unicon/googleapps-grouper-provisioner

This project is an Internet2 Grouper connector that synchronizes Grouper groups and users to Google Apps.

Google Apps Grouper Provisioner

Professional support/integration assistance for this module is available. For more information, visit https://unicon.net/opensource/grouper.

This project is a Grouper change log consumer and full sync agent that provisions (and deprovisions) Grouper groups and subjects to a Google Apps for Education/Business domain.

This project's source is now being maintained in the Grouper source repo. It can be found at https://github.com/Internet2/grouper/tree/master/grouper-misc/googleapps-grouper-provisioner. All adopters are encouraged to use that source instead.

Features

The Google Apps provisioner has the following features:

• Supports multiple provisioner instances/configurations.
• Fine-grain control over which groups are provisioned.
• Configure Google's "advanced" group settings.
• Optionally, set users with admin/update Grouper privileges as Google Group managers.
• Optionally, can provision Google user accounts.

Instructions

Instructions on installation, configuration, and execution can be found on the project's wiki.

Acknowledgements

Unicon's work on the Google Apps Grouper Provisioner project is funded through a project with Oregon State University. It is intended that the products (source code and deliverables) of this project will be donated to the Grouper project, and that rights will be assigned to Internet2.

These individuals have provided guidance through out the development process:

• Andy Morgan, Oregon State University
• Erica Lomax, Oregon State University
• David Langenberg, University of Chicago
• Chris Hyzer, University of Pennsylvania
• Jeff Pasch, New York University
• Gary Chapman, New York University
• Madan Dorairaj, New York University

googleapps-grouper-provisioner's Issues

Archive this repository

since it's now available elsewhere

Group Update of non-synced group appears to get sync'ed to Google

When a property change occurs to a Grouper group the change log consumer is asked to process all of them but should only act on ones that have been flagged for syncing to Google. The current coding does this check after it does an initial check to see if the Google group exists. It then steps out. So while nothing will get hurt by the current coding it is mis-leading when reading the logs.

NullPointerException on privilege drop when group is deleted.

Create a new Google group, if it doesn't exists

Manage privs not given properly.

Andy reported an issue where someone with admin privs was given the "manage" role while the provisioner config was set to update.

During discovery we also found that the Change Log Consumer wasn't setting the priv appropriately at all.

Prefetch of Google Groups (and users) should be optional and likely is only truly useful for FullSync

Documentation!

Create a new Google user, if it doesn't exists

Full Sync should be schedulable (via Grouper Loader)

Currently the full sync has to be run externally of the Grouper Loader. It would be nice this could be scheduled via "cron" and invoked within the loader.

Refactor the ChangeLogConsumer class

• split out bridging code to separate class (I need a good name for this class.)
• move the FullSync method to its class

This will leave the CLC class with just CLC specific code.

Include subjectName in membership changelog entries

Currently in membership type changelogs, only the subjectId is logged. While useful to Grouper users, subjectName is more often referenced and meaningful to Google Admins and can save some steps when troubleshooting issues.

Currently:

Google Apps Consumer 'google' - Change log entry 'ChangeLogEntry[timestamp=2018-06-05 12:57:04.473,sequence=16034723,category=membership,actionName=addMembership,contextId=56a9fbb8cb1d4bc696b4811419da4d1b,id=e0cc914fc95d4b9a8c9ef9a6ad3158c6,fieldName=members,subjectId=777777,sourceId=uncg-person,membershipType=flattened,groupId=51f5863f44d24a4badc7156e43f4ab0d,groupName=uncg:apps:AAA_test:bushyTestGroup,memberId=afb3efc0fa2447d9b9440d386b6c4247,fieldId=daf3e08d291e464aa5feda14b7ff4e72,subjectIdentifier0=]'

Proposed:

Google Apps Consumer 'google' - Change log entry 'ChangeLogEntry[timestamp=2018-06-05 12:57:04.473,sequence=16034723,category=membership,actionName=addMembership,contextId=56a9fbb8cb1d4bc696b4811419da4d1b,id=e0cc914fc95d4b9a8c9ef9a6ad3158c6,fieldName=members,subjectId=396705,subjectName="John T Spartan",sourceId=uncg-person,membershipType=flattened,groupId=51f5863f44d24a4badc7156e43f4ab0d,groupName=uncg:apps:AAA_test:bushyTestGroup,memberId=afb3efc0fa2447d9b9440d386b6c4247,fieldId=daf3e08d291e464aa5feda14b7ff4e72,subjectIdentifier0=]'

Allow Group(er) Attributes to override Google's Advanced Group Settings

The provisioner allows the Grouper admin to configure the advanced/extended Google Group settings only at the time of provisioning. It would be nice if those settings could be managed in Grouper using Grouper attributes assigned to a group.

Delete follow-ed by a quick re-add fails (because the body isn't buried yet)

Removing a user's grouper membership in in Grouper and then immediately re-adding the same user's membership for the same group fails for the Change Log Consumer:

Error processing membership add failed: com.google.api.client.googleapis.json.GoogleJsonResponseException: 409 Conflict
{
  "code" : 409,
  "errors" : [ {
    "domain" : "global",
    "message" : "Member already exists.",    "reason" : "duplicate"  } ],
  "message" : "Member already exists."
}

This is likely happening because Google hasn't committed the delete change throughout it's system when the CLC tries to re-add the membership, but eventually it catches up and the membership entry does go away.

Provide option to map Group(er) admin and/or updaters to be Google Group managers

Deprovision Google group when "Google" attribute is removed in Grouper

Modify Google group membership when Grouper group membership changes

Add option to leave extra Google members when doing a full sync

In some users, managers may add extra users directly to the group that shouldn't be removed when doing a full sync.

Deprovision Google group when group removed in Grouper

Modify Google group when Grouper Sync attributes changes

Group should be removed if GoogleSync attribute is removed; groups should be added when Google Sync attribute is added.

Privilege not added to an existing member

The whoCanManage property is set to "update" in my configuration but when the member already exists in Google with "Member" role then in Grouper when this member gets the "update" privilege added and the changelog runs the role remains the same in Google.

Start full sync upon Grouper Loader startup

Instead of running the first Change Log Consumer event, upon Grouper Loader start-up, it would be nice if a full sync could optionally be run.

Need Group Filter for Full Sync

The full sync is greedy and queries all Google Groups and compares them to Groupers target population. It then wants to remove/archive (nothing, if ignore is selected) all of the extraneous groups. This is fine if a Grouper is completely authoritative over Google Groups and a single provisioner is used, but does not probably work for most instance.

A filter is needed to match only groups that the provisioner "should" have created. For example filters in a specified prefix of "crs-" for courses or "clubs-" for on campus clubs, etc. A regex would be most flexible.

Add members to Google Groups