Opinion on grouper/shib options

[David Langenberg]

On Sep 4, 2015, at 8:21 AM, O'Dowd, Josh <Josh.O'Dowd at mso.umt.edu<mailto:Josh.O'Dowd at mso.umt.edu>> wrote:

Good Morning,

Our directory/grouper team has finally been made to see the wisdom in setting up a proper OpenLDAP with a Grouper overlay so that we can get seamless provisioning and an accurate member attribute from the directory at authentication.  We currently have a disparate systems which do not work together at all.  In the interim, I have been asked if I can have our shib idp3 make a grouper connection and create a populated member attribute for the authn response.

I see 2 valid options here:
1.        Create a custom connector which hits our Grouper REST endpoint and parse the response into a member attribute.
2.       Use a Grouper MemberDataConnector from the Grouper API.

I would really like to do the latter and while I have found the shibboleth integration docs for MemberDataConnector at https://spaces.internet2.edu/display/Grouper/Grouper+and+Shibboleth+Integration , there is nothing there which describes where the connection configuration happens(i.e, server url, connection properties, etc.).  The other caveat appears to be that I must install the entire Grouper API to use this one DataConnector.  Does that sound right?

Yes, thought note, this method of integration is SLOW (and also doesn't work with v3).  Basically you install Grouper on your IdP (the entire Java API and wire it up to the database, subject sources, etc).  Then you configure the attribute resolver (as soon as you port the DataConnectors to v3).  You'll probably find option 1 easier to implement.

Dave

--
David Langenberg
Identity & Access Management Architect
The University of Chicago



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150904/ce231178/attachment-0001.html>