Grouper Users - Open Discussion List

["Redman, Chad" <>]

Yes, if you set the x-forwarded-* headers, or at least x-forwarded-proto, it does tend to fix the http/https issue for applications. We saw the same with the Shibboleth IdP. And we took another look at our CSRF refererMatchDomain=false setting which was set a long time ago. if the x-forwarded headers are enabled, it isn't needed.

 

From: [mailto:] On Behalf Of Hyzer, Chris
Sent: Tuesday, October 30, 2018 2:32 PM
To: Coleman, Erik C <>;
Subject: [grouper-users] RE: Grouper 2.4 UI problem with Setting Attributes

 

First question, as you click through the app everything is ok except the attribute case you list?

 

If not, Do you have the UI url configured in grouper.properties?  And do you have x-forwarded-for and x-forwarded-proto HTTP HEADERS from the load balancer?  Im not sure they are needed but I think useful to have and that is how we set this up in a similar way. 

 

Thanks

Chris

 

From: <> On Behalf Of Coleman, Erik C
Sent: Tuesday, October 30, 2018 9:45 AM
To:
Subject: [grouper-users] RE: Grouper 2.4 UI problem with Setting Attributes

 

Brett, thanks,

 

I am not explicitly accessing the site insecurely, but I think you’re on to something.  We have redirects to HTTPS, but furthermore, since SSL is terminated at the AWS app load balancer, all the SSL is stripped out of the UI container in the Apache and Tomcat configs, but maybe there’s something amiss.

 

I’m no Java (or _javascript_) expert, so what function in the UI is having me try to access this link on HTTP and not HTTPS?:

 

http://authman-test.techservices.illinois.edu/grouper/grouperExternal/public/OwaspJavaScriptServlet

 

Is this something I can change in a properties file?

 

-Erik

 

 

From: Brett Bieber <>
Sent: Tuesday, October 30, 2018 8:24 AM
To: Coleman, Erik C <>;
Subject: Re: Grouper 2.4 UI problem with Setting Attributes

 

Hi Erik,

We're doing the same here at Nebraska and not having any issues, so I don't think it's a UI bug. I can't tell in the first screenshot if you were accessing the site securely or not, but I noticed the error message indicated an http vs https difference even though the domain name was the same. Is it possible you were accessing the site via an insecure URL and the config is set to https? We've got ours configured to redirect any requests to http:// to https:// at the load balancer. Hope that helps.

-Brett

---

From: <> on behalf of Coleman, Erik C <>
Sent: Monday, October 29, 2018 6:09:00 PM
To:
Subject: [grouper-users] Grouper 2.4 UI problem with Setting Attributes

 

I’m running into a snag with the new Grouper 2.4 (running from container tier/grouper:2.4.0-a2-u0-w0-p0).  I’m wanting to demonstrate how group owners can selectively choose to have their groups or folders sync to our AD via our PSPNG config. I select a group or folder and choose “More Actions” -> “Attribute Assignments” and assign an attribute, it seems to work, but then I get this strange error “ErrorType; LoadXML Description: Incorrect XML”:

 

 

Then if I click OK, then attempt to choose the action to assign a value to that attribute, I get a remarkably blank screen:

 

 

The only interesting log entries I am seeing is this:

 

grouper-api;grouper_error.log;as-aws-test-dev2;aws-poc;2018-10-29 18:05:26,238: [ajp-nio-8009-exec-3] ERROR CsrfGuardLogger.log(47) - - potential cross-site request forgery (CSRF) attack thwarted (user:ecc, ip:xxx.xxx.xxx.xxx, method:POST, uri:/grouper/grouperUi/app/UiV2GroupAttributeAssignment.assignmentMenuAddValue, error:request token does not match session token)

 

grouper-api;grouper_error.log;as-aws-test-dev2;aws-poc;2018-10-29 18:05:26,475: [ajp-nio-8009-exec-4] ERROR CsrfGuardLogger.log(47) - - Referer domain https://authman-test.techservices.illinois.edu/grouper/grouperUi/app/UiV2Main.index?operation=UiV2GroupAttributeAssignment.assignmentMenuAddValue&attributeAssignId=635adbb3af3b4c2fa54a8eafca18ee13&csrfExtraParam=xyz does not match request domain: http://authman-test.techservices.illinois.edu/grouper/grouperExternal/public/OwaspJavaScriptServlet

 

Is this a UI bug? Or possibly a sign I’ve got something corrupted somewhere?  It’s still pretty stock test environment otherwise.

 

Thanks,

 

Erik Coleman

University of Illinois at Urbana-Champaign