This info is from Advance CAMP session at 2019 Technology Exchange in New Orleans
https://docs.google.com/document/d/1iLbTbPe0qop0BW7L5nbEpYJY21vrg6I8nNdQMGU2DDk/edit
Also of interest, Grouper automatically managed recent memberships feature added in May 2020: https://spaces.at.internet2.edu/x/2wEOCg
Documentation from University of Nebraska on how to accommodate a 90 day grace period for employees.
This uses a rule through the Grouper UI, which adds a user to another group when their membership removes.
- contact Brett Bieber or Patrick Haugland for more info
Adding removed member to another group with expiration date (grace period group).
*Note these rule only triggers on users who are direct members of the access policy.
- Create a grace period group for your access policy.
- example "app:firefly:P:allows_denies:psc_90d_grace"
- Navigate to the group you wish to add a grace period rule to and click More | Attribute assignments
- example "ref:hr:pa:6700:Employee"
- Click the + Assign Attribute button and add in the following attribute assignment:
- Now click on the actions button to the right of the rule attribute that has been added and select "Add metadata assignment. Do this for each of the following attributes
- etc:attribute:rules:ruleActAsSubjectId
- Set value to "GrouperSystem"
- etc:attribute:rules:ruleActAsSubjectSourceId
- etc:attribute:rules:ruleCheckOwnerName
- Set value to Group ID Path ex "ref:hr:pa:6700:Employee"
- etc:attribute:rules:ruleCheckType
- Set value based on type of membership change
- New member being added "membershipAdd"
- Member being removed "membershipRemove"
- New member in a nested group "flattenedMembershipAdd"
- Member being removed from a nested group "flattenedMembershipRemove"
- etc:attribute:rules:ruleIfOwnerName
- Set value to Group ID Path ex "ref:hr:pa:6700:Employee"
- etc:attribute:rules:ruleThenEl
- Set value to ${ruleElUtils.assignMembershipDisabledDaysForGroupId("groupId", memberId, X, true)}
- Replace groupId with to the UUID of your grace period group
- example: f1453bf852354be9a2a8cc8cfff58c84
- Replace X with the number of days you want them to be in the grace period group.
- The resulting value should look something like.
- ${ruleElUtils.assignMembershipDisabledDaysForGroupId("f1453bf852354be9a2a8cc8cfff58c84", memberId, 90, true)}
*When you're done it should look something like this