Grouper Users - Open Discussion List

["Hyzer, Chris" <>]

Look at WEB-INF/grouperPatchStatus.properties

 

You should have success for each patch here:

 

https://spaces.internet2.edu/display/Grouper/v2.3+Release+Notes

 

Especially the UI patch 7, which fixes this problem:

 

https://bugs.internet2.edu/jira/browse/GRP-1405

 

So… do they say success or do you need to run the installer again to apply the patches?  J

 

If its hard to tell please sent that file along J

 

Thanks

Chris

 

 

 

From: Akki Kumar [mailto:]
Sent: Wednesday, May 03, 2017 12:46 PM
To: Hyzer, Chris <>
Cc:
Subject: Re: CSRF Error (Grouper 2.3.0 login w/ Cas)

 

Hi Chris,

 

Added Owasp.CsrfGuard.overlay.properties file to below link:

 

https://drive.google.com/open?id=0BwgGnZC7vA-6dHhLNWpFMmVvSVU

 

Thank you,

Akki

 

 

On Wed, May 3, 2017 at 12:01 PM, Hyzer, Chris <> wrote:

Please send me the file:

 

/tmp/grouperInstaller_v2_2_3/grouper.ui-2.3.0/dist/grouper/WEB-INF/classes/Owasp.CsrfGuard.overlay.properties

 

Thanks

Chris

 

From: Akki Kumar [mailto:]
Sent: Wednesday, May 03, 2017 10:08 AM
To: Hyzer, Chris <>
Cc:
Subject: Re: CSRF Error (Grouper 2.3.0 login w/ Cas)

 

Hi Chris,

 

Thank you for the prompt reply. Below link contains grouper logs from today (after starting tomcat). Also, during Grouper 2.3.0 installation, the installer ran and added all patches without any errors.

 

https://drive.google.com/open?id=0BwgGnZC7vA-6dHhLNWpFMmVvSVU

 

Note: The logs files, grouper_bench.log & grouper_debug.log are empty.

 

Thank you,

Akki

 

On Wed, May 3, 2017 at 8:56 AM, Hyzer, Chris <> wrote:

Are you fully patched?  Stop tomcat, delete all logs, put this in log4j.properties:

 

log4j.logger.edu.internet2.middleware.grouper.ui.GrouperUiFilter = DEBUG

 

start tomcat, and send all logs.

 

Thanks

Chris

 

From: Akki Kumar [mailto:]
Sent: Tuesday, May 02, 2017 3:06 PM
To: Hyzer, Chris <>
Cc:
Subject: CSRF Error (Grouper 2.3.0 login w/ Cas)

 

Hi Chris,

 

I installed Grouper 2.3.0 (Fresh Installation) and Tomcat 8.5.12. After login to the Grouper, UI displays below error:

 

Maybe your session timed out and you need to start again. This should not happen under normal operation. CSRF error.

I clicked on the "start over" link and I get below error:

You have an anonymous session since you are not logged in, but this section requires you to be logged in. Maybe No username found. Your identity provider might not be sending your username to this application. Either you need to use a different identity provider, or ask your IT department to send your username to this application.

 

As per below ticket (GRP-996), CSRF bug is fixed in 2.2.0, but the error is still showing up for the Grouper 2.3.0. What configuration are needed to fix this issue?

 

https://bugs.internet2.edu/jira/browse/GRP-996

 

Thank you,

Akki