Grouper Call of Nov. 22, 2023

Attending 

  • Chris Hyzer, Penn, Chair
  • Shilen Patel, Duke
  • Chad Redmond, Unicon
  • Jim Beard , Unicon
  • Vivek Sachdiva, independent
  • Bert Bee Lindgren, GA Tech
  • Gail Lift, Univ of Michigan
  • Daniel Fisher, Virginia Tech
  • Chris Hubing, Internet2
  • Emily Eisbruch, Independent, scribe


Administrivia


New Action Items from this call 

  •   Vivek  - add the version to which this applies to on the Migrate from json-lib to jackson wiki documentation=
  •  Chris Hyzer and Shilen -  discuss next steps on instrumentation data

Current Work

 Vivek

  • Worked on Migrate from json-lib to jackson
  • Converting from  JSON-lib to Jackson and back
  • Goal is move to Jackson
  • During testing we found some issues
  • It is suggested to have option for users to still use Json-Lib
  • Now there’s a property you can set true or false
  • By default, use Jackson, Jackson is faster
  • The two approaches are similar, but Jackson will go through the object model and figure out what it's going to do. Then the work is fast.  
  • JSON-lib is dynamic and performance issues
  • Chad has scripts using json-lib, would prefer to use Jackson
  • AI , Vivek will  add the version this applies to on the Migrate from json-lib to jackson documentation

  • LDAP list of groups from attributes and list  in loader - that work is done
  • Default setting is put groups next to where loader job is configured
  • And you specify a folder that exists, it will use that
  • For a new loader  job with an absolute path, you can put it anywhere in the registry
  • In some future version, change the default perhaps
  • Best of both worlds, can use the default and you can also put things where you want



  • Vivek worked on GRP-5082 ldap loader LDAP_GROUPS_FROM_ATTRIBUTES should allow specifying parent stem

  • Chris showed  the Group edit screen
  • If you have admin you can edit attestation on a group
  • Can do customization
  • By default, environment is not shown


Shilen

  • Ldap  
  • Found several things to adjust; these are fixed
  • Doing queries against API, there were errors
  • Needed changes on normalization
  • Old code was ignoring certain errors
  • Code was not handling moving objects in provisioners
  • Pools weren’t being pulled properly, causing many error messages
  •   Question:  Do we need unbound ID unit tests?
  •   Shilen : don’t know, will take a look, see pull requests Daniel did
  • Shilen also made changes to data provider in V5
  • Now it compares data stamps
  • It makes sure incremental stuff is not older than last pull for that data provider
  • Next for Shilen: integrating GSH templates for data provider





  • Dan: this merge went well
  • Shilen ran tests, there were just a few issues found and fixed
  •  Unbound ID for test scope is needed
  • Added a dependency to run unit tests around ldaptive session class
  • Can get rid of that dependency if needed
  • Ldaptive in v5 is snapshot
  • That will get fixed with next release
  • Helps in fixing bug
  • Chris hopes to release a new Grouper v5
  • Dependency on snapshot ….
  • Dan will notify Chris Hyzer on Slack when ready for next steps, in addition to doing a Pull Request


At Penn, wanted to move to more Duo native

  • Chris - there are 2 step users
  • Used for policies
  • Sync from Duo to database table to see if you are enrolled
  • Now Salepoint is managing that, it is provisioning the enrolled in 2 step role
  • Question of what needs to be in a transaction
  • Permission groups
  • Issue of adding a person to a group
  • User expectation issue
  • User hits save but then must get feedback, so there are not wrong assumptions
  • Close the loop so user can verify, Bob was added to group and it was fully effective as of this time

Chris 

  • Chris worked on Group edit screen



Memory issue

  • U. Michigan found memory change 4.5 to 4.8 . See JIRA 4950, but different conditions.
  • Michigan can provide logs
  • Running out of Java memory
  • Connection pool errors
  • When stagger the provisioning runs
  • Could be a setting 
  • Chris suggests this may be fixed in Grouper 4.9
  • Suggestion: look at connection pooling
  • But that might not explain the memory issue


Chad

    • Unicon has Authentication plug in
    • JJ has a web app for unit testing

JJ  has raised issues:

  • Folder/Directory names
    • Non standard folder names for sources
    • Makes it challenging for grouper beginners 
    • Structure was decided many years ago 
    • Hope to  be as consistent as possible
    • Consistency with Shib model?
    • Issue with tracking java file
    • Chad created a branch with greater consistency

    • Nice to have authentication in the UI built-in
    • Gail: did not notice the Grouper source code was not Maven standard
    • We will change build scripts
    • Biggest challenge will be different file locations and tracking file history
    • Question: Better to do this change of folder names on a major Grouper version change?
    • Chris Hyzer: not really, originally that was the plan, but when we compare with another branch, we want comparisons to work.  


  • Container
    • Issue is that it is hard to built container since it builds from an installer
    • Suggestion from Chad: get rid of installer and use script
    • Installer is  used only for build script
    • Installer has been taken out of training
    • Scripts in container, if we need to do something, we have it
    • Chris does not like using the Docker commands, too many layers
    • Problem: if you want to change script, you must build Grouper to Maven
    • And then you must release it
    • Or change Docker file to use local Grouper, which is faking it
    • Decision: Chris Hyzer is OK with this plan to move away from the Grouper Installer in favor of script

  • Grouper Client
    • client is intended to be standalone Jar, can be run on command line without dependencies
    • Like that model, without dependencies
    • Maven packaging can do that
    • We have extra stuff
    • Jackson, refactor
    • Tried shade plug in from Maven

  • Next Steps
    • Chad will handle client first
    • then build script
    • then change directory names

    • Good to move authentication into Grouper -Misc
    • Get JAR published in maven
    • Should be in plug-ins directory
    • Documentation - we need a wiki about this
    • Properties set in Grouper config files should be in the base
    • Grouper web app….
    • Snapshot issue
    • Docker would get from local maven
    • Built for releases, they are on Maven Central
    • Talk to Maven to get snapshots, or Bert can tell how it’s done


Grouper Training 

 

Issue Roundup 


Jiras in past two weeks


Grouper Emails in past two weeks



Grouper wiki updates in past two weeks



 Next Grouper Call: Wed., Dec. 6, 2023

  • No labels