Menu
▾
▴
unity-idm-discuss — Unity discussion and support
You can subscribe to this list here.
| 2014 |
Jan
(3) |
Feb
(1) |
Mar
|
Apr
(1) |
May
|
Jun
|
Jul
(2) |
Aug
(2) |
Sep
|
Oct
(3) |
Nov
|
Dec
(1) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2015 |
Jan
(20) |
Feb
(3) |
Mar
|
Apr
|
May
|
Jun
(15) |
Jul
(1) |
Aug
(7) |
Sep
(13) |
Oct
(2) |
Nov
(10) |
Dec
(1) |
| 2016 |
Jan
|
Feb
(2) |
Mar
|
Apr
(2) |
May
(1) |
Jun
|
Jul
(1) |
Aug
(2) |
Sep
(11) |
Oct
(7) |
Nov
(6) |
Dec
(11) |
| 2017 |
Jan
(10) |
Feb
(5) |
Mar
(27) |
Apr
(34) |
May
(25) |
Jun
(14) |
Jul
(7) |
Aug
(17) |
Sep
(11) |
Oct
(6) |
Nov
(14) |
Dec
(10) |
| 2018 |
Jan
(8) |
Feb
(19) |
Mar
(40) |
Apr
(9) |
May
(16) |
Jun
(23) |
Jul
(31) |
Aug
(7) |
Sep
(9) |
Oct
(6) |
Nov
(14) |
Dec
(19) |
| 2019 |
Jan
(4) |
Feb
(6) |
Mar
(1) |
Apr
(2) |
May
(6) |
Jun
(3) |
Jul
|
Aug
|
Sep
|
Oct
(2) |
Nov
(19) |
Dec
(14) |
| 2020 |
Jan
(10) |
Feb
(24) |
Mar
(49) |
Apr
(26) |
May
(12) |
Jun
(4) |
Jul
(13) |
Aug
(32) |
Sep
(13) |
Oct
(10) |
Nov
(4) |
Dec
(16) |
| 2021 |
Jan
(2) |
Feb
(8) |
Mar
(15) |
Apr
(19) |
May
(5) |
Jun
(13) |
Jul
(6) |
Aug
(38) |
Sep
(11) |
Oct
(18) |
Nov
(11) |
Dec
(13) |
| 2022 |
Jan
(10) |
Feb
(21) |
Mar
(28) |
Apr
(3) |
May
(7) |
Jun
(9) |
Jul
(14) |
Aug
(13) |
Sep
(8) |
Oct
(29) |
Nov
(1) |
Dec
(21) |
| 2023 |
Jan
(19) |
Feb
(9) |
Mar
|
Apr
(10) |
May
(7) |
Jun
(10) |
Jul
(14) |
Aug
(17) |
Sep
(1) |
Oct
(9) |
Nov
(5) |
Dec
(14) |
| 2024 |
Jan
(12) |
Feb
(2) |
Mar
(8) |
Apr
(1) |
May
(6) |
Jun
(6) |
Jul
(24) |
Aug
(15) |
Sep
(1) |
Oct
(6) |
Nov
(20) |
Dec
(14) |
| 2025 |
Jan
(12) |
Feb
(2) |
Mar
(10) |
Apr
(11) |
May
(13) |
Jun
(1) |
Jul
(2) |
Aug
(2) |
Sep
(8) |
Oct
|
Nov
|
Dec
|
|
From: Roman K. <ro...@un...> - 2023-01-26 17:24:05
|
HI Sander, It seems the Logo URL in some group w/ configured delegation has incorrect value - set to null. As the workaround I think it would be sufficient to find the promenatic group and from the console update the Logo URL to something meaningful. It would be helpful to understand how this project has been created, do you happen to know? In the meantime we will investigate the problem. Please let me know if the workaround worked for you. Best, Roman czw., 26 sty 2023 o 13:36 Sander Apweiler <sa....@fz...> napisał(a): > Hi Krzysztof, > we have an issue with only one group in upman. The user just got the > word "error" shown when they logged into upman. I just got the attached > stacktrace but no further info in the log. From the stacktrace I assume > that some config/parameter is missing but I don't know what. Do you > know where this exception is raised? > > Best regards, > Sander > > -- > Federated Systems and Data > Juelich Supercomputing Centre > > phone: +49 2461 61 8847 > fax: +49 2461 61 6656 > email: sa....@fz... > > ----------------------------------------------------------------------- > ----------------------------------------------------------------------- > Forschungszentrum Juelich GmbH > 52425 Juelich > Sitz der Gesellschaft: Juelich > Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 > Vorsitzender des Aufsichtsrats: MinDir Stefan Müller > Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), > Karsten Beneke (stellv. Vorsitzender), Dr. Ir. Pieter Jansens, > Prof. Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior > ----------------------------------------------------------------------- > ----------------------------------------------------------------------- > > > > > > _______________________________________________ > Unity-idm-discuss mailing list > Uni...@li... > https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss > |
|
From: Sander A. <sa....@fz...> - 2023-01-26 12:37:13
|
Hi Krzysztof, we have an issue with only one group in upman. The user just got the word "error" shown when they logged into upman. I just got the attached stacktrace but no further info in the log. From the stacktrace I assume that some config/parameter is missing but I don't know what. Do you know where this exception is raised? Best regards, Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Stefan Müller Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Dr. Ir. Pieter Jansens, Prof. Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Sander A. <sa....@fz...> - 2023-01-25 07:56:34
|
Hi Krzysztof, for the usage of MFA we want to provide some feedback. Some of this things you already know. - If OTP is wrong I have to redo the whole authentication. This feels a little bit annoying. On other platforms you just have to reenter the OTP, but not username & password. - Signalling MFA usage to SPs in common ways. There are already some common ways to signal the usage of MFA usage to services. This are the AuthnContextClassRef in SAML and the acr claim in OIDC. It would be great if this is supported by unity, too. - Proxying the MFA information from upstream IdP. If the upstram IdP already enables MFA and send the usage to services, MFA at unity does not increase the security anymore. Especially it the second factor is the same OTP generator. So it would be greate if there is a way to transfer the information to the SPs of unity. I know we can build a workaround but as you already mentioned storing information in unity to session bound attributes is not the best way. - If the user enables MFA in unity but the upstream IdP already preformed MFA, is would be great if there is a way for admins to configure if unity performs MFA or not and just proxies the information. As mentioned before there is no benefit if the second factor is the same. - Have an additional authentication flow policy "step_up" which does not fall back to never, if the user has no MFA configured, but just prohibits the operation/login. - Have different session lifetime for user who performed MFA. Since the MFA gives a better trust about the user account is not compromised, it would be nice if we can increase the session time for those user who authenticated with MFA. This would be a benefit for those, who are doing the additional step. I know some of them are not easy or fast solvable, but I hope all are doable in the future. What do you think about these points? Please let me know if some of them are unclear. Best regars, Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Stefan Müller Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Dr. Ir. Pieter Jansens, Prof. Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2023-01-24 08:51:39
|
W dniu 23.01.2023 o 08:59, Sander Apweiler pisze: > Good morning Krzysztof, > my email stocked in the drafts folder ... > > So the sys:oauth:clientName is stored in /oauth-clients and is set for > this client. The attribute of setting the display name is not set to > all oauth clients, which does not seem to be an issue for other > clients. Thanks, we found one bug in this area, it is likely that it was a root cause of your problem. Will be fixed in the next release, we will see if it helps. Best, Krzysztof |
|
From: Sander A. <sa....@fz...> - 2023-01-23 08:00:09
|
Good morning Krzysztof, my email stocked in the drafts folder ... So the sys:oauth:clientName is stored in /oauth-clients and is set for this client. The attribute of setting the display name is not set to all oauth clients, which does not seem to be an issue for other clients. Best regards, Sander On Fri, 2023-01-20 at 18:27 +0100, Krzysztof Benedyczak wrote: > Hi Sander, > > W dniu 13.01.2023 o 09:43, Sander Apweiler pisze: > > Good morning Krzysztof, > > in this case it was OAuth. I will check if the attributes were set > > correctly. > > > Have you by chance identified the source of the problem? We are so > far > only able to reproduce this behavior when setting client name > attribute > to literal "null null" value. Still investigating, but wanted to hear > whether you have any new insights here? > > Thanks, > Krzysztof > -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2023-01-20 17:27:24
|
Hi Sander, W dniu 13.01.2023 o 09:43, Sander Apweiler pisze: > Good morning Krzysztof, > in this case it was OAuth. I will check if the attributes were set > correctly. > Have you by chance identified the source of the problem? We are so far only able to reproduce this behavior when setting client name attribute to literal "null null" value. Still investigating, but wanted to hear whether you have any new insights here? Thanks, Krzysztof |
|
From: Sander A. <sa....@fz...> - 2023-01-13 08:43:49
|
Good morning Krzysztof, in this case it was OAuth. I will check if the attributes were set correctly. Best regards, Sander On Fri, 2023-01-13 at 09:36 +0100, Krzysztof Benedyczak wrote: > Hi Sander, > > W dniu 12.01.2023 o 17:02, Sander Apweiler pisze: > > Hi Krzysztof, > > > > we got some tickets that our instance show in the > > trustedApplications > > module services with the name null null (see screenshot). Which > > attribute does the module use to display the name? > > > That depends on the type of application. In case of SAML SPs it is > not > in attribute, it is taken from metadata. > > In case of OAuth it is in general taken from sys:oauth:clientName (in > proper group with IdP's OAuth clients) or from '/' attribute used as > displayedName (by default 'name'). > > Anyway nulls should not be shown. Can you please give any hint on > what > is inside those blocked entries? Would be very helpful to know at > least > whether those were SAML or OAuth apps. > > Best, > Krzysztof > > -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2023-01-13 08:37:10
|
Hi Sander, W dniu 12.01.2023 o 17:02, Sander Apweiler pisze: > Hi Krzysztof, > > we got some tickets that our instance show in the trustedApplications > module services with the name null null (see screenshot). Which > attribute does the module use to display the name? > That depends on the type of application. In case of SAML SPs it is not in attribute, it is taken from metadata. In case of OAuth it is in general taken from sys:oauth:clientName (in proper group with IdP's OAuth clients) or from '/' attribute used as displayedName (by default 'name'). Anyway nulls should not be shown. Can you please give any hint on what is inside those blocked entries? Would be very helpful to know at least whether those were SAML or OAuth apps. Best, Krzysztof |
|
From: Sander A. <sa....@fz...> - 2023-01-12 16:02:46
|
Hi Krzysztof, we got some tickets that our instance show in the trustedApplications module services with the name null null (see screenshot). Which attribute does the module use to display the name? Best regards, Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2023-01-05 10:53:53
|
Hi Sander, W dniu 3.01.2023 o 15:14, Sander Apweiler pisze: > Hi Krzysztof, > > On Tue, 2023-01-03 at 14:54 +0100, Krzysztof Benedyczak wrote: >> Hi Sander, >> >> W dniu 3.01.2023 o 07:39, Sander Apweiler pisze: >>> Dear Krzysztof, >>> first of all happy new year and all the best for 2023. >>> >>> After enabling two factor authentication on our services, we want >>> to >>> signal the usage of it to the services. In SAML we want to use the >>> https://refeds.org/profile/mfa in AuthnContextClassRef. In OIDC we >>> want >>> to use the acr claim. Is this possible within unity? I didn't find >>> anything in the manual about setting AuthnContextClassRef or acr. >> Unfortunately neither acr nor amr are not implemented in Unity as of >> now. Same for SAML. >> >>> The second thing we are thinking about is proxying the information >>> from >>> the Upstream IdPs if there was 2FA used. I read that we can read >>> the >>> AuthnContextClassRef in SAML input translation profile. >> Yes, it is exposed as an attribute in the context. >> >> >>> Is there also >>> an action which removes the old value, if this is not covered in >>> the >>> next login anymore? >> Hm, I don't understand the question. In general I don't think it is >> possible to set AuthnContextClassRef in SAML response manually. It >> should be possible to set manually acr in output profile for OAuth >> AS, >> although with some some extra work (i.e. one would need to put that >> in >> output profile + add to some scope, like profile). > Let me try to explain it. When I store the value of the > AuthnContextClassRef from remote IdP on an attribute and it signals > that 2FA was used but the next login the AuthnContextClassRef is not > released by the IdP anymore, I can not use the old value anymore and > must assume that no 2FA was performed. Of course I can create some > complex MVEL expression, but maybe there is an easier was to drop the > old information if the AuthnContextClassRef is not send by the remote > IdP anymore. I would just overwrite the attribute each time setting it to what was provided or to some default value otherwise. However, please keep in mind that, as we discussed long time ago, this is a generally imperfect workaround. Correctly, information on authentication context (from upstream IdP) should not be kept in an attribute but should be bound to login session and should be set there correctly on each authentication. This is very important if a given user can login both with remote IdP and with some local credential: in such case attribute storing authnContext from IdP will be there also after login with the local credential. So in general that's a bigger missing feature. Best, Krzysztof |
|
From: Sander A. <sa....@fz...> - 2023-01-03 14:15:18
|
Hi Krzysztof, On Tue, 2023-01-03 at 14:54 +0100, Krzysztof Benedyczak wrote: > Hi Sander, > > W dniu 3.01.2023 o 07:39, Sander Apweiler pisze: > > Dear Krzysztof, > > first of all happy new year and all the best for 2023. > > > > After enabling two factor authentication on our services, we want > > to > > signal the usage of it to the services. In SAML we want to use the > > https://refeds.org/profile/mfa in AuthnContextClassRef. In OIDC we > > want > > to use the acr claim. Is this possible within unity? I didn't find > > anything in the manual about setting AuthnContextClassRef or acr. > > Unfortunately neither acr nor amr are not implemented in Unity as of > now. Same for SAML. > > > The second thing we are thinking about is proxying the information > > from > > the Upstream IdPs if there was 2FA used. I read that we can read > > the > > AuthnContextClassRef in SAML input translation profile. > > Yes, it is exposed as an attribute in the context. > > > > Is there also > > an action which removes the old value, if this is not covered in > > the > > next login anymore? > > Hm, I don't understand the question. In general I don't think it is > possible to set AuthnContextClassRef in SAML response manually. It > should be possible to set manually acr in output profile for OAuth > AS, > although with some some extra work (i.e. one would need to put that > in > output profile + add to some scope, like profile). Let me try to explain it. When I store the value of the AuthnContextClassRef from remote IdP on an attribute and it signals that 2FA was used but the next login the AuthnContextClassRef is not released by the IdP anymore, I can not use the old value anymore and must assume that no 2FA was performed. Of course I can create some complex MVEL expression, but maybe there is an easier was to drop the old information if the AuthnContextClassRef is not send by the remote IdP anymore. Best regards, Sander > > Best, > Krzysztof > -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2023-01-03 13:54:48
|
W dniu 3.01.2023 o 14:51, Sander Apweiler pisze: > Dear Krzysztof, > thanks for the feedback. Yes the reason is that the group managers want > to invite only members to the group to have some more control about the > members because group membership includes quotas and permissions on > connected services. Would storing multiple email addresses, if their > are provided by the IdP, of the user also help here? Yes, I think so. |
|
From: Krzysztof B. <kb...@un...> - 2023-01-03 13:54:22
|
Hi Sander, W dniu 3.01.2023 o 07:39, Sander Apweiler pisze: > Dear Krzysztof, > first of all happy new year and all the best for 2023. > > After enabling two factor authentication on our services, we want to > signal the usage of it to the services. In SAML we want to use the > https://refeds.org/profile/mfa in AuthnContextClassRef. In OIDC we want > to use the acr claim. Is this possible within unity? I didn't find > anything in the manual about setting AuthnContextClassRef or acr. Unfortunately neither acr nor amr are not implemented in Unity as of now. Same for SAML. > The second thing we are thinking about is proxying the information from > the Upstream IdPs if there was 2FA used. I read that we can read the > AuthnContextClassRef in SAML input translation profile. Yes, it is exposed as an attribute in the context. > Is there also > an action which removes the old value, if this is not covered in the > next login anymore? Hm, I don't understand the question. In general I don't think it is possible to set AuthnContextClassRef in SAML response manually. It should be possible to set manually acr in output profile for OAuth AS, although with some some extra work (i.e. one would need to put that in output profile + add to some scope, like profile). Best, Krzysztof |
|
From: Sander A. <sa....@fz...> - 2023-01-03 13:52:12
|
Dear Krzysztof, thanks for the feedback. Yes the reason is that the group managers want to invite only members to the group to have some more control about the members because group membership includes quotas and permissions on connected services. Would storing multiple email addresses, if their are provided by the IdP, of the user also help here? Best regards, Sander On Tue, 2023-01-03 at 14:06 +0100, Krzysztof Benedyczak wrote: > Dear Sander, > > W dniu 21.12.2022 o 11:06, Sander Apweiler pisze: > > Dear Krzysztof, > > > > On Wed, 2022-12-21 at 10:54 +0100, Krzysztof Benedyczak wrote: > > > Dear Sander, > > > > > > W dniu 20.12.2022 o 15:22, Sander Apweiler pisze: > > > > Dear Krzysztof, > > > > we have ticket from a user about a problem to join a group. He > > > > got > > > > an > > > > invitation, but when he tries to follow the link and selecting, > > > > that he > > > > has already an account an error is shown that the enquiry is > > > > not > > > > applicable. > > > > > > > > The log just shows: > > > > 2022-12-20T15:02:39,400 [qtp573262513-45704] DEBUG > > > > unity.server.web.EnquiryWellKnownURLViewProvider: Enquiry form > > > > DataHub- > > > > GFZ_TestmanagementJoinEnquiry is not applicable > > > > > > > > I saw that the user was in past in the group. We checked if the > > > > user is > > > > already in the group, but he is not. There is not open enquiry > > > > of > > > > this > > > > user. Do you have some further hints for us, why the user can't > > > > follow > > > > this enquiry? > > > Yes, however there is bunch of points to be verified. > > > > > > 1. Please note down the enquiry form in question condition (if > > > not > > > empty) and other general settings (is it sticky? is it by > > > invitation > > > only?) - basically everything that is on the first screen of the > > > enquiry > > > configuration in console. > > It's sticky and by invitation only. Targeted group is / and only if > > the > > upman manged group is not in groups attribute. Automation has auto > > accept if "validCode == true" and the addToGroup statement. > > > > > 2. For that user in console in the root group please check what > > > is a > > > value (if any) of the FilledEnquiries attribute. Note that this > > > is > > > system attribute, by default hidden, in attributes viewer you > > > have to > > > enable showing such in the menu. (<- I think this is the most > > > likely > > > to > > > be the reason) > > The user only has the sys:policy-agreement-state attribute but not > > the > > FilledEnquiries attribute. > > > It took a while, but I was finally able to reproduce and understand > what > happens. > > So in this case the user U is invited with some email E1, but has > account in Unity with email E2. In such case, Unity will show the > registration form after following the registration link, but the user > has an option to switch to an enquiry if wants (i.e. can decide that > instead of creating a new account will bind another, the existing one > with E2). And this fails as after switching to enquiry, Unity stops > to > treat the user as invited (as invitation was sent to E2). > > I'll open a ticket to fix that. > > For the workaround: invitation with the registered email (i.e. E1) > should work perfectly. It will also work if the join enquiry is not > set > as "by invitation only". But AFAIR it was don one some (other) > purpose, > right? > > Best regards, > Krzysztof > -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2023-01-03 13:07:17
|
Dear Sander, W dniu 21.12.2022 o 11:06, Sander Apweiler pisze: > Dear Krzysztof, > > On Wed, 2022-12-21 at 10:54 +0100, Krzysztof Benedyczak wrote: >> Dear Sander, >> >> W dniu 20.12.2022 o 15:22, Sander Apweiler pisze: >>> Dear Krzysztof, >>> we have ticket from a user about a problem to join a group. He got >>> an >>> invitation, but when he tries to follow the link and selecting, >>> that he >>> has already an account an error is shown that the enquiry is not >>> applicable. >>> >>> The log just shows: >>> 2022-12-20T15:02:39,400 [qtp573262513-45704] DEBUG >>> unity.server.web.EnquiryWellKnownURLViewProvider: Enquiry form >>> DataHub- >>> GFZ_TestmanagementJoinEnquiry is not applicable >>> >>> I saw that the user was in past in the group. We checked if the >>> user is >>> already in the group, but he is not. There is not open enquiry of >>> this >>> user. Do you have some further hints for us, why the user can't >>> follow >>> this enquiry? >> Yes, however there is bunch of points to be verified. >> >> 1. Please note down the enquiry form in question condition (if not >> empty) and other general settings (is it sticky? is it by invitation >> only?) - basically everything that is on the first screen of the >> enquiry >> configuration in console. > It's sticky and by invitation only. Targeted group is / and only if the > upman manged group is not in groups attribute. Automation has auto > accept if "validCode == true" and the addToGroup statement. > >> 2. For that user in console in the root group please check what is a >> value (if any) of the FilledEnquiries attribute. Note that this is >> system attribute, by default hidden, in attributes viewer you have to >> enable showing such in the menu. (<- I think this is the most likely >> to >> be the reason) > The user only has the sys:policy-agreement-state attribute but not the > FilledEnquiries attribute. It took a while, but I was finally able to reproduce and understand what happens. So in this case the user U is invited with some email E1, but has account in Unity with email E2. In such case, Unity will show the registration form after following the registration link, but the user has an option to switch to an enquiry if wants (i.e. can decide that instead of creating a new account will bind another, the existing one with E2). And this fails as after switching to enquiry, Unity stops to treat the user as invited (as invitation was sent to E2). I'll open a ticket to fix that. For the workaround: invitation with the registered email (i.e. E1) should work perfectly. It will also work if the join enquiry is not set as "by invitation only". But AFAIR it was don one some (other) purpose, right? Best regards, Krzysztof |
|
From: Sander A. <sa....@fz...> - 2023-01-03 06:40:18
|
Dear Krzysztof, first of all happy new year and all the best for 2023. After enabling two factor authentication on our services, we want to signal the usage of it to the services. In SAML we want to use the https://refeds.org/profile/mfa in AuthnContextClassRef. In OIDC we want to use the acr claim. Is this possible within unity? I didn't find anything in the manual about setting AuthnContextClassRef or acr. The second thing we are thinking about is proxying the information from the Upstream IdPs if there was 2FA used. I read that we can read the AuthnContextClassRef in SAML input translation profile. Is there also an action which removes the old value, if this is not covered in the next login anymore? Best regards, Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2022-12-21 11:38:10
|
W dniu 21.12.2022 o 10:05, Sander Apweiler pisze: > Dear Krzysztof, > by investigating a No SAML context error I had a look in the unity > manual. The link to the saml howto [1] in section 13.3 does not exist > any more. Thanks for the heads up, will be fixed. Krzysztof |
|
From: Sander A. <sa....@fz...> - 2022-12-21 10:06:15
|
Dear Krzysztof, On Wed, 2022-12-21 at 10:54 +0100, Krzysztof Benedyczak wrote: > Dear Sander, > > W dniu 20.12.2022 o 15:22, Sander Apweiler pisze: > > Dear Krzysztof, > > we have ticket from a user about a problem to join a group. He got > > an > > invitation, but when he tries to follow the link and selecting, > > that he > > has already an account an error is shown that the enquiry is not > > applicable. > > > > The log just shows: > > 2022-12-20T15:02:39,400 [qtp573262513-45704] DEBUG > > unity.server.web.EnquiryWellKnownURLViewProvider: Enquiry form > > DataHub- > > GFZ_TestmanagementJoinEnquiry is not applicable > > > > I saw that the user was in past in the group. We checked if the > > user is > > already in the group, but he is not. There is not open enquiry of > > this > > user. Do you have some further hints for us, why the user can't > > follow > > this enquiry? > > Yes, however there is bunch of points to be verified. > > 1. Please note down the enquiry form in question condition (if not > empty) and other general settings (is it sticky? is it by invitation > only?) - basically everything that is on the first screen of the > enquiry > configuration in console. It's sticky and by invitation only. Targeted group is / and only if the upman manged group is not in groups attribute. Automation has auto accept if "validCode == true" and the addToGroup statement. > > 2. For that user in console in the root group please check what is a > value (if any) of the FilledEnquiries attribute. Note that this is > system attribute, by default hidden, in attributes viewer you have to > enable showing such in the menu. (<- I think this is the most likely > to > be the reason) The user only has the sys:policy-agreement-state attribute but not the FilledEnquiries attribute. Best regards, Sander > > After having that info either we will know what is going on or I'll > have > to ask further, more precise question. > > Best, > Krzysztof > -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2022-12-21 09:54:25
|
Dear Sander, W dniu 20.12.2022 o 15:22, Sander Apweiler pisze: > Dear Krzysztof, > we have ticket from a user about a problem to join a group. He got an > invitation, but when he tries to follow the link and selecting, that he > has already an account an error is shown that the enquiry is not > applicable. > > The log just shows: > 2022-12-20T15:02:39,400 [qtp573262513-45704] DEBUG > unity.server.web.EnquiryWellKnownURLViewProvider: Enquiry form DataHub- > GFZ_TestmanagementJoinEnquiry is not applicable > > I saw that the user was in past in the group. We checked if the user is > already in the group, but he is not. There is not open enquiry of this > user. Do you have some further hints for us, why the user can't follow > this enquiry? Yes, however there is bunch of points to be verified. 1. Please note down the enquiry form in question condition (if not empty) and other general settings (is it sticky? is it by invitation only?) - basically everything that is on the first screen of the enquiry configuration in console. 2. For that user in console in the root group please check what is a value (if any) of the FilledEnquiries attribute. Note that this is system attribute, by default hidden, in attributes viewer you have to enable showing such in the menu. (<- I think this is the most likely to be the reason) After having that info either we will know what is going on or I'll have to ask further, more precise question. Best, Krzysztof |
|
From: Sander A. <sa....@fz...> - 2022-12-21 09:05:21
|
Dear Krzysztof, by investigating a No SAML context error I had a look in the unity manual. The link to the saml howto [1] in section 13.3 does not exist any more. Best regards, Sander [1]: https://www.unity-idm.eu/documentation/unity-3.11.2/manual.html#saml-howto.txt# -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Sander A. <sa....@fz...> - 2022-12-20 14:22:56
|
Dear Krzysztof, we have ticket from a user about a problem to join a group. He got an invitation, but when he tries to follow the link and selecting, that he has already an account an error is shown that the enquiry is not applicable. The log just shows: 2022-12-20T15:02:39,400 [qtp573262513-45704] DEBUG unity.server.web.EnquiryWellKnownURLViewProvider: Enquiry form DataHub- GFZ_TestmanagementJoinEnquiry is not applicable I saw that the user was in past in the group. We checked if the user is already in the group, but he is not. There is not open enquiry of this user. Do you have some further hints for us, why the user can't follow this enquiry? Best regards, Sander Apweiler -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2022-12-15 18:44:26
|
W dniu 15.12.2022 o 15:26, Sander Apweiler pisze: > Hi Krysztof, > eaatrs did not work because the information are in the same group where > I need the new one. So I made it like you described in the last mail. > Now I have all in one attribute and can release them in scim. > Wow, great :-) Krzysztof |
|
From: Sander A. <sa....@fz...> - 2022-12-15 14:26:46
|
Hi Krysztof, eaatrs did not work because the information are in the same group where I need the new one. So I made it like you described in the last mail. Now I have all in one attribute and can release them in scim. Best regards, Sander On Thu, 2022-12-15 at 13:27 +0100, Sander Apweiler wrote: > Hi Krzysztof, > that's what I'm trying to do. But I did not used the external > attributes. I'll try to do this ASAP. > > Thanks for your answers. > Sander > > On Thu, 2022-12-15 at 13:25 +0100, Krzysztof Benedyczak wrote: > > W dniu 14.12.2022 o 16:18, Sander Apweiler pisze: > > > Sorry I forgot to mention: eduPersonEntitlement-external is > > > mapped > > > in > > > input translation profile and eduPersonEntitlement-internal is > > > created > > > via two attribute statements with conflict resolution merge. > > > > OK. So wouldn't that work: > > > > create a 3rd dynamic attribute eduPersonEntitlement-all, which > > would > > be > > set by 3 attribute statements: the 2 are the same as the ones used > > for > > the -internal, plus 3rd which will add -external (should work as > > this > > is > > regular attribute), of course all with conflict resolution 'merge'. > > > > ? > > > > Cheers, > > Krzysztof > > > > _______________________________________________ > Unity-idm-discuss mailing list > Uni...@li... > https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Sander A. <sa....@fz...> - 2022-12-15 12:27:53
|
Hi Krzysztof, that's what I'm trying to do. But I did not used the external attributes. I'll try to do this ASAP. Thanks for your answers. Sander On Thu, 2022-12-15 at 13:25 +0100, Krzysztof Benedyczak wrote: > W dniu 14.12.2022 o 16:18, Sander Apweiler pisze: > > Sorry I forgot to mention: eduPersonEntitlement-external is mapped > > in > > input translation profile and eduPersonEntitlement-internal is > > created > > via two attribute statements with conflict resolution merge. > > OK. So wouldn't that work: > > create a 3rd dynamic attribute eduPersonEntitlement-all, which would > be > set by 3 attribute statements: the 2 are the same as the ones used > for > the -internal, plus 3rd which will add -external (should work as this > is > regular attribute), of course all with conflict resolution 'merge'. > > ? > > Cheers, > Krzysztof > -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2022-12-15 12:25:41
|
W dniu 14.12.2022 o 16:18, Sander Apweiler pisze: > Sorry I forgot to mention: eduPersonEntitlement-external is mapped in > input translation profile and eduPersonEntitlement-internal is created > via two attribute statements with conflict resolution merge. OK. So wouldn't that work: create a 3rd dynamic attribute eduPersonEntitlement-all, which would be set by 3 attribute statements: the 2 are the same as the ones used for the -internal, plus 3rd which will add -external (should work as this is regular attribute), of course all with conflict resolution 'merge'. ? Cheers, Krzysztof |
