{"record":{"id":"5d972e09f1da1f09","repo":"apereo/cas","slug":"grouper-ws-did-not-respond-successfully-ensure-yo","errorCode":null,"errorMessage":"Grouper WS did not respond successfully. Ensure your credentials are correct , the url endpoint for Grouper WS is correctly configured and the subject [{}] exists in Grouper.","messagePattern":"Grouper WS did not respond successfully\\. Ensure your credentials are correct , the url endpoint for Grouper WS is correctly configured and the subject \\[(.+?)\\] exists in Grouper\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-grouper-core/src/main/java/org/apereo/cas/grouper/DefaultGrouperFacade.java","lineNumber":36,"sourceCode":" *\n * @author Misagh Moayyed\n * @since 5.1.0\n */\n@Slf4j\npublic class DefaultGrouperFacade implements GrouperFacade {\n\n    @Override\n    public Collection<WsGetGroupsResult> getGroupsForSubjectId(final String subjectId) {\n        try {\n            val results = fetchGroupsFor(subjectId);\n            if (results == null || results.length == 0) {\n                LOGGER.warn(\"Subject id [{}] could not be located.\", subjectId);\n                return new ArrayList<>();\n            }\n            LOGGER.debug(\"Found [{}] groups for [{}]\", results.length, subjectId);\n            return CollectionUtils.wrapList(results);\n        } catch (final Exception e) {\n            LOGGER.warn(\"Grouper WS did not respond successfully. Ensure your credentials are correct \"\n                + \", the url endpoint for Grouper WS is correctly configured and the subject [{}] exists in Grouper.\", subjectId, e);\n        }\n        return new ArrayList<>();\n    }\n\n    protected WsGetGroupsResult[] fetchGroupsFor(final String subjectId) {\n        val groupsClient = new GcGetGroups().addSubjectId(subjectId);\n        return groupsClient.execute().getResults();\n    }\n\n    @Override\n    public WsGetPermissionAssignmentsResults getPermissionAssignments(final GrouperPermissionAssignmentsQuery query) {\n        val gcGetPermissionAssignments = new GcGetPermissionAssignments();\n        FunctionUtils.doIfNotBlank(query.getAttributeDefinitionName(), gcGetPermissionAssignments::addAttributeDefName);\n        FunctionUtils.doIfNotBlank(query.getRoleName(), gcGetPermissionAssignments::addAttributeDefName);\n        FunctionUtils.doIfNotBlank(query.getRoleUuid(), gcGetPermissionAssignments::addRoleUuid);\n        FunctionUtils.doIfNotBlank(query.getSubjectAttributeName(), gcGetPermissionAssignments::addSubjectAttributeName);\n","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-grouper-core/src/main/java/org/apereo/cas/grouper/DefaultGrouperFacade.java#L18-L54","documentation":"This is a warning logged by DefaultGrouperFacade.getGroupsForSubjectId when the Grouper Web Service call (WsGetGroupsRequest) throws any exception. CAS could not retrieve groups for the subject from the Grouper WS endpoint, so it returns an empty list instead of the group set. The catch-all means any failure — connectivity, authentication, bad subject id, malformed response — surfaces as this single message.","triggerScenarios":"Calling getGroupsForSubjectId(subjectId) when: the Grouper WS URL is wrong or unreachable, the configured WS credentials (user/password) are rejected, the subject id does not exist in the Grouper subject source, or the WS client throws while parsing the response (e.g. WsGetGroupsResult unavailable).","commonSituations":"cas.authn.grouper / GrouperGroupField configuration pointing to a wrong host or port; Grouper WS credentials rotated without updating CAS; LDAP/subject source ids mismatched so the subject lookup fails; network/firewall blocking the WS endpoint; TLS certificate issues against the Grouper server.","solutions":["Verify the Grouper WS URL endpoint and credentials in the CAS grouper configuration properties and test them with curl against the WS endpoint.","Confirm the subject id exists in Grouper by querying the WS directly (WsGetSubjects / getGroups) for that subject.","Read the attached exception `e` in the same log line — it identifies the real cause (connectivity vs auth vs parse).","Check network reachability (DNS, firewall, TLS trust store) from the CAS host to the Grouper WS server."],"exampleFix":"// before\ncas.authn.grouper.url=https://grouper.example.edu/grouper-ws/servicesRest\n// after\ncas.authn.grouper.url=https://grouper.example.edu:443/grouper-ws/v2_5_000/servicesRest\n// and verify with:\n// curl -u wsUser:wsPass -X POST https://grouper.example.edu/grouper-ws/v2_5_000/servicesRest/v2_5_000/groups","handlingStrategy":"try-catch","validationCode":"// Pre-check config and reachability before calling the facade\nval wsUrl = casProperties.getAuthn().getGrouper().getWsUrl();\nAssert.hasText(wsUrl, \"Grouper WS URL must be configured\");\nvar conn = new URL(wsUrl).openConnection();\nconn.setConnectTimeout(3000);\nconn.connect(); // throws earlier with a clearer error if endpoint unreachable","typeGuard":null,"tryCatchPattern":"try {\n    var groups = facade.getGroupsForSubjectId(subjectId);\n    if (groups.isEmpty()) {\n        // degrade gracefully: no groups != fatal\n        logger.warn(\"Grouper returned no groups for {}; continuing with defaults\", subjectId);\n    }\n} catch (Exception e) {\n    logger.error(\"Grouper WS unreachable for subject {}\", subjectId, e);\n}","preventionTips":["Health-check the Grouper WS endpoint at startup or via actuator.","Keep WS credentials in a secret store, not plaintext config, and rotate with config refresh.","Log and monitor the nested exception in the same log line — it names the real cause.","Pin and test the Grouper WS API version explicitly in the URL."],"tags":["network","authentication","grouper","webservice"],"backgroundTag":"http-request-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}