Where You Get That Registry Data?

MaIS - Middleware and Integration Services, also known as "the Registry"
 
The core of the business is the an Oracle database.
 
Data flows into and out of the registry, going throug pre and post processing. For example, see the Person Registry data flow here:
https://web.stanford.edu/dept/as/mais/integration/dfd/person_registry_da...

 
This shows which clients the data comes from (the bubbles on the left, e.g. PeopleSoft).
The gray blocks are processing components that perform preprocessing and postprocessing.
Process called slog - sends data to LDAP
Bubbles on the right are clients consuming the data (e.g. Amcom)

MaIS provides six RESTful APIs (Account, Course Class, Person, Privileges (Authority), Student, Workgroup). Most use only GET (you can't modify the data), except for the Workgroup API, which does provide POST.
 

The STARS API is run by a different team.
 

You authenticate using signed client certificates and the process to get one is outlined on the MaIS website (http://mais.stanford.edu).
 
Most documents come in XML documents, except for Accounts which is both in XML and JSON.

 
Question: Is there a plan to move to JSON for the rest of the data? Yes on the plan, but it depends on the demand.
 

Before you will given access to data you'll need to secure approval from the data owners, providing a legitimate reason for using the data. The data owners approval process needs to take place before you are given access. You will then create a certificate which can then be used for testing (through a browser), and through scripts.
 

ACCOUNT
 

Accounts are SUNetIDs, email accounts, etc.
https://web.stanford.edu/dept/as/mais/applications/account/api.html

You can test (once you have a certificate) using a browser by visiting:
 
https://accountws-test.stanford.edu/accounts/<sunetid>
There is also a lite version, at https://accountws-test.stanford.edu/accounts/lite/<sunetid>
 

Accounts only work on SUNetID, but not alias and the data on the test website is scrambled. You don't have to use the browser, you can use scripts with the certificates. Beyond searching for individual IDs, you can also get some canned reports such as all accounts that have changed in the past 7 days.

 
Question: Can you get sponsor data?
Answer: Not yet, not through the RESTFUL API.
 
Question: Can we find information about hospital accounts if they have no SUNetID?
Answer: No, look in the Person Registry.
 
Question: What about getting the data through a DB query instead of the API?
Answer: Requires special permissions and a conversation with MAIS. They provide several ways to get at data such as file drops, individual queries, etc.
 
Question: Who is the data owner for sponsored accounts or workgroups?
Answer: Registry might be the owner. If the data is entered into through a MaIS application, MaIS might be the owner, depending on the actual data. If in doubt, ask.
 
Question: Is there a mapping of data owners to data they own?
Answer: On the website you can find who are the data owners.
 
PERSON DATA
 
https://web.stanford.edu/dept/as/mais/applications/person/api.html
 
Everybody has a person record in the registry (from PEoplesoft, SLAC, Hospital). Records are matched if they have multiple associations. Records from the hospital, for example, are merged with records from the school through matching algorithms.
 
You can query by their SUNetID, employee ID, or a registry ID (normally hidden)
 
Examples of affiliations are: Staff, Student, Faculty... The one shown first in the XML is the primary. There can be multiple affiliations and there is a ranking that determines which is the primary. The ranking is shown here: https://web.stanford.edu/dept/as/mais/integration/data/data_affiliation_...The lower the number, the higher the ranking in the registry. You are not bound by this ranking and you can use your own.
 
The XML for person shows all identifier, not just the primary SUNetID. The one marked "principal" is the primary SUNetID.
 
Question: How do you identify duplicate person accounts, say I leave and come back and create a new SUNetID?
Answer: MaIS has a process for finding duplicates using things like SSN and birth date. In most cases there is a way to resolve the duplicate ID, but sometimes it has to be manual.
 
 
Question: When you do SAML and Shibboleth you get a unique ID. Is that the SUNetID?
Answer: Shibboleth and WebAuth use your SUNetID, but there might be a separate unique ID not provided by the registry.
 
Question: Is org chart / reporting information available in the registry?
Answer: No, it's not available in the Person Registry as Peoplesoft does not feed this information into the registry.
 
Question: Can you create batch SUNet accounts for sponsorship?
Answer: Not possible right now. If interested, talk to Helen Clark as she's exploring requirements.
 
 
WORKGROUP API
 
This API also provides POST in addition to GET. You can create a workgroup, add members, etc. This is used for example, by STARS to add you to workgroups of people have taken a particular class.
 
Question: Can you nest a workgroup?
Answer: Yes, you can add a member with a workgroup name.
 
Question: Does the API get you a list of SUNetIDs as the members? Does it do recursion if a member is a workgroup?
Answer: Yes, it does recursion for you.
 
Question: Can you get a list of all the workgroups a person is in?
Answer: You can get a list of privgroups from the Person XML which includes workgroups.
 
There are other services we didn't get to. Go to http://mais.stanford.edu 
 
 
OTHER
 
Question: is there a Sponsorship API?
Answer: Not right now. Let Grace know if you are interested in a Sponsorship API or any other APIs. In Sponsorship Manager, you can search for a person you are about to sponsor, and suggestions come up for possible matches.