...
Release | Item | Description |
|---|---|---|
| 2.5 | Revisit Grouper service registry | Identify services in grouper. Make them easy to see, join, manage, document, attest, etc. https://docs.google.com/document/d/1zV2kuAKOwoBFIf4GIpiQt6-NFsVkdbYdagDjGcJ7efQ/edit |
| 2.5 | Simplify UI | Make UI task oriented and easy to use for various types of users |
| 2.5 | Integrate connid | midpoint uses connid for provisioning. This is a standard. We would like Grouper to be able to load from and provision to connid connectors. We would also like to migrate our (non-pspng) connectors (e.g. duo, box, etc) to connid (if not there already) and share with midpoint. |
| 2.5? | Improve notifications | support people, groups, and email lists. Individual email addresses are problematic. Add ability to batch emails. Log emails (temporarily). User can control preferences. Notify configure on groups. Grouper email notifications |
| 2.5 | Support JSON in grouper client | grouper client currently does XML but should do JSON (by defualt with option to switch back) |
| 2.5 (in progress) | attributes on memberships | allow direct and indirect attributes on memberships in UI |
| 2.5 patch | Subject source adapter configuration wizard | Have grouper subject source adaptor configuration in the UI like the loader config. Explore including Midpoint and Comanage if useful |
| 2.5 patch | Curated groups | Add features to support Duke presentation https://meetings.internet2.edu/media/medialibrary/2019/12/05/20191211-mckee-paranoidiam_1.pdf |
| ? | Move GSH needs into the UI | Look at how the community uses GSH and move those needs into the UI |
| ? | Membership constraints | Allow memberships to be able to be constrained for certain reasons, when those conditions are met, enable the membership, else disable. And keep the existing enabled/disabled dates if applicable |
| 2.5 patch | Troubleshoot access | Analyze why someone is or is not in a group, when they got added, audits related, and check provisioning to see if they are in LDAP or box |
| 2.5 | WS operations | Audit, enabled/disabled on findGroups, PIT, new paging, membership notes in WS |
| 2.5 patch | Daily report refactor | Refactor the Grouper "daily" report. make it a dashboard on UI. Keep calculations in attributes if they arent already there with instrumentation. See what features we can use from Michael Gettes dashboard |
| 2.5 patch | Changelog improvements | Allow change log consumers or message publishers to process messages before the single threaded "change log temp" processor completes. Or, not that change log temp is quicker, allow change log consumers to keep track of which messages they have processed so messages can be processed out of order |
2.5 patch | Register for notifications | Add ability for users to register to be notified of changes to specified objects. Note, there are rules to email users about changes to memberships |
| 2.5 patch | Provision lifecycle events | Events (such as admission, enrollment, new hire, etc.) must trigger lifecycle stage transitions, role changes, affiliation changes, etc. Those can then cause other events such as service eligibility. Lifecycle changes or affiliations all precipitate a need for provisioning wherein roles are mapped to services / entitlements. |
| 2.5 patch | Workflow state groups | The solution must support high level workflows between states. Group memberships transitioning among workflow state groups |
| 2.5 patch | Separation of duties | The solution must anticipate the possibility of conflicting roles in the case of multiple personae. Also allow overrides of separation of duties |
| 2.5 patch | Conflicting roles | The solutions must take into consideration that conflicting grants of authority, eg, one source indicating a grant of access and another a denial of access, must be resolvable according to the needs of each application or service context |
| 2.5 patch | Handle multiple roles | The solutions must enable individuals to have multiple roles/affiliations/relationships/whatever with the institution, each with its own lifecycle and overlapping set of access privileges needed to undertake each role. Statefulness (persistence and preservation of state) must permeate the design goals of all solution components in order to correctly and efficiently manage their access over the course of these multiple lifecycles |
| 2.5 | Add database columns | Add database columns for group expiry (membership expiry already exists), and membership notes (maybe an attribute instead). Anything else for point-in-time? "visible" flag for UI for groups. password table for revamped WS authn. Service account subject source table? provisioning status. provisioning group status? log table? email batching? config PIT table |
| 2.5? (started) | Revise build environment and dependency retrieval | Revising code environment to get rid of dependencies and the hybrid builds (Maven and ant builds, hard to keep everything in sync) Possible options:
Need to figure out versions for each dependency. |
| 2.5? | Harmonize the UNC, Grouper, and Unicon azure AD code | office365-and-azure-ad-grouper-provisioner |
| ? | Update WS authn | Keep creds in db, allow users to create a local entity with password, that should be sent with http header based on timestamp and hash of url and request body. look at popular APIs and do something similar, trying to be self serv. password should not be sent in request, just sometime cryptographically safe. allow password changing by user. |
| 2.5 patch | Min group membership size | In loader jobs and just on groups have min group sizes |
| 2.5 | Performance diagnostics | Administrative function to measure and diagnose the performance of a deployment |
| 2.5? | Real time message based provisioning | Allow messaging to take events to provision new netIds (pspng) |
| 2.5 patch | Expire dates | Add expire dates to groups (other objects? attribute definitions? attribute names?) and expose privilege expire dates to WS/UI. GRP-1807: folder names limited to 255. Add approx group size column? GRP-849: add enable/disable dates on groups like memberships and permisisons |
| 2.5 patch | PSPNG UI configuration wizard | Wizard to walk administrator through setting up a PSPNG configuration |
| 2.5? | Rules on individual membership | An individual membership could have a rule that it is dependent on memberships in another group for example |
| 2.6 | Add remaining attribute/permission operations to WS | Add permission hierarchy services for roles, actions. Limits? Any other attribute permission services? |
| ? | Add dropbox endpoint to pspng | |
| ? | Add unicon azure integration to grouper | Add the unicon azure integration to grouper. https://github.com/Unicon/office365-and-azure-ad-grouper-provisioner |
| ? | Add O365 to pspng | Need technical requirements first, leverage the existing Unicon work |
| 2.6? | Add bulk operations | Make bulk operations faster, e.g. creating or deleting a list of groups, adding or removing a list of memberships |
| 2.6? | UI warn, restrict, or schedule large operations | If adding a group to another group, maybe warn, restrict, notify user that the operation will take a while to provision. Or schedule this for later? |
| 2.5 | Copy entitlements to another user | Copy entitlements to another user. Optionally include start and end dates |
| 2.6? | Automatically clean various things | If a group is marked as a composite ad hoc list (and/or maybe includes / excludes), then if the membership is no longer relevant, then set an end date for some time in the future. Optionally notify. This applies to individual permissions as well. Automatically or manually clean up redundant privs (if assigned to group and individual). Automatically or manually clean up redundant memberships (group and individual) |
| ? | Add high level help or how tos | For admins or users etc |
| ? | Direct/indirect should show on policy group | |
| ? | Security model - documentation and UI opportunities - wizard? | |
| ? | Can application owners see reference group? via attributes | |
| On-going | Update third party libraries | Update third party libraries to the latest version |
| On-going | Update training videos | Go through training videos and either keep, re-record, annotate, or delete. Identify new training videos to make |
| On-going | Refine next generation provisioning | Take PSPNG and feedback from the field and add more features, refine it, improve it, etc |
On-going | Grouper Core enhancement | Continue adding capabilities to meet requirements from the field. |
On-going | Solicit and publicize community contributions of extensions and complements to Grouper. | |
Not yet assigned | More provisioning connectors | Add further connectors to reflect specified group, membership, role, and permission information into external systems and services. Include Google provisioning (from the Unicon contribution to the PSPNG) |
Not yet assigned | Scaling REST webservice | A page in the Administration guide, Grouper always available web services and client, demonstrates one way to provide always available services using a specialized client. The CIFER REST web service will need the server-side capability to provide that always-available functionality. In addition the REST API should be able to access multiple, read-only caches so it can efficiently handle any increase in query requests, most of which will not need to directly access the primary database. PSPNG should be able to provision to a database table, and WS should be able to read from that table (or tables) for simple operations. |
| Not yet assigned | Improve grouper startup time | Grouper takes a while to startup in webapp or gsh command line. Some ideas were nailgun for GSH, javassist byte code enhancement with gradle, profiling, making sure grouper starts in webapp before first request. |
...