v4 Upgrade instructions from v4

v4 Upgrade instructions from v4

When upgrading from Grouper v4 to another v4 container, this wiki will consolidate all the steps needed to perform that upgrade.

v6 Upgrade Instructions from v4



See information on Grouper Versioning here

Note, these are in reverse order, so go from bottom to top

Date

Upgrading from version

Upgrading to Version

Note for version

Importance

Jira

Step needed if...

Description

Date

Upgrading from version

Upgrading to Version

Note for version

Importance

Jira

Step needed if...

Description

2026/07/05

ALL

ALL

4.24.0

Important

GRP-7012

You have provisioning failsafes configured

Follow the steps in the Jira to review your configs

2026/05/24

ALL

ALL

4.23.0

Medium important

GRP-6902

If you have encrypted configs which shouldn't be labeled as such

Follow the steps in the Jira to review your configs

2026/05/18

ALL

ALL

4.23.0

Important

GRP-6964

If you have ".serviceUrl" in grouper-loader.properties

This config was renamed since it was causing issues.
You must refactor your configs.  See the Jir

2026/03/21

ALL

ALL

4.22.3

Not important

GRP-6805

You use TeamDynamix provisioning

Run your team dynamix provisioner and adjust the batch sizes in the provisioner config as needed

2026/01/31

ALL

ALL

4.21.2

Medium important

GRP-6566

You applied a patch for the GSH template vulnerability

You must remove the patch (2 class files) from the container
 

/opt/grouper/grouperWebapp/WEB-INF/classes/edu/internet2/ middleware/grouper/app/gsh/template/GshTemplateValidationService.class /opt/grouper/grouperWebapp/WEB-INF/classes/edu/internet2/ middleware/grouper/app/gsh/template/GshTemplateValidationService$1.class

2025/10/27

ALL

ALL

4.20.0

Medium important

GRP-6390

If you have CSV report jobs that select double quotes in the column names and you want the doublequotes in the CSV upload

You can set the default back to the old way or in those jobs you can configure the old way just for that job.  See the Jira: GRP-6390

2025/08/27

ALL

4.19.1

4.19.1

Not important

GRP-6318

You use Grouper

The Grouper version that shows up under Miscellaneous > Configuration will read "4.19.0", even though the version is 4.19.1.

2025/08/20

4.17.7

4.19.0

4.19.0

Important

GRP-6155

You have a SQL sync job using a query instead of a table

In v4.17.7, Grouper changed how it interpreted tables in a SQL sync job. If there were spaces in the name, it assumed it was a query instead of a table. This was problematic, so in v4.19.0 there is a new option for table vs. query. If your "table" was actually a query, you will now need to tell the SQL sync configuration that it's a query. There is a new dropdown for this.

2025/08/09

ALL

ALL

4.19.0

Not important

GRP-6261

You have a subject source in use which is not enabled

Enable all subject sources which are in use.  Subject sources which are not enabled will not resolve subjects

2025/07/31

ALL

ALL

4.19.0

Important

GRP-6253

You use Grouper

Right before upgrading to v5, you need to run the v4 daemon to populate the SQL membership cache tables.

2025/06/29

ALL

ALL

4.19.0

Medium important

GRP-5032

If you mind that the CRSF header name changed

You can change the header name back with the container env var: GROUPER_CRSF_HEADER=OWASP_CSRFTOKEN

2025/05/25

ALL

ALL

4.18.0

Not important

GRP-6055

You have WS external systems without test cases

Adjust the configs of your WS external systems to have test paths, methods, expected results.  Otherwise the test button which 
used to just report success on everything will now report a failure

2025/05/21

ALL

ALL

4.18.0

Not important

GRP-6159

You use Grouper WS incorrectly

If callers to your web service expect wrong stems to return all groups, 
revert to previous behavior

2025/03/19

ALL

ALL

4.17.6

Medium important



You use postgres and are not using the public schema

grouper.properties

# this is the schema ddlutils uses to query metadata with jdbc. usually this can be omitted, # and it defaults to your database loginid, however, in postgres, it can be different, so enter here # in sql server, it might need to be: dbo # {valueType: "string"} #ddlutils.schema = public

2025/03/19

ALL

ALL

4.17.6

Medium important



You use the MidPoint connector

Add a membership index on your data structure

CREATE INDEX gr_mp_memberships_by_subject_idx ON gr_mp_memberships (subject_id_index);

2025/01/04

ALL

ALL

4.17.0

Not important

GRP-5903

If you use mysql and hardcode the driver classname

You shouldnt hardcode the driver classname.  If you do, and want to continue to do so, change to this: com.mysql.cj.jdbc.Driver

2025/01/04

ALL

ALL

4.17.0

Not important

Several

If you use Grouper

Tomcat, ldaptive, and a handful of libraries were upgraded, look at container output and make sure no issues.  
Additionally: commons-httpclient-3.1.jar was removed, which should not cause issues, GrouperHttpClient should
be used instead.

2025/01/03

ALL

ALL

4.17.0

Medium important

GRP-5877

You use Grouper

Your grouper database credential should be able to manage DDL from now forward.

Upgrade task 29 should add index grouper_sync_mship_mem_idx on startup or you can run manually from jira.

2024/12/28

ALL

ALL

4.17.0

Not important

GRP-5893

If you have SCIM provisioners with membership CRUD select = false or replace memberships = true

Try setting membership CRUD select true and replace false.

2024/11/26

ALL

ALL

4.17.0

Important

GRP-5796

If you run Grouper

Upgrade tasks are now improved.  Make sure Grouper starts without errors.

2024/11/4

ALL

ALL

4.16.0

Medium important

GRP-5794

You use Grouper

If your grouper credential cannot do DDL, see the Jira and run the DDL manually.

Otherwise, after the OTHER_JOB_upgradeTasks job runs, the DDL will be added.  Look at the job message to confirm that there were no issues adding the DDL.

2024/09/11

ALL

ALL

4.15.3

Not important

GRP-5665

You want to use Playwright browser automation for UI sanity testing

Set this variable if you want the playwright jar in the lib dir: GROUPER_PLAYWRIGHT_MOVE_JARS=true Install playwright libs in derived image (recommended) RUN . /usr/local/bin/librarySetupFilesForComponent.sh && setupFilesForComponent_playwrightInstallOsLibsHelper && setupFilesForComponent_unsetAll Set this variable to install OS libs on startup (must be root, recommend to do derived image instead, takes extra time on startup to install) GROUPER_PLAYWRIGHT_INSTALL_OS_LIBS=true

2024/09/11

ALL

ALL

4.15.3

Important

GRP-5588

You use Grouper WS

Set this variable in the WS container:

GROUPERWS_URL_WITH_CONTEXT_NOSLASH=https://myws.inst.edu/grouper-ws

Test swagger after build: https://myws.inst.edu/grouper-ws/docs
See Jira or Container docs for details

2024/08/26

ALL

ALL

4.15.0

Medium important

GRP-5625

You use Grouper

If your grouper credential cannot do DDL, see the Jira and run the DDL manually.

Otherwise, after the OTHER_JOB_upgradeTasks job runs, the DDL will be added.  Look at the job message to confirm that there were no issues adding the DDL.

2024/08/26

ALL

ALL

4.15.0

Important

GRP-5653

You run commands in the OS during container build or run

The OS was upgraded from Rocky 8 (which is not unsupported) and Rocky 9.  See the Jira for notes but some things are a little different
like "yum" is not there anymore.  Check the output of building and running Grouper to see if there are any errors.

2024/08/24

4.10.3

4.11.0-4.14.3

4.11.0

Important

GRP-5635

You have one or more Recent memberships loader groups, and the CHANGE_LOG_consumer_recentMemberships job is failing

Run this gsh script to fix

import edu.internet2.middleware.grouper.app.serviceLifecycle.GrouperRecentMemberships def group = GroupFinder.findByName("etc:attribute:recentMemberships:grouperRecentMembershipsLoader", true) GrouperRecentMemberships.setupRecentMembershipsLoaderJob(group)

2024/07/30

ALL

ALL

4.12.1

Important

GRP-5408

You have an AWS provisioner

The AWS target throws a 400 if there is an active flag on SCIM group create.  In the Group section of the config, you must set "include active on group create" to false

2024/07/16

ALL

ALL

4.14.1

Medium important

GRP-5548

If you have SCIM provisioners

The provisioner will now select memberships from the target of SCIM provisioners.  To keep the old behavior, change the membership CRUD configuration to not select memberships.  Run the full in readonly mode and check what will be changed in the debug object logs.

2024/06/27

ALL

ALL

4.14.0

Medium important

GRP-5514

If you run Grouper

If your DB credential cannot do DDL then add tables manually from Jira

Otherwise, after the OTHER_JOB_upgradeTasks job runs, the DDL will be added.  Look at the job message to confirm that there were no issues adding the DDL.

2024/06/27

ALL

ALL

4.14.0

Medium important

GRP-3981

If you have an SQS external system

Enter in the secret key for sqs in your external system and save, if you
look for the external system config id in grouper.client.properties, there
a typo you can remove:



grouper.messaging.system.myAwsMessagingSystem.secretyKey

You need to add the region to the external system

2024/06/17

4.9.3+

ALL

4.14.0

Medium important

GRP-5450

If you have httpClientReuse=true in grouper.properties

You can remove that setting as the bug there was fixed.

2024/06/25

ALL

ALL

4.13.1

Medium important

GRP-5515

If you allow colons in passwords through basic auth

Read the documentation and set an environment variable to allow passwords to end in colons

2024/05/26

ALL

ALL

4.13.0

Not important

GRP-5395

You run Grouper

Tomcat was upgraded to v9, make sure any tomcat things work in UI/WS, including logs, SSL, authentication, etc

2024/03/19

ALL

ALL

4.12.0

Not important

GRP-5379

You run Grouper

Tomcat was upgraded, make sure any tomcat things work in UI/WS, including logs, SSL, authentication, etc

2024/03/10

ALL

ALL

4.11.0

Medium important

GRP-5312

If you use the provisioning framework and have too much memory allocated to your daemon

Try bumping down your daemon memory to 16g (16g in container and 13g heap) and see if you still have memory problems. 
Or if you had more than 32g, try 32g container and 28g heap.

2024/03/03