The VO participant life cycle typically begins with Enrolment Flows, which can be customised to meet the business processes of the VO. Typical enrolment patterns include invitation, self signup, and administrator- driven signup. As part of enrolment, attributes are collected from authoritative sources such as SAML assertions (e.g. ePPN, name, organisational affiliation) as well as from the Enrolee (user-asserted attributes such as preferred name or mobile phone). VO administrators can customise the attributes collected. Identifiers can be automatically assigned for new VO participants upon enrolment.

In order to facilitate management of larger VOs, COmanage supports delegated administration via a hierarchical model similar to LDAP OUs. Administrators can add roles and manage attributes for participants within their COU ("Collaborative Organizational Unit"). These roles can drive group memberships, which in turn can drive access to services. VO administrators may define Expiration Policies to automatically transition participants out of the VO based on various criteria, allowing for grace periods and other common termination patterns. Both human readable transaction history as well as database level point-in-time audit capabilities are provided.

Application or service integration primarily occurs via a plugin based provisioning infrastructure. Out of the box plugins include support for LDAP, a common application integration pattern, but custom plugins can be written as well. COmanage supports other types of plugins as well to facilitate various types of customisation. A REST API is also available.

COmanage supports various other identity management components. A typical deployment leverages the Shibboleth SP and EDS (though neither are required) for authentication services, and can be easily configured to work with Grouper to provide advanced group management capabilities. A proof-of-concept integration with OpenConext has also been successfully completed.

Supported standards