Opportunities and Challenges implementing Grouper

Liam Hoekenga

liamr@umich.edu

Identity and Access Management

Information Technology Services

• 600K active people

​

• Medical center, 19 schools and colleges united by a football team

​

• Support for ad hoc email groups, but nothing to facilitate departmental groups or access control in departments

​

​

Background

• Defining and organizing base groups
• Multiple affiliations
• Every department has a different definition of "my department"
• Complex data formats in LDAP
• Data designed for consumption by our IDM system not easily parsed by LDAP loader

{campus=UM_ANN-ARBOR}:{deptId=181500}:{deptGroup=COLLEGE_OF_LSA}:{deptDescription=LSA UG: English Language Inst}:{deptGroupDescription=College of Lit, Science & Arts}:{deptVPArea=PRVST_EXC_VP_ACA_AFF}

• Batch jobs
• Shifting paradigms in service deployment
• Heavy demand for IAM resources

​

Challenges

• Institutional data is rife with possibilities�{jobCategory=Staff}:{campus=UM_ANN-ARBOR}:{deptId=481403}:{deptGroup=ITS_IIA}:{deptDescription=ITS Sec Svcs ID & Access Mgt}:{deptGroupDescription=ITS Infrastrc & Info Assurance}:{deptVPArea=VP_INFO_TECHNOLOGY}:{jobcode=101908}:{jobFamily=210}:{emplStatus=A}:{regTemp=R}:{supervisorId=12345678}:{tenureStatus=NA}:{jobIndicator=P}
• User Benefits
• Automatically updated membership based on gaining/losing job roles or other affiliations
• Single point of management that can interface with multiple systems
• Common Good Solutions
• Meet your neighbors, pay your taxes!

​

Opportunities