Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

This is a design document for deprovisioning support in Grouper.  Comments welcome.

Deprovisioning in Grouper allows a deprovisioning administrator to see someone's access and instantly remove it.  It would also help notify application administrators where grouper is not the system of record or where manual deprovisioning is preferred.

The Grouper UI has screens for deprovisioning. 

...

Code Block
###################################
## Deprovisioning
###################################

# if deprovisioning should be enabled
deprovisioning.enable = true

# group that users who are allowed to deprovision other users are in
deprovisioning.managers.must.be.in.group comma separated realms for deprovisioning e.g. employee, student, etc
# these need to be alphanumeric suitable for properties keys for further config or for group extensions
deprovisioning.realms = 

# folder where system objects are for deprovisioning
# e.g. managersWhoCanDeprovision_<realmName>
# e.g. deprovisioning:usersWhoHaveBeenDeprovisioned_<realmName>
deprovisioning.systemFolder = $$grouper.rootStemForBuiltinObjects$$:deprovisioning:managersWhoCanDeprovision

# autocreate the deprovisioning groups
deprovisioning.autocreate.groups = true

# number of days in deproivisioning group that deprovisioned users go in (temporarily, but history will always be there)
deprovisioning.group.which.has.been.deprovisioned = $$grouper.rootStemForBuiltinObjects$$:deprovisioning:usersWhoHaveBeenDeprovisioned

# autocreate the deprovisioning groups
deprovisioning.autocreate.groups = true.  Should be the amount of time for systems of record to catch up and
# for people to change external systems of record in manual processes
deprovisioning.defaultNumberOfDaysInDeprovisioningGroup = 14

#number of groups shown in the body of deprovisioning email
deprovisioning.email.group.count = 100

#deprovisioning reminder email subject
deprovisioning.reminder.email.subject = You have $groupCount$ groups that have suggested users to be deprovisioned

#deprovisioning reminder email body (links and groups are added dynamically)
deprovisioning.reminder.email.body = You need to review the memberships of the following groups.  Review the memberships of each group and click: More actions -> Deprovisioning -> Members of this group have been reviewed
deprovisioning.reminder.email.body.greaterThan100 = There are $remaining$ more groups to be reviewed.

Deprovisioning managers

Identify the deprovisioning managers and add them to the "deprovisioning. managers group.must  e.beg. in.group", aka: <yourEtcPrefixHere>if your grouper.rootStemForBuiltinObjects is "etc", and your deprovisioning realm is "employee", then the group would be:

Code Block
etc:deprovisioning:managersWhoCanDeprovision_employee

 

Deprovisioning screens


See the users who have been deprovisioned

...