6 ms·

Nobody is mentioning a big open source project like Grouper, https://incommon.org/trusted-access/ https://incommon.org/trusted-access/ Can someone tell me why

Nobody is mentioning a big open source project like Grouper, https://incommon.org/trusted-access/ https://incommon.org/trusted-access/ Can someone tell me why is this project, or 4 softwares, not more widely known?

mooreds 5y ago
Incommon is focused on .edus, as far as I understand it. That might be why it isn't as well known as it should be. I've definitely heard of Shibboleth, it's one of the big players in OSS SAML implementations.
chromatin 5y ago
Well, objectively, looking at that page or for example the grouper page (https://incommon.org/software/grouper/ https://incommon.org/software/grouper/) I fail to get /exactly/ where grouper fits in, what it does and doesn’t do, and just generally why I would or wouldn’t choose it in my application. Likely, busy people don’t spend a lot of time digging in to software that doesn’t effectively communicate clearly what it is, unless they know from a trusted colleague, friend, or other resource that the software/tool will be essential or a major win for them. That’s a long-winded way to say “marketing” :)
- permalac 5y ago
  I would have thought that in SCIM provisioning people would invest more time researching for existing projects. Said that, I fully understand why people would not invest enough time to understand the Grouper environment, I going through it and feels like a punishment. If someone wants to see the potential, check this list of known users and their use cases : https://spaces.at.internet2.edu/display/Grouper/Community+Contributions https://spaces.at.internet2.edu/display/Grouper/Community+Co...
  - yaleman 5y ago
    The front page says "the research and education system for IAM" ... that reads like it's not for production use and would turn me off immediately.
nick__m 5y ago
Grouper look promising but there are performance problems with Grouper when you reach a certain scale. When I tried to import my institution LDAP, I had to exclude the major groups it was meant to manage as they were basically undeletable. Sure you could easily delete one reference group ex (u:ref:students:adm:adm101:20201:01) but deleting all the group from a faculty (evrything under u:ref:students:adm) took more than a weekend (I killed the job and recreated the database from a snapshot). In the grouper mailing list it was suggested to keep only the previous, current and next trimester but this arrangement was unworkable at my institution, there are valid usecases that require groups from the 5 last years. Things might have changed since I did this experiment a few years ago and I dont do identity management anymore :)
- permalac 5y ago
  Could you share the setup you ended up using? In my institution I have to replace a long lived solution that even suports a nis domain, and I feel a bit overwhelmed.

mooreds 5y ago

Incommon is focused on .edus, as far as I understand it. That might be why it isn't as well known as it should be. I've definitely heard of Shibboleth, it's one of the big players in OSS SAML implementations.

chromatin 5y ago

Well, objectively, looking at that page or for example the grouper page (https://incommon.org/software/grouper/ https://incommon.org/software/grouper/) I fail to get /exactly/ where grouper fits in, what it does and doesn’t do, and just generally why I would or wouldn’t choose it in my application. Likely, busy people don’t spend a lot of time digging in to software that doesn’t effectively communicate clearly what it is, unless they know from a trusted colleague, friend, or other resource that the software/tool will be essential or a major win for them. That’s a long-winded way to say “marketing” :)

permalac 5y ago
I would have thought that in SCIM provisioning people would invest more time researching for existing projects. Said that, I fully understand why people would not invest enough time to understand the Grouper environment, I going through it and feels like a punishment. If someone wants to see the potential, check this list of known users and their use cases : https://spaces.at.internet2.edu/display/Grouper/Community+Contributions https://spaces.at.internet2.edu/display/Grouper/Community+Co...
- yaleman 5y ago
  The front page says "the research and education system for IAM" ... that reads like it's not for production use and would turn me off immediately.

nick__m 5y ago

Grouper look promising but there are performance problems with Grouper when you reach a certain scale. When I tried to import my institution LDAP, I had to exclude the major groups it was meant to manage as they were basically undeletable. Sure you could easily delete one reference group ex (u:ref:students:adm:adm101:20201:01) but deleting all the group from a faculty (evrything under u:ref:students:adm) took more than a weekend (I killed the job and recreated the database from a snapshot). In the grouper mailing list it was suggested to keep only the previous, current and next trimester but this arrangement was unworkable at my institution, there are valid usecases that require groups from the 5 last years. Things might have changed since I did this experiment a few years ago and I dont do identity management anymore :)

permalac 5y ago
Could you share the setup you ended up using? In my institution I have to replace a long lived solution that even suports a nis domain, and I feel a bit overwhelmed.