unity-idm-discuss — Unity discussion and support

Re: [Unity-idm-discuss] Bug in unser (de-)selection on directory browser at console endpoint

[Roman K. <ro...@un...>]

Dear Sander,

Thank you for reporting this, I'll open a ticket to review this
functionality and cover findings.

Kind regards,
Roman

wt., 18 lis 2025 o 16:21 Sander Apweiler <sa....@fz...>
napisał(a):

> Dear Krzysztof,
> dear Roman,
>
> We found some strange behaviour in the directory browser of the console
> endpoint, which seems to be a but, from my perspective. When I select
> all users in a subgrop via the checkbox in table heading, deselect some
> few entities and remove entities from this group, also the deselected
> entities are removed from the group. They are also listed in the
> "confirmation pop-up window", so it seems that unity ignors the
> deselection. We found this in version 4.1.1 and can reproduce it in
> 4.2.0 as well.
>
> Best regards,
> Sander
>
> --
> Large-Scale Data Science
> Juelich Supercomputing Centre
>
> phone: +49 2461 61 8847
> fax: +49 2461 61 6656
> email: sa....@fz...
>
> -----------------------------------------------------------------------
> -----------------------------------------------------------------------
> Forschungszentrum Jülich GmbH
> 52425 Jülich
> Sitz der Gesellschaft: Jülich
> Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498
> Vorsitzender des Aufsichtsrats: MinDir Stefan Müller
> Geschäftsführung: Prof. Dr. Astrid Lambrecht (Vorsitzende),
> Dr. Stephanie Bauer (stellvertretende Vorsitzende),
> Prof. Dr. Ir. Pieter Jansens, Prof. Dr. Laurens Kuipers
> -----------------------------------------------------------------------
> -----------------------------------------------------------------------
>
>
>
> _______________________________________________
> Unity-idm-discuss mailing list
> Uni...@li...
> https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss
>

Re: [Unity-idm-discuss] Change text in consent screen

[Krzysztof B. <kb...@un...>]

Hi Laura,

W dniu 18.11.2025 o 15:27, Laura Hofer pisze:
>
> Hi Krzysztof,
>
> the question is to add a sentence to the "has requested access to your 
> data" part. Would that be possible?
>
Yes, sure. This message has a key:

SPInfoComponent.requestedAccess

you can define it with any custom value in your custom messages bundle 
(see documentation how to do it).

HTH,
Krzysztof

[Unity-idm-discuss] Bug in unser (de-)selection on directory browser at console endpoint

[Sander A. <sa....@fz...>]

Dear Krzysztof,
dear Roman,

We found some strange behaviour in the directory browser of the console
endpoint, which seems to be a but, from my perspective. When I select
all users in a subgrop via the checkbox in table heading, deselect some
few entities and remove entities from this group, also the deselected
entities are removed from the group. They are also listed in the
"confirmation pop-up window", so it seems that unity ignors the
deselection. We found this in version 4.1.1 and can reproduce it in
4.2.0 as well.

Best regards,
Sander

-- 
Large-Scale Data Science
Juelich Supercomputing Centre

phone: +49 2461 61 8847
fax: +49 2461 61 6656
email: sa....@fz...

-----------------------------------------------------------------------
-----------------------------------------------------------------------
Forschungszentrum Jülich GmbH
52425 Jülich
Sitz der Gesellschaft: Jülich
Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Stefan Müller
Geschäftsführung: Prof. Dr. Astrid Lambrecht (Vorsitzende),
Dr. Stephanie Bauer (stellvertretende Vorsitzende),
Prof. Dr. Ir. Pieter Jansens, Prof. Dr. Laurens Kuipers
-----------------------------------------------------------------------
-----------------------------------------------------------------------

Re: [Unity-idm-discuss] Change text in consent screen

[Laura H. <l....@fz...>]

Hi Krzysztof,

the question is to add a sentence to the "has requested access to your 
data" part. Would that be possible?

Kind regards,
Laura

Am 18.11.25 um 14:29 schrieb Krzysztof Benedyczak:
> Hi Laura,
>
> W dniu 17.11.2025 o 16:26, Laura Hofer pisze:
>> Hi Roman, Hi Krzysztof,
>>
>> We were wondering if there is a way to customise the text that is 
>> displayed to the user when asking whether their attributes will be 
>> transmitted in the consent screen?
>>
> 99% sure that the answer is "yes". But please be more specific - can 
> you more precisely point out which label/caption/header you want to 
> customize?
>
> Thanks,
> Krzysztof
>
>
-- 
"Das Forschungszentrum Jülich stellt zurzeit auf einen neuen Zertifikatsanbieter zum digitalen Signieren von E-Mails um. Während dieser Umstellungsarbeiten kann es vorkommen, dass das DFN Community PKI Zertifikat, mit dem diese E-Mail signiert worden ist, als ungültig angezeigt wird."

Large-Scale Data Science
Juelich Supercomputing Centre

phone: +49 2461 61 6576
fax: +49 2461 61 6656
email:l....@fz...

---------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------
Forschungszentrum Jülich GmbH
52425 Jülich
Sitz der Gesellschaft: Jülich
Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Stefan Müller
Geschäftsführung: Prof. Dr. Astrid Lambrecht (Vorsitzende),
Dr. Stephanie Bauer (stellvertretende Vorsitzende),
Prof. Dr. Ir. Pieter Jansens, Prof. Dr. Laurens Kuipers
---------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------

Re: [Unity-idm-discuss] Change text in consent screen

[Krzysztof B. <kb...@un...>]

Hi Laura,

W dniu 17.11.2025 o 16:26, Laura Hofer pisze:
> Hi Roman, Hi Krzysztof,
>
> We were wondering if there is a way to customise the text that is 
> displayed to the user when asking whether their attributes will be 
> transmitted in the consent screen?
>
99% sure that the answer is "yes". But please be more specific - can you 
more precisely point out which label/caption/header you want to customize?

Thanks,
Krzysztof

[Unity-idm-discuss] Change text in consent screen

[Laura H. <l....@fz...>]

Hi Roman, Hi Krzysztof,

We were wondering if there is a way to customise the text that is 
displayed to the user when asking whether their attributes will be 
transmitted in the consent screen?

Kind regards,
Laura

-- 
"Das Forschungszentrum Jülich stellt zurzeit auf einen neuen Zertifikatsanbieter zum digitalen Signieren von E-Mails um. Während dieser Umstellungsarbeiten kann es vorkommen, dass das DFN Community PKI Zertifikat, mit dem diese E-Mail signiert worden ist, als ungültig angezeigt wird."

Large-Scale Data Science
Juelich Supercomputing Centre

phone: +49 2461 61 6576
fax: +49 2461 61 6656
email: l....@fz...

---------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------
Forschungszentrum Jülich GmbH
52425 Jülich
Sitz der Gesellschaft: Jülich
Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Stefan Müller
Geschäftsführung: Prof. Dr. Astrid Lambrecht (Vorsitzende),
Dr. Stephanie Bauer (stellvertretende Vorsitzende),
Prof. Dr. Ir. Pieter Jansens, Prof. Dr. Laurens Kuipers
---------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------

Re: [Unity-idm-discuss] Vulnerability Report [X-frame By-Pass]

[Krzysztof B. <kb...@un...>]

Hi,

W dniu 6.11.2025 o 10:20, Whitehat Security pisze:
> Hello Team,
>
> I have found a bug in your website https://unity-idm.eu
> The details of it are as follows:-
>
>
>     Summary:
>
> X-Frame-Options ALLOW-FROM https://unity-idm.eu supported by several 
> Browser,
>
>
>     Steps To Reproduce:
>
>  1. Create a new HTML file
>  2. Put <iframe src="https://unity-idm.eu"0"></iframe>
>  3. Save the file
>  4. Open document in browser
>
>
>     Impact:
>
> Attacker may tricked user, sending them malicious link then user open 
> it clicked some image and their account unconsciously has been deactivated
>

This webpage is not accepting any sensitive user inputs, users have no 
accounts, it is information only. Therefore the attacks you are 
describing are of minimal - if any - threat to our users. Note: this 
applies also to the another report on clickjacking).

Nevertheless, thanks for the heads up :-)
Krzysztof

Re: [Unity-idm-discuss] Is ACR forwarding to upstream OP supported?

[Sander A. <sa....@fz...>]

Dear Roman,
I was on a business trip this week. I'll check and come back as soon as
possible.

Best regards,
Sander

On Thu, 2025-11-06 at 10:53 +0100, Roman Krysiński wrote:
> Dear Sander,
> 
> Please let me know your thoughts on this matter.
> 
> Kind regards,
> Roman
> 
> 
> pon., 3 lis 2025 o 12:59 Roman Krysiński <ro...@un...>
> napisał(a):
> > Dear Sander,
> > 
> > After testing and reviewing the code for ACR forwarding, it appears
> > that Unity always forwards the ACR request in the form of claims,
> > regardless of whether the original request used acr_values or
> > claims.
> > This means the forwarding is semantic rather than strict — Unity
> > preserves the meaning of the ACR request, but normalizes it to the
> > claims representation instead of copying the original parameter
> > format.
> > 
> > Could you please confirm if this aligns with what you’re observing
> > on your end, and whether a strict parameter-level forward would be
> > preferable in your use case?
> > 
> > Kind regards,
> > Roman
> >  
> > 
> > pt., 31 paź 2025 o 12:40 Roman Krysiński <ro...@un...>
> > napisał(a):
> > > Hi Sander,
> > > 
> > > Indeed it looks like there is a regression, I'll open a ticket to
> > > cover that and target it for the next release, unless this is an
> > > urgent matter - please let me know.
> > > 
> > > Kind regards,
> > > Roman
> > > 
> > > 
> > > śr., 29 paź 2025 o 16:55 Sander Apweiler
> > > <sa....@fz...> napisał(a):
> > > > Dear Roman,
> > > > thanks for the detailed answer. In case of forwarding, we
> > > > recognized
> > > > that the arc_values parameter from downstrem RP was not added.
> > > > 
> > > > Best regards,
> > > > Sander
> > > > 
> > > > On Wed, 2025-10-29 at 15:21 +0100, Roman Krysiński wrote:
> > > > > Hi Sander,
> > > > > You’re right - in Unity, when the ACR handling mode is set to
> > > > > fixed,
> > > > > the ACR request is not sent using the acr_values parameter.
> > > > > Instead,
> > > > > Unity adds the ACR information through the claims parameter
> > > > > in the
> > > > > authorization request.
> > > > > This is intentional and aligns with the OpenID Connect Core
> > > > > specification, which allows two equivalent ways to request an
> > > > > ACR:
> > > > >    1. 
> > > > >       via the simple acr_values request parameter, or
> > > > >    2. 
> > > > >       via the richer claims parameter that supports
> > > > > “essential” ACR
> > > > > requests and more detailed semantics (see OIDC §5.5.1 and
> > > > > §5.5.1.1).
> > > > > Unity uses the second form (the claims parameter) for fixed
> > > > > ACR
> > > > > configuration, since it provides better precision and
> > > > > flexibility —
> > > > > for example, it allows expressing essential ACR requirements.
> > > > > When ACR is set to forwarded, Unity simply forwards whatever
> > > > > format
> > > > > was present in the downstream request — that can be either
> > > > > acr_values
> > > > > or claims, depending on the client’s request.
> > > > > So in short:
> > > > >  * 
> > > > >    Fixed mode → ACR sent inside claims (not visible as
> > > > > acr_values)
> > > > >  * 
> > > > >    Forward mode → Unity preserves the original form (either
> > > > > acr_values or claims)
> > > > > Best regards,
> > > > > Roman
> > > > > 
> > > > > 
> > > > > 
> > > > > wt., 28 paź 2025 o 08:16 Sander Apweiler
> > > > > <sa....@fz...>
> > > > > napisał(a):
> > > > > > Hi Krzysztof,
> > > > > > hi Roman,
> > > > > > 
> > > > > > is the ACR forwarding to upstream OPs supported? I
> > > > > > knowthere are
> > > > > > configuration options, but if we test with forwarding and
> > > > > > even with
> > > > > > fixed ACR config to OP, the acr_values are not added in the
> > > > > > authorization call. We do not see them in our logs and also
> > > > > > the OP
> > > > > > does
> > > > > > not receive them.
> > > > > > 
> > > > > > Best regards,
> > > > > > Sander
> > > > > > 
> > > > 

-- 
Large-Scale Data Science
Juelich Supercomputing Centre

phone: +49 2461 61 8847
fax: +49 2461 61 6656
email: sa....@fz...

-----------------------------------------------------------------------
-----------------------------------------------------------------------
Forschungszentrum Jülich GmbH
52425 Jülich
Sitz der Gesellschaft: Jülich
Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Stefan Müller
Geschäftsführung: Prof. Dr. Astrid Lambrecht (Vorsitzende),
Dr. Stephanie Bauer (stellvertretende Vorsitzende),
Prof. Dr. Ir. Pieter Jansens, Prof. Dr. Laurens Kuipers
-----------------------------------------------------------------------
-----------------------------------------------------------------------

Re: [Unity-idm-discuss] Is ACR forwarding to upstream OP supported?

[Roman K. <ro...@un...>]

Dear Sander,

Please let me know your thoughts on this matter.

Kind regards,
Roman


pon., 3 lis 2025 o 12:59 Roman Krysiński <ro...@un...> napisał(a):

> Dear Sander,
>
> After testing and reviewing the code for ACR forwarding, it appears that
> Unity always forwards the ACR request in the form of claims, regardless of
> whether the original request used acr_values or claims.
> This means the forwarding is semantic rather than strict — Unity preserves
> the meaning of the ACR request, but normalizes it to the claims
> representation instead of copying the original parameter format.
>
> Could you please confirm if this aligns with what you’re observing on your
> end, and whether a strict parameter-level forward would be preferable in
> your use case?
>
> Kind regards,
> Roman
>
>
> pt., 31 paź 2025 o 12:40 Roman Krysiński <ro...@un...> napisał(a):
>
>> Hi Sander,
>>
>> Indeed it looks like there is a regression, I'll open a ticket to cover
>> that and target it for the next release, unless this is an urgent matter -
>> please let me know.
>>
>> Kind regards,
>> Roman
>>
>>
>> śr., 29 paź 2025 o 16:55 Sander Apweiler <sa....@fz...>
>> napisał(a):
>>
>>> Dear Roman,
>>> thanks for the detailed answer. In case of forwarding, we recognized
>>> that the arc_values parameter from downstrem RP was not added.
>>>
>>> Best regards,
>>> Sander
>>>
>>> On Wed, 2025-10-29 at 15:21 +0100, Roman Krysiński wrote:
>>> > Hi Sander,
>>> > You’re right - in Unity, when the ACR handling mode is set to fixed,
>>> > the ACR request is not sent using the acr_values parameter. Instead,
>>> > Unity adds the ACR information through the claims parameter in the
>>> > authorization request.
>>> > This is intentional and aligns with the OpenID Connect Core
>>> > specification, which allows two equivalent ways to request an ACR:
>>> >    1.
>>> >       via the simple acr_values request parameter, or
>>> >    2.
>>> >       via the richer claims parameter that supports “essential” ACR
>>> > requests and more detailed semantics (see OIDC §5.5.1 and §5.5.1.1).
>>> > Unity uses the second form (the claims parameter) for fixed ACR
>>> > configuration, since it provides better precision and flexibility —
>>> > for example, it allows expressing essential ACR requirements.
>>> > When ACR is set to forwarded, Unity simply forwards whatever format
>>> > was present in the downstream request — that can be either acr_values
>>> > or claims, depending on the client’s request.
>>> > So in short:
>>> >  *
>>> >    Fixed mode → ACR sent inside claims (not visible as acr_values)
>>> >  *
>>> >    Forward mode → Unity preserves the original form (either
>>> > acr_values or claims)
>>> > Best regards,
>>> > Roman
>>> >
>>> >
>>> >
>>> > wt., 28 paź 2025 o 08:16 Sander Apweiler <sa....@fz...>
>>> > napisał(a):
>>> > > Hi Krzysztof,
>>> > > hi Roman,
>>> > >
>>> > > is the ACR forwarding to upstream OPs supported? I knowthere are
>>> > > configuration options, but if we test with forwarding and even with
>>> > > fixed ACR config to OP, the acr_values are not added in the
>>> > > authorization call. We do not see them in our logs and also the OP
>>> > > does
>>> > > not receive them.
>>> > >
>>> > > Best regards,
>>> > > Sander
>>> > >
>>>
>>> --
>>> Large-Scale Data Science
>>> Juelich Supercomputing Centre
>>>
>>> phone: +49 2461 61 8847
>>> fax: +49 2461 61 6656
>>> email: sa....@fz...
>>>
>>> -----------------------------------------------------------------------
>>> -----------------------------------------------------------------------
>>> Forschungszentrum Jülich GmbH
>>> 52425 Jülich
>>> Sitz der Gesellschaft: Jülich
>>> Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498
>>> Vorsitzender des Aufsichtsrats: MinDir Stefan Müller
>>> Geschäftsführung: Prof. Dr. Astrid Lambrecht (Vorsitzende),
>>> Dr. Stephanie Bauer (stellvertretende Vorsitzende),
>>> Prof. Dr. Ir. Pieter Jansens, Prof. Dr. Laurens Kuipers
>>> -----------------------------------------------------------------------
>>> -----------------------------------------------------------------------
>>>
>>>
>>>
>>> _______________________________________________
>>> Unity-idm-discuss mailing list
>>> Uni...@li...
>>> https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss
>>>
>>

Re: [Unity-idm-discuss] Is ACR forwarding to upstream OP supported?

[Roman K. <ro...@un...>]

Dear Sander,

After testing and reviewing the code for ACR forwarding, it appears that
Unity always forwards the ACR request in the form of claims, regardless of
whether the original request used acr_values or claims.
This means the forwarding is semantic rather than strict — Unity preserves
the meaning of the ACR request, but normalizes it to the claims
representation instead of copying the original parameter format.

Could you please confirm if this aligns with what you’re observing on your
end, and whether a strict parameter-level forward would be preferable in
your use case?

Kind regards,
Roman


pt., 31 paź 2025 o 12:40 Roman Krysiński <ro...@un...> napisał(a):

> Hi Sander,
>
> Indeed it looks like there is a regression, I'll open a ticket to cover
> that and target it for the next release, unless this is an urgent matter -
> please let me know.
>
> Kind regards,
> Roman
>
>
> śr., 29 paź 2025 o 16:55 Sander Apweiler <sa....@fz...>
> napisał(a):
>
>> Dear Roman,
>> thanks for the detailed answer. In case of forwarding, we recognized
>> that the arc_values parameter from downstrem RP was not added.
>>
>> Best regards,
>> Sander
>>
>> On Wed, 2025-10-29 at 15:21 +0100, Roman Krysiński wrote:
>> > Hi Sander,
>> > You’re right - in Unity, when the ACR handling mode is set to fixed,
>> > the ACR request is not sent using the acr_values parameter. Instead,
>> > Unity adds the ACR information through the claims parameter in the
>> > authorization request.
>> > This is intentional and aligns with the OpenID Connect Core
>> > specification, which allows two equivalent ways to request an ACR:
>> >    1.
>> >       via the simple acr_values request parameter, or
>> >    2.
>> >       via the richer claims parameter that supports “essential” ACR
>> > requests and more detailed semantics (see OIDC §5.5.1 and §5.5.1.1).
>> > Unity uses the second form (the claims parameter) for fixed ACR
>> > configuration, since it provides better precision and flexibility —
>> > for example, it allows expressing essential ACR requirements.
>> > When ACR is set to forwarded, Unity simply forwards whatever format
>> > was present in the downstream request — that can be either acr_values
>> > or claims, depending on the client’s request.
>> > So in short:
>> >  *
>> >    Fixed mode → ACR sent inside claims (not visible as acr_values)
>> >  *
>> >    Forward mode → Unity preserves the original form (either
>> > acr_values or claims)
>> > Best regards,
>> > Roman
>> >
>> >
>> >
>> > wt., 28 paź 2025 o 08:16 Sander Apweiler <sa....@fz...>
>> > napisał(a):
>> > > Hi Krzysztof,
>> > > hi Roman,
>> > >
>> > > is the ACR forwarding to upstream OPs supported? I knowthere are
>> > > configuration options, but if we test with forwarding and even with
>> > > fixed ACR config to OP, the acr_values are not added in the
>> > > authorization call. We do not see them in our logs and also the OP
>> > > does
>> > > not receive them.
>> > >
>> > > Best regards,
>> > > Sander
>> > >
>>
>> --
>> Large-Scale Data Science
>> Juelich Supercomputing Centre
>>
>> phone: +49 2461 61 8847
>> fax: +49 2461 61 6656
>> email: sa....@fz...
>>
>> -----------------------------------------------------------------------
>> -----------------------------------------------------------------------
>> Forschungszentrum Jülich GmbH
>> 52425 Jülich
>> Sitz der Gesellschaft: Jülich
>> Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498
>> Vorsitzender des Aufsichtsrats: MinDir Stefan Müller
>> Geschäftsführung: Prof. Dr. Astrid Lambrecht (Vorsitzende),
>> Dr. Stephanie Bauer (stellvertretende Vorsitzende),
>> Prof. Dr. Ir. Pieter Jansens, Prof. Dr. Laurens Kuipers
>> -----------------------------------------------------------------------
>> -----------------------------------------------------------------------
>>
>>
>>
>> _______________________________________________
>> Unity-idm-discuss mailing list
>> Uni...@li...
>> https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss
>>
>

[Unity-idm-discuss] [SPAM] Re: Pre selected auth is not working

[Roman K. <ro...@un...>]

Resending mail for broader audience

wt., 28 paź 2025 o 09:12 Roman Krysiński <ro...@au...> napisał(a):

> Dear Sander,
>
> Indeed this looks like a bug, I'll open a ticket to address this issue.
>
> Thank you for additional information,
> Kind regards,
> Roman
>
> pon., 27 paź 2025 o 14:36 Sander Apweiler <sa....@fz...>
> napisał(a):
>
>> Dear Krzysztof,
>> dear Roman,
>>
>> we have some clients, which are going to test the uy_select_authn
>> option in OIDC. If they add this as additional query parameter in the
>> authentication request, followed by the entry from the lastAutnUsed
>> cookie, it is not working. Unity throws NoSignInContextException. I
>> added the full stacktrace where I was able to reproduce this issue. Is
>> there a wrong value used or is this a bug.
>>
>> My request URL was:
>>
>> https://login-dev.helmholtz.de/oauth2-as/oauth2-authz?response_type=code&client_id=REMOVED&claims_in_tokens=token&redirect_uri=http://localhost:8000&scope=openid+profile+email+sys:scim:read_profile+sys:scim:read_self_group&uy_select_authn=samlWeb._entryFromMetadata_d29e6d872187826fe025dc0b0b72c33c+1
>>
>> Best regards,
>> Sander
>>
>> --
>> Large-Scale Data Science
>> Juelich Supercomputing Centre
>>
>> phone: +49 2461 61 8847
>> fax: +49 2461 61 6656
>> email: sa....@fz...
>>
>> -----------------------------------------------------------------------
>> -----------------------------------------------------------------------
>> Forschungszentrum Jülich GmbH
>> 52425 Jülich
>> Sitz der Gesellschaft: Jülich
>> Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498
>> Vorsitzender des Aufsichtsrats: MinDir Stefan Müller
>> Geschäftsführung: Prof. Dr. Astrid Lambrecht (Vorsitzende),
>> Dr. Stephanie Bauer (stellvertretende Vorsitzende),
>> Prof. Dr. Ir. Pieter Jansens, Prof. Dr. Laurens Kuipers
>> -----------------------------------------------------------------------
>> -----------------------------------------------------------------------
>>
>>
>>
>> _______________________________________________
>> Unity-idm-discuss mailing list
>> Uni...@li...
>> https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss
>>
>

Re: [Unity-idm-discuss] Is ACR forwarding to upstream OP supported?

[Roman K. <ro...@un...>]

Hi Sander,

Indeed it looks like there is a regression, I'll open a ticket to cover
that and target it for the next release, unless this is an urgent matter -
please let me know.

Kind regards,
Roman


śr., 29 paź 2025 o 16:55 Sander Apweiler <sa....@fz...>
napisał(a):

> Dear Roman,
> thanks for the detailed answer. In case of forwarding, we recognized
> that the arc_values parameter from downstrem RP was not added.
>
> Best regards,
> Sander
>
> On Wed, 2025-10-29 at 15:21 +0100, Roman Krysiński wrote:
> > Hi Sander,
> > You’re right - in Unity, when the ACR handling mode is set to fixed,
> > the ACR request is not sent using the acr_values parameter. Instead,
> > Unity adds the ACR information through the claims parameter in the
> > authorization request.
> > This is intentional and aligns with the OpenID Connect Core
> > specification, which allows two equivalent ways to request an ACR:
> >    1.
> >       via the simple acr_values request parameter, or
> >    2.
> >       via the richer claims parameter that supports “essential” ACR
> > requests and more detailed semantics (see OIDC §5.5.1 and §5.5.1.1).
> > Unity uses the second form (the claims parameter) for fixed ACR
> > configuration, since it provides better precision and flexibility —
> > for example, it allows expressing essential ACR requirements.
> > When ACR is set to forwarded, Unity simply forwards whatever format
> > was present in the downstream request — that can be either acr_values
> > or claims, depending on the client’s request.
> > So in short:
> >  *
> >    Fixed mode → ACR sent inside claims (not visible as acr_values)
> >  *
> >    Forward mode → Unity preserves the original form (either
> > acr_values or claims)
> > Best regards,
> > Roman
> >
> >
> >
> > wt., 28 paź 2025 o 08:16 Sander Apweiler <sa....@fz...>
> > napisał(a):
> > > Hi Krzysztof,
> > > hi Roman,
> > >
> > > is the ACR forwarding to upstream OPs supported? I knowthere are
> > > configuration options, but if we test with forwarding and even with
> > > fixed ACR config to OP, the acr_values are not added in the
> > > authorization call. We do not see them in our logs and also the OP
> > > does
> > > not receive them.
> > >
> > > Best regards,
> > > Sander
> > >
>
> --
> Large-Scale Data Science
> Juelich Supercomputing Centre
>
> phone: +49 2461 61 8847
> fax: +49 2461 61 6656
> email: sa....@fz...
>
> -----------------------------------------------------------------------
> -----------------------------------------------------------------------
> Forschungszentrum Jülich GmbH
> 52425 Jülich
> Sitz der Gesellschaft: Jülich
> Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498
> Vorsitzender des Aufsichtsrats: MinDir Stefan Müller
> Geschäftsführung: Prof. Dr. Astrid Lambrecht (Vorsitzende),
> Dr. Stephanie Bauer (stellvertretende Vorsitzende),
> Prof. Dr. Ir. Pieter Jansens, Prof. Dr. Laurens Kuipers
> -----------------------------------------------------------------------
> -----------------------------------------------------------------------
>
>
>
> _______________________________________________
> Unity-idm-discuss mailing list
> Uni...@li...
> https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss
>

Re: [Unity-idm-discuss] Is ACR forwarding to upstream OP supported?

[Sander A. <sa....@fz...>]

Dear Roman,
thanks for the detailed answer. In case of forwarding, we recognized
that the arc_values parameter from downstrem RP was not added.

Best regards,
Sander

On Wed, 2025-10-29 at 15:21 +0100, Roman Krysiński wrote:
> Hi Sander,
> You’re right - in Unity, when the ACR handling mode is set to fixed,
> the ACR request is not sent using the acr_values parameter. Instead,
> Unity adds the ACR information through the claims parameter in the
> authorization request.
> This is intentional and aligns with the OpenID Connect Core
> specification, which allows two equivalent ways to request an ACR:
>    1. 
>       via the simple acr_values request parameter, or
>    2. 
>       via the richer claims parameter that supports “essential” ACR
> requests and more detailed semantics (see OIDC §5.5.1 and §5.5.1.1).
> Unity uses the second form (the claims parameter) for fixed ACR
> configuration, since it provides better precision and flexibility —
> for example, it allows expressing essential ACR requirements.
> When ACR is set to forwarded, Unity simply forwards whatever format
> was present in the downstream request — that can be either acr_values
> or claims, depending on the client’s request.
> So in short:
>  * 
>    Fixed mode → ACR sent inside claims (not visible as acr_values)
>  * 
>    Forward mode → Unity preserves the original form (either
> acr_values or claims)
> Best regards,
> Roman
> 
> 
> 
> wt., 28 paź 2025 o 08:16 Sander Apweiler <sa....@fz...>
> napisał(a):
> > Hi Krzysztof,
> > hi Roman,
> > 
> > is the ACR forwarding to upstream OPs supported? I knowthere are
> > configuration options, but if we test with forwarding and even with
> > fixed ACR config to OP, the acr_values are not added in the
> > authorization call. We do not see them in our logs and also the OP
> > does
> > not receive them.
> > 
> > Best regards,
> > Sander
> > 

-- 
Large-Scale Data Science
Juelich Supercomputing Centre

phone: +49 2461 61 8847
fax: +49 2461 61 6656
email: sa....@fz...

-----------------------------------------------------------------------
-----------------------------------------------------------------------
Forschungszentrum Jülich GmbH
52425 Jülich
Sitz der Gesellschaft: Jülich
Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Stefan Müller
Geschäftsführung: Prof. Dr. Astrid Lambrecht (Vorsitzende),
Dr. Stephanie Bauer (stellvertretende Vorsitzende),
Prof. Dr. Ir. Pieter Jansens, Prof. Dr. Laurens Kuipers
-----------------------------------------------------------------------
-----------------------------------------------------------------------

Re: [Unity-idm-discuss] Is ACR forwarding to upstream OP supported?

[Roman K. <ro...@un...>]

Hi Sander,

You’re right - in Unity, when the *ACR handling mode* is set to *fixed*,
the ACR request is not sent using the acr_values parameter. Instead, Unity
adds the ACR information through the *claims parameter* in the
authorization request.

This is intentional and aligns with the OpenID Connect Core specification,
which allows two equivalent ways to request an ACR:


   1.

   via the simple acr_values request parameter, or
   2.

   via the richer claims parameter that supports “essential” ACR requests
   and more detailed semantics (see OIDC §5.5.1
   <https://openid.net/specs/openid-connect-core-1_0.html#acrSemantics> and
   §5.5.1.1
   <https://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter>).

Unity uses the second form (the claims parameter) for *fixed ACR
configuration*, since it provides better precision and flexibility — for
example, it allows expressing essential ACR requirements.

When ACR is set to *forwarded*, Unity simply forwards whatever format was
present in the downstream request — that can be either acr_values or claims,
depending on the client’s request.

So in short:


   -

   *Fixed mode* → ACR sent inside claims (not visible as acr_values)
   -

   *Forward mode* → Unity preserves the original form (either acr_values or
   claims)

Best regards,

Roman



wt., 28 paź 2025 o 08:16 Sander Apweiler <sa....@fz...>
napisał(a):

> Hi Krzysztof,
> hi Roman,
>
> is the ACR forwarding to upstream OPs supported? I knowthere are
> configuration options, but if we test with forwarding and even with
> fixed ACR config to OP, the acr_values are not added in the
> authorization call. We do not see them in our logs and also the OP does
> not receive them.
>
> Best regards,
> Sander
>
> --
> Large-Scale Data Science
> Juelich Supercomputing Centre
>
> phone: +49 2461 61 8847
> fax: +49 2461 61 6656
> email: sa....@fz...
>
> -----------------------------------------------------------------------
> -----------------------------------------------------------------------
> Forschungszentrum Jülich GmbH
> 52425 Jülich
> Sitz der Gesellschaft: Jülich
> Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498
> Vorsitzender des Aufsichtsrats: MinDir Stefan Müller
> Geschäftsführung: Prof. Dr. Astrid Lambrecht (Vorsitzende),
> Dr. Stephanie Bauer (stellvertretende Vorsitzende),
> Prof. Dr. Ir. Pieter Jansens, Prof. Dr. Laurens Kuipers
> -----------------------------------------------------------------------
> -----------------------------------------------------------------------
>
>
>
> _______________________________________________
> Unity-idm-discuss mailing list
> Uni...@li...
> https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss
>

Re: [Unity-idm-discuss] Issue on fetching new access tokens from (public) OAuth clients using upstreamACRs in output translation profile

[Krzysztof B. <kb...@un...>]

Hi Sander,

After research of this topic: you are right, Unity is misbehaving. In 
general during access token refresh, authn_time and acr claims should be 
preserved.

I've opened ticket to fix that.

Thank you for pointing that up,
Krzysztof

W dniu 14.10.2025 o 09:08, Sander Apweiler pisze:
> Good morning Krzysztof,
> at the moment we have the problem, that usage of refresh tokens fails
> due to missing ACR information. Our idea was to send the information
> from the original authN. If you feel more comftable with removing them
> from the token, it is also fine. If the RP would need ACR information,
> it would need to do a step-up authentication after using a RF token.
>
> Best regards,
> Sander
>
>
> On Fri, 2025-10-10 at 14:14 +0200, Krzysztof Benedyczak wrote:
>>   
>> Hi Sander,
>>   
>>
>>   
>>   
>> W dniu 6.10.2025 o 13:58, Sander Apweiler pisze:
>>   
>>   
>>>   
>>> Hi Krzysztof,
>>> hi Roman,
>>>
>>> we encountered an issues where a public OAuth client gets error,
>>> when
>>> it tries to get a new access and refresh token, using a refresh
>>> token.
>>> The output translation profile creates an error because it can not
>>> access upstreamACRs. Which might make sense, since in using refresh
>>> tokens you do not have an upstream ACR. Would it make more sense to
>>> store the information from the original login and send the result
>>> instead of trying to resolve it again?
>>>
>>> I assume the same issue comes up for confidential clients.
>>>
>>>   
>>   
>> You are right: upstreamACR and several other variables in the output
>> profile are not accessible during token refresh.
>>   
>> I'd like to understand your question better. Do you suggest the
>> output profile provides information from the original authN (which
>> happened during initial access token creation)?
>>   
>> Or rather to expose information from the refreshed token? Or just
>> that this is token refresh?
>>   
>> Thank you,
>>   Krzysztof
>>   
>> _______________________________________________
>> Unity-idm-discuss mailing list
>> Uni...@li...
>> https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss

[Unity-idm-discuss] Is ACR forwarding to upstream OP supported?

[Sander A. <sa....@fz...>]

Hi Krzysztof,
hi Roman,

is the ACR forwarding to upstream OPs supported? I knowthere are
configuration options, but if we test with forwarding and even with
fixed ACR config to OP, the acr_values are not added in the
authorization call. We do not see them in our logs and also the OP does
not receive them.

Best regards,
Sander

-- 
Large-Scale Data Science
Juelich Supercomputing Centre

phone: +49 2461 61 8847
fax: +49 2461 61 6656
email: sa....@fz...

-----------------------------------------------------------------------
-----------------------------------------------------------------------
Forschungszentrum Jülich GmbH
52425 Jülich
Sitz der Gesellschaft: Jülich
Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Stefan Müller
Geschäftsführung: Prof. Dr. Astrid Lambrecht (Vorsitzende),
Dr. Stephanie Bauer (stellvertretende Vorsitzende),
Prof. Dr. Ir. Pieter Jansens, Prof. Dr. Laurens Kuipers
-----------------------------------------------------------------------
-----------------------------------------------------------------------

[Unity-idm-discuss] Pre selected auth is not working

[Sander A. <sa....@fz...>]

Dear Krzysztof,
dear Roman,

we have some clients, which are going to test the uy_select_authn
option in OIDC. If they add this as additional query parameter in the
authentication request, followed by the entry from the lastAutnUsed
cookie, it is not working. Unity throws NoSignInContextException. I
added the full stacktrace where I was able to reproduce this issue. Is
there a wrong value used or is this a bug.

My request URL was:
https://login-dev.helmholtz.de/oauth2-as/oauth2-authz?response_type=code&client_id=REMOVED&claims_in_tokens=token&redirect_uri=http://localhost:8000&scope=openid+profile+email+sys:scim:read_profile+sys:scim:read_self_group&uy_select_authn=samlWeb._entryFromMetadata_d29e6d872187826fe025dc0b0b72c33c+1

Best regards,
Sander

-- 
Large-Scale Data Science
Juelich Supercomputing Centre

phone: +49 2461 61 8847
fax: +49 2461 61 6656
email: sa....@fz...

-----------------------------------------------------------------------
-----------------------------------------------------------------------
Forschungszentrum Jülich GmbH
52425 Jülich
Sitz der Gesellschaft: Jülich
Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Stefan Müller
Geschäftsführung: Prof. Dr. Astrid Lambrecht (Vorsitzende),
Dr. Stephanie Bauer (stellvertretende Vorsitzende),
Prof. Dr. Ir. Pieter Jansens, Prof. Dr. Laurens Kuipers
-----------------------------------------------------------------------
-----------------------------------------------------------------------

Re: [Unity-idm-discuss] Algorithm on token introspection

[Sander A. <sa....@fz...>]

Good morning Krzystzof,
thanks for the update.

Best regards,
Sander

On Wed, 2025-10-22 at 22:29 +0200, Krzysztof Benedyczak wrote:
>  
> Hi Sander,
>  
> 
>  
>  
> Thanks for the stack trace. Bernd was was fully right. After
> verification: we don't support verification of tokens, when an IdP
> has more than one signing key. Actually it does not matter that there
> are different algorithms: it wouldn't work even with the same
> algorithm but two different keys (just the error would be different).
> Only the first key from metadata works.
>  
> I'm opening a ticket to cover that. Unfortunately it doesn't seem as
> an easy fix.
>  
> Best,
>  Krzysztof
>  

-- 
Large-Scale Data Science
Juelich Supercomputing Centre

phone: +49 2461 61 8847
fax: +49 2461 61 6656
email: sa....@fz...

-----------------------------------------------------------------------
-----------------------------------------------------------------------
Forschungszentrum Jülich GmbH
52425 Jülich
Sitz der Gesellschaft: Jülich
Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Stefan Müller
Geschäftsführung: Prof. Dr. Astrid Lambrecht (Vorsitzende),
Dr. Stephanie Bauer (stellvertretende Vorsitzende),
Prof. Dr. Ir. Pieter Jansens, Prof. Dr. Laurens Kuipers
-----------------------------------------------------------------------
-----------------------------------------------------------------------

Re: [Unity-idm-discuss] Help with enquiry form

[Krzysztof B. <kb...@un...>]

Hi Laura,

W dniu 20.10.2025 o 15:35, Laura Hofer pisze:
> Hi Krzysztof,
>
> Am 20.10.25 um 14:08 schrieb OTRS Notifications:Am 13.10.25 um 18:22 
> schrieb Krzysztof Benedyczak:
>
>> Can you please, check one thing *for the user on which you are 
>> experiencing the problem*:
>>
>> in admin console -> Directory Browser find that user in the Root 
>> group; then inspect the attributes. Is there an attribute 
>> "sys:policy-agreement-state"? If yes - what is the value?
>>
> unfortunately, the problem occurs for all users we have been able to 
> check. My account (and the ones where I checked this via the console 
> endpoint) does not have this attribute at all.
>
>> Also:
>>
>> * are there any other elements in the enquiry and are those shown all 
>> right?
>>
> There are no other elements in the enquiry, but the submit button is 
> displayed normally.
>
>> * I'm assuming you have not modified any advanced options like 
>> "Enquiry target groups" or "Target condition" and the user on which 
>> the problem is experienced is a member of the target group (here: 
>> UpMan project)?
>>
> We added the root group to the enquiry target groups and did not enter 
> anything in the target conditions, so nothing was changed.
>

I've tested this scenario - and works in my case. Certainly we have 
something to improve here: for sticky enquiries, when there is no 
contents then there should be no Submit button, and instead some 
configurable text saying that there is nothing to update.

However, the only case when I see only the Submit button, is after 
accepting the policy doc. And my user has the sys:policy-agreement-state 
attribute set.

The only one idea I have: have you enabled multiple enquiry forms for 
user's Home endpoint? If yes, then maybe you see a different one, which 
is correctly empty?

Otherwise, I'd try to do some small tests. Modify the enquiry to also 
ask for something else, to verify if that appears. Also you can try to 
manually recreate such an enquiry step by step (sounds like it has a 
simple configuration) and see if the new one has the same problem.

And also: it rather doesn't make sense to have '/' and another group as 
a target: '/' contains all users anyway. But that shouldn't harm, is 
only redundant configuration.

Cheers,
Krzysztof

Re: [Unity-idm-discuss] Algorithm on token introspection

[Krzysztof B. <kb...@un...>]

Hi Sander,

Thanks for the stack trace. Bernd was was fully right. After 
verification: we don't support verification of tokens, when an IdP has 
more than one signing key. Actually it does not matter that there are 
different algorithms: it wouldn't work even with the same algorithm but 
two different keys (just the error would be different). Only the first 
key from metadata works.

I'm opening a ticket to cover that. Unfortunately it doesn't seem as an 
easy fix.

Best,
Krzysztof

Re: [Unity-idm-discuss] claims in token for public clients

[Krzysztof B. <kb...@un...>]

Hi Sander,

W dniu 21.10.2025 o 13:57, Sander Apweiler pisze:
> Dear Krzysztof,
> dear Roman,
> is the claims_in_token parameter supported for public OAuth clients as
> well? We have one client, who is trying to use this but does not
> receive the claims within the tokens. In the logs the parameter seems
> to be set correctly.

That should work. Can you please provide what OAuth grant/OIDC flow is 
used here, and what is the requested value of the parameter?

Thanks,
Krzysztof

Re: [Unity-idm-discuss] Potential error in manual

[Krzysztof B. <kb...@un...>]

Hi Sander,

W dniu 21.10.2025 o 09:36, Sander Apweiler pisze:
> Hi Krzysztof,
> hi Roman,
>
> I found an error in the unity manual. In Chapter 13.4. Standard OAuth2
> the configuration parameters are listed as
> "unity.oauth2.client.CLIENT_ID" while they are
> "unity.oauth2.client.providers.CLIENT_ID". We encountered the problem
> when we were trying to enable ACR forwarding. Also CLIENT_ID might be a
> bit misunderstanding, since this may not the client ID, from the OAuth2
> client itself. Can you check this chapter?
>
Yes, the second table table with options uses a wrong prefix. Will add 
also some small clarification around CLIENT_ID.

Thanks,
Krzysztof

[Unity-idm-discuss] claims in token for public clients

[Sander A. <sa....@fz...>]

Dear Krzysztof,
dear Roman,
is the claims_in_token parameter supported for public OAuth clients as
well? We have one client, who is trying to use this but does not
receive the claims within the tokens. In the logs the parameter seems
to be set correctly.

Best regards,
Sander

-- 
Large-Scale Data Science
Juelich Supercomputing Centre

phone: +49 2461 61 8847
fax: +49 2461 61 6656
email: sa....@fz...

-----------------------------------------------------------------------
-----------------------------------------------------------------------
Forschungszentrum Jülich GmbH
52425 Jülich
Sitz der Gesellschaft: Jülich
Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Stefan Müller
Geschäftsführung: Prof. Dr. Astrid Lambrecht (Vorsitzende),
Dr. Stephanie Bauer (stellvertretende Vorsitzende),
Prof. Dr. Ir. Pieter Jansens, Prof. Dr. Laurens Kuipers
-----------------------------------------------------------------------
-----------------------------------------------------------------------

[Unity-idm-discuss] Potential error in manual

[Sander A. <sa....@fz...>]

Hi Krzysztof,
hi Roman,

I found an error in the unity manual. In Chapter 13.4. Standard OAuth2
the configuration parameters are listed as
"unity.oauth2.client.CLIENT_ID" while they are
"unity.oauth2.client.providers.CLIENT_ID". We encountered the problem
when we were trying to enable ACR forwarding. Also CLIENT_ID might be a
bit misunderstanding, since this may not the client ID, from the OAuth2
client itself. Can you check this chapter?

Best regards,
Sander

-- 
Large-Scale Data Science
Juelich Supercomputing Centre

phone: +49 2461 61 8847
fax: +49 2461 61 6656
email: sa....@fz...

-----------------------------------------------------------------------
-----------------------------------------------------------------------
Forschungszentrum Jülich GmbH
52425 Jülich
Sitz der Gesellschaft: Jülich
Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Stefan Müller
Geschäftsführung: Prof. Dr. Astrid Lambrecht (Vorsitzende),
Dr. Stephanie Bauer (stellvertretende Vorsitzende),
Prof. Dr. Ir. Pieter Jansens, Prof. Dr. Laurens Kuipers
-----------------------------------------------------------------------
-----------------------------------------------------------------------

Re: [Unity-idm-discuss] Help with enquiry form

[Laura H. <l....@fz...>]

Hi Krzysztof,

Am 20.10.25 um 14:08 schrieb OTRS Notifications:Am 13.10.25 um 18:22 
schrieb Krzysztof Benedyczak:

> Can you please, check one thing *for the user on which you are 
> experiencing the problem*:
>
> in admin console -> Directory Browser find that user in the Root 
> group; then inspect the attributes. Is there an attribute 
> "sys:policy-agreement-state"? If yes - what is the value?
>
unfortunately, the problem occurs for all users we have been able to 
check. My account (and the ones where I checked this via the console 
endpoint) does not have this attribute at all.

> Also:
>
> * are there any other elements in the enquiry and are those shown all 
> right?
>
There are no other elements in the enquiry, but the submit button is 
displayed normally.

> * I'm assuming you have not modified any advanced options like 
> "Enquiry target groups" or "Target condition" and the user on which 
> the problem is experienced is a member of the target group (here: 
> UpMan project)?
>
We added the root group to the enquiry target groups and did not enter 
anything in the target conditions, so nothing was changed.

Kind regards,
Laura

Am 13.10.25 um 18:22 schrieb Krzysztof Benedyczak:
> Hi Laura,
>
>
>
> W dniu 10.10.2025 o 16:16, Laura Hofer pisze:
>> Hi Krzysztof,
>>
>> thank you for the quick reply. Having multiple forms would be very 
>> helpful.
>>
>> The policy document is embedded and acceptance is not optional.
>>
>> The update enquiry form was created using the wizard, the type is 
>> sticky and the target groups are the group itself and the root group. 
>> For the policy agreement, we selected the relevant policy document, 
>> checkbox not selected. The text is the title of the policy.
>>
>> With the same configuration, the policy is displayed on other 
>> instances in the form on the home endpoint with a checkbox, and if 
>> this is not selected and you try to submit, an error message appears.
>>
>> Let us know if we can provide any further infos.
>>
>
> Can you please, check one thing *for the user on which you are 
> experiencing the problem*:
>
> in admin console -> Directory Browser find that user in the Root 
> group; then inspect the attributes. Is there an attribute 
> "sys:policy-agreement-state"? If yes - what is the value?
>
> Also:
>
> * are there any other elements in the enquiry and are those shown all 
> right?
>
> * I'm assuming you have not modified any advanced options like 
> "Enquiry target groups" or "Target condition" and the user on which 
> the problem is experienced is a member of the target group (here: 
> UpMan project)?
>
>
> Cheers,
> Krzysztof
>
>
>
>
>> Kind regards and have a nice weekend,
>> Laura
>>
>> Am 10.10.25 um 14:18 schrieb Krzysztof Benedyczak:
>>> Hi Laura,
>>>
>>> W dniu 10.10.2025 o 11:58, Laura Hofer pisze:
>>>> Hi Roman, Hi Krzysztof,
>>>>
>>>> We need some help with the Enquiry Update Form. Firstly, we have 
>>>> the problem that we cannot display more than one in the home endpoint.
>>>> Secondly, and this is a problem we only have on our production 
>>>> instance, so perhaps you know more about it, the non-optional 
>>>> policy agreements are not displayed when viewing the home endpoint. 
>>>> We don't have this problem on other instances. Can you think of any 
>>>> reason why this problem might be occurring? Or would you perhaps 
>>>> know which loggers we would need to increase, as we are not 
>>>> currently seeing any major error messages?
>>>>
>>> Yes - user home is limited to a single form. I think in Unity 4 we 
>>> can quite easily support more if this is the main problem.
>>>
>>> For the issue with agreements: can you please share more details of 
>>> your setup? I.e how form is setup and as well the setup of agreement 
>>> doc.
>>>
>>>
>>> Thanks,
>>> Krzysztof
>>>
>>>
>
-- 
"Das Forschungszentrum Jülich stellt zurzeit auf einen neuen Zertifikatsanbieter zum digitalen Signieren von E-Mails um. Während dieser Umstellungsarbeiten kann es vorkommen, dass das DFN Community PKI Zertifikat, mit dem diese E-Mail signiert worden ist, als ungültig angezeigt wird."

Large-Scale Data Science
Juelich Supercomputing Centre

phone: +49 2461 61 6576
fax: +49 2461 61 6656
email: l....@fz...

---------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------
Forschungszentrum Jülich GmbH
52425 Jülich
Sitz der Gesellschaft: Jülich
Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Stefan Müller
Geschäftsführung: Prof. Dr. Astrid Lambrecht (Vorsitzende),
Dr. Stephanie Bauer (stellvertretende Vorsitzende),
Prof. Dr. Ir. Pieter Jansens, Prof. Dr. Laurens Kuipers
---------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------