Menu
▾
▴
unity-idm-discuss — Unity discussion and support
You can subscribe to this list here.
| 2014 |
Jan
(3) |
Feb
(1) |
Mar
|
Apr
(1) |
May
|
Jun
|
Jul
(2) |
Aug
(2) |
Sep
|
Oct
(3) |
Nov
|
Dec
(1) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2015 |
Jan
(20) |
Feb
(3) |
Mar
|
Apr
|
May
|
Jun
(15) |
Jul
(1) |
Aug
(7) |
Sep
(13) |
Oct
(2) |
Nov
(10) |
Dec
(1) |
| 2016 |
Jan
|
Feb
(2) |
Mar
|
Apr
(2) |
May
(1) |
Jun
|
Jul
(1) |
Aug
(2) |
Sep
(11) |
Oct
(7) |
Nov
(6) |
Dec
(11) |
| 2017 |
Jan
(10) |
Feb
(5) |
Mar
(27) |
Apr
(34) |
May
(25) |
Jun
(14) |
Jul
(7) |
Aug
(17) |
Sep
(11) |
Oct
(6) |
Nov
(14) |
Dec
(10) |
| 2018 |
Jan
(8) |
Feb
(19) |
Mar
(40) |
Apr
(9) |
May
(16) |
Jun
(23) |
Jul
(31) |
Aug
(7) |
Sep
(9) |
Oct
(6) |
Nov
(14) |
Dec
(19) |
| 2019 |
Jan
(4) |
Feb
(6) |
Mar
(1) |
Apr
(2) |
May
(6) |
Jun
(3) |
Jul
|
Aug
|
Sep
|
Oct
(2) |
Nov
(19) |
Dec
(14) |
| 2020 |
Jan
(10) |
Feb
(24) |
Mar
(49) |
Apr
(26) |
May
(12) |
Jun
(4) |
Jul
(13) |
Aug
(32) |
Sep
(13) |
Oct
(10) |
Nov
(4) |
Dec
(16) |
| 2021 |
Jan
(2) |
Feb
(8) |
Mar
(15) |
Apr
(19) |
May
(5) |
Jun
(13) |
Jul
(6) |
Aug
(38) |
Sep
(11) |
Oct
(18) |
Nov
(11) |
Dec
(13) |
| 2022 |
Jan
(10) |
Feb
(21) |
Mar
(28) |
Apr
(3) |
May
(7) |
Jun
(9) |
Jul
(14) |
Aug
(13) |
Sep
(8) |
Oct
(29) |
Nov
(1) |
Dec
(21) |
| 2023 |
Jan
(19) |
Feb
(9) |
Mar
|
Apr
(10) |
May
(7) |
Jun
(10) |
Jul
(14) |
Aug
(17) |
Sep
(1) |
Oct
(9) |
Nov
(5) |
Dec
(14) |
| 2024 |
Jan
(12) |
Feb
(2) |
Mar
(8) |
Apr
(1) |
May
(6) |
Jun
(6) |
Jul
(24) |
Aug
(15) |
Sep
(1) |
Oct
(6) |
Nov
(20) |
Dec
(14) |
| 2025 |
Jan
(12) |
Feb
(2) |
Mar
(10) |
Apr
(11) |
May
(13) |
Jun
(1) |
Jul
(2) |
Aug
(2) |
Sep
(8) |
Oct
|
Nov
|
Dec
|
|
From: Sander A. <sa....@fz...> - 2021-11-03 08:48:57
|
Good morning Krzysztof, we have an SP which operates a single page application (SPA) and want to use PKCE. The browser expect HTTP header "access-control-allow- origin" to CORS requests, but it seems that unity does not send them: HTTP/1.1 200 OK Date: Wed, 03 Nov 2021 08:04:10 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains X-Frame-Options: DENY Allow: POST,GET,OPTIONS,HEAD Content-Length: 0 After switching the client type to public, because this is the only section in documentation where PKCE is mentioned the header looks like this: Endpoint: https://login-dev.helmholtz.de/oauth2/token OPTIONS /oauth2/token HTTP/1.1 Host: login-dev.helmholtz.de User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Access-Control-Request-Method: POST Referer: https://rz-vm64.gfz-potsdam.de:3000/ Origin: https://rz-vm64.gfz-potsdam.de:3000 DNT: 1 Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache Is PKCE already fully supported in unity? Do we need to do some further configuration to allow PKCE for this client? Best regards, Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Tomasz G. <ymg...@cy...> - 2021-11-02 14:39:18
|
Hi Krzysztof, We have recently upgraded to the new version of Unity and I can confirm that the problem with autofill in chrome has been solved. Thanks again for your help! Cheers, Tom On Wed, 15 Sept 2021 at 15:59, Tomasz Grabarczyk <ymg...@cy...> wrote: > Hi Krzysztof, > > Thanks for the update! It's good to know it will be solved soon > > Cheers > Tomek > > > śr., 15 wrz 2021 o 15:49 Krzysztof Benedyczak <kb...@un...> > napisał(a): > > > > Hi Tomasz, > > > > W dniu 02.08.2021 o 13:05, Piotr Piernik pisze: > > > Hi Tomasz > > > We investigating this problem. We are trying to recreate this > > > situation on varius browser and systems. We hope to fix this in the > > > next release. > > > > > A small update on that issue. That's really hard one as the logic/rules > > behind Chrome's password manager site introspection are pretty much > > confusing/undefined/... > > > > > > Anyway we finally managed to build a prototype that fixes this issue. It > > will take bit time to refactor that prototype into final version so it > > won't make it into the upcoming 3.6, but will be soon after either in a > > patch or in 3.7 latest. > > > > > > Cheers, > > Krzysztof > > > > > > > |
|
From: Sander A. <sa....@fz...> - 2021-11-02 12:45:40
|
Hello Krzysztof, We are using certificate login as one option for user authentication. The positiv aspect of certificate authentication is users are checked before they get a certificate from a trustful CA. Sadly after apple deals since several years with self-sigend certificates, which are offered to the users, Microsoft starts with the same bullshit in the last year. Of course self-sigend certificates are not trustful and we do not support them for authentication. But because unity uses the client authentication mechanism in SSL handshake, the user certificates are rejected before user reach the service and the user just see a certificate error in their browser which they do not understand. And those users do not use certificate authentication. They use normally the account at their home organisation or their social ID for authentication. Is there another way for certificate authentication without using the client authentication from SSL handshake? Best regards, Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Sander A. <sa....@fz...> - 2021-11-02 09:20:33
|
Good morning Krzysztof, we are testing 3.6.1 release and have some additional test we did not perform previously. When we submit a user updated without selecting a subgroup and the update is accepted, the use is not added to the group where group management was delegated. The user is only added if a subgroup is selected. Is this behaviour intended? Or do we need to add an add to group rule in automation section? Best regards, Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2021-10-26 19:25:04
|
W dniu 26.10.2021 o 11:55, Sander Apweiler pisze: > Hello Krzysztof, > we have the case that we, as unity administrator, need to merge two > accounts because the remote IdP changed the value we are using for > account mapping. We disabled the account merging for users because of > access rights to connected services. > > It seems that the texts for the merging dialog are not properly set on > 3.5.1 version. I tested it on several instances and it looks equal on > all systems. I pasted a screenshot of the dialog. > Got it, thx! Krzysztof |
|
From: Sander A. <sa....@fz...> - 2021-10-26 10:01:50
|
Hello Krzysztof, we have the case that we, as unity administrator, need to merge two accounts because the remote IdP changed the value we are using for account mapping. We disabled the account merging for users because of access rights to connected services. It seems that the texts for the merging dialog are not properly set on 3.5.1 version. I tested it on several instances and it looks equal on all systems. I pasted a screenshot of the dialog. Cheers, Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2021-10-18 14:09:12
|
Dear Subscribers, As Java 8 in EoL period, is officially unsupported by Oracle and also a second post-8 Long-Term-Support version of Java was recently published (Java 17), Unity will soon drop its support for the dated Java 8. Unity, since a long time (3.0.0 version), supports running on Java 11. Since version *3.8.0* (roughly expected in December 2021) *Java 11 will be *also *the minimum version of JVM*, on which Unity will run. It is advised to update Unity deployments to use Java 11 even before that release. Best regards, Krzysztof |
|
From: Krzysztof B. <kb...@un...> - 2021-10-18 14:07:54
|
Dear Subscribers,
A new update is available in the 3.6.x stream. It includes the following
improvements:
* Bugfix: proper determination of the filling status of a sticky
enquiry in HomeUI
* Support for SAML authentication assertions without subject
identifier. Note that in such case SLO can’t work as well as the
‘id’ variable in the input profile is set to null.
* A workaround was implemented making Chrome password manager properly
filling (and collecting) passwords in Unity.
More details available at https://www.unity-idm.eu/downloads/
Best regards,
Krzysztof
|
|
From: Krzysztof B. <kb...@un...> - 2021-10-12 09:47:02
|
Hi Sander, W dniu 12.10.2021 o 11:22, Sander Apweiler pisze: > Hi Krzysztof, > the enquiry is filled via home endpoint. > > The type is sticky and only available to / and /theme_test > In collected data only the group can be selected "/theme_test/?*/**" > with multiple group selection. The rest of the enquiry is empty. > > If you want I can provide you screenshots of the config. Reproduced - as expected bug (rather serious :/ - but easy to fix). Will be patched in 3.6.1. Thanks for the report, Krzysztof > Cheers, > Sander > > On Tue, 2021-10-12 at 11:08 +0200, Krzysztof Benedyczak wrote: >> Hi Sander, >> >> W dniu 12.10.2021 o 10:23, Sander Apweiler pisze: >>> Good morning Krzysztof, >>> we encountered a problem with account updates. If user A fills an >>> account update enquiry to join a group, this enquiry is filled for >>> all >>> users. User B and C have only the button "Remove last request and >>> create a new". For me this behaviour is very strange and feels >>> wrong. >>> Is this behaviour intended or a bug? >> Certainly sounds like a bug. Can you please provide bit more color? >> How >> this enquiry is acessed, what is the configuration? >> >> Thank you, >> Krzysztof >> >> |
|
From: Sander A. <sa....@fz...> - 2021-10-12 09:22:39
|
Hi Krzysztof, the enquiry is filled via home endpoint. The type is sticky and only available to / and /theme_test In collected data only the group can be selected "/theme_test/?*/**" with multiple group selection. The rest of the enquiry is empty. If you want I can provide you screenshots of the config. Cheers, Sander On Tue, 2021-10-12 at 11:08 +0200, Krzysztof Benedyczak wrote: > Hi Sander, > > W dniu 12.10.2021 o 10:23, Sander Apweiler pisze: > > Good morning Krzysztof, > > we encountered a problem with account updates. If user A fills an > > account update enquiry to join a group, this enquiry is filled for > > all > > users. User B and C have only the button "Remove last request and > > create a new". For me this behaviour is very strange and feels > > wrong. > > Is this behaviour intended or a bug? > > Certainly sounds like a bug. Can you please provide bit more color? > How > this enquiry is acessed, what is the configuration? > > Thank you, > Krzysztof > > -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2021-10-12 09:08:21
|
Hi Sander, W dniu 12.10.2021 o 10:23, Sander Apweiler pisze: > Good morning Krzysztof, > we encountered a problem with account updates. If user A fills an > account update enquiry to join a group, this enquiry is filled for all > users. User B and C have only the button "Remove last request and > create a new". For me this behaviour is very strange and feels wrong. > Is this behaviour intended or a bug? Certainly sounds like a bug. Can you please provide bit more color? How this enquiry is acessed, what is the configuration? Thank you, Krzysztof |
|
From: Sander A. <sa....@fz...> - 2021-10-12 08:23:43
|
Good morning Krzysztof, we encountered a problem with account updates. If user A fills an account update enquiry to join a group, this enquiry is filled for all users. User B and C have only the button "Remove last request and create a new". For me this behaviour is very strange and feels wrong. Is this behaviour intended or a bug? Cheers, Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Zoltan B. <ba...@aw...> - 2021-10-05 19:32:13
|
Dear Sander, Many thanks, it helped. Br, Zoltan On 10/4/2021 7:58 AM, Sander Apweiler wrote: > Dear Zoltan, > you need to add the attribute "sys:AuthorizationRole" and select the > value "SystemManager". If this attribute was set by an attribute > statement, you can't change it but need to add it to the user. > > Best regards, > Sander > > On Fri, 2021-10-01 at 19:48 +0200, Zoltan Bakcsa wrote: >> >> Dear Unity forum, >> >> I'm trying to make a user System Manager but could not figure it out. >> Could someone point me to the relevant part in the documentation? >> >> Br, >> Zoltan >> >> >> _______________________________________________ >> Unity-idm-discuss mailing list >> Uni...@li... >> https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss > |
|
From: Sander A. <sa....@fz...> - 2021-10-05 07:06:25
|
Good morning Krzysztof, I restarted unity, so it should be loaded. I set it via UI but after a restart this morning it was not loaded again. Cheers, Sander On Mon, 2021-10-04 at 11:55 +0200, Krzysztof Benedyczak wrote: > Hi Sander, > > W dniu 01.10.2021 o 07:46, Sander Apweiler pisze: > > Good morning Krzysztof, > > > > On Thu, 2021-09-23 at 12:45 +0200, Krzysztof Benedyczak wrote: > > > Hi Sander, > > > > > > W dniu 23.09.2021 o 07:17, Sander Apweiler pisze: > > > > Good morning Krzysztof, > > > > good morning Roman, > > > > > > > > I have two short questions about SAML NameID and unity. In past > > > > weeks I > > > > got two user tickets because their login with 3rd party IdP > > > > failed. > > > > In > > > > both cases the log showed that the IdP did not use NameID > > > > format. > > > > Both > > > > IdP admins said they didn't change it or didn't send it in > > > > past. > > > > Became > > > > unity here more strikt between 3.3.4 and 3.5.1? > > > Well, I don't recall anything clearly related, but it is bit hard > > > to > > > say > > > without knowing bit wider context. > > > > > > Do I read this correctly that SAML answer contained NameID > > > without > > > specifying the format attribute? - what in general means that the > > > format > > > is unspecified. > > > > > > Can you write which element had this nameID? Is it about > > > authenticated > > > entity? Or the IdP identifier? Unity log would be here also very > > > helpful, especially if it contains some error. > > I have to check when this happens the next time. > > > > One IdP admin reported the NameIdPolicy in AuthRequest is > > > > empty, > > > > see > > > > screenshot. Is this intended? > > > AFAIR this is configurable: unity authenticator has "accepted > > > name > > > formats" config, and you can have it left empty what would allow > > > any > > > format (and the NameIdPolicy you have pasted). > > Yes there is config about it and it was empty. But after setting > > this, > > the policy is still empty. > > > > Here is my IdP config: > > > > unity.saml.requester.remoteIdp.marine.name=MarineID IdP > > unity.saml.requester.remoteIdp.marine.address= > > https://idp.marine-id.org/idp/profile/SAML2/Redirect/SSO > > unity.saml.requester.remoteIdp.marine.binding=HTTP_REDIRECT > > unity.saml.requester.remoteIdp.marine.samlId= > > https://idp.marine-id.org/idp/shibboleth > > unity.saml.requester.remoteIdp.marine.certificate=MARINEID > > unity.saml.requester.remoteIdp.marine.translationProfile=tr-input- > > marineid > > unity.saml.requester.remoteIdp.marine.registrationFormForUnknown=ma > > rineID Registration Form > > unity.saml.requester.remoteIdp.marine.enableAccountAssociation=fals > > e > > unity.saml.requester.remoteIdp.marine.logoURI.en= > > https://www.marine-id.org/img/logo-noBG.svg > > unity.saml.requester.remoteIdp.marine.requestedNameFormat=urn:oasis > > :names:tc:SAML:2.0:nameid-format:persistent > > > > Do you see some error within? > > Nope, looks good to me. I just checked something similar and works > well > on my end. Are you sure that your authenticator was reloaded? I.e. > maybe > installed was not yet refreshed? The safest bet is to undeploy and > then > redeploy it. > > > Cheers, > Krzysztof > > -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2021-10-04 13:50:15
|
Hi Zoltan, W dniu 01.10.2021 o 20:18, Zoltan Bakcsa pisze: > > Dear Unity forum, > > I have a couple of microservice like software component which supposed > to cooperate through their respective APIs. These APIs require > authentication and authorization. > > Since we already have Unity running in our infrastructure for user > authentication, we would also use it for the authorization of these > software components. The plan is to use OAuth - Client credentials grant. > Originally I wanted to create an OAuth endpoint where I could create a > client for each software components that requires authorization. My > problem is that it does not seem to be possible to assign Scopes to > individual clients, only for the OAuth endpoint. Scopes set on the > Endpoint level are assigned to all clients underneath. As a result, > all clients will have the same set of scopes which is not what we want. > > Is it possible to assign scopes on a client level? > If not, how should it work? Each client should have its own Identity > Provider? What you describe to is mostly correct: at this point Unity allows for specifying available OAuth scopes per Identity Provider (or in oauth lingo: Authorization Server) endpoint. This is the list of allowed scopes - client can request subset of those scopes. And in typical case that's enough, as end-user can refuse to consent the client, if it requests too wide scopes. I agree that for the non-interactive client credentials grant this may be a limitation. As of now you can setup multiple IdP endpoints - each for each client with different scopes. Other option would be to enrich Unity with possibility to configure scopes which are allowed per each client individually. This would however require enhancement in code. Kind regards, Krzysztof |
|
From: Krzysztof B. <kb...@un...> - 2021-10-04 09:55:33
|
Hi Sander, W dniu 01.10.2021 o 07:46, Sander Apweiler pisze: > Good morning Krzysztof, > > On Thu, 2021-09-23 at 12:45 +0200, Krzysztof Benedyczak wrote: >> Hi Sander, >> >> W dniu 23.09.2021 o 07:17, Sander Apweiler pisze: >>> Good morning Krzysztof, >>> good morning Roman, >>> >>> I have two short questions about SAML NameID and unity. In past >>> weeks I >>> got two user tickets because their login with 3rd party IdP failed. >>> In >>> both cases the log showed that the IdP did not use NameID format. >>> Both >>> IdP admins said they didn't change it or didn't send it in past. >>> Became >>> unity here more strikt between 3.3.4 and 3.5.1? >> Well, I don't recall anything clearly related, but it is bit hard to >> say >> without knowing bit wider context. >> >> Do I read this correctly that SAML answer contained NameID without >> specifying the format attribute? - what in general means that the >> format >> is unspecified. >> >> Can you write which element had this nameID? Is it about >> authenticated >> entity? Or the IdP identifier? Unity log would be here also very >> helpful, especially if it contains some error. > I have to check when this happens the next time. >>> One IdP admin reported the NameIdPolicy in AuthRequest is empty, >>> see >>> screenshot. Is this intended? >> AFAIR this is configurable: unity authenticator has "accepted name >> formats" config, and you can have it left empty what would allow any >> format (and the NameIdPolicy you have pasted). > Yes there is config about it and it was empty. But after setting this, > the policy is still empty. > > Here is my IdP config: > > unity.saml.requester.remoteIdp.marine.name=MarineID IdP > unity.saml.requester.remoteIdp.marine.address=https://idp.marine-id.org/idp/profile/SAML2/Redirect/SSO > unity.saml.requester.remoteIdp.marine.binding=HTTP_REDIRECT > unity.saml.requester.remoteIdp.marine.samlId=https://idp.marine-id.org/idp/shibboleth > unity.saml.requester.remoteIdp.marine.certificate=MARINEID > unity.saml.requester.remoteIdp.marine.translationProfile=tr-input-marineid > unity.saml.requester.remoteIdp.marine.registrationFormForUnknown=marineID Registration Form > unity.saml.requester.remoteIdp.marine.enableAccountAssociation=false > unity.saml.requester.remoteIdp.marine.logoURI.en=https://www.marine-id.org/img/logo-noBG.svg > unity.saml.requester.remoteIdp.marine.requestedNameFormat=urn:oasis:names:tc:SAML:2.0:nameid-format:persistent > > Do you see some error within? Nope, looks good to me. I just checked something similar and works well on my end. Are you sure that your authenticator was reloaded? I.e. maybe when you tried to test it the endpoint on which this authenticator is installed was not yet refreshed? The safest bet is to undeploy and then redeploy it. Cheers, Krzysztof |
|
From: Sander A. <sa....@fz...> - 2021-10-04 05:58:33
|
Dear Zoltan, you need to add the attribute "sys:AuthorizationRole" and select the value "SystemManager". If this attribute was set by an attribute statement, you can't change it but need to add it to the user. Best regards, Sander On Fri, 2021-10-01 at 19:48 +0200, Zoltan Bakcsa wrote: > > Dear Unity forum, > > I'm trying to make a user System Manager but could not figure it out. > Could someone point me to the relevant part in the documentation? > > Br, > Zoltan > > > _______________________________________________ > Unity-idm-discuss mailing list > Uni...@li... > https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Zoltan B. <ba...@aw...> - 2021-10-01 18:18:15
|
Dear Unity forum, I have a couple of microservice like software component which supposed to cooperate through their respective APIs. These APIs require authentication and authorization. Since we already have Unity running in our infrastructure for user authentication, we would also use it for the authorization of these software components. The plan is to use OAuth - Client credentials grant. Originally I wanted to create an OAuth endpoint where I could create a client for each software components that requires authorization. My problem is that it does not seem to be possible to assign Scopes to individual clients, only for the OAuth endpoint. Scopes set on the Endpoint level are assigned to all clients underneath. As a result, all clients will have the same set of scopes which is not what we want. Is it possible to assign scopes on a client level? If not, how should it work? Each client should have its own Identity Provider? Br, Zoltan |
|
From: Zoltan B. <ba...@aw...> - 2021-10-01 17:49:10
|
Dear Unity forum, I'm trying to make a user System Manager but could not figure it out. Could someone point me to the relevant part in the documentation? Br, Zoltan |
|
From: Krzysztof B. <kb...@un...> - 2021-10-01 13:28:18
|
Hi Sander, W dniu 01.10.2021 o 15:17, Sander Apweiler pisze: > Hi Krzysztof, > > is there a way to get the sys:ProjectManagementRole of a user in a > specific group within output translation profiles? And is this > information stored for subgroups as well? I saw in the web UI that an > account has manager privileges in a group (and subgroups because of the > inheritance) but this is not shown as attribute in the subgroup. > > We have a connected service which needs to know who is the manager of a > specific group. The ProjectManagementRole attribute is only defined in one place - in subgroups its presence is not needed to have authZ. So if you want to have this attribute available in some sub-group context you need to add an attribute statement in that sub-group, to copy the role attribute from the parnet group. Then it will be visible in output profile. HTH, Krzysztof |
|
From: Sander A. <sa....@fz...> - 2021-10-01 13:17:52
|
Hi Krzysztof, is there a way to get the sys:ProjectManagementRole of a user in a specific group within output translation profiles? And is this information stored for subgroups as well? I saw in the web UI that an account has manager privileges in a group (and subgroups because of the inheritance) but this is not shown as attribute in the subgroup. We have a connected service which needs to know who is the manager of a specific group. Best regards, Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Sander A. <sa....@fz...> - 2021-10-01 05:46:19
|
Good morning Krzysztof, On Thu, 2021-09-23 at 12:45 +0200, Krzysztof Benedyczak wrote: > Hi Sander, > > W dniu 23.09.2021 o 07:17, Sander Apweiler pisze: > > Good morning Krzysztof, > > good morning Roman, > > > > I have two short questions about SAML NameID and unity. In past > > weeks I > > got two user tickets because their login with 3rd party IdP failed. > > In > > both cases the log showed that the IdP did not use NameID format. > > Both > > IdP admins said they didn't change it or didn't send it in past. > > Became > > unity here more strikt between 3.3.4 and 3.5.1? > > Well, I don't recall anything clearly related, but it is bit hard to > say > without knowing bit wider context. > > Do I read this correctly that SAML answer contained NameID without > specifying the format attribute? - what in general means that the > format > is unspecified. > > Can you write which element had this nameID? Is it about > authenticated > entity? Or the IdP identifier? Unity log would be here also very > helpful, especially if it contains some error. I have to check when this happens the next time. > > > One IdP admin reported the NameIdPolicy in AuthRequest is empty, > > see > > screenshot. Is this intended? > > AFAIR this is configurable: unity authenticator has "accepted name > formats" config, and you can have it left empty what would allow any > format (and the NameIdPolicy you have pasted). Yes there is config about it and it was empty. But after setting this, the policy is still empty. Here is my IdP config: unity.saml.requester.remoteIdp.marine.name=MarineID IdP unity.saml.requester.remoteIdp.marine.address=https://idp.marine-id.org/idp/profile/SAML2/Redirect/SSO unity.saml.requester.remoteIdp.marine.binding=HTTP_REDIRECT unity.saml.requester.remoteIdp.marine.samlId=https://idp.marine-id.org/idp/shibboleth unity.saml.requester.remoteIdp.marine.certificate=MARINEID unity.saml.requester.remoteIdp.marine.translationProfile=tr-input-marineid unity.saml.requester.remoteIdp.marine.registrationFormForUnknown=marineID Registration Form unity.saml.requester.remoteIdp.marine.enableAccountAssociation=false unity.saml.requester.remoteIdp.marine.logoURI.en=https://www.marine-id.org/img/logo-noBG.svg unity.saml.requester.remoteIdp.marine.requestedNameFormat=urn:oasis:names:tc:SAML:2.0:nameid-format:persistent Do you see some error within? Cheers, Sander > > HTH, > Krzysztof > -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2021-09-29 12:28:46
|
Dear Subscribers,
I have a pleasure to announce a new, big Unity release: 3.6.0. The main
highlights are:
* *New remote authentication experience*: faster, less intrusive, more
stable with many more improvements.
* “Combo” invitations: dynamically recognize whether the invited user
already exists in Unity or needs to be added.
* Enhancements of registration and enquiry forms
* Enhancements of the REST API
* OTP with LDAP backend
See https://www.unity-idm.eu/downloads/ for more details.
Best regards,
Krzysztof
|
|
From: Krzysztof B. <kb...@un...> - 2021-09-23 10:47:20
|
Hi Sander, W dniu 21.09.2021 o 10:45, Sander Apweiler pisze: > Good morning Krzysztof, > > in the old admin endpoint it was possible to reload endpoints, if there > was a chance in configuration. In the console endpoint this is not > possible and we need to restart unity to load new configuration from > files. The endpoint reload was much faster than a restart of unity (2-3 > minutes when you use eduGAIN). Would it be possible to include the > reload function in console endpoint too? Yeah, we have dropped this feature as it become much harder in Unity 3. In Unity 2 endpoints could be loaded only with the file configuration, there was no UI. But it should be possible to have this functionality. We will discuss that after 3.6 is out and will let you know. Cheers, Krzysztof |
|
From: Krzysztof B. <kb...@un...> - 2021-09-23 10:45:32
|
Hi Sander, W dniu 23.09.2021 o 07:17, Sander Apweiler pisze: > Good morning Krzysztof, > good morning Roman, > > I have two short questions about SAML NameID and unity. In past weeks I > got two user tickets because their login with 3rd party IdP failed. In > both cases the log showed that the IdP did not use NameID format. Both > IdP admins said they didn't change it or didn't send it in past. Became > unity here more strikt between 3.3.4 and 3.5.1? Well, I don't recall anything clearly related, but it is bit hard to say without knowing bit wider context. Do I read this correctly that SAML answer contained NameID without specifying the format attribute? - what in general means that the format is unspecified. Can you write which element had this nameID? Is it about authenticated entity? Or the IdP identifier? Unity log would be here also very helpful, especially if it contains some error. > One IdP admin reported the NameIdPolicy in AuthRequest is empty, see > screenshot. Is this intended? AFAIR this is configurable: unity authenticator has "accepted name formats" config, and you can have it left empty what would allow any format (and the NameIdPolicy you have pasted). HTH, Krzysztof |
