1. © 2006 The University of Chicago Grouper Backgrounder for Authorization WG Tom Barton, U Chicago

2. caBIG AuthZ WG17 July 20062 Functional Highlights  Group management capabilities  Basic group & membership management  Subgroups  Composite groups (union, intersection, complement)  Distributed authorities  Delegation of authority  Custom group types & attributes  Indirect membership traceback  Grouper is a management tool  Maintains group data & metadata in an RDBMS  Can manage any object presented to it as a “subject”

3. caBIG AuthZ WG17 July 20063 Components & Requisites  Components  Java API  Java UI (extremely mutable)  XML import/export tool  Command line shell  Infrastructure requisites  Hibernate for object persistence (supports most RDBMS’s)  Subject API for integration with identity sources  UI: Servlet API v2.3 REMOTE_USER or internal authN hook  Tarballs  API  UI  QuickStart package includes tomcat, database, identity source, etc

4. caBIG AuthZ WG17 July 20064 Privilege Model & Attribute Management  Per-group privileges  ADMIN, UPDATE, READ, VIEW, OPTIN, OPTOUT  Groups ↔ Attributes duality  Groups are lists of members  Members belong to a list of groups  Group names are attribute values of member objects  Grouper also manages Naming Stems  URN names and delegation of naming authority  Groups are named within a URN prefix = “naming stem”  Per-naming stem privileges  CREATE – can create groups with this naming stem  STEM – Create subordinate stems, assign CREATE priv  Privilegees are lists of “subjects”  So, group management capabilities apply to managing privileges

5. caBIG AuthZ WG17 July 20065 Subject API

6. caBIG AuthZ WG17 July 20066 Generic Integration Architecture

7. caBIG AuthZ WG17 July 20067 Status, Links  Grouper v1.0 RC1 released July 12  Grouper v1.0 to be released July 20-21  Grouper Wiki Grouper Wiki  Docs  Code  Product, project, & community support  Almost a complete solution. Lacking:  Near-real-time provisioning U Chicago, others will have JNDI provisioner “real soon now”  WS or other run-time query interfaces Cornell AXIS-based prototype  Roadmap  Aging of groups & memberships (v1.1)  Change notification (v1.1+)

8. caBIG AuthZ WG17 July 20068 Possible Q&A Areas  Run-time group query service  Systems integration  Federations, VOs, widely distributed authorities  Proxy IdPs, Service Centers