Welcome to Virtual Grouper training. 

The Grouper Training Environment (GTE) is a set of lesson plans, training exercises, and supporting Docker modules. Students are able to bring up a full training environment by running a simple command. The GTE provides all the necessary components and configuration to go from learning basic Grouper operations, to exploring the access governance concepts presented in the Grouper Deployment Guide (GDG). The focus of the GTE is Grouper installation, configuration, design, and operation. Little to no technical experience is required to complete the Grouper training.

The training environment will be made available to students via Amazon Web Services (AWS).  The student will only need a connection to the Internet and a suitable SSH client (e.g. OpenSSH on UNIX/Linux/Mac systems or PuTTY on Windows).  IP addresses and credentials will be provided during the class.

Session information

  • We will be taking short breaks throughout the day
  • To keep things flowing well, please refrain from using the Zoom chat window. Instead, use the dedicated Slack channel for your discussions!
  • VMs will be opened up several days before the class. They will remain open for two weeks after the class so that you can practice the lab exercises.
  • Ask ALL of your questions. There are no dumb questions.


  1. Connect to your AWS instance from your computer
  2. Install "Kahoot!" (learning and trivia app) on your phone or preferably a device not used by zoom
  3. Install the Zoom app if you do not already have it
    1. It is nice if you have a camera available that you can turn on from time to time so we can all put names to faces
  4. Install the Slack app if you do not already have it and make sure you are in the grouper-school-spring2022 channel
  5. Review these commands that you will need (located in the GTE)
  6. If you do not know linux, here is a 5 minute lesson
  7. Unix text editor, you need to be able to edit a file (there are only a few exercises that require this) with nano, vi, or emacs.  If you know how to use one of these, then you are good.  If not:
    1. "nano" is easiest, here is a 2 minute lesson
    2. If you prefer “vi”, here is an 8 minute lesson
  8. Read the Grouper Deployment Guide

Computer setup the morning of training

  1. If you have a phone or device not used for zoom, have that available with Kahoot! running. 
    1. You do not need to sign in to Kahoot but when using it please enter your real first and last name
  2. If you have multiple monitors available, that would be useful but not required
    1. Might be nice to not use a separate computer for Zoom and exercises, so you can share your screen if needed
  3. Open the Slack app to the class channel
  4. Open the Zoom app and connect to the Main zoom meeting (pinned from slack channel)
    1. Please mute yourself and either keep your camera on or be prepared to turn it on while speaking so we can put names to faces
  5. Open your terminal or SSH client (from pre-work <above> and slack pin) and connect to your GTE instance
    1. Run this command

      ./gte 101.1.1
    2. Leave that terminal/ssh window open.  Be prepared to reconnect if your SSH tunnel disconnects (e.g. when your browser stops working)
  6. Close all your browsers and tabs
  7. Open Chrome (or firefox if you don't have Chrome)
    1. Tab 1: GTE Jump page: https://localhost:8443/
    2. Tab 2: Grouper admin account:  https://localhost:8443/grouper/   (banderson/password)
    3. Tab 3: Text to copy/paste
    4. Tab 4: GTE commands
    5. Tab 5: SQL manager: https://localhost:8443/phpmyadmin/   (root/<no password>)
    6. Tab 6: LDAP manager: https://localhost:8443/phpldapadmin/  (cn=root,dc=internet2,dc=edu/password)
  8. We need another Grouper non-admin session.  Either open an incognito Chrome window (if other tabs are not incognito), or open a different browser (e.g. Firefox instead of Chrome)
    1. Tab 1: Grouper non-admin account:  https://localhost:8443/grouper/   (jsmith/password)
  9. Open a text editor e.g. notepad (windows) or notes (mac)

GTE commands - Simple commands to run GTE courses and interact with the environment

Text to copy/paste - Text from slides to copy and paste easily

Grouper Deployment Guide - Grouper concepts, standards, and best practices

Kahoot - for periodic quizes


Tuesday (Day 1)

  • 12:00-12:45 - Intro
  • 12:45-1:15 - 201.1.1 Basis and reference groups part 1
  • 1:15-1:30 - Break
  • 1:30-2:00 - 201.1.2 Basis and reference groups part 2
  • 2:00-2:45 - 201.2 Access policy groups
  • 2:45-3:00 - Break
  • 2:30-3:15 - 201.3 eduPersonAffiliation
  • 3:15-3:45 - 201.4 Policy groups and static application permissions
  • 4:45-4:15 - Discussion
  • 4:15-4:30 - Break
  • 4:30-5:00 - 201.4 Continued

Wednesday (Day 2)

  • 12:00 - 12:30 Finish up 201
  • 12:30 - 12:45: 211.0 priv. Intro
  • 12:45 - 1:00: 211.1 folder privs
  • 1:00 - 1:15: 211.2 group provs
  • 1:15 - 1:30: break
  • 1:30 - 2:10: 211.3 attribute privs
  • 2:10 - 2:25: 211.4 security groups
  • 2:25 - 2:35: 211.5 system accounts
  • 2:45 - 2:45: 211.6 inherited privs
  • 2:45 - 3:00: break
  • 3:00 - 3:30: 311.0 container intro
  • 3:30 - 3:40: 311.1 docs
  • 3:45 - 4:15: 311.2 quickstart
  • 4:15 - 4:30: break
  • 4:30 - 4:50: 311.3 Maturity 0
  • 4:50 - 5:00: 311.5 Maturity 2+

Thursday (Day 3)

  • 12:00 - 12:40: Containers and GTE
  • 12:40 - 1:15: 301.1: Components
  • 1:15 - 1:30: break
  • 1:30 - 2:15: 301.2:  Diagnostics
  • 2:15 - 2:45: 301.3: Configuration management
  • 2:45 - 3:00: break
  • 3:00 - 4:15: 301.4: Grouper shell
  • 4:15 - 4:30: break
  • 4:30 - 5:00: 301.5: Notifications

Friday (Day 4)

  • 12:00 - 12:20: 301.6 Subject sources
  • 12:20 - 12:40: 301.7 Ldap loader
  • 12:40 - 1:15: 301.8 GSH templates
  • 1:15 - 1:30: break
  • 1:30 - 2:45: 401.1 VPN use case
  • 2:45 - 3:00: break
  • 3:00 - 4:15: 401.2 VPN use case
  • 4:15 - 4:30: break
  • 4:30 - 5:00: Discussion and final instructions

GTE app links (once connected and a lesson is started)

Jump pagehttps://localhost:8443/ 
Links applications
Grouperhttps://localhost:8443/grouper/Admin: banderson/password
Civilian: jsmith/password
Grouper UI application
Database managerhttps://localhost:8443/phpmyadmin/root / <no password>Phpmyadmin Mysql database manager
LDAP managerhttps://localhost:8443/phpldapadmin/username: cn=root,dc=internet2,dc=edu
password: password
Phpldapadmin LDAP administration
Messaging managerhttps://localhost:8443/rabbitmq/username: guest
password: guest
Rabbitmq messaging administration
Shibboleth attributeshttps://localhost:8443/app
Simple screen to show login state

Other info linked from slack "bookmarks"

Corrections on 101 material

The slides are generally up to date, but the movies are out of date.  Thanks for your patience.  Note, you can change the playback speed (e.g. 1.5x or 2x) to process these quicker (smile)

One general note, the names of buttons, and the options in menus have changed (ahem... improved).  Expect a little bit of a scavenger hunt there...


  • LDAP sync.  The exercise does not work successfully.  You can set up the job, but it will not run correctly.  Please proceed with the rest of the video.

Improved database browser and LDAP browser

The ldap/database browsers in the GTE are web based browser and might not be the easiest to use or might not be what you are familiar with.  If you have a MySQL admin tool you can use that, or if you want a suggestion, install DBeaver community edition (free).  If you have an LDAP browser you can use that, or if you want a suggestion, install Apache Directory Studio (free).

  1. Make sure you dont have anything listening on 3306 or 8389 on your computer (or map other ports)
  2. You will want to change your connection string to tunnel the port to your computer


    ssh -L 8443:localhost:8443 -l student <ip address>


    ssh -L 8443:localhost:8443 -L 3306:localhost:3306 -L 8389:localhost:389 -l student <ip address>
  3. When starting a GTE module, tell it to expose mysql/ldap from the container


    gte <container name>


    gte --sql --ldap <container name>
  4. Connect to mysql from DBeaver or another mysql browser

    <no password>
  5. Connect to ldap from Apache directory studio or another ldap browser



If you have any questions about the workshop or its technical content, please send a note to Jean at jeanc@internet2.edu.

You can also use the dedicated Slack channel for an even faster response.

Run locally

  1. First install docker on mac or docker desktop on windows (or linux)
  2. Then spin up the GTE:

C:\Users\mchyzer-local> docker run -d -p 8443:443 --name 101.1.1 tier/gte:101.1.1-202310
  • No labels