Grouper attribute framework

The attribute framework is used for attaching metadata to various objects in the registry.  One example is here. 

Using

1. Create an attribute definition.  Note: anyone with CREATE or ADMIN on a folder can create attributes.  Note that you need ADMIN on the attribute definition to create an "attribute name" for the attribute.  As a standard, the definition has a different name than the "attribute name", and ends in "Def" so when attributes are used it is clear to the user.
   

   
   
   
   
   
   

2. Create an attribute name.  This is what is assigned to the "owner object", in this case is a group
   

   
   
   
   
   

3. Assign an attribute.  You need UPDATE (or ADMIN) on the attribute definition and ATTR_UPDATE (or ADMIN) on the owner object (in this case group)
   

   
   
   
   
   

4. Add a value
   

   
   

Features

• Attributes have a definition (attributeDef), and a name (attributeName or aka attributeDefName).  

• There is a one-to-many relationship between attributeDef and attributeName.  

• The definition has all the configuration, and the name is assigned to the object
  
  
  

  Open

  

  
  
   

• Attributes can be assigned to groups, memberships (immediate or effective), members (i.e. subjects), folders, other attributes, and attribute assignments (one level deep)
  
  

  Open

  

  
   

• Attribute assignments that are permissions have an optional "action" qualifier for permission type attributes.  This is a free form string which is configured per attribute definition
  
  

  Open

  

  
   

• Attributes could have free-form values, multi-valued, multi-assigned, limits as to where they can be applied, validation on values (TODO on validation), etc
  
  

  Open

  

  
   

• Attributes can have enabled/disabled dates.

Security on Attributes

• Attributes have security, coupled with other objects' security.  Each attribute has the following lists:

  • ATTR_VIEW: can see that the attribute exists

  • ATTR_READ: can see the attribute assignment

  • ATTR_UPDATE: can assign or unassign the attribute

  • ATTR_ADMIN: can rename the attribute or assign security

  • ATTR_OPTIN: can assign the attribute to one's self

  • ATTR_OPTOUT: can unassign the attribute to one's self

  • ATTR_DEF_ATTR_READ (v2.2+): can see attributes assigned to this attribute definition (note you need READ on the assigned attributes definition too)

  • ATTR_DEF_ATTR_UPDATE (v2.2+): can assign attributes to this attribute definition (note you need UPDATE on the assigned attributes definition too)

• In order to perform operations on attributes, more security is needed on the underlying objects.  For example, to assign an attribute to a group, you need ATTR_UPDATE on the attribute and GROUP_ATTR_UPDATE on the group.  In order to assign an attribute to a membership, you need ATTR_UPDATE on the attribute, and UPDATE on the group.

• To make attributes easier to use, you can set these settings in the grouper.properties to make attributes "public".  This means that if you have the appropriate security on the underlying object, you can add / edit / delete attributes from the object

• Attribute assignments can be delegatable.  You can identify as assignment as true for delegatable, false for not delegatable, or "grant" which means the user can delegate it, and set the delegate flag.

• Many attributes can share the same security settings.  An attribute consists of an attribute definition (where all the rules and security are applied), and an attribute name (just has a friendly and system name, and a description)
  

New Privileges for Attributes (in Grouper 2.2+)

In Grouper 2.2, new privileges have been added to determine if a subject has access to read or update attributes:

1. New privileges for groups — groupAttrRead and groupAttrUpdate.

2. New privileges for stems -- stemAttrRead and stemAttrUpdate.

3. New privileges for attributeDefs - attrDefAttrRead and attrDefAttrUpdate.

For group privileges:

1. To be able to read an attribute assigned to a group, you need attrRead (or attrAdmin) on the attribute and groupAttrRead (or admin) on the group.  

2. To be able to update an attribute assigned to a group, you need attrUpdate (or attrAdmin) on the attribute and groupAttrUpdate (or admin) on the group.

3. To be able to read an attribute assigned to an attribute assigned to a group, you need attrRead (or attrAdmin) on both attributes and groupAttrRead (or admin) on the group.

4. To be able to update an attribute assigned to an attribute assigned to a group, you need attrUpdate (or attrAdmin) on both attributes and groupAttrUpdate (or admin) on the group.

For stem privileges: