v5 Upgrade instructions from v5
When upgrading from Grouper v5 to another v5 container, this wiki will consolidate all the steps needed to perform that upgrade.
When upgrading from Grouper v4 to v5, also see v6 Upgrade Instructions from v4 for additional instructions which must be applied first.
See information on Grouper Versioning here.
Note: these are in reverse order, so go from bottom to top.
Date | Upgrading from version | Upgrading to version | Note for version | Importance | Jira | Step needed if... | Description |
|---|---|---|---|---|---|---|---|
2026/01/31 | ALL | ALL | 5.22.5 | Medium important | You applied a patch for the GSH template vulnerability | You must remove the patch (2 class files) from the container. /opt/grouper/grouperWebapp/WEB-INF/classes/edu/internet2/middleware/grouper/app/gsh/template/GshTemplateValidationService.class
/opt/grouper/grouperWebapp/WEB-INF/classes/edu/internet2/middleware/grouper/app/gsh/template/GshTemplateValidationService$1.class | |
2025/10/28 | ALL | ALL | 5.22.0 | Medium important | You use Grouper | The group main screen is now a summary screen. Adjust links to Grouper, or documentation as needed. You might want to display a banner to let users know, or change the default group screen to be the members tab. | |
2025/10/28 | ALL | ALL | 5.22.0 | Medium important | You use Grouper | Check your grouper.properties settings for: grouper.env.nameIf your prod env is blank, "prod" or "production" (case-insensitive), and your other envs are something else (not blank), then likely you do not need to do anything. If not, follow the documentation in the wiki to have a banner in the Grouper UI for non-prod envs. You might need to turn off the banner in prod if you have a different value there, and you might need to configure non-prod values. | |
2025/10/27 | ALL | ALL | 5.22.0 | Medium important | If you have CSV report jobs that select double quotes in the column names and you want the double quotes in the CSV upload | You can set the default back to the old way, or in those jobs you can configure the old way just for that job. See GRP-6390. | |
2026/01/31 | ALL | 6.0.1; ignore after 6.0.2+ | 5.21.0 | Medium important | You use pac4j authentication in UI or WS | In certain versions of Grouper (until 6.0.2+) you must make sure pac4j is configured not to run in environments which are not UI or WS (e.g. daemon or maybe gsh). | |
2025/10/03 | ALL | ALL | 5.21.0 | Not important | You use Grouper | The Grouper container install script was rewritten from the Grouper-installer to a bash script. Perform extra testing to make sure all your container customizations still work. | |
2025/10/03 | ALL | ALL | 5.21.0 | Medium important | You use the Adobe provisioner | If you have userNames in Adobe which are different than email, you should add userName as an entity attribute in the provisioner. Follow advice in GRP-6352. | |
2025/08/20 | 5.17.2 | 5.19.0 | 5.19.0 | Important |
| You have a SQL sync job using a query instead of a table | In v5.17.2, Grouper changed how it interpreted tables in a SQL sync job. If there were spaces in the name, it assumed it was a query instead of a table. This was problematic, so in v5.19.0 there is a new option for table vs. query. If your "table" was actually a query, you will now need to tell the SQL sync configuration that it's a query. There is a new dropdown for this. |
2025/08/09 | ALL | ALL | 5.20.5 | Not important | You are using the grouper loader veto hook | On version 5.20.5+ you can safely remove the grouper loader veto hook. See instructions in the Jira. | |
2025/08/17 | ALL | ALL | 5.20.2 | Important | You have ABAC scripts with = instead of == | Look at your ABAC scripted groups, and for the ones with = instead of ==, re-write the script with ==. Find script with = with SQL: select group_name, value_string
from grouper_aval_asn_asn_group_v gaaagv
where attribute_def_name_name2 like '%grouperJexlScriptJexlScript'
and value_string like '%=%'; | |
2025/08/09 | ALL | ALL | 5.20.0 | Not important | You have a subject source in use which is not enabled | Enable all subject sources which are in use. Subject sources which are not enabled will not resolve subjects. | |
2025/07/31 | ALL | ALL | 5.19.1 | Important | You use Grouper | Before upgrading to v5, you need to run the v4.20.0+ daemon to populate the SQL membership cache tables. If you are already in v5 in a version previous to v5.17.2, then upgrade to v5.17.2 as an intermediary upgrade, run the sqlCacheFullSync daemon, then get to the eventual v5 version. When you are done and upgraded to v5 and the sql cache table is populated (either from v4 or v5), if upgrading from v4 then also wait for upgrade task to finish, set this in grouper.hibernate.properties to reduce Grouper startup time. This should be done after you have been running v5.17.2+ for a couple weeks. registry.checkMembershipCacheIsPopulated = falseOr set this env var in container: GROUPER_CHECK_MEMBERSHIP_CACHE_IS_POPULATED=false | |
2025/06/29 | ALL | ALL | 5.19.1 | Medium important | If you mind that the CRSF header name changed | You can change the header name back with the container env var: GROUPER_CRSF_HEADER=OWASP_CSRFTOKEN | |
2025/05/25 | ALL | ALL | 5.18.0 | Not important | You have WS external systems without test cases | Adjust the configs of your WS external systems to have test paths, methods, and expected results. Otherwise the test button which used to just report success on everything will now report a failure. | |
2025/05/21 | ALL | ALL | 5.18.0 | Medium important | You use Jexl scripted groups and especially if you have changed the default full sync schedule | For the full jexl script daemon: OTHER_JOB_grouperLoaderJexlScriptFullSyncYou might want to change it to run daily, e.g.: 31 19 05 * * ?The jexl script incremental daemon runs every minute. | |
2025/05/21 | ALL | ALL | 5.18.0 | Not important | You use Grouper WS incorrectly | If callers to your web service expect wrong stems to return all groups, revert to previous behavior. | |
2025/05/21 | ALL | ALL | 5.18.0 | Medium important | You use Grouper | Upgrade task 32 adds three views. | |
2025/03/19 | ALL | ALL | 5.17.1 | Medium important |
| You use postgres and are not using the public schema | In # this is the schema ddlutils uses to query metadata with jdbc. usually this can be omitted,
# and it defaults to your database loginid, however, in postgres, it can be different, so enter here
# in sql server, it might need to be: dbo
# {valueType: "string"}
#ddlutils.schema = public |
2025/03/02 | ALL | ALL | 5.17.0 | Medium important | You use Grouper | Upgrade task 31 updates data field history tables. | |
2025/03/02 | ALL | ALL | 5.17.0 | Medium important |
| You use the MidPoint connector | Add a membership index on your data structure. CREATE INDEX gr_mp_memberships_by_subject_idx ON gr_mp_memberships (subject_id_index); |
2025/02/03 | ALL | ALL | 5.16.0 | Medium important | You use Grouper | Upgrade task 30 creates data field history tables. Success: upgrade task output: ,
created table grouper_data_field_assign_hst,
added index data_field_assign_hst1_idx,
added index data_field_assign_hst2_idx,
added index data_field_assign_hst3_idx,
added index data_field_assign_hst4_idx,
added foreign key data_field_assign_hst_fk_1,
added foreign key data_field_assign_hst_fk_2,
added foreign key data_field_assign_hst_fk_3,
created table grouper_data_row_assign_hst,
added index data_row_assign_hst1_idx,
added index data_row_assign_hst2_idx,
added index data_row_assign_hst3_idx,
added foreign key data_row_assign_hst_fk_1,
added foreign key data_row_assign_hst_fk_2,
created table grouper_data_row_field_asn_hst,
added index data_row_field_asn_hst1_idx,
added index data_row_field_asn_hst2_idx,
added index data_row_field_asn_hst3_idx,
added index data_row_field_asn_hst4_idx,
added foreign key data_row_field_asn_hst_fk_1,
added foreign key data_row_field_asn_hst_fk_2
Upgraded to version V30. | |
2025/01/04 | ALL | ALL | 5.15.0 | Not important | If you use mysql and hardcode the driver classname | You should not hardcode the driver classname. If you do, and want to continue to do so, change to this: com.mysql.cj.jdbc.Driver | |
2025/01/04 | ALL | ALL | 5.15.0 | Not important | Several | If you use Grouper | Tomcat, ldaptive, and a handful of libraries were upgraded. Look at container output and make sure there are no issues. Additionally: commons-httpclient-3.1.jar was removed, which should not cause issues. GrouperHttpClient should be used instead. |
2025/01/03 | ALL | ALL | 5.15.0 | Medium important | You use Grouper | Your grouper database credential should be able to manage DDL from now forward. Upgrade task 29 should add index | |
2024/12/28 | ALL | ALL | 5.15.0 | Not important | If you have SCIM provisioners with membership CRUD select = false or replace memberships = true | Try setting membership CRUD select true and replace false. | |
2024/11/26 | ALL | ALL | 5.14.0 | Important | If you run Grouper | Upgrade tasks are now improved. Make sure Grouper starts without errors. | |
2024/11/26 | ALL | ALL | 5.14.0 | Important | If you run Grouper | It is now assumed your Grouper DB user can run DDL. Enable it to run DDL if it cannot. DDL changes are in this release. Note, if you are going to 5.14.0 version, you should manually run the DDL in this jira at any point before upgrading. | |
2024/10/07 | ALL | ALL | 5.13.0 | Not important | If you run Grouper | Note: you do not need the attribute sqlCacheableGroup anymore for jexl scripted groups. We will probably remove these in the future. Make sure CHANGE_LOG_changeLogTempToChangeLog does not throw errors. Run this job: If you get errors you will need to adjust the DDL. If disabled_on is non-nullable, change it to be nullable: ALTER TABLE grouper_sql_cache_group MODIFY disabled_on DATETIME; | |
2024/10/07 | ALL | ALL | 5.13.0 | Medium important | If you run Grouper | If your DB credential cannot do DDL, then add tables manually from Jira. Otherwise, after the | |
2024/09/11 | ALL | ALL | 5.12.2 | Not important | You want to use Playwright browser automation for UI sanity testing | Set this variable if you want the playwright jar in the lib dir: GROUPER_PLAYWRIGHT_MOVE_JARS=true Install playwright libs in derived image (recommended): RUN . /usr/local/bin/librarySetupFilesForComponent.sh && setupFilesForComponent_playwrightInstallOsLibsHelper && setupFilesForComponent_unsetAll Set this variable to install OS libs on startup. This must be root; using a derived image is recommended instead because it takes extra time on startup to install. GROUPER_PLAYWRIGHT_INSTALL_OS_LIBS=true | |
2024/09/11 | ALL | ALL | 5.12.2 | Important | You use Grouper WS | Set this variable in the WS container: GROUPERWS_URL_WITH_CONTEXT_NOSLASH=https://myws.inst.edu/grouper-wsTest swagger after build: https://myws.inst.edu/grouper-ws/docs See Jira or container documentation for additional details. | |
2024/09/04 | v4 | ALL | 5.1.0 | Medium important | You have jexl scripted groups created in v4 | Component groups of the jexl loader script will need a cache attribute set before running the full sync. In addition, if you have GSH templates created in v4, to be able to edit the loader group in the UI, new template property "template type" will need to be set on all templates. See the Jira for detailed instructions, and a gsh script to do a mass attribute setting for all component groups. | |
2024/08/26 | ALL | ALL | 5.12.0 | Medium important | You use Grouper | If your grouper credential cannot do DDL, see the Jira and run the DDL manually. Otherwise, after Grouper starts or the | |
2024/08/26 | ALL | ALL | 5.12.0 | Important |