Grouper Training End Users Lite UI – Rules Chris Hyzer Internet2 University of Pennsylvania This work licensed under a Creative Commons Attribution-NonCommercial 3.0 Unported License.

Contents Introduction Assigning a sample rule Testing the rule

Introduction to Integration 3 3

Rules are triggered by actions in Grouper (on the CHECK) Introduction Rules are triggered by actions in Grouper (on the CHECK) They can have an IF condition If the CHECK has fired a rule, and the IF condition matches, then the THEN happens Configured with attributes on Grouper objects 4 4

Introduction (continued) Google “grouper rules” for documentation and examples https://spaces.internet2.edu/display/Grouper/Grouper+rules See the use cases section for some practical examples Note: some rules have a “daemon” component to make sure rules are consistent (generally runs daily) 5 5

Assigning a sample rule There are two ways to assign rules Your Grouper admin can do this with GSH Note: some rules must be done by your Grouper admin (by the GSH or UI) since the rule must run as GrouperSystem (privileged) Inherited privileges on a folder is an example A Grouper user can do this via the UI (or WS) 6 6

Composite intersection Grouper intersections have the problem that if the user is added to the “require group” in the future, they will be in the overall group Maybe you want them to go through an intake process again Also, composite ‘intersection’ and ‘minus’ might have performance implications 7 7

Composite intersection rules A rule on the overall group, which ‘checks’ when a membership is removed from the “require group” can remove member the member from the overall group A rule on the overall group, which ‘checks’ to see when a membership is added to the overall group, can veto that action if the entity is not in the require group 8 8

Composite intersection example See the Grouper wiki rule use case for ‘composite intersection’ and ‘veto if not eligible’ You need privileges ATTR_UPDATE and ATTR_READ on the two rules attribute definitions from your Grouper admin Assign the attributes and values When the attribute for ‘rule valid’ is T, it is ready 9 9

Add someone in the overall group, who is not in the “check group” Test the rules Remove someone from the “check group” and see them get removed from the overall group Add someone in the overall group, who is not in the “check group” Wait for the daemon to run at night to see the rule become consistent 10 10

Quiz Click on the quiz link in the video description to reinforce your knowledge of this topic 11 11

Thanks! Further information: Infosheets, mailing lists, wiki, downloads, etc.: www.internet2.edu/grouper Grouper demo server: grouperdemo.internet2.edu/ Grouper Online Training Home: spaces.internet2.edu/x/IIGfAQ This work licensed under a Creative Commons Attribution-NonCommercial 3.0 Unported License.