Grouper integration for automatic account & role provisioning

[joeparsons]

Original D7 issue: https://jira.arizona.edu/browse/UADIGITAL-1419

What is the problem that we want to solve?

User story

As a Quickstart site administrator, I need to be able to automatically provision and de-provision Drupal user accounts and roles based on Grouper group membership(s) and potentially other attributes from a central directory.

Background

Many University websites are administered or supported by one or more teams. Some teams support a large number of websites. The task of ensuring that team members have appropriate administrative access to all team-supported websites is compounded for teams with a a lot of turnover (e.g. teams that employ a lot of student employees).

Grouper is an enterprise-wide group management system for university related groups of people, teams, or departments. Grouper is well suited as an authorization system for role-based access to other systems or resources.

Potential solutions

• In July 2016, Patrick at the Graduate College published a guide for configuring the contrib Drupal LDAP module (and some of its submodules) to automatically add roles to existing Drupal user accounts based on Grouper group membership data queried from EDS. This solution does provide a way to automate role provisioning for existing Drupal users but does not provide a way to automatically provision or de-provision Drupal accounts for group members.
• The contrib simpleSAMLphp Authentication module available for Drupal 7 & 8 has built-in functionality for just-in-time provisioning of accounts and automatic role assignment based on SAML attributes.

Conditions of satisfaction

• [ ] The considered options are documented
• [ ] A recommended next step is documented
• [ ] An estimate of time and effort is provided for the recommendation
• [ ] …

[pbarabe]

Here's an updated guide for D9/QS2

[trackleft]

How do you feel about adding this as a guide in the Quickstart Repo?

We need to figure out where to put documentation. We have quickstart.arizona.edu, and the readmes in each repo, but nobody can find the ReadMes and quickstart.arizona.edu is hosting agnostic.

[danahertzberg]

History shared on 1/10/2024

• Been able to provision accounts via netID
• Desire to establish certain sites to groups rather than maintaining access per site
• Separate consideration is access revoking
• Would still need to attribute site changes to individual person

Example thoughts

• "Webteam students" or "Webteam full-time"
• "CALES CCT developers" or department members on their sites
• Grouper group would have the login info on the site

Other notes

• Groups module offers IT site desired needs
• Workbench access module exists with content editing needs
• Could consider grouper integration with group on the site
• "Sailpoint IIQ" is UITS IAM future implementation (Rhonda Royse, Mark Fischer)
• Could consider combining needs of Grouper integration with site permissions

Next steps

• Get more info on Sailpoint IIQ
• Determine if there are any conflicts between grouper groups and workbench access
• Get more info on workbench access and groups to determine if they are acceptable for various sites
• Determine what happens if module is uninstalled

[danahertzberg]

• Grouper isn't going away anytime soon, but not ideal to keep building on it
• Sailpoint IIQ is not capable of this functionality
• Main grouper issue: no way to see what a group is used for

Joe will own this ticket to continue progress