Opinion on grouper/shib options

[O'Dowd, Josh]

Good Morning,

Our directory/grouper team has finally been made to see the wisdom in setting up a proper OpenLDAP with a Grouper overlay so that we can get seamless provisioning and an accurate member attribute from the directory at authentication.  We currently have a disparate systems which do not work together at all.  In the interim, I have been asked if I can have our shib idp3 make a grouper connection and create a populated member attribute for the authn response.

I see 2 valid options here:

1.        Create a custom connector which hits our Grouper REST endpoint and parse the response into a member attribute.

2.       Use a Grouper MemberDataConnector from the Grouper API.

I would really like to do the latter and while I have found the shibboleth integration docs for MemberDataConnector at https://spaces.internet2.edu/display/Grouper/Grouper+and+Shibboleth+Integration , there is nothing there which describes where the connection configuration happens(i.e, server url, connection properties, etc.).  The other caveat appears to be that I must install the entire Grouper API to use this one DataConnector.  Does that sound right?

Any opinions or guidance is much appreciated.

Josh O'Dowd
Software Systems Analyst / Developer
University of Montana, IT Central
(406)243-6283

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150904/555050ca/attachment.html>