TI.25.1 TIERGrouper Deployment Guide
TI.25.1-TIERGrouperDeploymentGuide
User Manual:
Open the PDF directly: View PDF 
.
Page Count: 42
| Download | |
| Open PDF In Browser | View PDF |
TIER Grouper Deployment Guide
Version 1.0 2017-04-21
Repository ID: TI.25.1
Authors: James Babb
Tom Dopirak
Bill Thompson, Editor
TIER API and Entity Registry WG
Grouper Development Team
Sponsor: Internet2
Superseded documents: (none)
Proposed future review date: April 2018
Subject tags: Grouper, access management, authorization, access control, access control
model, access control policy
© 2017 Internet2
This work is licensed under a Creative Commons Attribution 4.0 International License.
Table of Contents
1 Executive Summary
2 Introduction
2.1 Purpose and Scope
2.2 Audience
2.3 Document Structure
2.4 Notes on Terminology
3 Understanding Grouper
3.1 Folders, Groups, and Membership
3.2 Composite Groups
3.3 Folder and Group Privileges
3.4 Grouper Daemon and Loader Jobs
4 Installing Grouper
4.1 Before You Begin
4.2 Grouper Installer
4.3 Install gsh Wrapper
4.3.1 Install Groovy
4.3.2 Install Shell Wrappers for Grouper
4.4 Configure the Grouper API
4.5 Configure the Subject API
4.6 Verify Source Adapter Configuration
4.7 Grouper UI Authentication
4.8 Grouper WS Authentication and Authorization
4.9 Grouper Daemon
4.10 Grouper Loader
4.10.1 SIMPLE_SQL Loader Jobs
4.10.2 SQL_GROUP_LIST Loader Jobs
4.10.3 LDAP Loader Jobs
5 TIER Folder and Group Design
5.1 Group Definitions
5.1.1 Basis Groups
5.1.2 Reference Groups
5.1.3 Access Policy Groups
5.1.4 Account Policy Groups
5.2 TIER Standard Folder Set and Pattern
5.2.1 etc:
5.2.2 basis:
TIER Grouper Deployment Guide
Version 1.0 2017-04-21
Page 1
5.2.3 ref:
5.2.4 bundle:
5.2.5 app:
5.2.6 org:
5.2.7 test:
6 Access Control Models
6.1 Access Control Model 1 - Grouper Subject Attributes
6.2 Access Control Model 2 - Grouper as PAP and PDP
6.3 Access Control Model 3 - RBAC User to Role Mapping
6.4 Access Control Model 4 - WebSSO Short-circuit
6.5 Distributed Access Control Management
6.6 Application Permissions Management - RBAC with Grouper
7 Provisioning Models
8 Operational Considerations
9 Conclusion
Appendix A - Example Access Policies
Example Access Policy 1 - Computing Lab
Example Access Policy 2 - Access to Online Course Material
Appendix B - Acknowledgements
TIER Grouper Deployment Guide
Version 1.0 2017-04-21
Page 2
List of Figures
Figure 1: University of Chicago VPN Access Policy
Figure 2: Enterprise Access Management with Grouper
Figure 3: Group and Folder Structure
Figure 4: Grouper Privileges and Delegation
Figure 5: Grouper Loader Jobs
Figure 6: Bundle Group in Access Policy
Figure 7: Access Control Model 1 - Grouper Subject Attributes
Figure 8: Access Control Model 2 - Grouper as PAP and PDP
Figure 9: Access Control Model 3 - RBAC User to Role Mapping
Figure 10: Access Control Model 4 - WebSSO Short-circuit
TIER Grouper Deployment Guide
Version 1.0 2017-04-21
Page 3
1 Executive Summary
“It’s not just about SAML federation, it’s about enabling high-value collaboration across thousands of
disciplines and millions of people. Hence agreement on attribute and authorization management, application
integration, administration procedures, workflow, privacy management, ...” - RL ‘Bob’ Morgan
Access management capabilities in higher education and research by and large continue to be
a mix of institutional specific custom solutions, whether they are built on in-house frameworks,
proprietary closed-source “solutions”, or open source toolkits like Grouper.
What if instead of every institution having its own special sauce there was broad agreement on
access management strategies, vocabulary, and assumed capabilities? What if, we could drive
“federation” deeper into institutional identity and access management (IAM) practices and more
easily enable high-value collaboration across thousands of disciplines and millions of people?
Grouper provides a common toolkit for group management and access control governance that
is well suited to the needs of the TIER community. The project maintains documentation and
training materials on the Grouper wiki mostly in the form of administration guides, community
contributions, and training videos. These materials do a very good job of providing reference
materials, and a variety of deployment and use case examples. However, for the uninitiated it is
not always clear where to start and how to stay on the right path. Additionally, many
configuration choices and deployment options are left for the deployer to decide. This has led to
deployments which have tended towards similar functionality, but often diverge considerably in
approach, terminology and implementation.
This deployment guide distills a variety of community practices represented in group and folder
design ideas and the various deployment examples in community contributions into a TIER
community approved approach. Harmonizing Grouper deployments with common practice,
vocabulary and IAM strategies will make it easier for the community to work together toward
common objectives and improve Grouper more quickly over time. It will also enable new and
existing Grouper deployments to more easily benefit from community experience, achieve IAM
goals more quickly, and work together to build a robust TIER based IAM practice.
The goal of this document is to help you come up to speed on Grouper concepts, how they
relate to identity and access management, and how they can be deployed to implement
effective access control in a wide variety of situations.
TIER Grouper Deployment Guide
Version 1.0 2017-04-21
Page 4
2 Introduction
A TIER based enterprise identity and access management program deploys Grouper as a
strategic component of its institutional role and access management solution. Grouper is at the
center of all group-like (e.g. institutional role, access control list, service eligibility, distribution
list) management activities.
Grouper can be employed in a variety of flexible access control models, but the underlying
approach follows a consistent path. Natural language access management policy drives
requirements which help to identify and define institutional cohorts (types of students, types of
employees, types of visitors/guests, etc.). Institutional cohorts are then turned into reference
groups which are used in the digital access policy definition. Access to systems is then
automatically kept in sync with policy as subject attributes change in underlying systems of
record (ERP, SIS, etc). This provides streamlined and automated access for existing and future
applications.
NIST 800-162 defines attribute-based access control (ABAC) as, “an access control
methodology where authorization to perform a set of operations is determined by evaluating
attributes associated with subject, object, requested operations, and in some cases environment
conditions against policy.” Access policy driven by institutional meaningful cohorts and kept up
to date automatically provides one of the primary benefits of an attribute-based access control
system. This is described in NIST 800-162 as “accommodating the external (unanticipated
user)”, meaning the system can handle users it has never seen before since access policy is
based on subject attributes instead of static access control lists or subject to role mappings.
2.1 Purpose and Scope
“...some additional scaffolding in the form of configurations and conventions based on successful models at
other campuses would accelerate an adopting campus's path to rolling out actual services.” - Warren Curry
This deployment guide aims to make it easier for new deployers to understand Grouper,
complete an initial deployment, and implement access management capabilities based on
common practice and terminology.
The guide focuses on using Grouper primarily for achieving access management governance
leveraging a subset of Grouper primitives and features. Additionally, Grouper has the ability to
manage fine-grained application level permissions, and while those are mostly out of scope for
this guide, the access management governance approach described here could be leveraged
when incorporating those features.
TIER Grouper Deployment Guide
Version 1.0 2017-04-21
Page 5
2.2 Audience
This guide is targeted at both technical staff and managers responsible for identity and access
management who are seeking detailed deployment and operational information on a TIER
compatible Grouper deployment.
Readers should be familiar with identity and access management concepts and terminology as
defined by NIST 800-162 ABAC, the Grouper glossary, and Grouper UI terminology. Readers
completely new to Grouper would also benefit from reviewing the video Intro to Grouper Pt. 1/3:
Access Management & Grouper.
2.3 Document Structure
This rest of the deployment guide is organized as follows:
● Section 3 Understanding Grouper provides a basic understanding of Grouper and how it
relates to TIER.
● Section 4 Installing Grouper provides a high-level overview of the major steps required to
install Grouper.
● Section 5 TIER Folder and Group Design defines a variety of group types and purposes,
and a recommended initial folder and group organization.
● Section 6 Access Control Models describes how TIER and Grouper components come
together to achieve access management capabilities.
● Section 7 Provisioning Models discuss provisioning models and strategies.
● Section 8 Operational Considerations provides pointers and tips on operating Grouper in
production.
● Section 9 concludes the document.
● Appendix A provides example access policies.
● Appendix B provides acknowledgments.
The guide relies on the Grouper wiki to provide current technical details and version specific
information.
2.4 Notes on Terminology
This document builds on and makes use of the NIST 800-162 ABAC terminology as the base for
IAM level concepts and borrows Grouper product specific terminology from the Grouper
glossary and Grouper UI terminology. When first exposed to Grouper, there is a tendency to
view everything as a “group”. This document adopts the following terminology to distinguish
Grouper primitives (e.g. “groups”) from TIER/IAM level concepts.
Tip: Make sure you read NIST 800-162 at least three times before moving forward. Really, do it!
TIER Grouper Deployment Guide
Version 1.0 2017-04-21
Page 6
Grouper primitives are specific names for features within the product itself. These may be
mapped to one or more TIER/IAM level concepts that are used to implement various IAM
capabilities. A Grouper group is a primitive and that can be used in many different ways to
implement the desired access control mechanism.
Subjects that have been added directly to a group are said to have a direct membership
assignment. Subjects that are members of a group by virtue of membership in another group
are said to have an indirect membership assignment. That is, they are members because of
their membership in a subgroup that is itself a member of the parent group. A composite group
is the result of combining two other groups, typically by relative complement (i.e. Group A minus
Group B).
In order to distinguish the intended use of a group this document will qualify the word “group”.
For instance, a reference group is a named group of subjects that is largely intended to be
used by reference within access policy groups. Reference groups can also be thought of as
labels or tags that are applied to subjects. In this way, they can also be viewed as subject
attributes from an ABAC perspective.
Basis groups consists solely of direct subject membership assignments and are often
maintained automatically by the Grouper Loader process. Basis groups are typically subsets of
cohorts that when used together in different combinations form proper reference groups. For
instance, an HR system might have different codes for various employees. These cohorts can
be loaded separately into basis groups and then combined into an “employee” reference group.
An access policy group is a composite group whose membership is composed of a single
include group (i.e. an allow group) and a single exclude group (i.e. deny group). Effective
membership in an access policy group represents a precomputed access policy decision.
Membership within an access policy group may be kept in sync directly with a target service or
an intermediary like an LDAP based enterprise directory service, and is often incorporated in a
SAML authentication response via Shibboleth.
An account policy group is a composite group whose membership is composed of a single
include group (i.e. an allow group) and a single exclude group (i.e. deny group). Effective
membership in an account policy group represents a precomputed account policy decision.
Membership within an account policy group signals that a suitable identity record (i.e. an
account) should be created and kept in sync with a target service.
Allow/deny groups are used specifically for access policy group definition. Subject
membership within an allow group must be indirect via a reference group. That is, the only direct
membership assignment permitted in an allow or deny group is a reference group. Reference
groups can be institutional in scope or specific to a particular application.
TIER Grouper Deployment Guide
Version 1.0 2017-04-21
Page 7
3 Understanding Grouper
A TIER based enterprise identity and access management program deploys Grouper as a
strategic component of its institutional role and access management solution. Grouper is at the
center of all group and access policy management. Managing access with Grouper results in
access to target systems being automatically kept in sync with policy as subject attributes
change in underlying systems of record (e.g. ERP, SIS, etc). This overall mechanism coupled
with powerful distributed management capabilities is what makes Grouper a core component of
a TIER based IAM system.
The Grouper project maintains three introductory videos that predate TIER, but are still very
relevant. The first one, Intro to Grouper: Access Management & Grouper, provides project
background and the rationale for the project's approach to access management. The second in
the series, Intro to Grouper: Grouper’s Core Access Management Capabilities, explores specific
Grouper concepts and capabilities, and how they come together in a specific case for managing
access to a VPN service. The third, and final in the series, Intro to Grouper: Grouper Toolkit
Components, describes the various product components and capabilities, and options for
integrating with existing campus IAM architecture.
The University of Chicago VPN example described in the Intro to Grouper series, provides a
great overview of how a variety of Grouper’s capabilities come together to implement powerful
access control management, and illustrates a common pattern that can be applied in many
situations:
1. Leverage institutional data to create meaningful cohorts (staff, student, etc)
2. Enable distributed management of exceptions and ad-hoc groups (Institutional Review
Board Membership, account locked by CISO (Chief Information Security Officer))
3. Use composite groups to define access policy (allow - deny)
4. Reflect access control decisions to target systems (app:vpn:vpn_authorized)
Let’s consider the access policy “Staff, student, postdocs, and members of the IRB office are
authorized to use the VPN unless their account is in the process of being closed (closure) or
has been administratively locked by the Information Security Office.” This is what NIST 800-162
calls the “natural language policy” (NLP). Figure 1 shows how the NLP is translated into digital
policy (DP) in Grouper.
TIER Grouper Deployment Guide
Version 1.0 2017-04-21
Page 8
Figure 1: University of Chicago VPN Access Policy
The policy calls out number of different cohorts which we call reference groups. These are
groups of subjects that share some characteristic, such as being a student, a postdoc or a
member of the IRB office. Reference groups can be kept in sync automatically with institution
data or manually when a data source is not available. The IRB office reference group is kept up
to date by directly adding or removing members via the Grouper UI. Reference groups are
institutional meaningful concepts and represent the best known “truth” about a subject at any
given moment.
Once the required reference groups are available, an access policy group
app:vpn:vpn_authorized is created and configured to reflect the NLP. An allow group
app:vpn:vpn_authorized_allow includes reference groups r
ef:student:all_students,
ref:faculty:postdocs, and r
ef:employee:all_staff. This captures the first part of the NLP.
Additionally, a deny group a
pp:vpn:vpn_authorized_deny is created and includes an identity
lifecycle group representing a deprovisioning state, r
ef:iam:closure, and a security control
group r
ef:security:locked_by_ciso. Combining the allow and the deny group in
vpn_authorized yields the appropriate digital policy and is kept up to date as the underlying
reference groups change.
Converting natural language policy into executable digital policy with a combination of reference
groups and access policy groups is a fundamental Grouper pattern and objective. Grouper
provides a single point of management, enables groups to be defined once and reused across
multiple applications, and empowers the right people to manage access. This example also
demonstrates a key objective of TIER based Grouper deployment, which is that access policy
should be easily discoverable and verified.
TIER Grouper Deployment Guide
Version 1.0 2017-04-21
Page 9
Figure 2: Enterprise Access Management with Grouper1
The rest of this section will introduce core Grouper concepts and primitives which includes:
● Folders, Groups, and Membership
● Composite Groups
● Folder and Group Privileges
● Grouper Daemon/Loader Jobs
3.1 Folders, Groups, and Membership
Grouper is organized around three main concepts; folders, groups, and memberships. A folder
is a container for other folders, groups, and other objects. It provides a namespace and a
security context for the objects it contains. A group is the list of entities (other groups or
subjects) that have membership in the group, along with other attributes that define the group,
such as group name and description.
1
Newcastle University May 2013 Grouper InfoGraphic
TIER Grouper Deployment Guide
Version 1.0 2017-04-21
Page 10
Membership in group can be direct or indirect and describes a relationship between a subject or
group and a group of interest. A subject or group is a direct member of a group if the subject or
group has been added to the group’s membership list. A subject is an indirect member of a
group, if the group contains a subgroup for which the subject is member, or as the result of a
composite group. Any membership that is not direct is called indirect. All indirect memberships
are automatically updated as the underlying direct memberships change.
Figure 3: Group and Folder Structure
3.2 Composite Groups
Grouper allows you to use two existing groups to define a third group. The third group called a
composite group of the other two factor groups. Groups can be combined as an intersection or
complement. Complement includes subjects that belong to the primary “left” factor group who
are not also members of the secondary “right” factor group (i.e. “left” minus “right”). Complement
is the primary method used to create composite groups for access policy.
An intersection includes entities that belong to both of the original factor groups, and produces a
composite "members-in-common". Intersection groups are often used when creating reference
groups from basis groups.
TIER Grouper Deployment Guide
Version 1.0 2017-04-21
Page 11
As membership changes in factor groups they are automatically reflected in composite groups.
3.3 Folder and Group Privileges
Folders and groups have privileges that can be assigned to subjects or groups within Grouper.
The privilege assignments control who can take what action on a folder or group. Each folder
and group has its own privilege assignments which enables fine-grained control and delegation
of authority. The Access Privileges definition in the Grouper glossary provides further details on
what each privilege provides.
Figure 4: Grouper Privileges and Delegation
The combination of folder hierarchy, administrative groups, and Grouper Rules are used to
manage folder and group privileges. Groups and folders created within a parent folder can be
configured to inherit privileges from the parent folder. How to design groups provides examples
of setting up folder structures and configuring privileges. Grouper rules privileges inheritance on
UI provides details on managing inherited privileges in the Grouper UI.
3.4 Grouper Daemon and Loader Jobs
The Grouper daemon is a background process required for a number of key Grouper features
including the Grouper loader. The Grouper Loader allows you to automatically manage group
memberships based on a data source. Out of the box supported data sources include SQL and
TIER Grouper Deployment Guide
Version 1.0 2017-04-21
Page 12
LDAP. Details about the various types of loader jobs and examples are maintained in the
Grouper loader wiki page. Grouper Training Admin Loader Part 1 and G
rouper Training Admin
Loader Part 2 training videos also go into more details about loader job options and
configuration, and operation.
Figure 5: Grouper Loader Jobs
4 Installing Grouper
4.1 Before You Begin
It is important to know where you can obtain help or provide feedback before you begin.
Grouper is community driven product and the public mailing lists are full of very responsive and
experienced users. If you are unsure if you have encountered a bug or are just having issues,
you can send an email to the Grouper-users email list. Feedback on the Grouper, such as bugs,
suggestions, or feature requests can be put straight into the Grouper JIRA. Whether making a
JIRA issue or emailing the list, please include as much information as possible such as version
and patches you are running, any relevant logs, any relevant configuration, what you were doing
at the time, and what you are trying to accomplish.
●
Grouper-Users Email List
○ You can view the archives and subscribe to it here:
https://lists.internet2.edu/sympa/arc/grouper-users
●
Grouper JIRA Instance
○ https://bugs.internet2.edu/jira/projects/GRP/issues/
○ Go to bugs.internet2.edu and you can sign up for an account
●
Grouper-Dev Email List
○ This is a good mailing list to be on if you are interested in the actual development
of Grouper. Archives and subscribe here:
TIER Grouper Deployment Guide
Version 1.0 2017-04-21
Page 13
○
https://lists.internet2.edu/sympa/arc/grouper-dev
4.2 Grouper Installer
Grouper is installed, patched, and upgraded using the Grouper installer. The installer will
download and configure all necessary components and will prompt for database connection
strings, usernames and passwords, and several configuration elements and deployment
choices.
The installer can install all the current Grouper components which includes:
● grouper.apiBinary - used for running the command line client and the Grouper daemon
● grouper.ui - the Java Servlet web-based user interface
● grouper.ws - SOAP and RESTful web service endpoints - used by the Grouper client and
for custom integration
● grouper.clientBinary - Java based client library for Grouper LDAP and web services
● grouper.pspng - provisioning plug-in for synchronizing group membership with external
systems
● grouper.psp - deprecated provisioning plug-in for synchronizing group membership with
external systems
The latest Grouper Installer is available on the Grouper downloads wiki page. The installer
requires full schema admin privileges at least for the initial install and upgrades. The installer
and gsh (the Grouper command line client) can output DDL for these purposes if necessary to
comply with organizational deployment policies. In any case, access to the underlying database
is controlled by the Grouper application layer when interacting with grouper.ui and grouper.ws.
Download and run the installer:
● Make sure you have Java 1.7 SDK. Must be the SDK and not just the JRE.
● Make a folder where you want Grouper installed
● Run: $ java -jar grouperInstaller.jar
Alternatively, you can pre-stage the install by downloading the required files first and then
running the grouperInstaller.jar in the same directory:
●
●
●
●
wget -r http://software.internet2.edu/grouper/release/2.3.0/
○ move all the files to the target host
cd software.internet2.edu/grouper/release/2.3.0
mv patches/grouper_v2_3_0* .
java - jar grouperInstaller.jar
Most the of defaults can be taken, except:
●
●
●
Do you want to use the default and included hsqldb database (t|f)?[t]:f
○ database connection string, user and password for target data should be used
Do you want to add quickstart subjects to DB (t|f)? f
Do you want to add quickstart data to registry (t|f)? f
TIER Grouper Deployment Guide
Version 1.0 2017-04-21
Page 14
●
Do you want to install the provisioning service provider (t|f)? [t]: f
Tip: The installer will initially create the grouper-ui and grouper-ws war files. However, to patch
or upgrade, the installer must have access to the exploded war files. Consider building all the
components together and moving the grouper.ui and grouper.ws directories to other hosts as
needed.
Tip: GrouperSystem is the “root” user and has full administrative privileges. The GrouperSystem
password should be strong and treated as a privileged account. Additional subjects can be
granted admin privilege by assigning them wheel group membership (which we’ll configure in
section 4.4). Add additional members to the wheel group within Grouper before configuring
external authentication (such as Shibboleth or CAS). This prevents you from being locked out of
the Grouper UI.
Recommendation: Grouper passwords should be externalized and encrypted, especially in
production deployments. This includes LDAP and database passwords.
Tip: grouper.installer.properties can be created to run non-interactive Grouper installs.
Tip: To drop all tables and recreate a fresh Grouper database run: “gsh -registry -drop
-runscript -noprompt”
Tip: Grouper 2.3 installer includes Tomcat 6 which is no longer supported. Recommend
deploying on a more recent version of Tomcat. Grouper will work with Tomcat 7 and 8.
4.3 Install gsh Wrapper
The default Grouper shell command line client, gsh, lacks modern shell features and integration
with scripting languages such as groovy or python. Shell Wrappers for Grouper provides these
features and improves usability and opens opportunities for further operational efficiencies.
4.3.1 Install Groovy
●
●
Groovy install instructions: http://groovy-lang.org/download.html#distro
verify installation: $ groovysh -version
4.3.2 Install Shell Wrappers for Grouper
●
●
●
●
git clone https://github.com/wgthom/groovysh4grouper
follow install instructions:
https://github.com/wgthom/groovysh4grouper/blob/master/groovy/README.groovy.md
run $GROUPER_HOME/grouper.apiBinary-X.X.X/bin/gsh.groovy
verify installation: $ groovy:000> findSubject("GrouperSystem")
TIER Grouper Deployment Guide
Version 1.0 2017-04-21
Page 15
○
●
===> Subject id: GrouperSystem, sourceId: g:isa, name:
GrouperSysAdmin
to exit groovysh: $ groovy:000> :exit
Tip: gsh.groovy provides tab completion of all Grouper API objects and a number of
convenience function that are defined in groovysh.profile.
4.4 Configure the Grouper API
The Grouper API is the core of the Grouper system, and its configuration controls overall
execution and behavior, including the command line interface, gsh, and the Grouper daemon.
Configuring the Grouper API is done by collection of properties and XML files.
Grouper uses a configuration overlay method to make it easier to deploy and upgrade Grouper
environments. This approach preserves distribution properties files and allows for an override
properties files for local configuration.
For an initial development tier install, update
$GROUPER_HOME/grouper.apiBinary-2.3.0/conf/grouper.properties with the following:
# differentiate test vs dev vs prod for logging and emailing
grouper.env.name = dev
# the URL which will be used in emails to users.
#e.g. https://server.school.edu/grouper/
grouper.ui.url = {whatever the URL of dev is}
# auto-created wheel group for convenience
configuration.autocreate.system.groups = true
# A wheel group allows you to enable non-GrouperSystem subjects to act
# like a root user when interacting with the registry.
groups.wheel.use = true
4.5 Configure the Subject API
Grouper uses a component called the Subject API to search for and resolve various entities (i.e.
subjects, groups, etc). Any subject that you want to assign group membership to must be
resolvable via the Subject API. This typically means connecting Grouper to either an enterprise
directory such as OpenLDAP or to a relational database used for identity management.
Configuration of source adapters provides detailed considerations and install instructions. The
Penn subject source JDBC2 example provides details on configuring the Subject API for a SQL
database.
TIER Grouper Deployment Guide
Version 1.0 2017-04-21
Page 16
Tip: Grouper expects the Subject ID to be unchangeable and irrevocable. Usually this an
opaque id (e.g. number or uuid). The source that a subject is associated with also should not
change. Subject Identifiers on the other hand are anything that can refer to a subject uniquely.
Subject Identifiers typically are usernames, NetIDs or EPPNs. It would be nice if subject id's and
identifiers are unique across sources, though this is not required. You should not have the same
subject in more than one source.
Tip: Subjects should be resolvable for as long as you want users to be able to search for them
or view them on the UI. It is possible for subjects to be inactive in which case they are not
searchable, but are still resolvable so they can be shown in the UI for auditing.
4.6 Verify Source Adapter Configuration
●
●
run $GROUPER_HOME/grouper.apiBinary-X.X.X/bin/gsh.groovy
groovy:000> subj = SubjectFinder.findByIdOrIdentifier("{UNI}", false)
○
●
replace {UNI} with a resolvable Id or Identifier like:
SubjectFinder.findByIdOrIdentifier(“wgt123”, false)
groovy:000> subj.getAttributes()
○
should return all attributes configured in sources.xml
Tip: Make sure search terms referenced in Subject API configuration are indexed.
Tip: $GROUPER_HOME/grouper.apiBinary-2.3.0/logs/grouper_error.log will have
detailed information in the event the configuration is not working.
Tip: Grouper installer configures Tomcat to run the expanded war files for grouper.ui at
$GROUPER_HOME/grouper.ui-X.X.X/dist/ and the grouper.ws at
$GROUPER_HOME/grouper.ws-X.X.X/grouper-ws/build/dist/grouper-ws. The classpaths
are $
GROUPER_HOME/grouper.ui-X.X.X/dist/grouper/WEB-INF/classes and
$GROUPER_HOME/grouper.ws-2.2.2/grouper-ws/build/dist/grouper-ws/WEB-INF/classes. Here
you will find the respective copies of sources.xml and other configuration files.
Tip: Grouper logs for the grouper.ui and grouper.ws defaults to
$TOMCAT_HOME/logs/grouperUi and $TOMCAT_HOME/logs/grouperWs
Once you verify the sources.xml configuration with gsh.groovy, the configuration needs to be
copied to the classpath of the grouper.ui and the grouper.ws webapps. You can also re-run the
installer to accomplish the same task. After a restart of Tomcat, you should be able to log in to
the grouper.ui with the GrouperSystem account and search for subjects in the IDM database.
Tip: A new administrative screen for Grouper admins to troubleshoot and verify subject API sources
has been added and is on by default in a 2.3.0 patch or 2.3.1+. Details on using this can be found in
Grouper subject API diagnostics in UI.
TIER Grouper Deployment Guide
Version 1.0 2017-04-21
Page 17
4.7 Grouper UI Authentication
The Grouper UI can delegate to Shibboleth or CAS for authentication. Grouper Training - Admin
- UI - Part ½ and Newcastle University - Protecting UI With Shib provide details on configuring
the Shibboleth SP with Grouper.
4.8 Grouper WS Authentication and Authorization
The grouper.ws by default uses container based authentication and expects users to have a
role assignment of “grouper_user”. Users of the web service must be resolvable subjects by the
Grouper Subject API. Other options for authentication are possible, and are listed in Grouper
WS authentication.
Generally, the steps to configure authentication and authorization are:
1. Create a service account (non-person DN and password) in LDAP
2. Configure container managed authentication in Tomcat that will authenticate the user
and return the “grouper_user” role
Tomcat 8 JNDIRealm Configuration for a user with an attribute memberOf=grouper_user:
Source Exif Data:
File Type : PDF File Type Extension : pdf MIME Type : application/pdf PDF Version : 1.5 Linearized : Yes Producer : Skia/PDF m59 Page Count : 42EXIF Metadata provided by EXIF.tools