Grouper at Duke Klara Jelinkova Duke University Shilen

Grouper at Duke Klara Jelinkova, Duke University Shilen Patel, Duke University Internet 2 Fall Meeting San Diego 2007

Duke University at a Glance • Durham NC • Ranking US News: 8 • Students Enrollment (full-time) 12, 824 • Undergraduate 6, 197 • Graduate and Professional 6, 627 • Faculty 2, 664 (including research professors, lecturers etc. ) • Employees 30, 551 • Number of Courses Fall 2007 8, 000 • Number of courses used by i. Tunes. U 4, 000

The Problem Find a consistent and consolidated way to manage the large numbers of class- department -, and projectbased groups. Provide an automated load of class data to the Enterprise directory from the Authoritative Enterprise Systems. Duke needed to provide an interface for super-users providing faculty support to create and manage adhoc groups and modify existing pre-loaded group data and have those modification propagated through the directory to end-user applications.

Solution Grouper was first connected up to the source data systems to automatically receive class list data and address the ERP-maintained groups. A hands on training process was established as well as policies and procedures for group stewardship. The grouper interface was rolled out to select superusers to give them the ability to modify automatically groups and create ad-hoc groups as needed. In production for 2 years.

How it has been implemented

Applications that use it • • • i. Tunes. U Elluminate Live - Web. Conferencing Lectopia - Lecture capture Duke Pass - Student portal Dcal - Calendaring Web. Files - Online file storage

How it has implemented - Web. Files

How it has implemented - Web. Files

How it hast been implemented - scale • 104, 439 groups total. • 104, 302 course groups (instructor, student, and TA groups for each course) • 26 dynamic groups • 111 ad-hoc groups • 91, 551 stems total • 1, 125, 013 entries in the grouper_memberships table • 208, 540 entries in the grouper_members table.

Group Information in LDAP • Database triggers instead of LDAP-PC • Novell Id. M • LDAP attributes • is. Member. Of • edu. Course. Member • edu. Course. Offerring

Database Triggers

Dynamic Groups • What are they? • How do we maintain them? • Updated by Novell Id. M

Dynamic Groups Data Flow

Example Usage of Dynamic Groups • LDAP filters to determine academic careers • (&(edu. Person. Affiliation=student) (|(&(du. Student. Status. C 1=ACTIVE)(du. PSAcad. Career. C 1=LAW)) (&(du. Student. Status. C 2=ACTIVE)(du. PSAcad. Career. C 2=LAW)) (&(du. Student. Status. C 3=ACTIVE)(du. PSAcad. Career. C 3=LAW)) (&(du. Student. Status. C 4=ACTIVE)(du. PSAcad. Career. C 4=LAW)))) • (is. Member. Of=urn: mace: duke. edu: groups: students: careers: LAW)

Authorization Examples with Grouper • d. Cal • Group with dynamic and regular groups as members • Eligibility data set in LDAP • i. Tunes. U • Class data in Grouper • edu. Course. Member available using Shibboleth

Issues • Performance • Managing Groups • Searching • Adding or Removing Administrators • User Interface • • Navigation Java Exceptions Favorite Groups Bulk operations

Issues - 2 • Subject API • Performance • Subject Queries • FERPA issues • is. Member. Of access issues