Wiki Home

Grouper Release Announcements

Grouper Guides

Grouper Deployment Guide

Community Contributions

Internal Developer Resources

When upgrading from Grouper v2.5 to another v2.5 container, this wiki will consolidate all the steps needed to perform that upgrade

Note, these are in reverse order, so go from bottom to top

DateUpgrading from versionUpgrading to VersionNote for versionImportanceStep needed if...DescriptionJira
2023/11/04v2.5.0-v2.5.68ALL2.5.69Not important

GRP-5107

If you were affected by the authentication bypass vulnerability and installed the remediation

You can safely remove the remediation

2021/09/02ALLALL2.5.55Medium importantYou use GrouperGo to the daemon screen after upgrade and click "More actions → Schedule jobs"
2021/09/01ALLALL2.5.55Not importantYou want to prevent deletion of attribute names through the UINew optional UI property uiV2.attributeDefName.preventDeleteInUi can be set to true, so that if an admin accidentally tries to delete an attribute name, it will show an error instead of deleting all the assignments and the attribute name. Either WS or GSH can still be used to delete and attribute nameGRP-2852
2021/09/01ALLALL2.5.55Not ImportantYou have a custom UI depending on the Lite UI JSP templates or other Struts v1

Until 2.5.55, custom JSP tag definitions were packaged with the Docker container, while the Java libraries they depended on were not, thus causing startup errors. In GRP-3346 these *.tld files were moved to the legacy directory (folder grouper-misc/grouper-legacy-ui in the source repository). If you have a custom image incorporating the Admin UI jsp pages, you may need to update jsp templates, and include new files in your image (download from Github or your local Git copy):


GRP-3346
2021/07/28ALLALL2.5.53Not importantYou get an error viewing grouper loader list of groups loader config

Run this from GSH

edu.internet2.middleware.grouper.misc.GrouperStartup.initLoaderType()

GRP-3548

2021/05/27ALLALL2.5.52ImportantYou use Grouper

There is a new status URL outside of the normal /grouper or /grouper-ws path. 

If you do not need this, you should disable it.

If nothing specified, there is a new status path: /status_grouper/status

If you don't want this, set: -e GROUPER_APACHE_STATUS_PATH=none

If you want it something different, do this: -e GROUPER_APACHE_STATUS_PATH=/status2_grouper/status

GRP-3467

2021/05/27v2.5.*ALL2.5.52ImportantIf you use GrouperDDL updates

GRP-3439

2021/05/26v2.5.51-v2.5.52+2.5.52Not importantIf you use the Grouper feature "Custom UI"You need to convert the configuration to config files from attributes (contact Chris for specifics)

GRP-3483

2021/05/26v2.5.*ALL2.5.52Not importantIf you are using the new provisioning framework

There have been changes to the way indirect provisionable data is stored.  Run the following using GSH to clean up old assignments:

edu.internet2.middleware.grouper.app.provisioning.GrouperProvisioningService.deleteInvalidIndirectProvisioningAssignments()

GRP-3439

2021/05/16ALLALL2.5.52Not importantIf you have a servlet or filter mapped to other URLs than are built in to Grouper (not common)Register extra CSRF urls (dynamic content) in grouper-ui.properties

GRP-3450

2021/04/28ALLALL2.5.49Not importantIf you have change log consumers or message producers that expect "type" attributes (e.g. policy) to be applied when group is created (and not a minute afterwards)The inherited metadata for grouper types, attestation, provisioning, and deprovisioning are now handled in daemons which do full syncs (daily) and each minute an incremental sync.  So after a group is created, it takes a minute for "policy" to be inherited from an ancestor folder for example.

GRP-3385
GRP-3436
GRP-3435
GRP-3363


2021/04/28ALLALL2.5.49ImportantYou want special characters in object extensions besides underscore and dash and do not have a regex configured

Grouper now ( by default if not other extension regex validation specified ) restricts creating new objects with special chars (besides underscore and dash)

To restore previous default set these settings in grouper.properties to false:

stem.validateExtensionByDefault = false
group.validateExtensionByDefault = false
attributeDef.validateExtensionByDefault = false
attributeDefName.validateExtensionByDefault = false

GRP-3430

GRP-3431

GRP-3432

GRP-3433


2021/04/26ALLALL2.5.49Medium importantYou want to allow objects with same name and different caseGrouper now ( by default ) restricts creating new objects with same name and different case (e.g. "ref:test" and "ref:Test")

To restore previous default set these settings in grouper.properties to false:

grouperHook.StemUniqueNameCaseInsensitiveHook.autoRegister = false
grouperHook.GroupUniqueNameCaseInsensitiveHook.autoRegister = false
grouperHook.AttributeDefUniqueNameCaseInsensitiveHook.autoRegister = false
grouperHook.AttributeDefNameUniqueNameCaseInsensitiveHook.autoRegister = false

GRP-3423

GRP-3424

GRP-3425

GRP-3426

2021/03/30ALLALL2.5.49Not importantIf you use container STDOUT logging (not to host files, not overridden log4j.properties)Review this commit to see if you want to resurrect any log4j.properties settings that were removed

GRP-3325

2021/03/27ALLALL2.5.47Not importantIf you use GrouperRefactor grouper.properties email settings.  See Jira for details

GRP-3313

2021/03/17ALLv2.5.442.5.45Not importantIf you configured a GSH template in 2.5.44Pull up the template in the editor wizard, and make sure there are no invalid entries.  Save.  Pull up a random folder and group in UI and make sure they display.

GRP-3250

2021/03/07ALLv2.5.*2.5.45Not importantIf you use GrouperMySQL and Postgres database drivers were updated.  If it is not working, then you need to delete the driver in a container hook script and overlay the previous version in the lib dir

GRP-3222

GRP-3198

2021/02/22ALLALL2.5.43ImportantIf you have an LDAP external system which uses TLSThe TLS flag in LDAP external systems now defaults to false instead of true.  If you don't have this set and you are using TLS, set it to true.  You can setup a test filter in the
external system and test it from the UI. If you have this as "false" explicitly, you can remove that config since the new default is false.

GRP-3162

2021/02/19ALLv2.5.*2.5.43Not importantIf you have any GSH or SQL script daemons

Add in grouper-loader.properties for each GSH/SQL other job daemon specifying if it is a script or a file, e.g.

otherJob.<scriptDaemonConfigKey>.fileType = script
-or-
otherJob.<scriptDaemonConfigKey>.fileType = file


GRP-3157

2021/02/01ALLv2.5.*2.5.41Medium importantIf you use SSL in your container with apacheAfter upgrading make sure SSL is working and make sure the container file /etc/httpd/conf.d/ssl-enabled.conf is ok
Review the 2.5.41 new env vars for container

GRP-3021

GRP-3108

2021/1/27Allv2.5.*2.5.40ImportantIf you use GrouperIf you were using SELF_SIGNED_CERT=true, change to GROUPER_SELF_SIGNED_CERT=true
Look at the output when the container starts and see if there is an error and if so adjust the env vars you pass to the container

GRP-3102

2021/1/27Allv2.5.*2.5.40ImportantIf you use GrouperDDL updates

GRP-3058

2020/12/07Allv2.5.*2.5.38ImportantIf you use GrouperDDL updates
2020/10/20Allv2.5+2.5.36Not importantIf you want to make sure inherited privs get converted correctly

Either run the Upgrade Task daemon or let it run, then query for inherited privilege rules that arent owned by GrouperSystem, there should be none.   Use the application template, after that still should be none.

select
	attribute_assign_id,
	assigned_to_stem_name,
	rule_check_type,
	rule_check_stem_scope,
	rule_then_enum_arg1,
	rule_act_as_subject_id,
	rule_act_as_subject_source_id
from
	grouper_rules_v
where
	rule_act_as_subject_id != 'GrouperSystem'
	and assigned_to_type = 'stem'
	and rule_check_type in ('attributeDefCreate' , 'stemCreate' , 'groupCreate')
	and rule_then_enum in ('assignAttributeDefPrivilegeToAttributeDefId' , 'assignStemPrivilegeToStemId' , 'assignGroupPrivilegeToGroupId')

GRP-2926

2020/10/20ALLv2.5.*2.5.36Medium importantIf your IdP timeout is not 10 hoursThe default tomee session timeout is now 10 hours instead of 30 minutes in the UI.  And 1 minute instead of 30 minutes in the WS.  Change this default in your UI to your IdP SSO length with container env var: GROUPER_TOMCAT_SESSION_TIMEOUT_MINUTES

GRP-2967

2020/10/20Allv2.5.*2.5.36ImportantIf you use GrouperLook at the startup logs for the container to make sure there are no errors, and make sure file customizations still work

GRP-2994

DateUpgrading from versionUpgrading to VersionNote for versionImportanceStep needed if...DescriptionJira
2020/09/16v2.4+v2.5.39
(included in .40+)		2.5.35ImportantIf you have configuration in the database

You will not see history for existing DB configs until you run the SQL in your DB, see jira.
This also causes a null pointer exception if you dont run it.

GRP-2947

2020/07/21Allv2.5.*2.5.33ImportantIf you use GrouperDDL updates
2020/07/21v2.5.25+v2.5.*2.5.33Probably not importantIf you have a recent membership group configuredAfter upgrade, run the "Upgrade Tasks" daemon, or wait an hour.  If you have used "recent memberships" you will see the attributes moved from the source group to the target group.

GRP-2874

2020/07/21Allv2.5.*2.5.33ImportantIf you use LDAP and are interested in pool validationThis defaults to validate connections periodically instead of on checkout for performance reasons.  See Jira for details.  The default is now to check pool every 30 minutes, you probably want to set something lower.

GRP-2863

2020/07/21v2.5.*v2.5.*2.5.33Not importantIf you are expecting apache indexes to be on (previous default)Set the container env var to get previous behavior:
GROUPER_APACHE_DIRECTORY_INDEXES=true

GRP-2862

2020/07/21Allv2.5.*2.5.33Might be importantIf you are putting configs in the DB and want to import externalized text config to DB: grouper.text.en.us.propertiesImport that file to the DB and remove from container overlay or mount

GRP-2807

2020/07/21Allv2.5.*2.5.33ImportantIf you overlay the server.xml and not use ENV vars to configureYou need to make sure the ajp connector will work:
secretRequired="false" address="0.0.0.0" allowedRequestAttributesPattern=".*"

GRP-2851

2020/07/21v2.5.25+v2.5.*2.5.33ImportantIf your loader query or group_loader query in the group: 
etc:attribute:recentMemberships:grouperRecentMembershipsLoader
is not a simple select from a view		Delete that group, restart grouper (any service), see the group recreated with the correct query.  Make sure it is scheduled and run the loader job once.

GRP-2893

2020/07/21AllAll2.5.33Might be importantBasic auth passwords (e.g. WS) cannot contain colonsChange those passes, or look at this Jira to support colons in passes (and
not usernames) GRP-3163

GRP-2800

GRP-3163

2020/05/13v2.5.*v2.5.*2.5.29Not importantIf you care about the log prefix of logs or need 
to revert to old behavior		-e GROUPER_LOG_PREFIX=grouper

Log prefix.  By default it is "grouper-ui' for ui-only container.  grouper-ws for ws-only.  grouper-scim for scim-only.  grouper-daemon for daemon-only.  Or "grouper" if not set to something else.

GRP-2772

2020/05/13v2.5.*v2.5.*2.5.29Not importantIf you use any of these env vars in your Dockerfile or container: RUN_APACHE,  RUN_SHIB_SP, 
 RUN_TOMEE,  RUN_HSQLDB,  SELF_SIGNED_CERT		Add prefix GROUPER_ to themGRP-2776
2020/05/13v2.5.*v2.5.*2.5.29ImportantIf you are overlaying or replacing text in files that can use new env vars, use thoseReview v2.5.28 changes on  container documentation page .NA
DateUpgrading from versionUpgrading to VersionNote for versionImportanceStep needed if...DescriptionJira
2020/05/05v2.5.*v2.5.35v2.5.27ImportantIf you overlay the grouper.xml or grouper-www.conf, and not from the shell hook methodYou should patch these files correctly from the shell script hook

GRP-2749

2020/05/05Allv2.5.*v2.5.27ImportantIf you use GSH scriptsIf you have cron'ed GSH scripts or run GSH script manually, the error handling changed, which might affect how these complete.  See JiraGRP-2732
2020/05/05Allv2.5.*v2.5.27Not importantIf you have usdu or badMembership in your grouper-loader.properties configSome jobs were split out to have single purpose daemons, see Jira for details

GRP-2722

2020/05/05Allv2.5.*v2.5.27Not importantIf you use WS or UI diagnostics URL (/status) and do not want group names in diagnostics outputYou can report an abbreviated list for diagnostics if you like

GRP-2719

2020/05/05v2.4+ (container)v2.5.*v2.5.27ImportantIf you use /opt/grouper/lib directory in containerWe used to copy this directory to /opt/grouper/grouperWebapp/WEB-INF/lib, but no longer.  Mount or copy to the right place.  See Jira for details.

GRP-2740

2020/05/05v2.5.25+v2.5.*v2.5.27Not importantIf you dont want a temporary diagnostics errorYou might want to run the recent memberships loader job manually after upgrading so you don't get diagnostics errors of a daemon that hasn't run

GRP-2723

2020/04/21Allv2.5.*v2.5.23Probably not importantIf you have dbUrl in subject.propertiesDatabase connections in grouper are configured in grouper-loader.properties, move it there.  See Jira for details

GRP-2679

2020/04/21Allv2.5.*v2.5.23Probably not importantIf you use vt-ldapIf you know that you use the vt-ldap interface, or if you search your configs for "vt", follow the instructions in the Jira.  Only ldaptive is supported now.

GRP-2696

2020/04/21Allv2.5.*v2.5.23ImportantIf you have morph string secret configured in external file from morphString.properties

encrypt.key = /some/path/morph.secret		Carefully inspect your morphString.properties and see if there is a newline in your secret file path: /some/path/morph.secret
If so, then set this in morphString.properties

encrypt.trimWhitespaceFromMorphSecretFile = false

GRP-2687

2020/04/21Allv2.5.*v2.5.23Not importantIf you configured the workflow scheduleSearch for "workfow" in grouper-loader.properties, change to "workflow"

GRP-2689

2020/04/21Allv2.5.*v2.5.23Not importantIf you use grouper jars outside of containerYou can remove base properties files in classpath

GRP-2683

2020/04/08v2.4v2.5.*v2.5.22

Upgrade instructions from v2.4 to v2.5



  • No labels