1. Grouper at Duke Klara Jelinkova, Duke University Shilen Patel, Duke University Internet 2 Fall Meeting San Diego 2007

2. Duke University at a Glance Durham NC Ranking US News: 8 Students Enrollment (full-time) 12,824 Undergraduate 6,197 Graduate and Professional 6,627 Faculty 2,664 (including research professors, lecturers etc.) Employees 30,551 Number of Courses Fall 2007 8,000 Number of courses used by iTunesU 4,000

3. The Problem Find a consistent and consolidated way to manage the large numbers of class- department -, and project- based groups. Provide an automated load of class data to the Enterprise directory from the Authoritative Enterprise Systems. Duke needed to provide an interface for super-users providing faculty support to create and manage ad- hoc groups and modify existing pre-loaded group data and have those modification propagated through the directory to end-user applications.

4. Solution Grouper was first connected up to the source data systems to automatically receive class list data and address the ERP-maintained groups. A hands on training process was established as well as policies and procedures for group stewardship. The grouper interface was rolled out to select super- users to give them the ability to modify automatically groups and create ad-hoc groups as needed. In production for 2 years.

5. How it has been implemented

6. Applications that use it iTunesU Elluminate Live - WebConferencing Lectopia - Lecture capture Duke Pass - Student portal Dcal - Calendaring WebFiles - Online file storage

7. How it has implemented - WebFiles

9. How it hast been implemented - scale 104,439 groups total. 104,302 course groups (instructor, student, and TA groups for each course) 26 dynamic groups 111 ad-hoc groups 91,551 stems total 1,125,013 entries in the grouper_memberships table 208,540 entries in the grouper_members table.

10. Group Information in LDAP Database triggers instead of LDAP-PC Novell IdM LDAP attributes isMemberOf eduCourseMember eduCourseOfferring

11. Database Triggers

12. Dynamic Groups What are they? How do we maintain them? Updated by Novell IdM

13. Dynamic Groups Data Flow

14. Example Usage of Dynamic Groups LDAP filters to determine academic careers (&(eduPersonAffiliation=student) (|(&(duStudentStatusC1=ACTIVE)(duPSAcadCareerC1=LAW)) (&(duStudentStatusC2=ACTIVE)(duPSAcadCareerC2=LAW)) (&(duStudentStatusC3=ACTIVE)(duPSAcadCareerC3=LAW)) (&(duStudentStatusC4=ACTIVE)(duPSAcadCareerC4=LAW)))) (isMemberOf=urn:mace:duke.edu:groups:students:careers:LAW)

15. Authorization Examples with Grouper dCal Group with dynamic and regular groups as members Eligibility data set in LDAP iTunesU Class data in Grouper eduCourseMember available using Shibboleth

16. Issues Performance Managing Groups Searching Adding or Removing Administrators User Interface Navigation Java Exceptions Favorite Groups Bulk operations

17. Issues - 2 Subject API Performance Subject Queries FERPA issues isMemberOf access issues