Grouper Users - Open Discussion List

["Coleman, Erik C" <>]

Ah, that makes sense. Perhaps I misunderstood the purpose of “uiV2.loader.view.by.group.admins” option.  I understood the security ramifications and planned on doing this only to a small subset of trusted IT admins acting as my Grouper “helpers” to be able to make their own reference groups, but didn’t necessarily want to grant them full Grouper access.  Perhaps that is one in the same with the SQL access required.

 

I think we’ll just steer around that and have them request the loader jobs, and we’ll configure it on their behalf.

 

Thanks!

 

-Erik

 

 

 

 

 

From: Hyzer, Chris <>
Sent: Tuesday, April 23, 2019 3:53 PM
To: Coleman, Erik C <>;
Subject: RE: Loader jobs for non-admins

 

You have to be a grouper admin to manage loader jobs.  The reason is that configuring SQL is an admin level activity.  At penn we have some views that once setup other people can manage, but they cant manage the configuration of the job.  Does that not work for you?  We would need an enhancement to allow non grouper admins to manage loader jobs…

 

Thanks

Chris

 

From: <> On Behalf Of Coleman, Erik C
Sent: Tuesday, April 23, 2019 3:58 PM
To:
Subject: [grouper-users] Loader jobs for non-admins

 

Hello,

 

Has anyone successfully configured Grouper to allow non-sysadmins to create loader jobs? We’ve delegated folders to IT Pros, and we have set the following in grouper-ui.properties:

 

uiV2.loader.view.by.group.admins = true

 

I’ve verified a particular admin does have “ADMIN” privileges on a new group he created in his folder, yet when he goes to the “Loader” option in the tab, he gets the following error:

Error: Problem calling method loader on edu.internet2.middleware.grouper.grouperUi.serviceLogic.UiV2GrouperLoader

 

And the UI logs show a problem:

 

grouper-api;grouper_error.log;aws-test;224588347132;2019-04-23 13:59:41,074: [ajp-nio-8009-exec-4] ERROR GrouperUiRestServlet.doGet(310) - - Problem calling reflection from URL: edu.internet2.middleware.grouper.grouperUi.serviceLogic.UiV2GrouperLoader.loader

java.lang.NullPointerException: Problem calling method loader on edu.internet2.middleware.grouper.grouperUi.serviceLogic.UiV2GrouperLoader

at edu.internet2.middleware.grouper.grouperUi.beans.ui.GroupContainer$3.callback(GroupContainer.java:588)

at edu.internet2.middleware.grouper.GrouperSession.callbackGrouperSession(GrouperSession.java:974)

at edu.internet2.middleware.grouper.grouperUi.beans.ui.GroupContainer.isCanAdmin(GroupContainer.java:583)

at edu.internet2.middleware.grouper.grouperUi.beans.ui.GrouperLoaderContainer.isCanSeeLoader(GrouperLoaderContainer.java:2359)

at edu.internet2.middleware.grouper.grouperUi.serviceLogic.UiV2GrouperLoader.loader(UiV2GrouperLoader.java:687)

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

at java.lang.reflect.Method.invoke(Method.java:498)

at edu.internet2.middleware.grouper.util.GrouperUtil.invokeMethod(GrouperUtil.java:4189)

at edu.internet2.middleware.grouper.util.GrouperUtil.callMethod(GrouperUtil.java:4140)

at edu.internet2.middleware.grouper.j2ee.GrouperUiRestServlet.doGet(GrouperUiRestServlet.java:277)

at edu.internet2.middleware.grouper.j2ee.GrouperUiRestServlet.doPost(GrouperUiRestServlet.java:148)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:661)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:230)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)

at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)

at org.owasp.csrfguard.CsrfGuardFilter.doFilter(CsrfGuardFilter.java:88)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)

at edu.internet2.middleware.grouper.ui.GrouperUiFilter.doFilter(GrouperUiFilter.java:1127)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)

at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198)

at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)

at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:478)

at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140)

at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:80)

at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:624)

at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)

at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:341)

at org.apache.coyote.ajp.AjpProcessor.service(AjpProcessor.java:478)

at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)

at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:798)

at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1441)

at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)

at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)

at java.lang.Thread.run(Thread.java:748)

 

I’ve also tried to do the following:

uiV2.loader.must.be.in.group = etc:grouperUi:grouperUiUserData

 

to grant access to anyone that’s used the GUI, but that seems to not make any difference either.

 

Any tips on getting this working?

 

Thanks!

-Erik