/
Grouper container documentation

Grouper container documentation

 

The Grouper project currently supports Grouper v2.5+ running only in the i2incommon container (including of course subcontainers).  If you want to take pieces out and run in an unsupported way feel free to do that on your own.  If you have questions about how to do something with the container that you think you cannot do and think you need to do surgery, please discuss it with the Grouper team first, there is likely a way to do it with the existing container.   We are open to changing how the container is structured in v2.6, lets discuss and improve together.

This is how the Grouper container works in v2.5

image-20260712-052410.png

 

Directory structure

alpha order...

Path

Description

Path

Description

/etc/httpd/conf.d/grouper-www.conf (removed in v5)

Apache config for Grouper.  Includes Shibboleth directive if using Shibboleth

/etc/shibboleth/shibboleth2.xml (removed in v5)

Shibboleth config

/opt/grouper/

Grouper base dir

/opt/grouper/grouperWebapp/

J2EE webapp dir for grouper

/opt/grouper/grouperWebapp/WEB-INF/classes/

Grouper config files

/opt/grouper/grouperWebapp/WEB-INF/classes/log4j.properties (before v2.6.5)

Log file

/opt/grouper/grouperWebapp/WEB-INF/classes/log4j2.xml (v2.6.7.1+)

Log file, replace if you like

/opt/grouper/grouperWebapp/WEB-INF/classes/log4j_additional.properties (before v2.6.5)

If you want to append some configurations to the built-in log4j.properties, put those here (2.5.41+)

/opt/grouper/grouperWebapp/WEB-INF/classes/log4j2.additionalLoggers.xml.txt (v2.6.7.1+)

If you want to put loggers in, put in this file, they will be substituted into the stock log4j2.xml e.g.

<Logger name="edu.a.b.c" level="debug" additivity="false"> <AppenderRef ref="grouper_error"/> </Logger>

/opt/grouper/grouperWebapp/WEB-INF/classes/log4j2.additionalAppenders.xml.txt (v2.6.8+)

If you want to put appenders in, put in this file, they will be substituted into the stock log4j2.xml e.g.

       <RollingFile name="some_appender_name" fileName="/opt/grouper/logs/someFile.log" filePattern="/opt/grouper/logs/someFile.log.%d{yyyy-MM-dd}" > <PatternLayout pattern="someFile.log;${ENV};${USERTOKEN};${layout}"/> <Policies> <TimeBasedTriggeringPolicy interval="1"/> </Policies> <DefaultRolloverStrategy max="30" /> </RollingFile>  

/opt/grouper/grouperWebapp/WEB-INF/classes/grouperText/grouper.text.en.us.properties

Externalized text file (note in 2.5.33+ this can be imported into database config)

/opt/grouper/grouperWebapp/WEB-INF/ddlScripts

DDL scripts that are run automatically or not, are written here

/opt/grouper/grouperWebapp/WEB-INF/libUiAndDaemon/

Jars used in UI and daemon only.  Place custom change log consumers here

/opt/grouper/grouperWebapp/WEB-INF/lib/

Jars used in all services (UI/WS/daemon/scim).  Replace database drivers or add jars for all services 

/opt/grouper/grouperWebapp/WEB-INF/web.xml

web.xml for grouper might need security settings for authentication (e.g. tomcat LDAP authn for WS)

/opt/grouper/logs

If you are externalizing logs to a "mount", this is the suggested standard location

/opt/grouper/slashRoot

Any files or folders in here will be overlaid on /   (root dir).  This is useful for lower maturity levels
so you only need one mount to copy files in and one mount to copy files out.

If you have a dir in your host, lets say "/foo/bar/slashRoot", and you mount that to the container
"/opt/grouper/slashRoot", then if you make the file:
/foobar/slashRoot/opt/grouper/grouperWebapp/WEB-INF/classes/grouper.hibernate.properties,
then it will exist in the container at: /opt/grouper/grouperWebapp/WEB-INF/classes/grouper.hibernate.properties

/opt/container_files/certs

built in self signed certs

/opt/grouper/certs/anchors/*.pem

SSL anchor certs

/opt/grouper/certs/client/*.pem 

SSL certs (to connect from Grouper to external systems), not for client authentication necessarily

/opt/grouper/certs/keys/*.key

SSL cert private keys (or could go somewhere else)

/opt/hsqldb
(removed in 2.6.5+)

HSQLDB directory if using an embedded database (for quick starts or demos)

/opt/tomee (v2.5, v2.6)

/opt/tomcat (v4+)

Tomee/Tomcat app server

/opt/tomee/bin (v2.5, v2.6)

/opt/tomcat/bin (v4+)

Startup and shutdown scripts for tomee/tomcat

/opt/tomee/conf/server.xml (v2.5, v2.6)

/opt/tomcat/conf/server.xml (v4+)

Tomee/Tomcat server.xml might need settings for authentication (e.g. tomcat LDAP authn for WS)

/usr/lib/jvm/java-1.8.0-amazon-corretto (v2.5, v2.6)

/usr/lib/jvm/java-17-amazon-corretto (v4)

JAVA_HOME (do not hard code this path, use the ENV var)

/usr/lib/jvm/java-1.8.0-amazon-corretto/jre/lib/security/cacerts (v2.5, v2.6)

/usr/lib/jvm/java-17-amazon-corretto/jre/lib/security/cacerts (v4)

cacerts for java

Ports and configs

Port

Service

Description

Config file

Port

Service

Description

Config file

443 (removed in v5)

Apache

Apache listens to requests and reverse proxies to tomcat 8009.
The apache URL path: /grouper           →   tomcat /grouper
The apache URL path: /grouper-ws     →   tomcat /grouper
The apache URL path: /grouper -scim →   tomcat /grouper

Note, v5 there is no apache and tomcat listens on 8443 by default.

/etc/httpd/conf.d/grouper-www.conf

8009

AJP

Tomcat listens here to get reverse proxied requests
from apache (or another web server.
Note, if you use an external apache you can link that up with
the internal apache or expose the 8009 (in a secured way!)

/opt/tomee/conf/server.xml (v2.5, v2.6)

/opt/tomcat/conf/server.xml (v4)

 

 

maps the /opt/grouper/grouperWebapp directory with 
the HTTP path /grouper

/opt/tomee/conf/Catalina/localhost/grouper.xml (v2.5, v2.6)

/opt/tomcat/conf/Catalina/localhost/grouper.xml (v4)

8005/8080/8443

Tomcat

8005 is the internal shutdown port for tomcat

8080 is the HTTP port for tomcat

8443 is the HTTPS port for tomcat

/opt/tomee/conf/server.xml (v2.5, v2.6)

/opt/tomcat/conf/server.xml (v4)

9001

Hsqldb

Embedded database port (for quick starts and demos)

(removed in 2.6.5+)

22

SSHD

If you are running in a managed environment where there is no

console access, you need to have the option to have SSHD

for troubleshooting reasons (e.g. see env vars, run top, jstack,

look at config files, etc)

You can make this work however you want, here is an example from AWS ECS Dockerfile RUN yum install -y openssh-server RUN ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key -N '' RUN ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key -N '' EXPOSE 22 Mount or overlay: /opt/tier-support/supervisord_sshd.conf [program:sshd] command=/usr/sbin/sshd -D stdout_logfile=/dev/stdout stdout_logfile_maxbytes=0 Mount or overlay or edit: /usr/local/bin/grouperScriptHooks.sh #!/bin/sh grouperScriptHooks_setupFilesPost() { cp -v /opt/tier-support/supervisord.conf /opt/tier-support/supervisord.conf.origGrouper cat /opt/tier-support/supervisord_sshd.conf >> /opt/tier-support/supervisord.conf # assumes you have an env var PASS from your password manager echo "root:${PASS}" | chpasswd } export -f grouperScriptHooks_setupFilesPost

Grouper Container params

There are a few arguments you can pass to the container, and env vars...   Note the command if specified (optional) will set env vars before the env vars.  So you could call the container with "ui" but then specify that -e GROUPER_RUN_SHIB_SP='false'   (e.g. if you run CAS)

Argument

Description

Argument

Description

ui

will set env vars: 
GROUPER_UI='true'
GROUPER_RUN_APACHE='true'  (removed in v5)
GROUPER_RUN_SHIB_SP='true'  (removed in v5)
GROUPER_RUN_TOMEE='true' (v2.5, v2.6)
GROUPER_RUN_TOMCAT='true' (v4)

ws

will set env vars:
GROUPER_WS='true'
GROUPER_RUN_APACHE='true'  (removed in v5)
GROUPER_RUN_TOMEE='true' (v2.5, v2.6)
GROUPER_RUN_TOMCAT='true' (v4+)

scim

will set env vars:
GROUPER_SCIM='true'
GROUPER_RUN_APACHE='true' (removed in v5)
GROUPER_RUN_TOMEE='true' (v2.5, v2.6)
GROUPER_RUN_TOMCAT='true' (v4+)

daemon

will set env vars:
GROUPER_DAEMON='true'
GROUPER_RUN_TOMEE='true' (v2.5, v2.6)
GROUPER_RUN_TOMCAT='true' (v4+)

bin/gsh  <gshScriptFileName> -or-
/opt/grouper/grouperWebapp/WEB-INF/bin/gsh.sh  <gshScriptFileName>
gsh

will just run gsh commands from docker command line e.g. (note, you need to put that file in the container e.g. with slashRoot

docker run --detach --mount type=bind,src=/opt/grouperInstaller/logs,dst=/opt/grouper/logs --mount type=bind,src=/opt/grouperInstaller/slashRoot,dst=/opt/grouper/slashRoot --name gsh i2incommon/grouper:2 .5.XX /opt/grouper/grouperWebapp/WEB-INF/bin/gsh.sh /opt/grouper/grouperWebapp/WEB-INF/bin/createGrouperSystemPasswordUi.gsh

Note: this will not work with a quickstart container.  Shell into the quickstart container and run gsh.sh

ui-ws

will set env vars (if not overridden):
GROUPER_UI='true'
GROUPER_WS='true'
GROUPER_RUN_APACHE='true' (removed in v5)
GROUPER_RUN_SHIB_SP='true' (removed in v5)
GROUPER_RUN_TOMEE='true' (v2.5, v2.6)
GROUPER_RUN_TOMCAT='true' (v4+)

quickstart   (v2.5.27+)

will set env vars (if not overridden):
GROUPER_RUN_HSQLDB=true (removed in 2.6.5+)
GROUPER_RUN_SHIB_SP=false (removed in v5)
GROUPER_SELF_SIGNED_CERT=true
GROUPER_AUTO_DDL_UPTOVERSION='v4.*.*'   (or whatever version you are running)
GROUPER_UI_CONFIGURATION_EDITOR_SOURCEIPADDRESSES='0.0.0.0/0'
GROUPER_START_DELAY_SECONDS=10
GROUPER_UI_GROUPER_AUTH=true
GROUPER_WS_GROUPER_AUTH=true
GROUPER_MCP=true
GROUPER_SCIM_GROUPER_AUTH=true
(v2.6.4-) If a GROUPERSYSTEM_QUICKSTART_PASS is set and GROUPER_UI_GROUPER_AUTH is true (and GROUPER_QUICKSTART is true), it will configure that in grouper.hibernate.base.properties
(v2.6.5+) If a GROUPERSYSTEM_QUICKSTART_PASS is set and GROUPER_UI_GROUPER_AUTH is true, it will configure that in grouper.hibernate.base.properties
(v2.6.4-) If a GROUPERSYSTEM_QUICKSTART_PASS is set and GROUPER_WS_GROUPER_AUTH is true (and GROUPER_QUICKSTART is true),  it will configure that in grouper.hibernate.base.properties
(v2.6.5+) If a GROUPERSYSTEM_QUICKSTART_PASS is set and GROUPER_WS_GROUPER_AUTH is true,  it will configure that in grouper.hibernate.base.properties

containerPing (v4.9.1+, v5.6.0+)

run ping every 10 minutes.  This ensures a process is running so the container does not die.  In v4, if you are running supervisor, you can run a container with no tomcat.  But in v5, there needs to be a process running.  So if you want a GSH container you can use the containerPing command.  Or if you just want to start a grouper container that does nothing for testing of other things (file paths, file permissions, certs, etc). 

-e GROUPER_OPENSHIFT=true

will set env vars (if not overridden):
GROUPER_CHOWN_DIRS=false
GROUPER_SHIB_LOG_USE_PIPE=false
GROUPER_GSH_CHECK_USER=false
GROUPER_RUN_PROCESSES_AS_USERS=false

<no command>

do nothing, so GSH can be used in bash in container, or pass in ENV vars to run something not with command above

-e GROUPER_UI=true

env var will tell grouper to allow ui calls via grouper.hibernate.base.properties (default false)
grouper.is.ui.elConfig = ${java.lang.System.getenv().get('GROUPER_UI')}

-e GROUPER_WS=true

env var will tell grouper to allow ws calls via grouper.hibernate.base.properties (default false)
grouper.is.ws.elConfig = ${java.lang.System.getenv().get('GROUPER_WS')}

-e GROUPER_SCIM=true

env var will tell grouper to allow ws calls via grouper.hibernate.base.properties (default false)
grouper.is.scim.elConfig = ${java.lang.System.getenv().get('GROUPER_SCIM')}

-e GROUPER_DAEMON=true

env var will tell grouper to kick of daemon thread in tomcat (default false)
grouper.is.daemon.elConfig = ${java.lang.System.getenv().get('GROUPER_DAEMON')}

-e GROUPER_MCP=true (v7.0.1+)

env will enable the MCP servlets in Grouper for AI.  This is needed in the UI env and WS env. 
Note: further configuration is needed to actually use the MCP but this is the first step

-e GROUPER_QUICKSTART=true
(v2.5.28+)

env var will setup quickstart components (default false)

-e GROUPER_RUN_APACHE=true (removed in v5)

env var will tell supervisor to kick off apache in container.  Note, apache is not needed (default false)

for Grouper.  You could hook up an external web server to tomcat or run from tomcat itself (not recommended)

-e GROUPER_RUN_SHIB_SP=true
(RUN_SHIB_SP up to v2.5.27) (removed in v5)

env var will tell supervisor to kick off shib sp in container.  Note if you dont use shib this is not needed. (default false)

Note: you can also run shib outside the grouper container (e.g. in another container or from reverse proxy)

Note: if RUN_SHIB_SP is false, it will take the shib apache directive out of grouper-www.conf

-e GROUPER_USE_PIPES (v2.5.46+) (removed in v5)

if logs should go to pipe.  Defaults to true if openshift if false

-e GROUPER_SHIB_LOG_USE_PIPE   (v2.5.30+) (removed in v5)

env var to not setup a pipe for shib.  defaults to true. 
Set to false if should just log stdout and stderr of shib to /tmp/logshibd
Might want to mount /tmp/logshibd to the external host, or other shib log files

-e GROUPER_RUN_TOMEE=true (v2.5, v2.6)
-e GROUPER_RUN_TOMCAT=true (v4+)
(RUN_TOMEE up to v2.5.27)

env var will tell supervisor to kick off tomcat.  Note you must have this to true if you are doing anything  (default false)

but a GSH env.  The WS/UI/scim/daemon must run tomcat in container.

-e GROUPER_RUN_HSQLDB=true    (v2.5.27+)
(RUN_HSQLDB up to v2.5.27)
(removed in 2.6.5+)

env var will tell supervisor to start hsqldb, storing data files to /opt/hsqldb and listening in container on port 9001 (default false)

-e GROUPER_USE_SSL=false (v2.5.28+)

if you do not want apache listening on 443 ssl.  If apache is running, default is true

in v5+ this applies to tomcat and not apache

-e GROUPER_WEBCLIENT_IS_SSL=false (v2.5.44+)

(default is "true").  if the client to Grouper is not SSL (whether SSL is done in the Grouper container or outside), then set this to false (for browser or WS caller) so Grouper does not setup URLs back to itself with SSL

-e GROUPER_SELF_SIGNED_CERT=true
(SELF_SIGNED_CERT up to v2.5.27)

if you dont set GROUPER_SELF_SIGNED_CERT, and you have GROUPER_USE_SSL=true (default), and you dont set GROUPER_SSL_CERT_FILE, and this file doesnt exist: /etc/pki/tls/certs/host-cert.pem, then this will be true.

Means a self signed cert will be configured with apache so it will function though not ideal.  Common to use this behind a load balancer which terminates SSL

In v5 this applies to tomcat and not apache

-e GROUPER_SSL_USE_STAPLING=false    (v2.5.41+) (removed in v5)

set to false to turn stapling off in ssl-enabled.conf (if you don't overlay that file)

-e GROUPER_SSL_CERT_FILE=a/b/c    (v2.5.41+)

Location of cert file.  For self signed built in cert see this page

-e GROUPER_SSL_KEY_FILE=a/b/d    (v2.5.41+)

Location of key file.  For self signed built in cert see this page

-e GROUPER_SSL_USE_CHAIN_FILE=true|false    (v2.5.41+)

true if should include an SSL chain file in the ssl-enabled.conf, false if should remove it

-e GROUPER_SSL_CHAIN_FILE=/a/b/e    (v2.5.41+)

Location of chain file if GROUPER_SSL_USE_CHAIN_FILE=true.  If GROUPER_SELF_SIGNED_CERT!=true, this defaults to /etc/pki/tls/certs/cachain.pem (if that file exists), if GROUPER_SELF_SIGNED_CERT=true, this is not used since GROUPER_SSL_USE_CHAIN_FILE=true

-e GROUPER_APACHE_SERVER_NAME=https://a.b.c:443  (v2.5.28+) (removed in v5)

will set server name in grouper-www.conf and will set UseCanonicalName On. Note that if you are doing SSL offloading to your container which has Shibboleth, you will want to set this to https://your-hostname:443, and modify shibboleth2.xml to set handlerSSL="false" in <Sessions>.

-e GROUPER_APACHE_NONSSL_PORT=80    (v2.5.28+) (removed in v5)

will change the non-ssl port of apache.  default is 80.

-e GROUPER_APACHE_SSL_PORT=443    (v2.5.28+) (removed in v5)

will change the ssl port of apache.  default is 443.

-e GROUPER_APACHE_AJP_TIMEOUT_SECONDS    (v2.5.28+) (removed in v5)

defaults to 3600 (one hour), customize here

-e GROUPER_APACHE_DIRECTORY_INDEXES    (v2.5.30+) (removed in v5)

defaults to false.  set to true to have apache directory indexes on

-e GROUPER_APACHE_REMOTE_IP_HEADER    (v2.5.41+) (removed in v5)

e.g. X-Forwarded-For   Replaces source IP address from reverse proxy.  See apache directive RemoteIPHeader (will put in grouper-www.conf)

-e GROUPER_APACHE_REMOTE_IP_TRUSTED_PROXY   (v2.5.41+) (removed in v5)

e.g. 1.2.3.4/28.  Allows proxy from certain networks.  See apache directive RemoteIPTrustedProxy (will put in grouper-www.conf)

-e GROUPER_APACHE_REMOTE_IP_INTERNAL_PROXY    (v2.6.8+) (removed in v5)

e.g. 10.1.2.3/24   Allows proxy from private networks.  See apache directive RemoteIPInternalProxy (will put in grouper-www.conf)

-e GROUPER_APACHE_STATUS_PATH (v2.5.51+) (removed in v5) (removed in v5)

The status path is good for monitoring (e.g. from nagios).  You can restrict the source IP address of status in the grouper.properties: ws.diagnostic.sourceIpAddresses

If nothing specified, there is a status path: /status_grouper/status

If you don't want this, set: -e GROUPER_APACHE_STATUS_PATH=none

If you want it something different, do this: -e GROUPER_APACHE_STATUS_PATH=/status2_grouper/status

-e GROUPER_TOMCAT_HTTP_PORT (v2.5.28+)

defaults to -1.  Set to -1 to not run the http/8080 connector (v4.10.2+, v5.7.0+).

-e GROUPER_TOMCAT_HTTPS_PORT (v4.10.2+) (v5.7.0+)

defaults to 8443.  Set to -1 to not run the https/8443 connector (v4.10.2+, v5.7.0+).

-e GROUPER_TOMCAT_AJP_PORT (v2.5.28+)

defaults to 8009 in v4.10.2+.  defaults to -1 in v5.7.0+.  Set to -1 to not run the 8009 apache connector (v4.10.2+, v5.7.0+).

-e GROUPER_TOMCAT_SHUTDOWN_PORT (v2.5.28+)

defaults to 8005

-e GROUPER_TOMCAT_LOG_ACCESS=true (v2.5.29+)

defaults to false.  if you want tomcat to log access.  Apache does this too.  

-e GROUPER_TOMCAT_LOG_ACCESS_DIRECTORY=/opt/grouper/logs

defaults to /tmp in v4.  defaults to /opt/grouper/logs in v5.7.0+

in v7.1.0+ and v6.2.0+ this defaults to /opt/grouper/logs if GROUPER_LOG_TO_HOST=true, and blank if false (log to STDOUT)

-e GROUPER_TOMCAT_LOG_ACCESS_PATTERN (v6.2.0+, v7.2.0+)

If GROUPER_TOMCAT_LOG_ACCESS is true, this is the pattern for the Tomcat access logging. The default is:

    $GROUPER_LOG_PREFIX;catalina.out;%h %l %{grouperRemoteUser}r %t \&quot;%r\&quot; %s %b

Because of how Grouper wraps requests, the normal %u element may not available for Tomcat logging. The %{grouperRemoteUser}r element says to use the request attribute grouperRemoteUser, which Grouper will set for a session for both built-in UI auth and for Pac4j. If you are using an external authentication container and passing the remote user via a header or environment variable, you may need to override the default format and use %u which logs REMOTE_USER.

-e GROUPER_TOMCAT_MAX_HEADER_COUNT=200 (v2.5.57+)

due to an error in chrome 93, tomcat throws an exception about too many http headers.  The default is now 200 for tomcat, but can be customized

-e GROUPER_TOMCAT_SESSION_TIMEOUT_MINUTES=600   (v2.5.36+)

tomcat defaults to <session-timeout>30</session-timeout> in /opt/tomee/conf/web.xml or /opt/tomcat/conf/web.xml, Grouper defaults to 10 hours (600) for UI and 1 minute fo WS.  If you use SSO without requiring reauth, then you might as well default to the SSO session length for the UI (ask your IdP operator).   Set to -2 to not change the default value in file

-e GROUPER_TOMCAT_REMOTE_CIDR_VALVE_ALLOW='1.2.3.4/32'

(v4.3.2+ and v5.1.1+)

inserts a valve into server.xml with RemoteCIDRValve to restrict the source IP address for requests to tomcat (e.g. AJP)

-e GROUPER_TOMCAT_REMOTE_IP_VALVE=false (v4.10.2+ and v5.7.0+)

when tomcat is run without apache behind a web server or load balancer, set this to true and configure below. If you set controls over IP addresses allowed to configure (grouperUi.configurationEditor.sourceIpAddresses or GROUPER_UI_CONFIGURATION_EDITOR_SOURCEIPADDRESSES), you will want to use this so that you can use the IPs of the originating client and not the IPs for the load balancers

-e GROUPER_TOMCAT_REMOTE_IP_INTERNAL_PROXIES="abc" (v4.10.2+ and v5.7.0+)

Sets the internalProxies matching pattern in the Tomcat RemoteIpValve valve. Use along with GROUPER_TOMCAT_REMOTE_IP_VALVE=true.

Regular expression that matches the IP addresses of internal proxies. If they appear in the remoteIpHeader value, they will be trusted and will not appear in the proxiesHeader value

By default, 10/8, 192.168/16, 169.254/16, 127/8, 100.64/10, 172.16/12, and ::1 are allowed.

Due to how they are processed by the Grouper startup script, the pipe character needs to be escaped once, and all other escapes need to be double escaped.

Example:

GROUPER_TOMCAT_REMOTE_IP_INTERNAL_PROXIES=10\\.10\\.\\d{1,3}\\.\\d{1,3}\|192\\.168\\.1\\.\\d{1,3}

server.xml: <Valve className="org.apache.catalina.valves.RemoteIpValve" internalProxies="10\.10\.\d{1,3}\.\d{1,3}|192\.168\.1\.\d{1,3}" />

-e GROUPER_TOMCAT_REMOTE_IP_HEADER=x-forwarded-for (v4.10.2+ and v5.7.0+)

Name of the Http Header read by this valve that holds the list of traversed IP addresses starting from the requesting client.  Defaults to: x-forwarded-for

-e GROUPER_TOMCAT_REMOTE_IP_PROXIES_HEADER=x-forwarded-by (v4.10.2+ and v5.7.0+)

Name of the http header created by this valve to hold the list of proxies that have been processed in the incoming remoteIpHeader.  Defaults to: x-forwarded-by

-e GROUPER_TOMCAT_REMOTE_IP_TRUSTED_PROXIES="abc" (v4.10.2+ and v5.7.0+)

Regular expression that matches the IP addresses of trusted proxies. If they appear in the remoteIpHeader value, they will be trusted and will appear in the proxiesHeader value.

-e GROUPER_TOMCAT_REMOTE_IP_PROTOCOL_HEADER=X-Forwarded-Proto (v4.10.2+ and v5.7.0+)

Name of the http header read by this valve that holds the flag that this request.  Defaults to: X-Forwarded-Proto

-e GROUPER_TOMCAT_REMOTE_IP_PROTOCOL_HEADER_HTTPS_VALUE=https (v4.10.2+ and v5.7.0+)

Value of the protocolHeader to indicate that it is an Https request.  Defaults to https

-e GROUPER_TOMCAT_REMOTE_IP_HTTP_SERVER_PORT=80 (v4.10.2+ and v5.7.0+)

Value returned by ServletRequest.getServerPort() when the protocolHeader indicates http protocol.  Defaults to 80

Comments