v7 Upgrade instructions from v7
When upgrading from Grouper v7 to another v7 image, this wiki will consolidate all the steps needed to perform that upgrade.
When upgrading from Grouper v4 to v6, also see v6 Upgrade Instructions from v4 for additional instructions which must be applied first. Also see the v5 to v5 upgrade steps and v6 to v6 upgrade steps.
See information on Grouper Versioning here
Note, these are in reverse order, so go from bottom to top
Date | Upgrading from version | Upgrading to Version | Note for version | Importance | Jira | Step needed if... | Description |
|---|---|---|---|---|---|---|---|
2026/10/18 | ALL | ALL | 7.9.0 | Important | You call Grouper web services with a 7.9.0+ grouperClient (or WS client version v7_9_000+) and read subject attribute values, or you list attributes in | Subject attribute values in WS responses are now encoded so multivalued attributes return all values. See GRP-5430 for the format, how to decode, and the multivaluedLdapAttributes change. | |
2026/10/18 | ALL | ALL | 7.9.0 | Medium important | You use the Duo admin role provisioner | The provisioner now sends the Duo role_id instead of the role name and supports custom admin roles and role priority. The Duo Admin API application needs the "Grant resource - Read" permission so Grouper can read the admin roles. If Duo rejects a role change, the admin is set to read_only (fail closed). Run the provisioner in read-only or diagnostics mode first and check that there are no unexpected role changes. | |
2026/10/18 | ALL | ALL | 7.9.0 | Important | You have folders set to "do not provision" in the provisioning UI | Before this fix, the provisioning UI saved "do not provision" on a folder with a blank folder scope, which only excludes groups directly in that folder. Groups in its subfolders still inherit provisioning from a provisioned parent folder. Follow the upgrade instructions in GRP-7498 to find those folders and set the folder scope, then run a full sync. | |
2026/10/11 | ALL | ALL | 7.8.0 | Medium important | You use the Grouper MCP server | Upgrade task 46 adds the column Until it runs, every MCP tool log insert fails. The error is logged and tool calls still work, but the audit rows are lost, MCP throttling (which counts those rows) does not limit anyone, and the MCP tool logs screen in the UI shows an error. | |
2026/10/05 | ALL | ALL | 7.7.0 | Important | Users who are not Grouper sysadmins are in the MCP SQL or admin groups: | The sysadmin requirement documented for these groups is now enforced. A member of To keep giving those users access, move them to the new limited groups (GRP-7415): | |
2026/10/04 | ALL | ALL | 7.7.0 | Medium important | You configured | This setting was loaded but never applied. It now is: a group or entity matching the value (on the Grouper side or in the target) is never inserted, updated or deleted, and neither are its memberships. A matching membership is left alone too. Ignored objects are counted as Review each configured value before upgrading, since it will start taking effect. For groupAttributes / entityAttributes, a value on the membership attribute itself ignores just those memberships, not the group or entity. | |
2026/09/28 | 7.4.x and earlier | ALL | 7.6.0 | Medium important | You use the MCP SQL tools (sql_select, sql_get_schema) against the Grouper database | As of 7.5.0 no database is available to the MCP SQL tools by default, and In grouper.properties add | |
2026/09/27 | ALL | ALL | 7.6.0 | Not important | You have processes that add groups as members of other groups | Circular group memberships are now vetoed at any depth, not just a group added to itself (e.g. A in B and B in A). A process that creates such a chain will now get an error. Review loaders, scripts, and provisioning that add group members. | |
2026/09/26 | ALL | ALL | 7.5.1 | Important | Users who are not sysadmins create or edit rules in the UI | Security fix. Non-sysadmins can now only add or edit rules from the predefined patterns, and the rule must match the selected pattern. Custom rules and rules that use expression language (EL) are sysadmin-only. Set | |
2026/09/26 | ALL | ALL | 7.5.1 | Medium important | Users who are not sysadmins create rules that send email | If neither | |
2026/07/05 | ALL | ALL | 7.3.0 | Medium important | If you use Postgres | Follow the steps in the Jira to widen | |
2026/07/05 | ALL | ALL | 7.3.0 | Not important | You use Grouper | DDL upgrade tasks (43) | |
2026/07/05 | ALL | ALL | 7.3.0 | Important | You have provisioning failsafes configured | Follow the steps in the Jira to review your configs | |
2026/10/18 | 7.3.x and earlier | 7.4.0 - 7.8.x | 7.4.0 | Important | You have user lifecycle policies configured ( | The group edit screen fails for every group with: GRP-7174 added a required index that orders the lifecycle policies on the group edit page, and policies configured before it have no index. Add | |
2026/05/24 | ALL | ALL | 7.2.0 | Medium important | If you have encrypted configs which shouldn't be labeled as such | Follow the steps in the Jira to review your configs | |
2026/05/18 | ALL | ALL | 7.2.0 | Not important | You use Grouper | DDL upgrade tasks (41, 42) | |
2026/05/18 | ALL | ALL | 7.2.0 | Important | If you have ".serviceUrl" in grouper-loader.properties | This config was renamed since it was causing issues. | |
2026/04/05 | ALL | ALL | 7.1.0 | Not important | You use Grouper | Two minor DDL upgrade tasks (39, 40) | |
2026/04/05 | ALL | ALL | 7.1.0 | Not important | You use history in ABAC | If you are accumulating history, it might not be working correctly. TRUNCATE TABLE grouper_data_row_field_asn_hst;
TRUNCATE TABLE grouper_data_row_assign_hst;Note, if that doesnt work, you can delete from or commit or work with it until they are both empty. in postgres | |
2026/04/05 | ALL | ALL | 7.1.0 | Not important | You use ABAC | Set your abac default and available subject sources: GRP-6872 | |
2026/03/21 | ALL | ALL | 7.0.3 | Not important | You use TeamDynamix provisioning | Run your team dynamix provisioner and adjust the batch sizes in the provisioner config as needed | |
2026/03/07 | ALL | ALL | 7.0.1 | Not important | You want to enable MCP in Grouper for AI | Set this env variable in your container: GROUPER_MCP=trueYou might want to edit the etc:mcp* groups and add eligibility to them (e.g. some sort of workforce reference group) In v7.0.1 ONLY, you should run the this GSH before using MCP (e.g. at first startup) edu.internet2.middleware.grouper.authentication.GrouperOAuthSigningKey.getPublicKey(); | |
2026/03/06 | ALL | ALL | 7.0.1 | Medium important | You use Grouper | Upgrade task 38 has DDL with new tables for MCP | |
2026/03/06 | ALL | ALL | 7.0.1 | Important | You use Grouper | In the grouper.hibernate.properties, set this to a v7 version, e.g. 7.*.* registry.auto.ddl.upToVersion = 7.*.* | |
2026/03/06 | ALL | ALL | 7.0.1 | Important | You use Grouper | Make sure you have reviewed all v6 to v6 upgrade steps |
If you want to run v7 locally, you can do something like this (change port, version, database url if not on mac): (use your own random password, not 'jM0wlZE3xDGyHSo0lujl')
$ docker run --name postgres -e POSTGRES_PASSWORD=jM0wlZE3xDGyHSo0lujl -d -p 5432:5432 postgres:14
$ docker exec -it -u postgres postgres psql
# CREATE USER grouper PASSWORD 'jM0wlZE3xDGyHSo0lujl';
# CREATE DATABASE grouper;
# GRANT ALL PRIVILEGES ON DATABASE grouper TO grouper;
# \q docker run -d -p 8081:8080 --name my-grouper \
-e GROUPER_UI_GROUPER_AUTH=true \
-e GROUPER_SELF_SIGNED_CERT=true \
-e GROUPER_AUTO_DDL_UPTOVERSION='v7.*.*' \
-e GROUPER_UI_CONFIGURATION_EDITOR_SOURCEIPADDRESSES='0.0.0.0/0' \
-e GROUPERSYSTEM_QUICKSTART_PASS=jM0wlZE3xDGyHSo0lujl \
-e GROUPER_UI=true \
-e GROUPER_DATABASE_URL="jdbc:postgresql://docker.for.mac.localhost:5433/grouper?currentSchema=public" \
-e GROUPER_DATABASE_USERNAME=grouper \
-e GROUPER_DATABASE_PASSWORD=jM0wlZE3xDGyHSo0lujl \
i2incommon/grouper:7.X.Y ui