v5 Upgrade instructions from v5
When upgrading from Grouper v5 to another v5 container, this wiki will consolidate all the steps needed to perform that upgrade.
When upgrading from Grouper v4 to v5, also see v6 Upgrade Instructions from v4 for additional instructions which must be applied first.
See information on Grouper Versioning here.
Note: these are in reverse order, so go from bottom to top.
Date | Upgrading from version | Upgrading to version | Note for version | Importance | Jira | Step needed if... | Description |
|---|---|---|---|---|---|---|---|
2026/01/31 | ALL | ALL | 5.22.5 | Medium important | You applied a patch for the GSH template vulnerability | You must remove the patch (2 class files) from the container. /opt/grouper/grouperWebapp/WEB-INF/classes/edu/internet2/middleware/grouper/app/gsh/template/GshTemplateValidationService.class
/opt/grouper/grouperWebapp/WEB-INF/classes/edu/internet2/middleware/grouper/app/gsh/template/GshTemplateValidationService$1.class | |
2025/10/28 | ALL | ALL | 5.22.0 | Medium important | You use Grouper | The group main screen is now a summary screen. Adjust links to Grouper, or documentation as needed. You might want to display a banner to let users know, or change the default group screen to be the members tab. | |
2025/10/28 | ALL | ALL | 5.22.0 | Medium important | You use Grouper | Check your grouper.properties settings for: grouper.env.nameIf your prod env is blank, "prod" or "production" (case-insensitive), and your other envs are something else (not blank), then likely you do not need to do anything. If not, follow the documentation in the wiki to have a banner in the Grouper UI for non-prod envs. You might need to turn off the banner in prod if you have a different value there, and you might need to configure non-prod values. | |
2025/10/27 | ALL | ALL | 5.22.0 | Medium important | If you have CSV report jobs that select double quotes in the column names and you want the double quotes in the CSV upload | You can set the default back to the old way, or in those jobs you can configure the old way just for that job. See GRP-6390. | |
2026/01/31 | ALL | 6.0.1; ignore after 6.0.2+ | 5.21.0 | Medium important | You use pac4j authentication in UI or WS | In certain versions of Grouper (until 6.0.2+) you must make sure pac4j is configured not to run in environments which are not UI or WS (e.g. daemon or maybe gsh). | |
2025/10/03 | ALL | ALL | 5.21.0 | Not important | You use Grouper | The Grouper container install script was rewritten from the Grouper-installer to a bash script. Perform extra testing to make sure all your container customizations still work. | |
2025/10/03 | ALL | ALL | 5.21.0 | Medium important | You use the Adobe provisioner | If you have userNames in Adobe which are different than email, you should add userName as an entity attribute in the provisioner. Follow advice in GRP-6352. | |
2025/08/20 | 5.17.2 | 5.19.0 | 5.19.0 | Important |
| You have a SQL sync job using a query instead of a table | In v5.17.2, Grouper changed how it interpreted tables in a SQL sync job. If there were spaces in the name, it assumed it was a query instead of a table. This was problematic, so in v5.19.0 there is a new option for table vs. query. If your "table" was actually a query, you will now need to tell the SQL sync configuration that it's a query. There is a new dropdown for this. |
2025/08/09 | ALL | ALL | 5.20.5 | Not important | You are using the grouper loader veto hook | On version 5.20.5+ you can safely remove the grouper loader veto hook. See instructions in the Jira. | |
2025/08/17 | ALL | ALL | 5.20.2 | Important | You have ABAC scripts with = instead of == | Look at your ABAC scripted groups, and for the ones with = instead of ==, re-write the script with ==. Find script with = with SQL: select group_name, value_string
from grouper_aval_asn_asn_group_v gaaagv
where attribute_def_name_name2 like '%grouperJexlScriptJexlScript'
and value_string like '%=%'; | |
2025/08/09 | ALL | ALL | 5.20.0 | Not important | You have a subject source in use which is not enabled | Enable all subject sources which are in use. Subject sources which are not enabled will not resolve subjects. | |
2025/07/31 | ALL | ALL | 5.19.1 | Important | You use Grouper | Before upgrading to v5, you need to run the v4.20.0+ daemon to populate the SQL membership cache tables. If you are already in v5 in a version previous to v5.17.2, then upgrade to v5.17.2 as an intermediary upgrade, run the sqlCacheFullSync daemon, then get to the eventual v5 version. When you are done and upgraded to v5 and the sql cache table is populated (either from v4 or v5), if upgrading from v4 then also wait for upgrade task to finish, set this in grouper.hibernate.properties to reduce Grouper startup time. This should be done after you have been running v5.17.2+ for a couple weeks. registry.checkMembershipCacheIsPopulated = falseOr set this env var in container: GROUPER_CHECK_MEMBERSHIP_CACHE_IS_POPULATED=false | |
2025/06/29 | ALL | ALL | 5.19.1 | Medium important | If you mind that the CRSF header name changed | You can change the header name back with the container env var: GROUPER_CRSF_HEADER=OWASP_CSRFTOKEN | |
2025/05/25 | ALL | ALL | 5.18.0 | Not important | You have WS external systems without test cases | Adjust the configs of your WS external systems to have test paths, methods, and expected results. Otherwise the test button which used to just report success on everything will now report a failure. | |
2025/05/21 | ALL | ALL | 5.18.0 | Medium important | You use Jexl scripted groups and especially if you have changed the default full sync schedule | For the full jexl script daemon: OTHER_JOB_grouperLoaderJexlScriptFullSyncYou might want to change it to run daily, e.g.: 31 19 05 * * ?The jexl script incremental daemon runs every minute. | |
2025/05/21 | ALL | ALL | 5.18.0 | Not important | You use Grouper WS incorrectly | If callers to your web service expect wrong stems to return all groups, revert to previous behavior. | |
2025/05/21 | ALL | ALL | 5.18.0 | Medium important | You use Grouper | Upgrade task 32 adds three views. | |
2025/03/19 | ALL | ALL | 5.17.1 | Medium important |
| You use postgres and are not using the public schema | In # this is the schema ddlutils uses to query metadata with jdbc. usually this can be omitted,
# and it defaults to your database loginid, however, in postgres, it can be different, so enter here
# in sql server, it might need to be: dbo
# {valueType: "string"}
#ddlutils.schema = public |