v4 Upgrade instructions from v4
When upgrading from Grouper v4 to another v4 container, this wiki will consolidate all the steps needed to perform that upgrade.
v6 Upgrade Instructions from v4
See information on Grouper Versioning here
Note, these are in reverse order, so go from bottom to top
Date | Upgrading from version | Upgrading to Version | Note for version | Importance | Jira | Step needed if... | Description |
|---|---|---|---|---|---|---|---|
2026/07/05 | ALL | ALL | 4.24.0 | Important | You have provisioning failsafes configured | Follow the steps in the Jira to review your configs | |
2026/05/24 | ALL | ALL | 4.23.0 | Medium important | If you have encrypted configs which shouldn't be labeled as such | Follow the steps in the Jira to review your configs | |
2026/05/18 | ALL | ALL | 4.23.0 | Important | If you have ".serviceUrl" in grouper-loader.properties | This config was renamed since it was causing issues. | |
2026/03/21 | ALL | ALL | 4.22.3 | Not important | You use TeamDynamix provisioning | Run your team dynamix provisioner and adjust the batch sizes in the provisioner config as needed | |
2026/01/31 | ALL | ALL | 4.21.2 | Medium important | You applied a patch for the GSH template vulnerability | You must remove the patch (2 class files) from the container /opt/grouper/grouperWebapp/WEB-INF/classes/edu/internet2/ middleware/grouper/app/gsh/template/GshTemplateValidationService.class
/opt/grouper/grouperWebapp/WEB-INF/classes/edu/internet2/ middleware/grouper/app/gsh/template/GshTemplateValidationService$1.class
| |
2025/10/27 | ALL | ALL | 4.20.0 | Medium important | If you have CSV report jobs that select double quotes in the column names and you want the doublequotes in the CSV upload | You can set the default back to the old way or in those jobs you can configure the old way just for that job. See the Jira: GRP-6390 | |
2025/08/27 | ALL | 4.19.1 | 4.19.1 | Not important | You use Grouper | The Grouper version that shows up under Miscellaneous > Configuration will read "4.19.0", even though the version is 4.19.1. | |
2025/08/20 | 4.17.7 | 4.19.0 | 4.19.0 | Important | You have a SQL sync job using a query instead of a table | In v4.17.7, Grouper changed how it interpreted tables in a SQL sync job. If there were spaces in the name, it assumed it was a query instead of a table. This was problematic, so in v4.19.0 there is a new option for table vs. query. If your "table" was actually a query, you will now need to tell the SQL sync configuration that it's a query. There is a new dropdown for this. | |
2025/08/09 | ALL | ALL | 4.19.0 | Not important | You have a subject source in use which is not enabled | Enable all subject sources which are in use. Subject sources which are not enabled will not resolve subjects | |
2025/07/31 | ALL | ALL | 4.19.0 | Important | You use Grouper | Right before upgrading to v5, you need to run the v4 daemon to populate the SQL membership cache tables. | |
2025/06/29 | ALL | ALL | 4.19.0 | Medium important | If you mind that the CRSF header name changed | You can change the header name back with the container env var: GROUPER_CRSF_HEADER=OWASP_CSRFTOKEN | |
2025/05/25 | ALL | ALL | 4.18.0 | Not important | You have WS external systems without test cases | Adjust the configs of your WS external systems to have test paths, methods, expected results. Otherwise the test button which | |
2025/05/21 | ALL | ALL | 4.18.0 | Not important | You use Grouper WS incorrectly | If callers to your web service expect wrong stems to return all groups, | |
2025/03/19 | ALL | ALL | 4.17.6 | Medium important | You use postgres and are not using the public schema | grouper.properties # this is the schema ddlutils uses to query metadata with jdbc. usually this can be omitted,
# and it defaults to your database loginid, however, in postgres, it can be different, so enter here
# in sql server, it might need to be: dbo
# {valueType: "string"}
#ddlutils.schema = public | |
2025/03/19 | ALL | ALL | 4.17.6 | Medium important | You use the MidPoint connector | Add a membership index on your data structure
| |
2025/01/04 | ALL | ALL | 4.17.0 | Not important | If you use mysql and hardcode the driver classname | You shouldnt hardcode the driver classname. If you do, and want to continue to do so, change to this: com.mysql.cj.jdbc.Driver | |
2025/01/04 | ALL | ALL | 4.17.0 | Not important | Several | If you use Grouper | Tomcat, ldaptive, and a handful of libraries were upgraded, look at container output and make sure no issues. |
2025/01/03 | ALL | ALL | 4.17.0 | Medium important | You use Grouper | Your grouper database credential should be able to manage DDL from now forward. Upgrade task 29 should add index grouper_sync_mship_mem_idx on startup or you can run manually from jira. | |
2024/12/28 | ALL | ALL | 4.17.0 | Not important | If you have SCIM provisioners with membership CRUD select = false or replace memberships = true | Try setting membership CRUD select true and replace false. | |
2024/11/26 | ALL | ALL | 4.17.0 | Important | If you run Grouper | Upgrade tasks are now improved. Make sure Grouper starts without errors. | |
2024/11/4 | ALL | ALL | 4.16.0 | Medium important | You use Grouper | If your grouper credential cannot do DDL, see the Jira and run the DDL manually. Otherwise, after the OTHER_JOB_upgradeTasks job runs, the DDL will be added. Look at the job message to confirm that there were no issues adding the DDL. | |
2024/09/11 | ALL | ALL | 4.15.3 | Not important | You want to use Playwright browser automation for UI sanity testing | Set this variable if you want the playwright jar in the lib dir:
GROUPER_PLAYWRIGHT_MOVE_JARS=true
Install playwright libs in derived image (recommended)
RUN . /usr/local/bin/librarySetupFilesForComponent.sh && setupFilesForComponent_playwrightInstallOsLibsHelper && setupFilesForComponent_unsetAll
Set this variable to install OS libs on startup (must be root, recommend to do derived image instead, takes extra time on startup to install)
GROUPER_PLAYWRIGHT_INSTALL_OS_LIBS=true | |
2024/09/11 | ALL | ALL | 4.15.3 | Important | You use Grouper WS | Set this variable in the WS container: GROUPERWS_URL_WITH_CONTEXT_NOSLASH=https://myws.inst.edu/grouper-ws Test swagger after build: https://myws.inst.edu/grouper-ws/docs | |
2024/08/26 | ALL | ALL | 4.15.0 | Medium important | You use Grouper | If your grouper credential cannot do DDL, see the Jira and run the DDL manually. Otherwise, after the OTHER_JOB_upgradeTasks job runs, the DDL will be added. Look at the job message to confirm that there were no issues adding the DDL. | |
2024/08/26 | ALL | ALL | 4.15.0 | Important | You run commands in the OS during container build or run | The OS was upgraded from Rocky 8 (which is not unsupported) and Rocky 9. See the Jira for notes but some things are a little different | |
2024/08/24 | 4.10.3 | 4.11.0-4.14.3 | 4.11.0 | Important | You have one or more Recent memberships loader groups, and the CHANGE_LOG_consumer_recentMemberships job is failing | Run this gsh script to fix import edu.internet2.middleware.grouper.app.serviceLifecycle.GrouperRecentMemberships
def group = GroupFinder.findByName("etc:attribute:recentMemberships:grouperRecentMembershipsLoader", true)
GrouperRecentMemberships.setupRecentMembershipsLoaderJob(group) | |
2024/07/30 | ALL | ALL | 4.12.1 | Important | You have an AWS provisioner | The AWS target throws a 400 if there is an active flag on SCIM group create. In the Group section of the config, you must set "include active on group create" to false | |
2024/07/16 | ALL | ALL | 4.14.1 | Medium important | If you have SCIM provisioners | The provisioner will now select memberships from the target of SCIM provisioners. To keep the old behavior, change the membership CRUD configuration to not select memberships. Run the full in readonly mode and check what will be changed in the debug object logs. | |
2024/06/27 | ALL | ALL | 4.14.0 | Medium important | If you run Grouper | If your DB credential cannot do DDL then add tables manually from Jira Otherwise, after the OTHER_JOB_upgradeTasks job runs, the DDL will be added. Look at the job message to confirm that there were no issues adding the DDL. | |
2024/06/27 | ALL | ALL | 4.14.0 | Medium important | If you have an SQS external system | Enter in the secret key for sqs in your external system and save, if you grouper.messaging.system.myAwsMessagingSystem.secretyKeyYou need to add the region to the external system | |
2024/06/17 | 4.9.3+ | ALL | 4.14.0 | Medium important | If you have httpClientReuse=true in grouper.properties | You can remove that setting as the bug there was fixed. | |
2024/06/25 | ALL | ALL | 4.13.1 | Medium important | If you allow colons in passwords through basic auth | Read the documentation and set an environment variable to allow passwords to end in colons | |
2024/05/26 | ALL | ALL | 4.13.0 | Not important | You run Grouper | Tomcat was upgraded to v9, make sure any tomcat things work in UI/WS, including logs, SSL, authentication, etc | |
2024/03/19 | ALL | ALL | 4.12.0 | Not important | You run Grouper | Tomcat was upgraded, make sure any tomcat things work in UI/WS, including logs, SSL, authentication, etc | |
2024/03/10 | ALL | ALL | 4.11.0 | Medium important | If you use the provisioning framework and have too much memory allocated to your daemon | Try bumping down your daemon memory to 16g (16g in container and 13g heap) and see if you still have memory problems. | |
2024/03/03 |