresses from list of Admins and Read/Update users. Note, we need a param (in the source) of which subject attribute is the email attribute. If none sent, log error, need either emails here or emails from admins
- attestationDaysUntilRecertify (String) integer number of days until need to recertify from last certification. Can have a default in grouper.properties if not set. (180?)
- attestationLastEmailedDate (String)(on group only) yyyy/mm/dd date that this was last emailed so multiple emails dont go out on same day
- attestationDaysBeforeToRemind (String) Integer number of days before attestation to start sending emails about it.
- attestationStemScope (String) one|sub (for folders only, scope one level or all levels). Default to all levels.
- attestationDateCertified (String) (on group only) yyyy/mm/dd is the last date certified for this group. (only for groups, not stems)
Future scope
- If attestation is not done in a certain amount of time, disable the memberships or group somehow