1. Grouper Training End Users Lite UI – Rules
Chris Hyzer
Internet2
University of Pennsylvania
This work licensed under a Creative Commons Attribution-NonCommercial 3.0 Unported License.

2. Contents
Introduction
Assigning a sample rule
Testing the rule

3. Introduction to Integration3 3

4. Rules are triggered by actions in Grouper (on the CHECK)
Introduction
Rules are triggered by actions in Grouper (on the CHECK)
They can have an IF condition
If the CHECK has fired a rule, and the IF condition matches, then the THEN happens
Configured with attributes on Grouper objects 4 4

5. Introduction (continued)
Google “grouper rules” for documentation and examples
See the use cases section for some practical examples
Note: some rules have a “daemon” component to make sure rules are consistent (generally runs daily) 5 5

6. Assigning a sample rule
There are two ways to assign rules
Your Grouper admin can do this with GSH
Note: some rules must be done by your Grouper admin (by the GSH or UI) since the rule must run as GrouperSystem (privileged)
Inherited privileges on a folder is an example
A Grouper user can do this via the UI (or WS) 6 6

7. Composite intersection
Grouper intersections have the problem that if the user is added to the “require group” in the future, they will be in the overall group
Maybe you want them to go through an intake process again
Also, composite ‘intersection’ and ‘minus’ might have performance implications 7 7

8. Composite intersection rules
A rule on the overall group, which ‘checks’ when a membership is removed from the “require group” can remove member the member from the overall group
A rule on the overall group, which ‘checks’ to see when a membership is added to the overall group, can veto that action if the entity is not in the require group 8 8

9. Composite intersection example
See the Grouper wiki rule use case for ‘composite intersection’ and ‘veto if not eligible’
You need privileges ATTR_UPDATE and ATTR_READ on the two rules attribute definitions from your Grouper admin
Assign the attributes and values
When the attribute for ‘rule valid’ is T, it is ready 9 9

10. Add someone in the overall group, who is not in the “check group”
Test the rules
Remove someone from the “check group” and see them get removed from the overall group
Add someone in the overall group, who is not in the “check group”
Wait for the daemon to run at night to see the rule become consistent 10 10

11. Quiz
Click on the quiz link in the video description to reinforce your knowledge of this topic 11 11

12. Thanks! Further information:
Infosheets, mailing lists, wiki, downloads, etc.:
Grouper demo server: grouperdemo.internet2.edu/
Grouper Online Training Home: spaces.internet2.edu/x/IIGfAQ
This work licensed under a Creative Commons Attribution-NonCommercial 3.0 Unported License.