Introduction to Grouper. Open source, community-driven project of the Internet2 Middleware Initiative Initial release v0.5 in December 2004 Grouper originally.

Slides:

Advertisements

Similar presentations

Defining the Security Domain Marilu Goodyear John H. Louis University of Kansas.

Advertisements

IBM Software Group ® Accessing Domino via Outlook iNotes Access for Microsoft Outlook - Notes Domino 5.5 – Domino Access for MS Outlook - Notes Domino.

70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment Chapter 1: Introduction to Windows Server 2003.

Peter Deutsch Director, I&IT Systems July 12, 2005

Administering Active Directory

Hands-On Microsoft Windows Server 2003 Administration Chapter 3 Administering Active Directory.

NSF Middleware Initiative: GridShib Tom Barton University of Chicago.

Widely Distributed Access Management Tom Barton University of Chicago.

Grouper Training Developers and Architects How to Design Permissions Shilen Patel Duke University This work licensed under a Creative Commons Attribution-NonCommercial.

© 2011 The University of Chicago InCommon Silver Implementation at UChicago Tom Barton 1.

CAMP Med Mapping HIPAA to the Middleware Layer Sandra Senti Biological Sciences Division University of Chicago C opyright Sandra Senti,

Understanding Active Directory

70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment, Enhanced Chapter 1: Introduction to Windows Server 2003.

Credential Provider Operational Practices Statement CAMP Shibboleth June 29, 2004 David Wasley.

Introduction to Group Management Tom Barton, Blair Christensen University of Chicago.

A Model for Enterprise Group and Affiliation Management RL “Bob” Morgan University of Washington CAMP, June 2005.

Signet and Grouper for Distributed Attribute Administration

Technical Overview of Kuali Rice UC Davis, Information & Educational Technology January 2009.

Implementing Secure Shared File Access

Authorization Scenarios with Signet RL “Bob” Morgan University of Washington Internet2 Member Meeting, September 2004.

Introduction to Grouper Part 1: Access Management & Grouper Tom Barton University of Chicago and Internet2 Manager – Grouper Project.

Australian Access Federation Robert Hazeltine Identity and Access Management Enterprise Systems Office.

Introduction to Grouper

I2/NMI Update: Signet, Grouper, & GridShib Tom Barton University of Chicago.

Grouper at the University of Minnesota Christopher A. Bongaarts Grouper Virtual Working Group May 20, 2013.

Access Management with Grouper Tom Barton University of Chicago.

Module 9 Configuring Messaging Policy and Compliance.

70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment, Enhanced Chapter 1: Introduction to Windows Server 2003.

Intro to Grouper There’s nothing fishy about Identity Management with Grouper.

Shibboleth as Attribute Delivery for Authorization Renee Shuey Penn State University June 27, 2006.

UCLA Enterprise Directory Identity Management Infrastructure UC Enrollment Service Technical Conference October 16, 2007 Ying Ma

Module 9 Configuring Messaging Policy and Compliance.

Grouper Training Developers and Architects Advanced Topics Chris Hyzer Internet2 University of Pennsylvania This work licensed under a Creative Commons.

Using Signet and Grouper for Access Management Using Signet and Grouper for Access Management Tom Barton, University of Chicago Lynn McRae, Stanford University.

Windows Role-Based Access Control Longhorn Update

Master Data Management & Microsoft Master Data Services Presented By: Jeff Prom Data Architect MCTS - Business Intelligence (2008), Admin (2008), Developer.

© 2006 The University of Chicago Grouper Backgrounder for Authorization WG Tom Barton, U Chicago.

Grouper Tom Barton University of Chicago. I2MM Spring Outline  Grouper’s place in the world  Some Grouper guts  Deployment scenarios.

UC Groups: An Access Management Service Tom Barton University of Chicago.

© ITT Educational Services, Inc. All rights reserved. IS3230 Access Security Unit 6 Implementing Infrastructure Controls.

University of Washington Collaboration: Identity and Access Management Lori Stevens University of Washington October 2007.

Current Middleware Picture Tom Barton University of Chicago Tom Barton University of Chicago.

Grouper Training Developers and Architects How to Design Groups Shilen Patel Duke University This work licensed under a Creative Commons Attribution-NonCommercial.

CaGrid 1.0 Security Infrastructure Stephen Langella, Scott Oster, Shannon Hastings, David Ervin, Joshua Phillips, Vinay Kumar, Tahsin Kurc, Joel Saltz.

Grouper attributes and privileges FUTURE features in Internet2 MACE Grouper June 2009 Chris Hyzer University of Pennsylvania Internet2.

Directory Services CS5493/7493. Directory Services Directory services represent a technological breakthrough by integrating into a single management tool:

Delegating Mediasite Management Using Roles and Advanced Access Permissions Patrick Klaassen.

Windows Active Directory – What is it? Definition - Active Directory is a centralized and standardized system that automates network management of user.

1 Name of Meeting Location Date - Change in Slide Master Authentication & Authorization Technologies for LSST Data Access Jim Basney

Protect your data Enable your users Desktop Virtualization Information protection Mobile device & application management Identity and Access Management.

University of Southern California Identity and Access Management (IAM)

Basharat Institute of Higher Education

Secure Connected Infrastructure

I2/NMI Update: Signet, Grouper, & GridShib

Objectives Differentiate between the different editions of Windows Server 2003 Explain Windows Server 2003 network models and server roles Identify concepts.

Copyright Notice Copyright Bob Bailey This work is the intellectual property of the author. Permission is granted for this material to be shared.

ESA Single Sign On (SSO) and Federated Identity Management

Chris Hyzer, University of Pennsylvania

University of Southern California Identity and Access Management (IAM)

Privilege Management: the Big Picture

Shibboleth as Attribute Delivery for Authorization

Brian Arkills Microsoft Solutions Architect

Signet Privilege Management

PDI: Intro to Grouper Jeff Ruch Jeff Ruch ACNS Middleware

Signet & Privilege Management

Use this presentation with Section 2 of the Deployment Workbook.

Signet Privilege Management

NSF Middleware Initiative: GridShib

Presentation transcript:

Introduction to Grouper

Open source, community-driven project of the Internet2 Middleware Initiative Initial release v0.5 in December 2004 Grouper originally focused on robust management of groups, emphasizing: Delegation and distributed management Integration with most any existing IdM infrastructure. See case studies and campus contributions at: y+Contributions y+Contributions Grouper v2.0 provides broader set of access management capabilities, including roles & permissions Released 6 September October 2011 Grouper story

1.Start out using a single user attribute, affiliation, in LDAP or AD to let applications implement access policies 2.Enrich centralized access management using groups determined from systems of record Courses, financial accounts, departments Define service specific access policies in central IAM system 3.Get central IT out of the loop Distributed management Exceptions Departmental apps 4.Increase integration of access management Direct application integration with web services ESB/SOA, REST/SOAP Roles & privileges to support applications more deeply 3 October 2011 Access management is a process: making authZ more than authN

Grouper: core concepts 4 October 2011 Folders in hierarchies Group Direct members Subgroup Indirect members Composite groups = U

Security & delegation in Grouper 5 October 2011 Create groups Create subfolders Admin Update membership Read membership View group Opt-in Opt-out Delegation

Beyond groups 6 October 2011 Attributes Roles Permissions Attribute definition Permission definition Role inheritance Delegation model extends that for Groups

Membership start & end times (optional) Move or copy folders, groups, etc User audit Point in time audit Rules 7 October 2011 Access management lifecycle support

8 October 2011 Grouper components as of v2.0

New and improved in Grouper v2.0 9 October 2011 FeatureDescription RulesExecute built-in actions and expression language to add business logic to Grouper actions Attribute and Permissions UIs Ajax-y UIs to define, view, and assign attributes and permissions Permission Disallow To manage inheritance of permissions via Role, Resource, or Action hierarchies Permission LimitsBuilt-in Policy Decision Point that combines run-time context with permissions to produce Allow/Deny Point in Time AuditQuery Grouper’s state at a previous time External SubjectsInvitation processes leverage federation to let external Subjects be given group memberships and permissions Syncing GroupersFederate groups between two Groupers Member Search & Sort Selective Subject attribute caching for improved sorting and searching capability and speed LdappcNG enhancement Improved performance through caching

Tom Barton’s UChicago group memberships 10 June 2011

dn: uid=tbarton,ou=people,dc=uchicago,dc=edu ucismemberof: uc:org:nsit:integration:techag ucismemberof: uc:org:nsit:srdirs ucismemberof: uc:org:nsit:integration:iteco:wr ucismemberof: uc:applications:confluence:NSIT:esx ucismemberof: uc:org:nsit:integration:iteco:rd ucismemberof: uc:applications:confluence:NSIT:Directors ucismemberof: uc:org:nsit:staff ucismemberof: uc:applications:confluence:NSIT:Everyone ucismemberof: uc:org:nsit:integration:shib_group ucismemberof: uc:applications:bulkmail:users ucismemberof: uc:org:library:gnet:admins ucismemberof: uc:applications:gnetid:admins ucismemberof: uc:applications:wireless:authorized ucismemberof: uc:applications:cmail:users:authorized ucismemberof: uc:reference:affiliations:effective:staff LDAP entry for uid=tbarton,ou=people,dc=uchicago,dc=edu ucIsMemberOf : uc:org:nsit:srdirs ucIsMemberOf : uc:reference:affiliations:effective:staff Memberships become LDAP attributes 11 ucIsMemberOf : uc:applications:vpn:authorized June 2011

UChicago VPN simple delegation example Different groups, different authorities. VPN only uses “vpn:authorized”. 12 eligibledenied student staff alumhospital closure locked vpn:authorized postdoc = ̶ IRB June 2011 Core business systems IRB Office IT Security Team IdM system

UChicago applications managed by Grouper, so far aams Ad Astra Bulkmail Business Objects Enterprise Chalk CityRyde Cmail cnet Confluence Directory Administration dmca Facilities SIMS gnetid grouper im isx IT Ecosystem Lab School LDAP lists Mail Forwarding Microsoft Exchange modem pool myUChicago online directory password expiration rt 13 Service Now shibboleth Statements portlet SVN tank UC Groups unifiedcomm uPoV Monitor versions voip vpn web hosting webproxy Webshare webspace wireless June 2011

14 October 2011