Grouper at Duke

1
Grouper at Duke

• Klara Jelinkova, Duke University
• Shilen Patel, Duke University
• Internet 2 Fall Meeting
• San Diego 2007

2
Duke University at a Glance

• Durham NC
• Ranking US News 8
• Students Enrollment (full-time) 12,824
• Undergraduate 6,197
• Graduate and Professional 6,627
• Faculty 2,664 (including research professors,
  lecturers etc.)
• Employees 30,551
• Number of Courses Fall 2007 8,000
• Number of courses used by iTunesU 4,000

3
The Problem

• Find a consistent and consolidated way to manage
  the large numbers of class- department -, and
  project-based groups.
• Provide an automated load of class data to the
  Enterprise directory from the Authoritative
  Enterprise Systems.
• Duke needed to provide an interface for
  super-users providing faculty support to create
  and manage ad-hoc groups and modify existing
  pre-loaded group data and have those modification
  propagated through the directory to end-user
  applications.

4
Solution

• Grouper was first connected up to the source data
  systems to automatically receive class list data
  and address the ERP-maintained groups.
• A hands on training process was established as
  well as policies and procedures for group
  stewardship.
• The grouper interface was rolled out to select
  super-users to give them the ability to modify
  automatically groups and create ad-hoc groups as
  needed.
• In production for 2 years.

5
How it has been implemented
6
Applications that use it

• iTunesU
• Elluminate Live - WebConferencing
• Lectopia - Lecture capture
• Duke Pass - Student portal
• Dcal - Calendaring
• WebFiles - Online file storage

7
How it has implemented - WebFiles
8
How it has implemented - WebFiles
9
How it hast been implemented - scale

• 104,439 groups total.
• 104,302 course groups (instructor, student, and
  TA groups for each course)
• 26 dynamic groups
• 111 ad-hoc groups
• 91,551 stems total
• 1,125,013 entries in the grouper_memberships
  table
• 208,540 entries in the grouper_members table.

10
Group Information in LDAP

• Database triggers instead of LDAP-PC
• Novell IdM
• LDAP attributes
• isMemberOf
• eduCourseMember
• eduCourseOfferring

11
Database Triggers
12
Dynamic Groups

• What are they?
• How do we maintain them?
• Updated by Novell IdM

13
Dynamic Groups Data Flow
14
Example Usage of Dynamic Groups

• LDAP filters to determine academic careers
• ((eduPersonAffiliationstudent)
  (((duStudentStatusC1ACTIVE)(duPSAcadCareerC1LA
  W)) ((duStudentStatusC2ACTIVE)(duPSAcadCareerC2
  LAW)) ((duStudentStatusC3ACTIVE)(duPSAcadCareerC
  3LAW)) ((duStudentStatusC4ACTIVE)(duPSAcadCaree
  rC4LAW))))
• (isMemberOfurnmaceduke.edugroupsstudentscare
  ersLAW)

15
Authorization Examples with Grouper

• dCal
• Group with dynamic and regular groups as members
• Eligibility data set in LDAP
• iTunesU
• Class data in Grouper
• eduCourseMember available using Shibboleth

16
Issues

• Performance
• Managing Groups
• Searching
• Adding or Removing Administrators
• User Interface
• Navigation
• Java Exceptions
• Favorite Groups
• Bulk operations

17
Issues - 2

• Subject API
• Performance
• Subject Queries
• FERPA issues
• isMemberOf access issues