<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Sep 4, 2015, at 8:21 AM, O'Dowd, Josh <<a href="mailto:Josh.O'Dowd@mso.umt.edu" class="">Josh.O'Dowd@mso.umt.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
Good Morning,<o:p class=""></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<o:p class=""> </o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
Our directory/grouper team has finally been made to see the wisdom in setting up a proper OpenLDAP with a Grouper overlay so that we can get seamless provisioning and an accurate member attribute from the directory at authentication. We currently have a disparate
systems which do not work together at all. In the interim, I have been asked if I can have our shib idp3 make a grouper connection and create a populated member attribute for the authn response.<o:p class=""></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<o:p class=""> </o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
I see 2 valid options here:<o:p class=""></o:p></div>
<div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: -0.25in;" class="">
<span class="">1.<span style="font-style: normal; font-variant: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span> Create a custom connector
which hits our Grouper REST endpoint and parse the response into a member attribute.<o:p class=""></o:p></div>
<div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: -0.25in;" class="">
<span class="">2.<span style="font-style: normal; font-variant: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span>Use a Grouper MemberDataConnector
from the Grouper API.<o:p class=""></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<o:p class=""> </o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
I would really like to do the latter and while I have found the shibboleth integration docs for MemberDataConnector at<span class="Apple-converted-space"> </span><a href="https://spaces.internet2.edu/display/Grouper/Grouper+and+Shibboleth+Integration" style="color: purple; text-decoration: underline;" class="">https://spaces.internet2.edu/display/Grouper/Grouper+and+Shibboleth+Integration</a><span class="Apple-converted-space"> </span>,
there is nothing there which describes where the connection configuration happens(i.e, server url, connection properties, etc.). The other caveat appears to be that I must install the entire Grouper API to use this one DataConnector. Does that sound right?</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>Yes, thought note, this method of integration is SLOW (and also doesn't work with v3). Basically you install Grouper on your IdP (the entire Java API and wire it up to the database, subject sources, etc). Then you configure the attribute resolver (as
soon as you port the DataConnectors to v3). You'll probably find option 1 easier to implement.</div>
<div><br class="">
</div>
<div>Dave</div>
<div><br class="">
</div>
</div>
<div class="">
<div class="">--<br class="">
David Langenberg<br class="">
Identity & Access Management Architect<br class="">
The University of Chicago<br class="">
</div>
<div class=""><br class="">
</div>
<br class="Apple-interchange-newline">
</div>
<br class="">
</body>
</html>