Grouper Users - Open Discussion List

["Redman, Chad" <>]

Ah, missed the https vs. http. I think this is what we needed to get past that:

 

Owasp.CsrfGuard.overlay.properties

org.owasp.csrfguard._javascript_Servlet.refererMatchDomain = false

 

 

From: [mailto:] On Behalf Of Redman, Chad
Sent: Tuesday, October 30, 2018 10:32 AM
To: Coleman, Erik C <>;
Subject: [grouper-users] RE: Grouper 2.4 UI problem with Setting Attributes

 

Do you have sticky sessions set in the load balancer? The CSRF tokens are generated per server.

 

From: [] On Behalf Of Coleman, Erik C
Sent: Tuesday, October 30, 2018 9:45 AM
To:
Subject: [grouper-users] RE: Grouper 2.4 UI problem with Setting Attributes

 

Brett, thanks,

 

I am not explicitly accessing the site insecurely, but I think you’re on to something.  We have redirects to HTTPS, but furthermore, since SSL is terminated at the AWS app load balancer, all the SSL is stripped out of the UI container in the Apache and Tomcat configs, but maybe there’s something amiss.

 

I’m no Java (or _javascript_) expert, so what function in the UI is having me try to access this link on HTTP and not HTTPS?:

 

http://authman-test.techservices.illinois.edu/grouper/grouperExternal/public/OwaspJavaScriptServlet

 

Is this something I can change in a properties file?

 

-Erik

 

 

From: Brett Bieber <>
Sent: Tuesday, October 30, 2018 8:24 AM
To: Coleman, Erik C <>;
Subject: Re: Grouper 2.4 UI problem with Setting Attributes

 

Hi Erik,

We're doing the same here at Nebraska and not having any issues, so I don't think it's a UI bug. I can't tell in the first screenshot if you were accessing the site securely or not, but I noticed the error message indicated an http vs https difference even though the domain name was the same. Is it possible you were accessing the site via an insecure URL and the config is set to https? We've got ours configured to redirect any requests to http:// to https:// at the load balancer. Hope that helps.

-Brett

---

From: <> on behalf of Coleman, Erik C <>
Sent: Monday, October 29, 2018 6:09:00 PM
To:
Subject: [grouper-users] Grouper 2.4 UI problem with Setting Attributes

 

I’m running into a snag with the new Grouper 2.4 (running from container tier/grouper:2.4.0-a2-u0-w0-p0).  I’m wanting to demonstrate how group owners can selectively choose to have their groups or folders sync to our AD via our PSPNG config. I select a group or folder and choose “More Actions” -> “Attribute Assignments” and assign an attribute, it seems to work, but then I get this strange error “ErrorType; LoadXML Description: Incorrect XML”:

 

 

Then if I click OK, then attempt to choose the action to assign a value to that attribute, I get a remarkably blank screen:

 

 

The only interesting log entries I am seeing is this:

 

grouper-api;grouper_error.log;as-aws-test-dev2;aws-poc;2018-10-29 18:05:26,238: [ajp-nio-8009-exec-3] ERROR CsrfGuardLogger.log(47) - - potential cross-site request forgery (CSRF) attack thwarted (user:ecc, ip:xxx.xxx.xxx.xxx, method:POST, uri:/grouper/grouperUi/app/UiV2GroupAttributeAssignment.assignmentMenuAddValue, error:request token does not match session token)

 

grouper-api;grouper_error.log;as-aws-test-dev2;aws-poc;2018-10-29 18:05:26,475: [ajp-nio-8009-exec-4] ERROR CsrfGuardLogger.log(47) - - Referer domain https://authman-test.techservices.illinois.edu/grouper/grouperUi/app/UiV2Main.index?operation=UiV2GroupAttributeAssignment.assignmentMenuAddValue&attributeAssignId=635adbb3af3b4c2fa54a8eafca18ee13&csrfExtraParam=xyz does not match request domain: http://authman-test.techservices.illinois.edu/grouper/grouperExternal/public/OwaspJavaScriptServlet

 

Is this a UI bug? Or possibly a sign I’ve got something corrupted somewhere?  It’s still pretty stock test environment otherwise.

 

Thanks,

 

Erik Coleman

University of Illinois at Urbana-Champaign