Deprovisioning features in Grouper allows allow a deprovisioning administrator to see someone's access and instantly remove it. It would
Grouper will also help notify application administrators where grouper Grouper is not the system of record or where manual deprovisioning is preferred.
The Grouper UI has screens for Here are workflows around configuring and using deprovisioning.
################################### ## Deprovisioning ################################### # if deprovisioning should be enabled deprovisioning.enable = true # comma separated realms for deprovisioning e.g. employee, student, etc # these need to be alphanumeric suitable for properties keys for further config or for group extensions deprovisioning.realms = # Group name of the group that identifies generally if an entity is # in this realm. So if a group is deprovisioned # by various realms, then only deprovision if the entity in the group # is not in any realm eligible group. # e.g. VPN is deprovisioned by realms employee and student. If the person # is no longer an employee, but is still # a student, then dont deprovision. # deprovisioning.realm_<realmName>.groupNameMeansInRealm = a:b:c # deprovisioning.realm_employee.groupNameMeansInRealm = community:employee # folder where system objects are for deprovisioning # e.g. managersWhoCanDeprovision_<realmName> # e.g. usersWhoHaveBeenDeprovisioned_<realmName> deprovisioning.systemFolder = $$grouper.rootStemForBuiltinObjects$$:deprovisioning # autocreate the deprovisioning groups deprovisioning.autocreate.groups = true # users in this group who are admins of a realm but who are not Grouper SysAdmins, will be # able to deprovision from all grouper groups/objects, not just groups they have access to UPDATE/ADMIN deprovisioning.admin.group = $$deprovisioning.systemFolder$$:deprovisioningAdmins # number of days in deproivisioning group. Should be the amount of time for systems of record to catch up and # for people to change external systems of record in manual processes deprovisioning.defaultNumberOfDaysInDeprovisioningGroup = 14 #number of groups shown in the body of deprovisioning email deprovisioning.email.group.count = 100 #deprovisioning reminder email subject deprovisioning.reminder.email.subject = You have $groupCount$ groups that have suggested users to be deprovisioned #deprovisioning reminder email body (links and groups are added dynamically) deprovisioning.reminder.email.body = You need to review the memberships of the following groups. Review the memberships of each group and click: More actions -> Deprovisioning -> Members of this group have been reviewed deprovisioning.reminder.email.body.greaterThan100 = There are $remaining$ more groups to be reviewed.
Identify the deprovisioning managers and add them to the managers group. e.g. if your grouper.rootStemForBuiltinObjects is "etc", and your deprovisioning realm is "employee", then the group would be:
See the users who have been deprovisioned
Use the menu to deprovision a user
Search for a user to deprovision
Search results show the right subject sources
See the user's access, add some notes, and deprovision them
The deprovisioning attribute is assignable to memberships, groups, and folders. This is a single-assign marker attribute. The rest are assigned on that attribute assignment. Note: not all attributes are used for each type of owner (group/folder/membership)
If allows adds to group of people who are deprovisioned
can be: blank, true, or false. If blank, then will not allow adds unless auto change loader is false
If this is a loader job, if being in a deprovisioned group means the user should not be in the loaded group.
can be: blank (true), or false (false)
If the deprovisioning screen should autoselect this object as an object to deprovision
can be: blank, true, or false. If blank, then will autoselect unless deprovisioningAutoChangeLoader is false
If deprovisioning configuration is directly assigned to the group or folder or inherited from parent
Email addresses to send deprovisioning messages.
If blank, then send to group managers, or comma separated email addresses (mutually exclusive with deprovisioningMailToGroup)
Group ID which holds people to email members of that group to send deprovisioning messages (mutually exclusive with deprovisioningEmailAddresses)
If this is true, then send an email about the deprovisioning event. If the assignments were removed, then give a description of the action. If assignments were not removed, then remind the managers to unassign. Can be <blank>, true, or false. Defaults to false unless the assignments were not removed.
If the deprovisioning screen should show this object if the user as an assignment.
can be: blank, true, or false. If blank, will default to true unless auto change loader is false.
Add in a last reviewed date similar to attestation. Only send emails if the date the user was added to the deprovisioned group is after the last reviewed date
Do not allow assignments by WS of deprovisioned users to deprovisionable objects by realm. Allow a param to override this
Allow global deprovision across realms or if no realm specified. Or document how to do this
- Users of this screen would need to be in a certain group. Grouper admins would also be allowed to use this page
- Note: users of this screen would effectively have a lot of access in grouper. They can pull up any subjects and see what they have. They can remove most things. But they do not have to be Grouper admins. This screen could be used by an HR person.
- This screen could be disabled if an institution does not want it.
- The screen would have a subject lookup for someone to be deprovisioned
- When submitting that combobox, all the assignments in grouper would display, as well as deprovisioned status
- A button "Deprovision user and remove access" adds the user to a built-in group for people who will be deprovisioned.
- This group has a membership expiry for a certain configured amount of time (2 weeks is the default)
- This group can be used in "exclude" groups or rules in grouper for lockouts
- Note, some institutions might already have this "lockout" group
- Assignments on screen will include direct memberships, privileges, and attribute assignments
- Note, permissions are assigned on roles or memebrships in roles so those would not be shown but they would be removed
- The screen will have checkbox about assignments to deprovision
- There could be a way to see effective as well as immediate assignments, though it will default to immediate (ones you can deprovision)
- There is a "check all" and "uncheck all" button
- An "unassign" button will remove all those assignments
- Also adds the user to the deprovisioning group with end date on membership of 2 weeks
- Assignments are in point in time so they can be restored later or migrated to another user
- Groups and folders have attributes related to deprovisioning
- Mark a group or folder as ineligible for deprovisioning (e.g. the lockout group)
- If Grouper is not the system of record for a group, mark a group or folder with attributes so that emails are sent out to application owners to deprovision that user. This would not remove the assignment in grouper because in this case grouper is not the source of the assignment but instead reflects it in another system. The receiver of the email would need to unassign the user and that data would flow back to grouper ater the next load
- e.g. an attribute to say "deprovision_notify_app_owner", an attribute "deprovision_notify_app_owner_email", attribute "deprovision_notify_app_owner_email_subject", "deprovision_notify_app_owner_email_body"
- Attribute keep track of when last emailed so users dont get emailed more than once a day
- There is feature in loader jobs to not load deprovisioned users (without having to adjust the query). Of course loader jobs could be exempt from this if they need deprovisioned users inside. The default would be to not include them
- There is an overall audit and then keep individual audits
- Daemon will send emails to application owners on users to deprovision. Will send one email with batch of users to deprovision
- Screen for app owners to see who they should look at
- There is a report of deprovisioned users and assignments they still have access to so that followups can be made after a week or two to make sure everything is removed for that user that should be
- There could be a report of inactive users and things they are still assigned to to clean out users who left the institution long ago
- If messaging queues are configured, messages will be sent to deprovision a user
- If someone adds a deprovioned (for 2 weeks) user to a group or privilege or permission, then they will get a warning that the user has been deprovisioned...
- Application managers could run membership reports to see which users have been deprovisioned (ever), or which users are not active, not active staff, etc
- If the entitlements arent known in grouper, have it make a group, rule that adds a user to another group, which notifies someone to see entitlements need to be removed, and remove the user from the group
Blog on Grouper Deprovisioning with Grouper 2.4 (September 2018)