On a fresh deployment, the first MCP request triggers RSA key pair generation. saveConfigValue calls GrouperConfigHibernate.saveOrUpdate() which triggers AuditEntry.saveOrUpdate() requiring a GrouperSession. The MCP filter does not establish one.

Changes:

• GrouperOAuthSigningKey.java — Wrapped the key save in GrouperSession.startRootSession() with {{finally { GrouperSession.stopQuietly() }}}