Opinion on grouper/shib options

[O'Dowd, Josh]

Thanks David,

I don't mind writing an extension.  It is well documented for IDPv2.x.  I am assuming the extension instructions at https://wiki.shibboleth.net/confluence/display/SHIB2/IdPDevExtDataCtr can be applied to v3 because I haven't seen anything to indicate otherwise.  I already have a package we have used in the past for using GrouperWS API to connect to the REST service and parse the response into groups.  This seems a lot cleaner than installing Grouper on the IDP, and will be easier to back out once our directory/grouper backend is properly configured.  Thanks for the input, guys.

-Josh

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of David Langenberg
Sent: Friday, September 04, 2015 9:01 AM
To: Shib Users
Subject: Re: Opinion on grouper/shib options


On Sep 4, 2015, at 8:21 AM, O'Dowd, Josh <Josh.O'Dowd at mso.umt.edu<mailto:Josh.O'Dowd at mso.umt.edu>> wrote:

Good Morning,

Our directory/grouper team has finally been made to see the wisdom in setting up a proper OpenLDAP with a Grouper overlay so that we can get seamless provisioning and an accurate member attribute from the directory at authentication.  We currently have a disparate systems which do not work together at all.  In the interim, I have been asked if I can have our shib idp3 make a grouper connection and create a populated member attribute for the authn response.

I see 2 valid options here:
1.        Create a custom connector which hits our Grouper REST endpoint and parse the response into a member attribute.
2.       Use a Grouper MemberDataConnector from the Grouper API.

I would really like to do the latter and while I have found the shibboleth integration docs for MemberDataConnector at https://spaces.internet2.edu/display/Grouper/Grouper+and+Shibboleth+Integration , there is nothing there which describes where the connection configuration happens(i.e, server url, connection properties, etc.).  The other caveat appears to be that I must install the entire Grouper API to use this one DataConnector.  Does that sound right?

Yes, thought note, this method of integration is SLOW (and also doesn't work with v3).  Basically you install Grouper on your IdP (the entire Java API and wire it up to the database, subject sources, etc).  Then you configure the attribute resolver (as soon as you port the DataConnectors to v3).  You'll probably find option 1 easier to implement.

Dave

--
David Langenberg
Identity & Access Management Architect
The University of Chicago



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150904/9140479e/attachment.html>