Menu
▾
▴
unity-idm-discuss — Unity discussion and support
You can subscribe to this list here.
| 2014 |
Jan
(3) |
Feb
(1) |
Mar
|
Apr
(1) |
May
|
Jun
|
Jul
(2) |
Aug
(2) |
Sep
|
Oct
(3) |
Nov
|
Dec
(1) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2015 |
Jan
(20) |
Feb
(3) |
Mar
|
Apr
|
May
|
Jun
(15) |
Jul
(1) |
Aug
(7) |
Sep
(13) |
Oct
(2) |
Nov
(10) |
Dec
(1) |
| 2016 |
Jan
|
Feb
(2) |
Mar
|
Apr
(2) |
May
(1) |
Jun
|
Jul
(1) |
Aug
(2) |
Sep
(11) |
Oct
(7) |
Nov
(6) |
Dec
(11) |
| 2017 |
Jan
(10) |
Feb
(5) |
Mar
(27) |
Apr
(34) |
May
(25) |
Jun
(14) |
Jul
(7) |
Aug
(17) |
Sep
(11) |
Oct
(6) |
Nov
(14) |
Dec
(10) |
| 2018 |
Jan
(8) |
Feb
(19) |
Mar
(40) |
Apr
(9) |
May
(16) |
Jun
(23) |
Jul
(31) |
Aug
(7) |
Sep
(9) |
Oct
(6) |
Nov
(14) |
Dec
(19) |
| 2019 |
Jan
(4) |
Feb
(6) |
Mar
(1) |
Apr
(2) |
May
(6) |
Jun
(3) |
Jul
|
Aug
|
Sep
|
Oct
(2) |
Nov
(19) |
Dec
(14) |
| 2020 |
Jan
(10) |
Feb
(24) |
Mar
(49) |
Apr
(26) |
May
(12) |
Jun
(4) |
Jul
(13) |
Aug
(32) |
Sep
(13) |
Oct
(10) |
Nov
(4) |
Dec
(16) |
| 2021 |
Jan
(2) |
Feb
(8) |
Mar
(15) |
Apr
(19) |
May
(5) |
Jun
(13) |
Jul
(6) |
Aug
(38) |
Sep
(11) |
Oct
(18) |
Nov
(11) |
Dec
(13) |
| 2022 |
Jan
(10) |
Feb
(21) |
Mar
(28) |
Apr
(3) |
May
(7) |
Jun
(9) |
Jul
(14) |
Aug
(13) |
Sep
(8) |
Oct
(29) |
Nov
(1) |
Dec
(21) |
| 2023 |
Jan
(19) |
Feb
(9) |
Mar
|
Apr
(10) |
May
(7) |
Jun
(10) |
Jul
(14) |
Aug
(17) |
Sep
(1) |
Oct
(9) |
Nov
(5) |
Dec
(14) |
| 2024 |
Jan
(12) |
Feb
(2) |
Mar
(8) |
Apr
(1) |
May
(6) |
Jun
(6) |
Jul
(24) |
Aug
(15) |
Sep
(1) |
Oct
(6) |
Nov
(20) |
Dec
(14) |
| 2025 |
Jan
(12) |
Feb
(2) |
Mar
(10) |
Apr
(11) |
May
(13) |
Jun
(1) |
Jul
(2) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: Krzysztof B. <kb...@un...> - 2021-10-12 09:08:21
|
Hi Sander, W dniu 12.10.2021 o 10:23, Sander Apweiler pisze: > Good morning Krzysztof, > we encountered a problem with account updates. If user A fills an > account update enquiry to join a group, this enquiry is filled for all > users. User B and C have only the button "Remove last request and > create a new". For me this behaviour is very strange and feels wrong. > Is this behaviour intended or a bug? Certainly sounds like a bug. Can you please provide bit more color? How this enquiry is acessed, what is the configuration? Thank you, Krzysztof |
|
From: Sander A. <sa....@fz...> - 2021-10-12 08:23:43
|
Good morning Krzysztof, we encountered a problem with account updates. If user A fills an account update enquiry to join a group, this enquiry is filled for all users. User B and C have only the button "Remove last request and create a new". For me this behaviour is very strange and feels wrong. Is this behaviour intended or a bug? Cheers, Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Zoltan B. <ba...@aw...> - 2021-10-05 19:32:13
|
Dear Sander, Many thanks, it helped. Br, Zoltan On 10/4/2021 7:58 AM, Sander Apweiler wrote: > Dear Zoltan, > you need to add the attribute "sys:AuthorizationRole" and select the > value "SystemManager". If this attribute was set by an attribute > statement, you can't change it but need to add it to the user. > > Best regards, > Sander > > On Fri, 2021-10-01 at 19:48 +0200, Zoltan Bakcsa wrote: >> >> Dear Unity forum, >> >> I'm trying to make a user System Manager but could not figure it out. >> Could someone point me to the relevant part in the documentation? >> >> Br, >> Zoltan >> >> >> _______________________________________________ >> Unity-idm-discuss mailing list >> Uni...@li... >> https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss > |
|
From: Sander A. <sa....@fz...> - 2021-10-05 07:06:25
|
Good morning Krzysztof, I restarted unity, so it should be loaded. I set it via UI but after a restart this morning it was not loaded again. Cheers, Sander On Mon, 2021-10-04 at 11:55 +0200, Krzysztof Benedyczak wrote: > Hi Sander, > > W dniu 01.10.2021 o 07:46, Sander Apweiler pisze: > > Good morning Krzysztof, > > > > On Thu, 2021-09-23 at 12:45 +0200, Krzysztof Benedyczak wrote: > > > Hi Sander, > > > > > > W dniu 23.09.2021 o 07:17, Sander Apweiler pisze: > > > > Good morning Krzysztof, > > > > good morning Roman, > > > > > > > > I have two short questions about SAML NameID and unity. In past > > > > weeks I > > > > got two user tickets because their login with 3rd party IdP > > > > failed. > > > > In > > > > both cases the log showed that the IdP did not use NameID > > > > format. > > > > Both > > > > IdP admins said they didn't change it or didn't send it in > > > > past. > > > > Became > > > > unity here more strikt between 3.3.4 and 3.5.1? > > > Well, I don't recall anything clearly related, but it is bit hard > > > to > > > say > > > without knowing bit wider context. > > > > > > Do I read this correctly that SAML answer contained NameID > > > without > > > specifying the format attribute? - what in general means that the > > > format > > > is unspecified. > > > > > > Can you write which element had this nameID? Is it about > > > authenticated > > > entity? Or the IdP identifier? Unity log would be here also very > > > helpful, especially if it contains some error. > > I have to check when this happens the next time. > > > > One IdP admin reported the NameIdPolicy in AuthRequest is > > > > empty, > > > > see > > > > screenshot. Is this intended? > > > AFAIR this is configurable: unity authenticator has "accepted > > > name > > > formats" config, and you can have it left empty what would allow > > > any > > > format (and the NameIdPolicy you have pasted). > > Yes there is config about it and it was empty. But after setting > > this, > > the policy is still empty. > > > > Here is my IdP config: > > > > unity.saml.requester.remoteIdp.marine.name=MarineID IdP > > unity.saml.requester.remoteIdp.marine.address= > > https://idp.marine-id.org/idp/profile/SAML2/Redirect/SSO > > unity.saml.requester.remoteIdp.marine.binding=HTTP_REDIRECT > > unity.saml.requester.remoteIdp.marine.samlId= > > https://idp.marine-id.org/idp/shibboleth > > unity.saml.requester.remoteIdp.marine.certificate=MARINEID > > unity.saml.requester.remoteIdp.marine.translationProfile=tr-input- > > marineid > > unity.saml.requester.remoteIdp.marine.registrationFormForUnknown=ma > > rineID Registration Form > > unity.saml.requester.remoteIdp.marine.enableAccountAssociation=fals > > e > > unity.saml.requester.remoteIdp.marine.logoURI.en= > > https://www.marine-id.org/img/logo-noBG.svg > > unity.saml.requester.remoteIdp.marine.requestedNameFormat=urn:oasis > > :names:tc:SAML:2.0:nameid-format:persistent > > > > Do you see some error within? > > Nope, looks good to me. I just checked something similar and works > well > on my end. Are you sure that your authenticator was reloaded? I.e. > maybe > installed was not yet refreshed? The safest bet is to undeploy and > then > redeploy it. > > > Cheers, > Krzysztof > > -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2021-10-04 13:50:15
|
Hi Zoltan, W dniu 01.10.2021 o 20:18, Zoltan Bakcsa pisze: > > Dear Unity forum, > > I have a couple of microservice like software component which supposed > to cooperate through their respective APIs. These APIs require > authentication and authorization. > > Since we already have Unity running in our infrastructure for user > authentication, we would also use it for the authorization of these > software components. The plan is to use OAuth - Client credentials grant. > Originally I wanted to create an OAuth endpoint where I could create a > client for each software components that requires authorization. My > problem is that it does not seem to be possible to assign Scopes to > individual clients, only for the OAuth endpoint. Scopes set on the > Endpoint level are assigned to all clients underneath. As a result, > all clients will have the same set of scopes which is not what we want. > > Is it possible to assign scopes on a client level? > If not, how should it work? Each client should have its own Identity > Provider? What you describe to is mostly correct: at this point Unity allows for specifying available OAuth scopes per Identity Provider (or in oauth lingo: Authorization Server) endpoint. This is the list of allowed scopes - client can request subset of those scopes. And in typical case that's enough, as end-user can refuse to consent the client, if it requests too wide scopes. I agree that for the non-interactive client credentials grant this may be a limitation. As of now you can setup multiple IdP endpoints - each for each client with different scopes. Other option would be to enrich Unity with possibility to configure scopes which are allowed per each client individually. This would however require enhancement in code. Kind regards, Krzysztof |
|
From: Krzysztof B. <kb...@un...> - 2021-10-04 09:55:33
|
Hi Sander, W dniu 01.10.2021 o 07:46, Sander Apweiler pisze: > Good morning Krzysztof, > > On Thu, 2021-09-23 at 12:45 +0200, Krzysztof Benedyczak wrote: >> Hi Sander, >> >> W dniu 23.09.2021 o 07:17, Sander Apweiler pisze: >>> Good morning Krzysztof, >>> good morning Roman, >>> >>> I have two short questions about SAML NameID and unity. In past >>> weeks I >>> got two user tickets because their login with 3rd party IdP failed. >>> In >>> both cases the log showed that the IdP did not use NameID format. >>> Both >>> IdP admins said they didn't change it or didn't send it in past. >>> Became >>> unity here more strikt between 3.3.4 and 3.5.1? >> Well, I don't recall anything clearly related, but it is bit hard to >> say >> without knowing bit wider context. >> >> Do I read this correctly that SAML answer contained NameID without >> specifying the format attribute? - what in general means that the >> format >> is unspecified. >> >> Can you write which element had this nameID? Is it about >> authenticated >> entity? Or the IdP identifier? Unity log would be here also very >> helpful, especially if it contains some error. > I have to check when this happens the next time. >>> One IdP admin reported the NameIdPolicy in AuthRequest is empty, >>> see >>> screenshot. Is this intended? >> AFAIR this is configurable: unity authenticator has "accepted name >> formats" config, and you can have it left empty what would allow any >> format (and the NameIdPolicy you have pasted). > Yes there is config about it and it was empty. But after setting this, > the policy is still empty. > > Here is my IdP config: > > unity.saml.requester.remoteIdp.marine.name=MarineID IdP > unity.saml.requester.remoteIdp.marine.address=https://idp.marine-id.org/idp/profile/SAML2/Redirect/SSO > unity.saml.requester.remoteIdp.marine.binding=HTTP_REDIRECT > unity.saml.requester.remoteIdp.marine.samlId=https://idp.marine-id.org/idp/shibboleth > unity.saml.requester.remoteIdp.marine.certificate=MARINEID > unity.saml.requester.remoteIdp.marine.translationProfile=tr-input-marineid > unity.saml.requester.remoteIdp.marine.registrationFormForUnknown=marineID Registration Form > unity.saml.requester.remoteIdp.marine.enableAccountAssociation=false > unity.saml.requester.remoteIdp.marine.logoURI.en=https://www.marine-id.org/img/logo-noBG.svg > unity.saml.requester.remoteIdp.marine.requestedNameFormat=urn:oasis:names:tc:SAML:2.0:nameid-format:persistent > > Do you see some error within? Nope, looks good to me. I just checked something similar and works well on my end. Are you sure that your authenticator was reloaded? I.e. maybe when you tried to test it the endpoint on which this authenticator is installed was not yet refreshed? The safest bet is to undeploy and then redeploy it. Cheers, Krzysztof |
|
From: Sander A. <sa....@fz...> - 2021-10-04 05:58:33
|
Dear Zoltan, you need to add the attribute "sys:AuthorizationRole" and select the value "SystemManager". If this attribute was set by an attribute statement, you can't change it but need to add it to the user. Best regards, Sander On Fri, 2021-10-01 at 19:48 +0200, Zoltan Bakcsa wrote: > > Dear Unity forum, > > I'm trying to make a user System Manager but could not figure it out. > Could someone point me to the relevant part in the documentation? > > Br, > Zoltan > > > _______________________________________________ > Unity-idm-discuss mailing list > Uni...@li... > https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Zoltan B. <ba...@aw...> - 2021-10-01 18:18:15
|
Dear Unity forum, I have a couple of microservice like software component which supposed to cooperate through their respective APIs. These APIs require authentication and authorization. Since we already have Unity running in our infrastructure for user authentication, we would also use it for the authorization of these software components. The plan is to use OAuth - Client credentials grant. Originally I wanted to create an OAuth endpoint where I could create a client for each software components that requires authorization. My problem is that it does not seem to be possible to assign Scopes to individual clients, only for the OAuth endpoint. Scopes set on the Endpoint level are assigned to all clients underneath. As a result, all clients will have the same set of scopes which is not what we want. Is it possible to assign scopes on a client level? If not, how should it work? Each client should have its own Identity Provider? Br, Zoltan |
|
From: Zoltan B. <ba...@aw...> - 2021-10-01 17:49:10
|
Dear Unity forum, I'm trying to make a user System Manager but could not figure it out. Could someone point me to the relevant part in the documentation? Br, Zoltan |
|
From: Krzysztof B. <kb...@un...> - 2021-10-01 13:28:18
|
Hi Sander, W dniu 01.10.2021 o 15:17, Sander Apweiler pisze: > Hi Krzysztof, > > is there a way to get the sys:ProjectManagementRole of a user in a > specific group within output translation profiles? And is this > information stored for subgroups as well? I saw in the web UI that an > account has manager privileges in a group (and subgroups because of the > inheritance) but this is not shown as attribute in the subgroup. > > We have a connected service which needs to know who is the manager of a > specific group. The ProjectManagementRole attribute is only defined in one place - in subgroups its presence is not needed to have authZ. So if you want to have this attribute available in some sub-group context you need to add an attribute statement in that sub-group, to copy the role attribute from the parnet group. Then it will be visible in output profile. HTH, Krzysztof |
|
From: Sander A. <sa....@fz...> - 2021-10-01 13:17:52
|
Hi Krzysztof, is there a way to get the sys:ProjectManagementRole of a user in a specific group within output translation profiles? And is this information stored for subgroups as well? I saw in the web UI that an account has manager privileges in a group (and subgroups because of the inheritance) but this is not shown as attribute in the subgroup. We have a connected service which needs to know who is the manager of a specific group. Best regards, Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Sander A. <sa....@fz...> - 2021-10-01 05:46:19
|
Good morning Krzysztof, On Thu, 2021-09-23 at 12:45 +0200, Krzysztof Benedyczak wrote: > Hi Sander, > > W dniu 23.09.2021 o 07:17, Sander Apweiler pisze: > > Good morning Krzysztof, > > good morning Roman, > > > > I have two short questions about SAML NameID and unity. In past > > weeks I > > got two user tickets because their login with 3rd party IdP failed. > > In > > both cases the log showed that the IdP did not use NameID format. > > Both > > IdP admins said they didn't change it or didn't send it in past. > > Became > > unity here more strikt between 3.3.4 and 3.5.1? > > Well, I don't recall anything clearly related, but it is bit hard to > say > without knowing bit wider context. > > Do I read this correctly that SAML answer contained NameID without > specifying the format attribute? - what in general means that the > format > is unspecified. > > Can you write which element had this nameID? Is it about > authenticated > entity? Or the IdP identifier? Unity log would be here also very > helpful, especially if it contains some error. I have to check when this happens the next time. > > > One IdP admin reported the NameIdPolicy in AuthRequest is empty, > > see > > screenshot. Is this intended? > > AFAIR this is configurable: unity authenticator has "accepted name > formats" config, and you can have it left empty what would allow any > format (and the NameIdPolicy you have pasted). Yes there is config about it and it was empty. But after setting this, the policy is still empty. Here is my IdP config: unity.saml.requester.remoteIdp.marine.name=MarineID IdP unity.saml.requester.remoteIdp.marine.address=https://idp.marine-id.org/idp/profile/SAML2/Redirect/SSO unity.saml.requester.remoteIdp.marine.binding=HTTP_REDIRECT unity.saml.requester.remoteIdp.marine.samlId=https://idp.marine-id.org/idp/shibboleth unity.saml.requester.remoteIdp.marine.certificate=MARINEID unity.saml.requester.remoteIdp.marine.translationProfile=tr-input-marineid unity.saml.requester.remoteIdp.marine.registrationFormForUnknown=marineID Registration Form unity.saml.requester.remoteIdp.marine.enableAccountAssociation=false unity.saml.requester.remoteIdp.marine.logoURI.en=https://www.marine-id.org/img/logo-noBG.svg unity.saml.requester.remoteIdp.marine.requestedNameFormat=urn:oasis:names:tc:SAML:2.0:nameid-format:persistent Do you see some error within? Cheers, Sander > > HTH, > Krzysztof > -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2021-09-29 12:28:46
|
Dear Subscribers,
I have a pleasure to announce a new, big Unity release: 3.6.0. The main
highlights are:
* *New remote authentication experience*: faster, less intrusive, more
stable with many more improvements.
* “Combo” invitations: dynamically recognize whether the invited user
already exists in Unity or needs to be added.
* Enhancements of registration and enquiry forms
* Enhancements of the REST API
* OTP with LDAP backend
See https://www.unity-idm.eu/downloads/ for more details.
Best regards,
Krzysztof
|
|
From: Krzysztof B. <kb...@un...> - 2021-09-23 10:47:20
|
Hi Sander, W dniu 21.09.2021 o 10:45, Sander Apweiler pisze: > Good morning Krzysztof, > > in the old admin endpoint it was possible to reload endpoints, if there > was a chance in configuration. In the console endpoint this is not > possible and we need to restart unity to load new configuration from > files. The endpoint reload was much faster than a restart of unity (2-3 > minutes when you use eduGAIN). Would it be possible to include the > reload function in console endpoint too? Yeah, we have dropped this feature as it become much harder in Unity 3. In Unity 2 endpoints could be loaded only with the file configuration, there was no UI. But it should be possible to have this functionality. We will discuss that after 3.6 is out and will let you know. Cheers, Krzysztof |
|
From: Krzysztof B. <kb...@un...> - 2021-09-23 10:45:32
|
Hi Sander, W dniu 23.09.2021 o 07:17, Sander Apweiler pisze: > Good morning Krzysztof, > good morning Roman, > > I have two short questions about SAML NameID and unity. In past weeks I > got two user tickets because their login with 3rd party IdP failed. In > both cases the log showed that the IdP did not use NameID format. Both > IdP admins said they didn't change it or didn't send it in past. Became > unity here more strikt between 3.3.4 and 3.5.1? Well, I don't recall anything clearly related, but it is bit hard to say without knowing bit wider context. Do I read this correctly that SAML answer contained NameID without specifying the format attribute? - what in general means that the format is unspecified. Can you write which element had this nameID? Is it about authenticated entity? Or the IdP identifier? Unity log would be here also very helpful, especially if it contains some error. > One IdP admin reported the NameIdPolicy in AuthRequest is empty, see > screenshot. Is this intended? AFAIR this is configurable: unity authenticator has "accepted name formats" config, and you can have it left empty what would allow any format (and the NameIdPolicy you have pasted). HTH, Krzysztof |
|
From: Sander A. <sa....@fz...> - 2021-09-23 05:17:37
|
Good morning Krzysztof, good morning Roman, I have two short questions about SAML NameID and unity. In past weeks I got two user tickets because their login with 3rd party IdP failed. In both cases the log showed that the IdP did not use NameID format. Both IdP admins said they didn't change it or didn't send it in past. Became unity here more strikt between 3.3.4 and 3.5.1? One IdP admin reported the NameIdPolicy in AuthRequest is empty, see screenshot. Is this intended? Cheers, Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Sander A. <sa....@fz...> - 2021-09-21 08:45:08
|
Good morning Krzysztof, in the old admin endpoint it was possible to reload endpoints, if there was a chance in configuration. In the console endpoint this is not possible and we need to restart unity to load new configuration from files. The endpoint reload was much faster than a restart of unity (2-3 minutes when you use eduGAIN). Would it be possible to include the reload function in console endpoint too? Cheers, Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2021-09-17 12:10:54
|
Hi Sander, W dniu 17.09.2021 o 13:50, Sander Apweiler pisze: > Dear Krzysztof, > In past we had the issue that for some IdPs the authentication failed > and the user needed to select them a second time. This problem was > solved and the second redirect is done automatically. User reported > that this is sometimes very slow and they click a second time on the > IdP button because they don't saw that the process is already running. > Clicking a second time crashes the login flow. The users see an error > about no OAuth context. > > Would it possible to highlight the running process? > > And does the attached log has something to do with the error? At least > this is what I saw in the logs at the reported timestamp. It is very likely that this problem will be completely addressed by the upcoming 3.6.0 release. Cheers, Krzysztof |
|
From: Sander A. <sa....@fz...> - 2021-09-17 11:50:56
|
Dear Krzysztof,
In past we had the issue that for some IdPs the authentication failed
and the user needed to select them a second time. This problem was
solved and the second redirect is done automatically. User reported
that this is sometimes very slow and they click a second time on the
IdP button because they don't saw that the process is already running.
Clicking a second time crashes the login flow. The users see an error
about no OAuth context.
Would it possible to highlight the running process?
And does the attached log has something to do with the error? At least
this is what I saw in the logs at the reported timestamp.
2021-09-17T13:29:39,357 [qtp1186312760-8179] DEBUG unity.server.event.EventProcessor: Fire event: [trigger=methodInvocation.getEntityLabel, invokerEntity=102, timestamp=Fri Sep 17 13:29:39 CEST 2021, contents={"method":"getEntityLabel","interfaceName":"EntityManagement","exception":null,"args":[{"identity":null,"entityId":102}]}]
2021-09-17T13:29:39,367 [qtp1186312760-8179] DEBUG unity.server.event.EventProcessor: Fire event: [trigger=methodInvocation.getEntityLabel, invokerEntity=102, timestamp=Fri Sep 17 13:29:39 CEST 2021, contents={"method":"getEntityLabel","interfaceName":"EntityManagement","exception":null,"args":[{"identity":null,"entityId":102}]}]
2021-09-17T13:29:39,378 [qtp1186312760-8179] DEBUG unity.server.event.EventProcessor: Fire event: [trigger=methodInvocation.getEntityLabel, invokerEntity=102, timestamp=Fri Sep 17 13:29:39 CEST 2021, contents={"method":"getEntityLabel","interfaceName":"EntityManagement","exception":null,"args":[{"identity":null,"entityId":102}]}]
2021-09-17T13:29:39,385 [qtp1186312760-8179] DEBUG unity.server.event.EventProcessor: Fire event: [trigger=methodInvocation.getEntityLabel, invokerEntity=102, timestamp=Fri Sep 17 13:29:39 CEST 2021, contents={"method":"getEntityLabel","interfaceName":"EntityManagement","exception":null,"args":[{"identity":null,"entityId":102}]}]
2021-09-17T13:29:39,393 [qtp1186312760-8179] DEBUG unity.server.event.EventProcessor: Fire event: [trigger=methodInvocation.getEntityLabel, invokerEntity=102, timestamp=Fri Sep 17 13:29:39 CEST 2021, contents={"method":"getEntityLabel","interfaceName":"EntityManagement","exception":null,"args":[{"identity":null,"entityId":102}]}]
2021-09-17T13:29:39,401 [qtp1186312760-8179] DEBUG unity.server.event.EventProcessor: Fire event: [trigger=methodInvocation.getEntityLabel, invokerEntity=102, timestamp=Fri Sep 17 13:29:39 CEST 2021, contents={"method":"getEntityLabel","interfaceName":"EntityManagement","exception":null,"args":[{"identity":null,"entityId":102}]}]
2021-09-17T13:29:39,409 [qtp1186312760-8179] DEBUG unity.server.event.EventProcessor: Fire event: [trigger=methodInvocation.getEntityLabel, invokerEntity=102, timestamp=Fri Sep 17 13:29:39 CEST 2021, contents={"method":"getEntityLabel","interfaceName":"EntityManagement","exception":null,"args":[{"identity":null,"entityId":102}]}]
2021-09-17T13:29:39,417 [qtp1186312760-8179] DEBUG unity.server.event.EventProcessor: Fire event: [trigger=methodInvocation.getEntityLabel, invokerEntity=102, timestamp=Fri Sep 17 13:29:39 CEST 2021, contents={"method":"getEntityLabel","interfaceName":"EntityManagement","exception":null,"args":[{"identity":null,"entityId":102}]}]
2021-09-17T13:29:39,424 [qtp1186312760-8179] DEBUG unity.server.event.EventProcessor: Fire event: [trigger=methodInvocation.getEntityLabel, invokerEntity=102, timestamp=Fri Sep 17 13:29:39 CEST 2021, contents={"method":"getEntityLabel","interfaceName":"EntityManagement","exception":null,"args":[{"identity":null,"entityId":102}]}]
2021-09-17T13:29:39,433 [qtp1186312760-8179] DEBUG unity.server.event.EventProcessor: Fire event: [trigger=methodInvocation.getEntityLabel, invokerEntity=102, timestamp=Fri Sep 17 13:29:39 CEST 2021, contents={"method":"getEntityLabel","interfaceName":"EntityManagement","exception":null,"args":[{"identity":null,"entityId":102}]}]
2021-09-17T13:29:39,440 [qtp1186312760-8179] DEBUG unity.server.event.EventProcessor: Fire event: [trigger=methodInvocation.getEntityLabel, invokerEntity=102, timestamp=Fri Sep 17 13:29:39 CEST 2021, contents={"method":"getEntityLabel","interfaceName":"EntityManagement","exception":null,"args":[{"identity":null,"entityId":102}]}]
2021-09-17T13:29:39,449 [qtp1186312760-8179] DEBUG unity.server.event.EventProcessor: Fire event: [trigger=methodInvocation.getEntityLabel, invokerEntity=102, timestamp=Fri Sep 17 13:29:39 CEST 2021, contents={"method":"getEntityLabel","interfaceName":"EntityManagement","exception":null,"args":[{"identity":null,"entityId":102}]}]
Just a copy of a few lines, repeates much more in the logs with ongoing
timestamps.
Best regards,
Sander
--
Federated Systems and Data
Juelich Supercomputing Centre
phone: +49 2461 61 8847
fax: +49 2461 61 6656
email: sa....@fz...
-----------------------------------------------------------------------
-----------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich
Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Volker Rieke
Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender),
Karsten Beneke (stellv. Vorsitzender), Dr. Astrid Lambrecht,
Prof. Dr. Frauke Melchior
-----------------------------------------------------------------------
-----------------------------------------------------------------------
|
|
From: Tomasz G. <ymg...@cy...> - 2021-09-15 14:18:52
|
Hi Krzysztof, Thanks for the update! It's good to know it will be solved soon Cheers Tomek śr., 15 wrz 2021 o 15:49 Krzysztof Benedyczak <kb...@un...> napisał(a): > > Hi Tomasz, > > W dniu 02.08.2021 o 13:05, Piotr Piernik pisze: > > Hi Tomasz > > We investigating this problem. We are trying to recreate this > > situation on varius browser and systems. We hope to fix this in the > > next release. > > > A small update on that issue. That's really hard one as the logic/rules > behind Chrome's password manager site introspection are pretty much > confusing/undefined/... > > > Anyway we finally managed to build a prototype that fixes this issue. It > will take bit time to refactor that prototype into final version so it > won't make it into the upcoming 3.6, but will be soon after either in a > patch or in 3.7 latest. > > > Cheers, > Krzysztof > > > |
|
From: Krzysztof B. <kb...@un...> - 2021-09-15 13:49:32
|
Hi Tomasz, W dniu 02.08.2021 o 13:05, Piotr Piernik pisze: > Hi Tomasz > We investigating this problem. We are trying to recreate this > situation on varius browser and systems. We hope to fix this in the > next release. > A small update on that issue. That's really hard one as the logic/rules behind Chrome's password manager site introspection are pretty much confusing/undefined/... Anyway we finally managed to build a prototype that fixes this issue. It will take bit time to refactor that prototype into final version so it won't make it into the upcoming 3.6, but will be soon after either in a patch or in 3.7 latest. Cheers, Krzysztof |
|
From: Krzysztof B. <kb...@un...> - 2021-09-13 13:20:43
|
Hi Sander, W dniu 10.09.2021 o 11:52, Sander Apweiler pisze: > Hi Krzysztof, > I inspected one thing and can reproduce it. I thought it was caused by > the restart but at least one information isn't. When I have added > attribute classes to a subgroup and configure or even change the > membership delegation thereafter, the attribute classes are dropped. Got it. Actually this happens only if you do the above without any reset/reload of the groups tree in between the changes. Will be addressed in 3.6.0 which we are finalizing slowly. Thank you for precise bug report! Krzysztof > Cheers, > Sander > > On Fri, 2021-08-20 at 14:49 +0200, Krzysztof Benedyczak wrote: >> W dniu 19.08.2021 o 12:40, Sander Apweiler pisze: >>> We don't run any groovy scripts or API calls here. >>> >>> I will write down when I make online changes and check after >>> reboots if >>> they are still in place. When I can limit the time frame where it >>> happens, I let you know. >>> >>> But at least the loss of attribute classes information happened >>> more >>> than once. >> Sounds reasonable - we need at least some rough hint on when this >> could >> be triggered. >> >> Cheers, >> Krzysztof >> |
|
From: Sander A. <sa....@fz...> - 2021-09-10 09:52:13
|
Hi Krzysztof, I inspected one thing and can reproduce it. I thought it was caused by the restart but at least one information isn't. When I have added attribute classes to a subgroup and configure or even change the membership delegation thereafter, the attribute classes are dropped. Cheers, Sander On Fri, 2021-08-20 at 14:49 +0200, Krzysztof Benedyczak wrote: > W dniu 19.08.2021 o 12:40, Sander Apweiler pisze: > > We don't run any groovy scripts or API calls here. > > > > I will write down when I make online changes and check after > > reboots if > > they are still in place. When I can limit the time frame where it > > happens, I let you know. > > > > But at least the loss of attribute classes information happened > > more > > than once. > > Sounds reasonable - we need at least some rough hint on when this > could > be triggered. > > Cheers, > Krzysztof > -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2021-08-31 09:22:04
|
Dear Zoltan, W dniu 30.08.2021 o 15:26, Zoltan Bakcsa pisze: > Dear Krzysztof, > > First of all: now it works, many thanks for the help. > > > One of the screenshots you have shared shows that your OAuth clients > are > > configured to authenticate with the *authenticator* called 'pwd'. > > Yes, but that 'pwd' authenticator is under > Identity provider>Jupyter hub login>Users authentication > (https://snipboard.io/rUS3MP.jpg). Since it is under Users > authentication I assumed that authenticator is used (only) for > checking user's credentials and not the client credentials. Yes, it is used there, however it was also present on this screenshot: https://snipboard.io/pTxEek.jpg So you have reused the same authenticator for authenticating users as well as OAuth client. This, on its own, can be a valid setup. > > Next check if your client (in Directory browser) has this particular > > password credential set. > > I did not have a password configured there. Once I set it (with Update > credential button in the context menu) and adjusted the jupyter hub > config it started to work. I must have overlooked the relevant part in > the docs. > > However, it is still super confusing to me. > Now I have 2 "passwords" for the client. > The one that can be set in the directory browser here: > https://snipboard.io/BEAplM.jpg > > And another one that can be set under Identity Provider>Jupyter hub > login> Oauth client> [client ID]>Client secret : > https://snipboard.io/YnEado.jpg > > Of course, up to now I tried to use the client secret from this latter > option, which did not work. > What is the purpose of the Client secret then? > Hmm, that should set up exactly the same credential - you can access that from two places. From directory you can set all credentials and from IdP -> client you should be only setting the one used for OAuth. I'll recheck that, maybe we have some regression there, but most likely there was some save click missing. Anyway we should improve the UI there to show whether the client secret is set or not. Best, Krzysztof > Br, > Zoltan > > On 8/30/2021 10:25 AM, Krzysztof Benedyczak wrote: >> Dear Zoltan, >> >> >> W dniu 25.08.2021 o 15:34, ba...@aw... pisze: >>> Dear Krzysztof, >>> >>>> One more thing to check: please ensure that your authenticator used >>>> by OAuth token endpoint ('pwd') is linked to a *password >>>> credential* that is actually set for the client. It is a common >>>> pitfall (as >in Unity you can have multiple password credentials). >>> Could you please describe how to do this step-by-step? I'm afraid I >>> do not speak the Unity language yet. >>> Also, in my first email I linked screenshots of the whole >>> configuration. Can you check whether the authenticator is linked to >>> the correct credential? >>> Perhaps you could point me to the relevant part in the documentation? >> >> One of the screenshots you have shared shows that your OAuth clients >> are configured to authenticate with the *authenticator* called 'pwd'. >> >> Now this authenticator is defining how to check the client's >> credential. In Authentication -> Facilities you will find the list of >> your authenticators. Locate entry 'pwd' there and check details. It >> should be an authenticator of type 'password' (i.e. checking >> passwords stored locally). And in its configuration there will be a >> password credential selected, which is used by this authenticator. >> Note it down. >> >> Next check if your client (in Directory browser) has this particular >> password credential set. Note that you can define multiple password >> credentials for your system (e.g. one for admins with high security >> requirements, one for ordinary users with lower requirements). Also >> unity defines one by its own (used to for the initial admin's >> password). So it is likely you have >1, and make sure the >> authenticator is using the correct one. >> >> HTH, >> Krzysztof >> |
|
From: Zoltan B. <ba...@aw...> - 2021-08-30 13:26:23
|
Dear Krzysztof, First of all: now it works, many thanks for the help. > One of the screenshots you have shared shows that your OAuth clients are > configured to authenticate with the *authenticator* called 'pwd'. Yes, but that 'pwd' authenticator is under Identity provider>Jupyter hub login>Users authentication (https://snipboard.io/rUS3MP.jpg). Since it is under Users authentication I assumed that authenticator is used (only) for checking user's credentials and not the client credentials. > Next check if your client (in Directory browser) has this particular > password credential set. I did not have a password configured there. Once I set it (with Update credential button in the context menu) and adjusted the jupyter hub config it started to work. I must have overlooked the relevant part in the docs. However, it is still super confusing to me. Now I have 2 "passwords" for the client. The one that can be set in the directory browser here: https://snipboard.io/BEAplM.jpg And another one that can be set under Identity Provider>Jupyter hub login> Oauth client> [client ID]>Client secret : https://snipboard.io/YnEado.jpg Of course, up to now I tried to use the client secret from this latter option, which did not work. What is the purpose of the Client secret then? Br, Zoltan On 8/30/2021 10:25 AM, Krzysztof Benedyczak wrote: > Dear Zoltan, > > > W dniu 25.08.2021 o 15:34, ba...@aw... pisze: >> Dear Krzysztof, >> >>> One more thing to check: please ensure that your authenticator used >>> by OAuth token endpoint ('pwd') is linked to a *password credential* >>> that is actually set for the client. It is a common pitfall (as >in >>> Unity you can have multiple password credentials). >> Could you please describe how to do this step-by-step? I'm afraid I do >> not speak the Unity language yet. >> Also, in my first email I linked screenshots of the whole >> configuration. Can you check whether the authenticator is linked to >> the correct credential? >> Perhaps you could point me to the relevant part in the documentation? > > One of the screenshots you have shared shows that your OAuth clients are > configured to authenticate with the *authenticator* called 'pwd'. > > Now this authenticator is defining how to check the client's credential. > In Authentication -> Facilities you will find the list of your > authenticators. Locate entry 'pwd' there and check details. It should be > an authenticator of type 'password' (i.e. checking passwords stored > locally). And in its configuration there will be a password credential > selected, which is used by this authenticator. Note it down. > > Next check if your client (in Directory browser) has this particular > password credential set. Note that you can define multiple password > credentials for your system (e.g. one for admins with high security > requirements, one for ordinary users with lower requirements). Also > unity defines one by its own (used to for the initial admin's password). > So it is likely you have >1, and make sure the authenticator is using > the correct one. > > HTH, > Krzysztof > |
.){kind=link}
