Grouper Call of July 5, 2023

Attending 

  • Chris Hyzer, Penn, Chair
  • Vivek Sachdiva, independent
  • Shilen Patel, Duke
  • Chad Redman, Unicon
  • Kellen  Murphy, University of Virginia
  • Brennan Cox, University of Virginia
  • Liam Hoekanga, University of Michigan
  • Gail Lift, University of Michigan
  •  Bert Bee-Lindgren, Georgia Tech
  • Carey Black, Purdue
  • Chris Hubing, Internet2
  • Emily Eisbruch, Independent


Mark your Calendar:

 Internet2 TechEx is Sept. 18-22, 2023 in Minneapolis 


DISCUSSION

Administrivia


Discussion

Base CAMP is Online July 10-14, 2023

  •   both Chris and Chad will present at both Base CAMP Grouper sessions


New Action Items from this call:



Administrivia


Mark your Calendar:

 Internet2 TechEx is Sept. 18-22, 2023 in Minneapolis 

 

Base CAMP is coming up  Online July 10-14

  •   both Chris and Chad will present at both Base CAMP Grouper sessions


Discussion


Release of Grouper 5.2.0.  

There are 2 upgrade steps from 5.2.0

20 Jiras

All fixes in 4.4.0

Add internal id to pit tables - groups/members/fields

Dont validate abac scripts to UI works, will add back later

Fix breadcrumbs for entity data fields

Fix issue with abac queries where the dictionary internal ids are not right

See the release notes: https://spaces.at.internet2.edu/display/Grouper/v5+Release+Notes



 Provisioning framework SCIM2 provisioner at Atlassian cloud

 Here is an example of configuring the provisioning framework for Atlassian (including external system), and some advanced features:

  • Shows how to use the JEXL script editor in the UI
  • Provisions Grouper Local Entities which represent users in Atlassian who are not in your IdP.  Not sure we will do that, but nice to know we can

Below are docs and movies

https://spaces.at.internet2.edu/display/Grouper/Grouper+SCIM2+Atlassian+cloud+provisioner

https://www.youtube.com/watch?v=WrWiFaA3B8w

https://spaces.at.internet2.edu/display/Grouper/Grouper+Atlassian+cloud+SCIM2+external+system

https://youtu.be/u4_2tdX_2-g


  • Mostly this just worked, which was great
  • Can use local entities and assign email addresses and provision
  • Chris opened some JIRAs to improve the way local entities are provisioned
  • Jexl script tester will be helpful, otherwise you need to know the API 


Chris Hyzer updated this page: Grouper ABAC with scripted groups



Rocky Linux plan (Chris Hubing)


Current Work


Vivek

  • Worked on connecting GSH templates w ABAC loader scripts
  • https://spaces.at.internet2.edu/display/Grouper/Grouper+custom+template+via+GSH
  • Template enables creating the ABAC / JEXL script
  • Will not show up in GSH templates dropdown
  • Only shows up if a group is marked as ABAC
  • Select pattern to get list of available patterns
  • Template admin configures
  • WIll make this customizable, explain what attributes are available
  • There will be an analysis screen
  • Question:
  •    Are permissions tied to ability to edit the loader? 
  •   (update on a group)
  •   Or can they be more fine grained? 
  •   UVA use case: Some users should be able to build loader but not to generate a JEXL script (operations team vs engineering team)

  •   AI  Chris Hyzer: will look into permissions around ABAC scripts, making them more fine-grained per UVA use case
  • After the call, Chris Hyzer updated this page: Grouper ABAC with scripted groups



Shilen


  • Worked on this:  GRP-4799
    Add internal id to pit tables - groups/members/fields
  • Mysql install issue, Shilen fixed this
  • Will look at data provider for LDAP for ABAC
  • Currently set up for SQL
  • For LDAP we would ask the user what the LDAP query would be
  • What attributes they want
  • Attribute could be connected to a data field or could be  a packed value
  • Might be a scripted option for packed? 


Chris

  •  Design for Grouper dependency caching
  • https://spaces.at.internet2.edu/display/Grouper/Grouper+dependency+SQL+caching
  • Looking at incremental updates for scripted groups
  • Hope to add tables to track dependencies in Grouper
  • Table for dependency type and table for dependency
  • When someone edits an ABAC script, the logic looks at the dependencies and makes adjustments
  • Matt: deal with English names or internal identifiers?
  • Subject to renames and move object issues
  • Then need to rewrite descriptions
  • Maybe scripted groups should not hold English names, but instead the internal identifiers
  • Then have UI display that shows English name
  • Chris Hyzer: two options: store things as  system name OR use an internal ID
  • We decided last time we discussed this was to store things as the friendly name, to be helpful when people do export or look at it
  • AI Chris will update coding standards  around use of names https://spaces.at.internet2.edu/display/Grouper/Grouper+developers+coding+standards


  • Example of exporting the config
  • Could store things as friendly name and keep track of the friendly name for when we rename things, we do adjustment
  • Right now JEXL scripts can break with renames
  • Dependency table, and rename logic, is helpful
  • Question: owner versus dependent, owner type needs to be clear



Chris worked on various  JIRAs

 

  • Opened Jiras for local entities
  • Issue with Grouper 5 now fixed
  • Breadcrumbs of data field screens were missing entires, fixed now
  • Scripts were validated against group memberships, need better validation, couldn’t use edit screen, now disabled and will be added back later



  • Upgraded Tomcat , new container setting.  



Chad

  • Issue around composites
  • Doesn’t batch
  • AI Chris Hyzer - Fix app is timing out situation raised by Chad 


Issue Roundup 


Jiras in past two weeks


Wiki Updates


Grouper Users Email List

As of July 5, 2023, Emily emailed Mathieu Hetru and Chris Leung suggesting the Grouper Slack channel is the best place to get support





Next Grouper Call: Wed. July 19, 2023 




  • No labels