Skip to Content.
Sympa Menu

grouper-users - RE: [grouper-users] SSO integration - grouper 2.3.0

Subject: Grouper Users - Open Discussion List

List archive

RE: [grouper-users] SSO integration - grouper 2.3.0

Chronological Thread 
  • From: "Hyzer, Chris" <>
  • To: "Singley, Norman" <>, Jeff McCullough <>, Travis Schmidt <>
  • Cc: Gouper Users List <>
  • Subject: RE: [grouper-users] SSO integration - grouper 2.3.0
  • Date: Fri, 23 Sep 2016 10:50:42 +0000
  • Accept-language: en-US
  • Authentication-results: spf=none (sender IP is ) ;
  • Ironport-phdr: 9a23:w9KJwhX+vglAHqH1z3KX0BpDTq3V8LGtZVwlr6E/grcLSJyIuqrYZh2Ct8tkgFKBZ4jH8fUM07OQ6P+wHzFbqs/c+Fk5M7VyFDY9wf0MmAIhBMPXQWbaF9XNKxIAIcJZSVV+9Gu6O0UGUOz3ZlnVv2HgpWVKQka3HUNPK+/0Ao/fidisn6D3osWLIlYAuD3oK4hzKhqyoBSV/u8Rm45rLOx5nj3OuH5BfaJtxGVnIV+CtxPn4YGt+YIl/ihN7bZp1cNOX+3fdI8lSbhfETsmezQ36cPlsBLrRwaV5XYYX3RQnxZVVUyN0AvzQJbq+hDxtu981DXSadHsRK41QnK55KduSRP0oCgCPj89tmrQj5ojorhcpUfrhw1tzpSQKKqVLvtlNOuJeNgaVHhMRO5QTCcHH5uxaY1JAuYca7UL57LhrkcD+EPtTTKnA/nin3oR3if7
  • Spamdiagnosticmetadata: NSPM
  • Spamdiagnosticoutput: 1:99

Does your apache config or web.xml require basic?  If so remove those config things





From: Singley, Norman [mailto:]
Sent: Thursday, September 22, 2016 5:03 PM
To: Jeff McCullough <>; Travis Schmidt <>
Cc: Hyzer, Chris <>; Gouper Users List <>
Subject: RE: [grouper-users] SSO integration - grouper 2.3.0


HI folks.


We’re working on implementing this as well, and I ran into a problem.  It does re-direct to our CAS (shibboleth) SSO, and I authenticate and get redirected back to grouper, but at that point, I get an http status 401 error “This request requires http authentication”. 


It’s a fresh install of grouper2.3.0.  I’m using servername:8080/grouper in the "GROUPER_SERVER" field. 


I did keep this line in, because without it, Tomcat would not start, but it is pointing to a blank file. 



Thanks for any help anyone can offer. 



Norman Singley

Directory Services

406 243 6799





From: [] On Behalf Of Jeff McCullough
Sent: Thursday, August 25, 2016 4:33 PM
To: Travis Schmidt
Cc: Hyzer, Chris; Gouper Users List
Subject: Re: [grouper-users] SSO integration - grouper 2.3.0


Thank you. I tried this out, and found it to work. Since we allow anyone to login to grouper, I changed the Realm to:






One can also add the SAML authenticator if they want to have more info returned and used to setup up roles. 





On Aug 24, 2016, at 11:28 AM, Travis Schmidt <> wrote:


I was able to get this to work by using the Tomcat integration on the Java CAS Client:



The context definition for Tomcat looks like this:


        <Context docBase="/ucd/opt/grouper-ui/dist/grouper" path="/grouper"
















          <!-- Single sign-out support -->








I didn't need to alter anything in the Grouper UI itself, just need to make sure that the logged in user was searchable by a source.




On Wed, Aug 24, 2016 at 11:12 AM Hyzer, Chris <> wrote:

Is anyone using CAS with Grouper 2.3?  How was it configured?


Do we need a servlet filter?







From: Jeff McCullough [mailto:]
Sent: Tuesday, August 23, 2016 3:23 PM

To: Hyzer, Chris <>
Cc: Gouper Users List <>
Subject: Re: [grouper-users] SSO integration - grouper 2.3.0


Yes, it doesn’t look like it doesn’t have an effect. 


Remote_user in index.jsp. This is the part that displays the username from REMOTE_USER. 




        <dt>Your user name:</dt>

        <dd><%= request.getRemoteUser()== null ? "null" : request.getRemoteUser() %></dd>






It is the same call in the index.jsp in the grouper UI root directory.


if(request.getRemoteUser()==null || "y".equals(request.getParameter("badRole"))) {








On Aug 22, 2016, at 8:29 PM, Hyzer, Chris <> wrote:


Ok, I need that setting when I do authn with apache, maybe you don’t need it.


How do you display REMOTE_USER in jsp exactly?





From: Jeff McCullough [
Sent: Monday, August 22, 2016 8:47 PM
To: Hyzer, Chris <>
Cc: Gouper Users List <>
Subject: Re: [grouper-users] SSO integration - grouper 2.3.0


Hi Chris,


For the grouper.ui.authentication.http.header parameter, I tried no value, $REMOTE_USER and REMOTE_USER. None of these changed the error behavior.


Tomcat server.xml doesn’t have that or any similar setting. 


For diagnostics of tomcat/CAS, I installed a small cas-client app that reads/displays REMOTE_USER via a request.getRemoteUser() call. It works as expected. 


Do you have any other ideas?





On Aug 20, 2016, at 7:33 AM, Hyzer, Chris <> wrote:


Is it $REMOTE_USER or just REMOTE_USER?   I don’t think you need to change that setting as you said…  but try editing it. 


Do you have tomcat server.xml setting:


<Connector port="8552" protocol="AJP/1.3" connectionTimeout="600000" request.tomcatAuthentication="false"

      URIEncoding="UTF-8" />


Or whatever the tomcat authn setting for your version is…





From:  [On Behalf Of Jeff McCullough
Sent: Friday, August 19, 2016 10:35 PM
To: Gouper Users List <>
Subject: [grouper-users] SSO integration - grouper 2.3.0


Hi all,


I’ve run into a snag with SSO integration this time around. I’ve actually done the procedure multiple times on other versions, and it was very easy to setup, no problems. This time with grouper 2.3.0, no workie.  Here’s what I’ve done:


I have the CAS 3.4.2 java client integrated with tomcat version 7 running on java 1.8. 


I removed the security-constraints, login-config, and security-role from the web.xml file. 


I modified the struts-config.xml with callLogin set to, though the previous step is where I start seeing the below error.


This seemed redundant (because REMOTE_USER is the default), but found it in a email thread where someone else was having the same issue.

I modified grouper.ui.authentication.http.header = $REMOTE_USER


Lastly I added the debug statement ( = DEBUG) in log4j with the result of:


2016-08-19 19:24:55,632: [http-bio-8443-exec-2] DEBUG GrouperUiFilter.remoteUser(636) -  - httpServletRequest.getRemoteUser(): null, $REMOTE_USER header: null, REMOTE_USER attribute: null, session.getAttribute(authUser): null, remoteUser overall: null


I’ve confirmed that the CAS client is in fact returning REMOTE_USER with correct user id. I modified the index.jsp within the grouper UI to display it, so I know grouper is seeing it. Yet, I get the error message:


You have an anonymous session since you are not logged in, but this section requires you to be logged in. Maybe No username found. Your identity provider might not be sending your username to this application. Either you need to use a different identity provider, or ask your IT department to send your username to this application.


Thanks in advance for any insights you may have.






Archive powered by MHonArc 2.6.19.

Top of Page