Grouper Users - Open Discussion List

[Akki Kumar <>]

Hi Chris,

Added Owasp.CsrfGuard.overlay.properties file to below link:

https://drive.google.com/open?id=0BwgGnZC7vA-6dHhLNWpFMmVvSVU

Thank you,

Akki

On Wed, May 3, 2017 at 12:01 PM, Hyzer, Chris <> wrote:

Please send me the file:

 

/tmp/grouperInstaller_v2_2_3/grouper.ui-2.3.0/dist/grouper/WEB-INF/classes/Owasp.CsrfGuard.overlay.properties

 

Thanks

Chris

 

From: Akki Kumar [mailto:]
Sent: Wednesday, May 03, 2017 10:08 AM
To: Hyzer, Chris <>
Cc:
Subject: Re: CSRF Error (Grouper 2.3.0 login w/ Cas)

 

Hi Chris,

 

Thank you for the prompt reply. Below link contains grouper logs from today (after starting tomcat). Also, during Grouper 2.3.0 installation, the installer ran and added all patches without any errors.

 

https://drive.google.com/open?id=0BwgGnZC7vA-6dHhLNWpFMmVvSVU

 

Note: The logs files, grouper_bench.log & grouper_debug.log are empty.

 

Thank you,

Akki

 

On Wed, May 3, 2017 at 8:56 AM, Hyzer, Chris <> wrote:

Are you fully patched?  Stop tomcat, delete all logs, put this in log4j.properties:

 

log4j.logger.edu.internet2.middleware.grouper.ui.GrouperUiFilter = DEBUG

 

start tomcat, and send all logs.

 

Thanks

Chris

 

From: Akki Kumar [mailto:]
Sent: Tuesday, May 02, 2017 3:06 PM
To: Hyzer, Chris <>
Cc:
Subject: CSRF Error (Grouper 2.3.0 login w/ Cas)

 

Hi Chris,

 

I installed Grouper 2.3.0 (Fresh Installation) and Tomcat 8.5.12. After login to the Grouper, UI displays below error:

 

Maybe your session timed out and you need to start again. This should not happen under normal operation. CSRF error.

I clicked on the "start over" link and I get below error:

You have an anonymous session since you are not logged in, but this section requires you to be logged in. Maybe No username found. Your identity provider might not be sending your username to this application. Either you need to use a different identity provider, or ask your IT department to send your username to this application.

 

As per below ticket (GRP-996), CSRF bug is fixed in 2.2.0, but the error is still showing up for the Grouper 2.3.0. What configuration are needed to fix this issue?

 

https://bugs.internet2.edu/jira/browse/GRP-996

 

Thank you,

Akki