CalGroups Service Overview
What is the CalGroups service?
CalGroups is an access management system based on the Grouper application. It allows campus members to create and manage groups that are synchronized among these primary group stores: Grouper, LDAP, AD, and bConnected. CAS and campus applications consume group information from these sources for authorization purposes. In effect, the group you create is the same group, everywhere.
CalGroups Data Flow
What is a CalGroup?
A CalGroup is a collection of CalNet identities. All CalGroups are stored in Grouper and propagated in real time to the rest of the primary group stores: LDAP, AD and bConnected. Campus applications can consume CalGroup membership information from any one of these group stores.
CalGroups are also referenced by CAS for access management purposes. Campus applications can configure authorization rules in CAS that limit access to the members specified CalGroups.
What is CalGroups for?
Access Control
CalGroups are used for making access control decisions: membership in a group determines access to a service. You can set up CalGroups to map to your application’s roles and allow only members of these groups to access your application via CAS. This has the added benefit of providing automated de-provisioning via links to official groups.
Communication Lists
CalGroups may also be used for communication lists. An application’s role groups can be available in bConnected as Google Groups that can receive email. Please note that while CalGroups may be configurable for some functions of mailing lists, it does not replicate the full features of a mailing list application.
What are the types of CalGroups?
| Type | Description | Group Creation and Membership Updates | Example |
|---|---|---|---|
| Ad hoc | A group where the membership is manually maintained. | Grouper | People in a project team |
| Automated | A group that is created programmatically from a source application. | From the source application | bCourses class list |
| Official | An automated group derived from official systems of record (UC Path, SIS, ADVCON). | From attribute changes in the systems of record | All employees from UC Path |
| Composite | A group that is the product of two or more groups. | Any update to member groups changes the composite membership. | An intersection of an ad hoc BFS access group and the All Employees group |
How is the CalGroups Service organized?
Grouper is organized in a hierarchy. At the top level, the following four folders represent the main divisions of the group space:
| Folder | Description | Group Type |
|---|---|---|
| App | Groups that are programmatically derived from source applications. | Automated |
| Official | Groups that are programmatically derived from official systems of record (UC Path, SIS). | Official |
| Org | Groups managed and consumed by departments. Departments receive their own subfolder. | Ad hoc, Automated, or Composite |
| Community | Groups created by the individual user. |