Grouper Provisioning Plugin
The Grouper Provisioning Plugin provisions groups and memberships in groups to an Internet2 Grouper instance using the Grouper web services interface.
Operations
Registry CO Person Transaction | Grouper Action |
|---|---|
Add | None, provisioning is for CO Group records and memberships only |
Edit | None, provisioning is for CO Group records and memberships only |
Enter Grace Period | None, provisioning is for CO Group records and memberships only |
Expiration / Becomes Inactive | None, provisioning is for CO Group records and memberships only |
Unexpire / Becomes Active | None, provisioning is for CO Group records and memberships only |
Delete | None, provisioning is for CO Group records and memberships only |
Manual Provision | None, provisioning is for CO Group records and memberships only |
Registry CO Group Transaction | Grouper Action |
|---|---|
Add | Provision CO Group record (including memberships) to Grouper |
Edit | Provision CO Group record (including memberships) to Grouper |
Delete | Delete CO Group record (and memberships) to Grouper |
Manual Provision | Provision CO Group record (including memberships) to Grouper |
Provisioning of groups from Registry into Grouper is per CO with all groups for a CO provisioned under a single (configurable) stem or folder in Grouper. All groups in Registry, with the exception of the 'admin' and 'members' groups for COUs, are provisioned directly under the configured stem or folder for the CO. The 'admin' and 'members' groups for COUs are provisioned into a stem or folder hierarchy that mirrors the COU parent-child relationship (if any) in Registry.
A change in the COU hierarchy in Registry, such as changing a parent-child COU relationship or deleting a COU parent, will not be reflected in Grouper. At this time the Grouper web services component does not support moving stems or folders. A request to the Grouper team to implement such a feature for the web services component has been made (CO-1043). We do not recommend changing the COU parent-child relationships once established when using the Grouper Provisioner. Renaming COUs and deleting COUs (with no children or roles) is supported.
If you plan for users to access the Grouper UI and for that access to be managed using COmanage Registry, we recommend you create a CO unique identifier and use it as the expected identifier that the Grouper UI will see and map to subjects (Grouper users).
Configuration
We recommend that before configuring a Grouper Provisioner for a CO you have already enrolled or onboarded at least one user to create a CO Person record with an active status.
We include details for deploying Grouper itself. You may wish to skip some items below if you will be using a Grouper instance that is already deployed.
- Prepare your database for Grouper.
- Prepare Java.
- Prepare Apache HTTP Server.
- Prepare the Tomcat container.
- Prepare for Grouper installation.
- Install Grouper.
- Complete post configuration steps.
- Test the Grouper Shell GSH.
- Test the Grouper UI.
- Test the Grouper WS.
- Grant CREATE VIEW to Registry database user.
- Configure the Grouper Provisioner Plugin.
- Configure Grouper subject source.
- Intial Reconciliation and Testing.
- Configure SSO access to the Grouper UI for users.