Body
Audience: Grouper Group Administrators and Delegated Managers
Application: Grouper
Purpose: Provide guidance for locating groups, managing memberships, completing attestations, and obtaining support.
Overview
Grouper is Purdue University's enterprise group management platform. It allows authorized users to manage access to applications, services, email lists, shared resources, and other systems through group memberships configured in Grouper.
Instead of granting permissions directly to individuals, access is typically managed by adding or removing users from groups. Changes made in Grouper may be synchronized to downstream systems according to those systems' provisioning schedules. For example, updates directly to Azure groups may sync within 5 minutes. However, updates to boilerAD must then sync to Azure. Those updates can take 30 minutes to an hour, depending on the timing.
Accessing Grouper
- Navigate to the Grouper application.
- Sign in using your Purdue credentials.
- Upon successful login, you will be presented with the Grouper home page.
Finding a Group
Using Search
The fastest way to locate most groups is through the Grouper search bar.
- Enter the group name or a portion of the group name.
- Review the search results.
- Select the desired group.
Tips
- Search using the full group name whenever possible.
- Searching by a unique portion of the group name may return fewer results.
- Verify that you have selected the correct group before making changes.
Browsing the Folder Structure
Groups can also be located by navigating through Grouper folders.
- Browse through the folder hierarchy.
- Open the organizational area containing the group.
- Select the desired group.
This method can be useful when the exact group name is unknown.
Viewing Membership
To review the members of a group:
- Open the group.
- Select the Members tab.
- Review the membership list.
Depending on the group's configuration, you may see:
- Direct memberships
- Effective memberships
- Composite memberships
- Service accounts
- Nested groups
Adding Members
To add a member to a group:
- Open the group.
- Select Add Members.
- Search for the desired user.
- Select the user from the search results.
- Click Add.
- Select Add Members to complete the process.
Important
Entering a username into the search field does not add the user.
You must select the user from the search results before completing the addition.
Removing Members
To remove a member from a group:
- Open the group.
- Locate the member.
- Select the checkbox next to the membership record.
- Click Remove Membership.
- Confirm the removal if prompted.
The membership will be removed from the group.
Understanding Membership Types
Direct Membership
The user was added directly to the group.
Example:
User → Group
Administrators can typically add or remove direct memberships.
Effective Membership
The user receives membership through another group.
Example:
User → Department Group → Application Group
Effective memberships are inherited and generally cannot be removed directly from the destination group.
Composite Membership
Membership is calculated based on the relationship between multiple groups.
Changes to composite memberships must be made in the source groups that drive the composite.
Group Administration
Some groups allow delegated administration.
Group administrators may be able to:
- Add members
- Remove members
- Assign additional administrators
- Review membership history
- Complete attestations
Administrative privileges should be granted only to individuals responsible for managing access.
Attestations
What Is an Attestation?
An attestation is a periodic review of a group's membership to verify that users still require access.
Attestations help ensure:
- Access remains appropriate.
- Former employees or role changes are addressed.
- Unnecessary access is removed.
- Security and compliance requirements are met.
Why Attestations Matter
Access requirements change over time.
Users may:
- Change positions.
- Move to different departments.
- Leave Purdue.
- No longer require application access.
Regular reviews help maintain accurate group memberships and support the principle of least privilege.
Completing an Attestation
When an attestation is assigned:
- Open the group identified in the attestation request.
- Review each current member.
- Verify that access is still required.
- Remove memberships that are no longer appropriate.
- Complete the attestation within Grouper.
If the purpose of a membership is unclear, consult the group owner or business owner before removing access.
Attestation Best Practices
- Review members individually.
- Avoid automatically approving memberships without validation.
- Remove access that is no longer justified.
- Verify administrative memberships.
- Complete attestation requests promptly.
- Maintain documentation when required by departmental procedures.
Common Troubleshooting
I Cannot Find a User
Try the following:
- Search by username.
- Search by first and last name.
- Verify spelling.
- Confirm the account exists and is active.
I Cannot Find a Group
Try the following:
- Use broader search terms.
- Browse through the folder hierarchy.
- Confirm the group name with the group owner.
- Verify that you have permission to view the group.
If you believe you should have access but cannot locate or view a group, submit a ticket to IT_IDENTITY through the Purdue Service Portal at service.purdue.edu.
I Cannot Remove a Member
The membership may be effective or inherited from another group.
Review the membership details to determine whether it originates from an upstream group.
If necessary, make changes in the source group responsible for granting access.
A User Was Added but Still Does Not Have Access
Many systems consume Grouper memberships through automated provisioning processes.
Allow time for downstream systems to process the membership change. If access has not been granted after the expected provisioning window, contact the application owner or submit a support request.
Best Practices
- Apply the principle of least privilege.
- Grant access only when there is a documented business need.
- Remove access when it is no longer required.
- Periodically review group memberships.
- Keep administrator groups limited to authorized personnel.
- Verify changes after completing membership updates.
- Use attestations to maintain accurate access over time.
Getting Help
Submit a ticket to IT_IDENTITY through service.purdue.edu for assistance with:
- Grouper access issues
- Group visibility problems
- Administrative access requests
- Delegated administration questions
- Membership management troubleshooting
- Attestation questions and support
Quick Reference
Add a User
Open Group
→ Add Members
→ Search User
→ Select User
→ Add
→ Add Members
Remove a User
Open Group
→ Select Member
→ Remove Membership
Complete an Attestation
Open Group
→ Review Membership
→ Remove Unnecessary Access
→ Complete Attestation
Find a Group
Search Bar
or
Browse Folder Structure
Need Additional Grouper Access?
Submit an IT_IDENTITY ticket at service.purdue.edu