The goal of the effort is to address all the previously mentioned shortcomings of provisioning. Over the last year each member of the Grouper development team has been spending some or all of their time, happily working on the new provisioning framework. It was not possible to easily analyze provisioning issues to troubleshoot helpdesk tickets about access problems. Some Grouper provisioners have had serious performance problems. A lot of the logic to make provisioning happen is written over and over (in slightly different ways) which results in a lot of unnecessary technical debt and inconsistent behavior. Many provisioners do not have unit tests since it is difficult or impossible to replicate the target without buying licenses. Some provisioners do not have core features that others do (e.g. The configuration varies widely for various existing provisioners, and the property files are difficult to “get right”. Einstein defined “insanity” as doing the same thing over and over and expecting different results. In some cases we have been rewriting provisioners repeatedly to try to improve features and performance (e.g.
Grouper has for years successfully provisioned to many different targets. Some things are a work in progress.īriefly I would like to start by mentioning the previous provisioning in Grouper. Most items in the write-up below exist in Grouper 2.5 now. All Grouper supported provisioners are included in the Grouper container so they can be easily leveraged. Please let the Grouper team know if you have provisioning use cases, and if you are keeping up with the latest Grouper 2.5 containers and want to volunteer to kick the tires on the new technology. Until then, each Grouper 2.5 release will contain more and more provisioning features that can be used to help solidify and polish the framework. When Grouper 2.6 is released in the next six months, all provisioning is planned to be migrated to the new framework.
In addition, if an institution does not have a provisioning system, or if it is desired to have a different way to provision entitlements to applications, the Grouper provisioning framework can be used for that too.Ĭaption: Diagram of the New Grouper Provisioning Framework Instead Grouper needs to be able to quickly and reliably provision authorization data to other IAM middleware such as MidPoint/LDAP/SQL as a core feature. The intent of the framework is not to turn Grouper into a provisioning engine like MidPoint. The new Grouper provisioning framework revolutionizes how data flows between Grouper and external systems.
Our most recent focus has been a reimagining of the way Grouper handles provisioning. Grouper, the access management component of the InCommon Trusted Access Platform, continues to evolve to meet the community’s needs. By Chris Hyzer, University of Pennsylvania
0 kommentar(er)
