Grouper at Duke

1. Grouper at Duke Klara Jelinkova, Duke University Shilen Patel, Duke University Internet 2 Fall Meeting San Diego 2007

2. Duke University at a Glance • Durham NC • Ranking US News: 8 • Students Enrollment (full-time) 12,824 • Undergraduate 6,197 • Graduate and Professional 6,627 • Faculty 2,664 (including research professors, lecturers etc.) • Employees 30,551 • Number of Courses Fall 2007 8,000 • Number of courses used by iTunesU 4,000

3. The Problem Find a consistent and consolidated way to manage the large numbers of class- department -, and project-based groups. Provide an automated load of class data to the Enterprise directory from the Authoritative Enterprise Systems. Duke needed to provide an interface for super-users providing faculty support to create and manage ad-hoc groups and modify existing pre-loaded group data and have those modification propagated through the directory to end-user applications.

4. Solution Grouper was first connected up to the source data systems to automatically receive class list data and address the ERP-maintained groups. A hands on training process was established as well as policies and procedures for group stewardship. The grouper interface was rolled out to select super-users to give them the ability to modify automatically groups and create ad-hoc groups as needed. In production for 2 years.

5. How it has been implemented

6. Applications that use it • iTunesU • Elluminate Live - WebConferencing • Lectopia - Lecture capture • Duke Pass - Student portal • Dcal - Calendaring • WebFiles - Online file storage

7. How it has implemented - WebFiles

8. How it has implemented - WebFiles

9. How it hast been implemented - scale • 104,439 groups total. • 104,302 course groups (instructor, student, and TA groups for each course) • 26 dynamic groups • 111 ad-hoc groups • 91,551 stems total • 1,125,013 entries in the grouper_memberships table • 208,540 entries in the grouper_members table.

10. Group Information in LDAP • Database triggers instead of LDAP-PC • Novell IdM • LDAP attributes • isMemberOf • eduCourseMember • eduCourseOfferring

11. Database Triggers

12. Dynamic Groups • What are they? • How do we maintain them? • Updated by Novell IdM

13. Dynamic Groups Data Flow

14. Example Usage of Dynamic Groups • LDAP filters to determine academic careers • (&(eduPersonAffiliation=student) (|(&(duStudentStatusC1=ACTIVE)(duPSAcadCareerC1=LAW)) (&(duStudentStatusC2=ACTIVE)(duPSAcadCareerC2=LAW)) (&(duStudentStatusC3=ACTIVE)(duPSAcadCareerC3=LAW)) (&(duStudentStatusC4=ACTIVE)(duPSAcadCareerC4=LAW)))) • (isMemberOf=urn:mace:duke.edu:groups:students:careers:LAW)

15. Authorization Examples with Grouper • dCal • Group with dynamic and regular groups as members • Eligibility data set in LDAP • iTunesU • Class data in Grouper • eduCourseMember available using Shibboleth

16. Issues • Performance • Managing Groups • Searching • Adding or Removing Administrators • User Interface • Navigation • Java Exceptions • Favorite Groups • Bulk operations

17. Issues - 2 • Subject API • Performance • Subject Queries • FERPA issues • isMemberOf access issues