Access Management with Grouper Tom Barton University of Chicago

Why? Lower cost by factoring access management out Simplify & make consistent by using one group in many places Let the right people manage access, directly See who can access what, in one place 2

Grouper: core concepts 3 Folders in hierarchies Group Direct members Subgroup Indirect members Composite groups Custom attributes

Security & delegation 4 Create groups Create subfolders Admin Update membership Read membership View group Opt-in Opt-out Delegation

5 Grouper integration

EXAMPLES 6

7

dn: uid=tbarton,ou=people,dc=uchicago,dc=edu ucismemberof: uc:org:nsit:integration:techag ucismemberof: uc:org:nsit:srdirs ucismemberof: uc:org:nsit:integration:iteco:wr ucismemberof: uc:applications:confluence:NSIT:esx ucismemberof: uc:org:nsit:integration:iteco:rd ucismemberof: uc:applications:confluence:NSIT:Directors ucismemberof: uc:org:nsit:staff ucismemberof: uc:applications:confluence:NSIT:Everyone ucismemberof: uc:org:nsit:integration:shib_group ucismemberof: uc:applications:bulkmail:users ucismemberof: uc:org:library:gnet:admins ucismemberof: uc:applications:gnetid:admins ucismemberof: uc:applications:wireless:authorized ucismemberof: uc:applications:cmail:users:authorized ucismemberof: uc:reference:affiliations:effective:staff LDAP entry for uid=tbarton,ou=people,dc=uchicago,dc=edu ucIsMemberOf : uc:org:nsit:srdirs ucIsMemberOf : uc:reference:affiliations:effective:staff Memberships become LDAP attributes 8 ucIsMemberOf : uc:applications:vpn:authorized

U Chicago: simple delegation Wireless & VPN Guest network ID management Business Objects access Different groups, different authorities 9 eligibleunauthorized student staff alumhospital closure locked authorized postdoc = ̶

Brown: Managing Access to Course Resources MACE Grouper Course Groups iTunesMajordomoConfluenceWebCT All Recipient list, Discussion SenderCan Use AdministratorInstructorBroadcast SenderSpace Admin Instructors (provisioned) Instructor Managers TAs TA and Designer ContributorInstructor Space Admin Content Developers Designer Mentors LearnerStudent Auditors Auditor Students (provisioned, read only) Student Vagabonds Auditor Other, outside MACE GrouperSuper Admin Super Admin(s)

11

12 NIH’s Cancer BioInformatics Grid

NEW IN V1.5.0 Just released … some capabilities are partial or “experimental” 13

Lite UI AJAX components for simple end-user tasks URL links directly to a group Integrated within Grouper UI webapp Two entry points: Admin UI & Lite UI Admin UI uses new components too More Lite UIs may be contributed by deployers 14

Performance 15

Audit Who did what when … Add/delete/update membership, group, folder, and Grouper privileges Attribute definition & assignment XML import Move/copy group or folder Audit reporting via Grouper Admin UI & Grouper Shell 16

Move & copy Copy/move groups/folders to another folder Why? Template groups & template folders Update organizational hierarchies Old group name optionally continues to refer to moved group Supported by Grouper Admin UI & Grouper Shell (Grouper-WS soon) 17

Notification Near real time provisioning of group info Group, membership, folder, and privilege changes Serialized Provided to registered consumers SQL & API access to transactions LDAP provisioning connector will use in v

Attribute framework Assign custom attributes to principal Grouper objects Groups Folders Memberships Attributes Will have several value types, multi-values, etc Only an enumerated type in Attributes are objects in folders, like groups, and their security model is similar to that of groups 19

Roles & permissions Role extends Group, links Subjects with Permissions Permission is a type of attribute assigned to a role or to a membership in a role Has an Action qualifier, eg, Read or Write Permission sets. Eg, organizational hierarchies Superior roles inherit subordinate permissions 20

Grouper & Identity Services Grouper’s roles & permissions are only low level capabilities, initially No high level interfaces have been implemented or even defined yet Looking for help with that from MACE- Paccman and from partner sites More later in this conference about Grouper and identity service interfaces in Kuali and in uPortal 21

Grouper roadmap Current version is v1.5+ Notification enhancements Attribute & permission enhancements New LDAPPC = shibboleth AA + SPMLv2 v1.6 Point-in-time audit Role management interface uPortal integration Kuali Rice integration 22

23

24

MACE/Internet2 IAM work Shibboleth InCommon Federation Grouper Comanage Identity services & application domestication Privilege & access management MACE-paccman working group !Signet Grouper to add some privilege management capability MACE-directories working group edu* schema, white papers, etc 25

Identity services activities & Higher Ed MACE-paccman working group Kuali Rice OSS projects, some JA-SIG affiliated Liberty, Identity Gang, etc International efforts akin to MACE’s Advanced CAMP June 2009 in Philly 26