Skip to Content.
Sympa Menu

grouper-users - [grouper-users] RE: CSRF Error (Grouper 2.3.0 login w/ Cas)

Subject: Grouper Users - Open Discussion List

List archive

[grouper-users] RE: CSRF Error (Grouper 2.3.0 login w/ Cas)


Chronological Thread 
  • From: "Hyzer, Chris" <>
  • To: Akki Kumar <>
  • Cc: "" <>
  • Subject: [grouper-users] RE: CSRF Error (Grouper 2.3.0 login w/ Cas)
  • Date: Wed, 3 May 2017 16:01:36 +0000
  • Accept-language: en-US
  • Authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=isc.upenn.edu;
  • Ironport-phdr: 9a23:j+E2qRLh0rN9x9Pr/NmcpTZWNBhigK39O0sv0rFitYgfLPrxwZ3uMQTl6Ol3ixeRBMOAuqwC1rud4vuocFdDyK7JiGoFfp1IWk1NouQttCtkPvS4D1bmJuXhdS0wEZcKflZk+3amLRodQ56mNBXdrXKo8DEdBAj0OxZrKeTpAI7SiNm82/yv95HJbQhFgDuwbalyIRiyogncsscbipZ+J6gszRfEvmFGcPlMy2NyIlKTkRf85sOu85Nm7i9dpfEv+dNeXKvjZ6g3QqBWAzogM2Au+c3krgLDQheV5nsdSWoZjBxFCBXY4R7gX5fxtiz6tvdh2CSfIMb7Q6w4VSik4qx2ThLjlSUJOCMj8GzPisJ+kr9VoA6vqRJ8zY7bYoCVO+Zxca7GZ9wWWXZNU9xNWyBdAI6xaZYEAeobPeZfqonwv1UCoxm+BAitGuzv0CdEjWLo0K06yeQhEBrG0AI9FN8JtXTbsNX1NacTUO+r1qnF1jTDb+hK1jvn9YjIag4uofeKXb5qb8Xe1FQvGhrDg16Np4LlODaV2f4Ms2id9+dgWuWvi2koqwF1vDej3Nsjio7Mho4Ny1DE8zl5z5gvJd2+VkF7fcCoHIFOuC6HKot6WsciQ2ZnuCY11LIGo4S3czYXx5Q6wRPUdv+Jc5CQ7x79TumdPSp0iXd4dL6imhq/9Eagx+LgWsWo1VtHrDRKn9bRun0I0hHf9NSLR/ll8ku81zuDyxrf5+VZLUwui6bXNposzqQtmpcRsEnOGDL9ll/sg6+MbEok//Cl6+T5bbXioZ+RL5d6hx35PKgyh8CzGPk1PBAAUmSC/uSzz6Ps8Vf+QLVXkv05ia7ZsI3cJcsGvKK5GxVV0oE/6xmhEzimzNUYnX4BLF5ffxKHkpTpO1XJIPD/DvezmUijkDBux/zeP73hBIvCLmTbnbv/Z7lx91NQxQ8uwdxC+p5ZD78BLf3vVkPtsdHVDAE2PgOpz+viDdhxyJ8SVGCXDq+cKqzSsFuI5uw1I+mLYY8YoDP9JOQl5//ujH42h0UdcLKo3ZsMdH+0BOlmI12HbnrqhNcNC3kFsRcjTODykl2NTSZTZ2quX6I7/jw7B5imDYDeRoC1nrOBxj63HoBNZm9YEFCMCmzld4GFW/cXdCKSOdFtniYFVbinV48uywuutAnkxLp7MObY4DMXuo/+1Is92+qGvBIx9HRXEsGUySnZRmR9jGIOSCYr0btjoEt70Q/bjoB3hvVZEZpY4PYfASkgMpuJhcxrGd3oHkrqfs2IUxzuFtCtASAjQ8gZwsQFJVtlFtOkyB3Pwnz5UPcui7WXCclsoern1H/rKpMlxg==
  • Spamdiagnosticmetadata: NSPM
  • Spamdiagnosticoutput: 1:99

Please send me the file:

 

/tmp/grouperInstaller_v2_2_3/grouper.ui-2.3.0/dist/grouper/WEB-INF/classes/Owasp.CsrfGuard.overlay.properties

 

Thanks

Chris

 

From: Akki Kumar [mailto:]
Sent: Wednesday, May 03, 2017 10:08 AM
To: Hyzer, Chris <>
Cc:
Subject: Re: CSRF Error (Grouper 2.3.0 login w/ Cas)

 

Hi Chris,

 

Thank you for the prompt reply. Below link contains grouper logs from today (after starting tomcat). Also, during Grouper 2.3.0 installation, the installer ran and added all patches without any errors.

 

 

Note: The logs files, grouper_bench.log & grouper_debug.log are empty.

 

Thank you,

Akki

 

On Wed, May 3, 2017 at 8:56 AM, Hyzer, Chris <> wrote:

Are you fully patched?  Stop tomcat, delete all logs, put this in log4j.properties:

 

log4j.logger.edu.internet2.middleware.grouper.ui.GrouperUiFilter = DEBUG

 

start tomcat, and send all logs.

 

Thanks

Chris

 

From: Akki Kumar [mailto:]
Sent: Tuesday, May 02, 2017 3:06 PM
To: Hyzer, Chris <>
Cc:
Subject: CSRF Error (Grouper 2.3.0 login w/ Cas)

 

Hi Chris,

 

I installed Grouper 2.3.0 (Fresh Installation) and Tomcat 8.5.12. After login to the Grouper, UI displays below error:

 

Maybe your session timed out and you need to start again. This should not happen under normal operation. CSRF error.


I clicked on the "start over" link and I get below error:

You have an anonymous session since you are not logged in, but this section requires you to be logged in. Maybe No username found. Your identity provider might not be sending your username to this application. Either you need to use a different identity provider, or ask your IT department to send your username to this application.

 

As per below ticket (GRP-996), CSRF bug is fixed in 2.2.0, but the error is still showing up for the Grouper 2.3.0. What configuration are needed to fix this issue?

 

 

Thank you,

Akki

 


Archive powered by MHonArc 2.6.19.

Top of Page