Install and Setup - Revision history

Dgreenwood: /* Option 2: Create a self-signed cert from PowerShell */

2026-08-17T13:26:44Z

Option 2: Create a self-signed cert from PowerShell

← Older revision		Revision as of 08:26, 17 August 2026
Line 266:		Line 266:
	--->		--->

	=====~~Option 2: Create a self-signed cert from~~ PowerShell=====		=====From PowerShell=====

	Some organizations have reported issues with how IIS creates a self-signed cert. If you attempt to open the Grooper website and run into an error message that says "ERR_SSL_KEY_USAGE_INCOMPATIBLE", this method should resolve your issue.

	# Open Windows PowerShell (as an admin) on your web server.		# Open Windows PowerShell (as an admin) on your web server.
Line 288:		Line 286:

	<div style="position: relative; box-sizing: content-box; max-height: 80vh; max-height: 80svh; width: 100%; aspect-ratio: 1.7777777777777777; padding: 40px 0 40px 0;"><iframe src="https://app.supademo.com/embed/cm84wmybv00arxq0hpn4yo1c9?embed_v=2" loading="lazy" title="2025Wiki - Install and Setup - 06 Create a self-signed certificate (PowerShell)" allow="clipboard-write" frameborder="0" webkitallowfullscreen="true" mozallowfullscreen="true" allowfullscreen style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"></iframe></div>		<div style="position: relative; box-sizing: content-box; max-height: 80vh; max-height: 80svh; width: 100%; aspect-ratio: 1.7777777777777777; padding: 40px 0 40px 0;"><iframe src="https://app.supademo.com/embed/cm84wmybv00arxq0hpn4yo1c9?embed_v=2" loading="lazy" title="2025Wiki - Install and Setup - 06 Create a self-signed certificate (PowerShell)" allow="clipboard-write" frameborder="0" webkitallowfullscreen="true" mozallowfullscreen="true" allowfullscreen style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"></iframe></div>

			{{fyi-box\|This documentation previously described how to add a self-signed certificate via IIS.
			* That method has been removed from this guide because it causes certificate configuration issues for users.
			* The IIS certificate wizard sets an outdated Key Usage flag (Key Encipherment) instead of the Digital Signature flag that modern browsers require for TLS.
			* If you previously added a self-signed certificate through IIS and now see the error <code>ERR_SSL_KEY_USAGE_INCOMPATIBLE</code> when opening Grooper in your browser, use the PowerShell method described in the [[#From PowerShell\|section above]] instead.
			*
			}}

	===== How to add the cert to a browsers trusted root certification authority store (from Chrome) =====		===== How to add the cert to a browsers trusted root certification authority store (from Chrome) =====

Dgreenwood: /* How to create and bind a self-signed certificate */

2026-08-17T13:12:30Z

How to create and bind a self-signed certificate

← Older revision		Revision as of 08:12, 17 August 2026
Line 242:		Line 242:
	**<li class="fyi-bullet">Example: You will not be able to paste from a clipboard to Grooper using an insecure connection (i.e. HTTP)		**<li class="fyi-bullet">Example: You will not be able to paste from a clipboard to Grooper using an insecure connection (i.e. HTTP)

	Here, we will cover the ''most basic'' steps to create a self-signed SSL certificate and bind it to the Grooper Web Client's website.		Here, we will cover the most basic steps to create a self-signed SSL certificate and bind it to the Grooper Web Client's website.
	<div style="padding-left: 1.5em;">		<div style="padding-left: 1.5em;">
	<!---		<!---

Dgreenwood: /* Option 1: Create a self-signed cert in IIS */

2026-08-17T13:11:44Z

Option 1: Create a self-signed cert in IIS

← Older revision		Revision as of 08:11, 17 August 2026
Line 244:		Line 244:
	Here, we will cover the ''most basic'' steps to create a self-signed SSL certificate and bind it to the Grooper Web Client's website.		Here, we will cover the ''most basic'' steps to create a self-signed SSL certificate and bind it to the Grooper Web Client's website.
	<div style="padding-left: 1.5em;">		<div style="padding-left: 1.5em;">
			<!---
	===== Option 1: Create a self-signed cert in IIS =====		===== Option 1: Create a self-signed cert in IIS =====

Line 263:		Line 264:

	<div style="position: relative; box-sizing: content-box; max-height: 80vh; max-height: 80svh; width: 100%; aspect-ratio: 1.7777777777777777; padding: 40px 0 40px 0;"><iframe src="https://app.supademo.com/embed/cm84uca6y02po3h0igp7mg3lk?embed_v=2" loading="lazy" title="2025Wiki - Install and Setup - 05 Create a self-signed certificate (IIS)" allow="clipboard-write" frameborder="0" webkitallowfullscreen="true" mozallowfullscreen="true" allowfullscreen style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"></iframe></div>		<div style="position: relative; box-sizing: content-box; max-height: 80vh; max-height: 80svh; width: 100%; aspect-ratio: 1.7777777777777777; padding: 40px 0 40px 0;"><iframe src="https://app.supademo.com/embed/cm84uca6y02po3h0igp7mg3lk?embed_v=2" loading="lazy" title="2025Wiki - Install and Setup - 05 Create a self-signed certificate (IIS)" allow="clipboard-write" frameborder="0" webkitallowfullscreen="true" mozallowfullscreen="true" allowfullscreen style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"></iframe></div>
			--->

	=====Option 2: Create a self-signed cert from PowerShell=====		=====Option 2: Create a self-signed cert from PowerShell=====

Dgreenwood at 20:44, 22 July 2026

2026-07-22T20:44:41Z

← Older revision		Revision as of 15:44, 22 July 2026
Line 12:		Line 12:
	# [[#Installing Grooper Desktop\|Installing Grooper Desktop]] - This is only required if you are scanning paper documents into Grooper using a scanner attached to a computer. If you are not scanning documents, you may ignore this.		# [[#Installing Grooper Desktop\|Installing Grooper Desktop]] - This is only required if you are scanning paper documents into Grooper using a scanner attached to a computer. If you are not scanning documents, you may ignore this.

	{~~\|class="~~attn-box"		{{attn-box\|For best results, all installers should be run as an administrator.}}
	\|
	~~⚠~~
	\|
	For best results, all installers should be run as an administrator.
	\|}

	'''''PLEASE NOTE: At the end of this article, you will also find guidance for upgrading an older version of Grooper to the current version. If you are upgrading an existing install, there are some additional things you need to be aware of. Please visit the [[#Upgrading an older version of Grooper\|Upgrading an older version of Grooper]] section of this article for more information.'''''		'''''PLEASE NOTE: At the end of this article, you will also find guidance for upgrading an older version of Grooper to the current version. If you are upgrading an existing install, there are some additional things you need to be aware of. Please visit the [[#Upgrading an older version of Grooper\|Upgrading an older version of Grooper]] section of this article for more information.'''''
Line 202:		Line 197:
	:*<li class="fyi-bullet"> For example: Browsers won't allow you to paste text copied to your clipboard to text editors in Grooper from an insecure connection.		:*<li class="fyi-bullet"> For example: Browsers won't allow you to paste text copied to your clipboard to text editors in Grooper from an insecure connection.

	{~~\|class="~~attn-box"		{{attn-box\|'''''BE AWARE: For Grooper Desktop to scan to the Grooper web server, you must connect securely in the browser (HTTPS).'''''
	\|
	~~⚠~~
	\|
	'''''BE AWARE: For Grooper Desktop to scan to the Grooper web server, you must connect securely in the browser (HTTPS).'''''
	* Always use HTTPS to connect to the Grooper web app.		* Always use HTTPS to connect to the Grooper web app.
	* NEVER use HTTP to connect to the Grooper web app. Scanned images will be refused if using an HTTP address.		* NEVER use HTTP to connect to the Grooper web app. Scanned images will be refused if using an HTTP address.
	* '''At minimum''' a [[Install_and_Setup#How to create and bind a self-signed certificate\|self-signed certificate]] must be installed on the Grooper web server. ''This is generally acceptable for test environments.''		* '''At minimum''' a [[Install_and_Setup#How to create and bind a self-signed certificate\|self-signed certificate]] must be installed on the Grooper web server. ''This is generally acceptable for test environments.''
	* '''Best practice:''' Use an internally issued certificate managed by your organization's IT.		* '''Best practice:''' Use an internally issued certificate managed by your organization's IT.}}
	\|}

	<big>Breaking Change: HTTPS Required for Application Installation</big>		<big>Breaking Change: HTTPS Required for Application Installation</big>
Line 363:		Line 353:
	Connecting to a Grooper Repository is one of the first things you will do after installing Grooper to start designing (or implementing already architected) document processing solutions. This is done with the [[Grooper Command Console]] application.		Connecting to a Grooper Repository is one of the first things you will do after installing Grooper to start designing (or implementing already architected) document processing solutions. This is done with the [[Grooper Command Console]] application.

	{~~\|class="~~attn-box"		{{attn-box\|Grooper Command Console must be run as an administrator. It performs functions that require elevated access in Windows.}}
	\|
	~~⚠~~
	\|
	Grooper Command Console must be run as an administrator. It performs functions that require elevated access in Windows.
	\|}
	<div style="padding-left: 1.5em;">		<div style="padding-left: 1.5em;">
	=== Prerequisites ===		=== Prerequisites ===
Line 510:		Line 495:
	We will show you how to install and start the most basic versions of these Grooper services from the Grooper Command Console.		We will show you how to install and start the most basic versions of these Grooper services from the Grooper Command Console.

	{~~\|class="~~attn-box"		{{attn-box\|Grooper Command Console must be run as an administrator. It performs functions that require elevated access in Windows.}}
	\|
	~~⚠~~
	\|
	Grooper Command Console must be run as an administrator. It performs functions that require elevated access in Windows.
	\|}
	<div style="padding-left: 1.5em;">		<div style="padding-left: 1.5em;">
	=== Service account permissions ===		=== Service account permissions ===

Dgreenwood at 20:41, 22 July 2026

2026-07-22T20:41:53Z

← Older revision		Revision as of 15:41, 22 July 2026
Line 34:		Line 34:
	*'''Grooper Desktop''': This is a lightweight desktop application required to scan paper documents into Grooper. It must be installed on any desktop computer connected to an optical scanner.		*'''Grooper Desktop''': This is a lightweight desktop application required to scan paper documents into Grooper. It must be installed on any desktop computer connected to an optical scanner.
	*'''Grooper services''': While not ''strictly'' required to perform basic testing in Grooper. As a practical matter, at least two Grooper services are required for most installs, an '''Activity Processing''' and '''Import Watcher''' service. [[#Installing necessary Grooper services\|See here for more information.]]		*'''Grooper services''': While not ''strictly'' required to perform basic testing in Grooper. As a practical matter, at least two Grooper services are required for most installs, an '''Activity Processing''' and '''Import Watcher''' service. [[#Installing necessary Grooper services\|See here for more information.]]

			{{fyi-box\|'''This is only a summary of install components'''

			For full system architecture information and requirements, [[Grooper_Infrastructure#System_Architecture_and_Requirements\|refer to the Grooper Infrastructure article]].
			}}

	<section begin="antivirus_advice" />		<section begin="antivirus_advice" />
	{~~\|class="~~attn-box"		{{attn-box\|In some cases, antivirus software will interfere with Grooper's installation, preventing a complete install.
	\|
	~~⚠~~
	\|
	In some cases, antivirus software will interfere with Grooper's installation, preventing a complete install.
	* You may need to whitelist the Grooper installers/software ''before'' installing.		* You may need to whitelist the Grooper installers/software ''before'' installing.
	* This will ensure the antivirus software is not preventing DLL files from installing or executing.		* This will ensure the antivirus software is not preventing DLL files from installing or executing.


	Most commonly, this issue has been demonstrated when installing the Grooper Desktop application.		Most commonly, this issue has been demonstrated when installing the Grooper Desktop application.

	If Grooper Desktop is installed correctly, and you are able to scan using the scanner's native software (but not with Grooper), you may need to (1) uninstall Grooper Desktop, (2) whitelist the Grooper Desktop installer and GrooperDesktop.exe application and (3) reinstall Grooper Desktop to ensure you can scan from the Grooper web client.		If Grooper Desktop is installed correctly, and you are able to scan using the scanner's native software (but not with Grooper), you may need to (1) uninstall Grooper Desktop, (2) whitelist the Grooper Desktop installer and GrooperDesktop.exe application and (3) reinstall Grooper Desktop to ensure you can scan from the Grooper web client.}}<section end="antivirus_advice" />
	\|}
	<section end="antivirus_advice" />
	{{#lst:Grooper Infrastructure\|centralized vs distributed}}		{{#lst:Grooper Infrastructure\|centralized vs distributed}}

Dgreenwood at 18:34, 11 June 2026

2026-06-11T18:34:49Z

← Older revision		Revision as of 13:34, 11 June 2026
Line 572:		Line 572:

	=== Installing an Import Watcher service ===		=== Installing an Import Watcher service ===

	~~{{GrooperServiceUserRights}}~~

	An Import Watcher service must be running to import documents into Grooper.		An Import Watcher service must be running to import documents into Grooper.

Dgreenwood: /* Installing an Activity Processing service */

2026-06-11T18:09:20Z

Installing an Activity Processing service

← Older revision		Revision as of 13:09, 11 June 2026
Line 519:		Line 519:
	\|}		\|}
	<div style="padding-left: 1.5em;">		<div style="padding-left: 1.5em;">
			=== Service account permissions ===

			{{LeastPrivilegeServiceAccounts}}

	=== Installing an Activity Processing service ===		=== Installing an Activity Processing service ===

	~~{{GrooperServiceUserRights}}~~

	An Activity Processing service must be running to automate task processing in a Batch Process.		An Activity Processing service must be running to automate task processing in a Batch Process.

Dgreenwood: /* Setup: App pool identity permissions */

2026-06-11T15:47:08Z

Setup: App pool identity permissions

@@ Line 178: / Line 178: @@
 </div>
 ==== Setup: App pool identity permissions ====
-From a security standpoint, it is best practice to only give a minimum number of permissions to this account.
+{{Template:LeastPrivilegeAppPoolAccounts}}
 ====Installing Grooper Web Client====

Dgreenwood: /* SSL and HTTPS: Secure website connections */

2026-05-12T16:00:38Z

SSL and HTTPS: Secure website connections

← Older revision		Revision as of 11:00, 12 May 2026
Line 287:		Line 287:
	** Existing deployments using HTTP must be updated to HTTPS.		** Existing deployments using HTTP must be updated to HTTPS.
	** Clients will be unable to access the application properly unless the server presents a trusted TLS/SSL certificate.		** Clients will be unable to access the application properly unless the server presents a trusted TLS/SSL certificate.
			** There is an exception. When accessed via localhost addresses, Grooper runs in "dev mode" and is allowed to operate over HTTP.
	* '''Required Action'''		* '''Required Action'''
	** Before installing or upgrading, configure the Grooper web server with a valid HTTPS certificate that is trusted by all client machines.		** Before installing or upgrading, configure the Grooper web server with a valid HTTPS certificate that is trusted by all client machines.

Dgreenwood: /* SSL and HTTPS: Secure website connections */

2026-05-12T15:58:03Z

SSL and HTTPS: Secure website connections

← Older revision		Revision as of 10:58, 12 May 2026
Line 305:		Line 305:
	# Requires a valid public domain		# Requires a valid public domain
	# Examples: [https://en.wikipedia.org/wiki/DigiCert DigiCert], [https://en.wikipedia.org/wiki/GlobalSign GlobalSign],[https://en.wikipedia.org/wiki/Let%27s_Encrypt Let's Encrypt]		# Examples: [https://en.wikipedia.org/wiki/DigiCert DigiCert], [https://en.wikipedia.org/wiki/GlobalSign GlobalSign],[https://en.wikipedia.org/wiki/Let%27s_Encrypt Let's Encrypt]
			*<li class="attn-bullet"> If you continually see a "Your server session has expired - page will be reloaded" error. You may be using an HTTP address. Ensure you've bound an SSL certificate and enter an HTTPS address instead.

	Below, we will instruct you how to create a self-signed certificate and set up your browser to trust the certificate. This is the quickest way to get started testing a Grooper install.		Below, we will instruct you how to create a self-signed certificate and set up your browser to trust the certificate. This is the quickest way to get started testing a Grooper install.