unity-idm-discuss — Unity discussion and support

Re: [Unity-idm-discuss] Sending mail - NoSuchProviderException

[Krzysztof B. <kb...@un...>]

Hi,

W dniu 09.03.2020 o 14:50, D Baum pisze:
> Hi,
>
> I ran into issues with sending verification emails for newly registered
> users in unity 3.2.0 last week. The exception in the logs was
>
> javax.mail.NoSuchProviderException: No provider for address type rfc822
>
> which lead me to
>
> https://www.devsumo.com/technotes/2014/03/javamail-random-nosuchproviderexception-errors-sending-smtp-mail/
>
> I could resolve the problem by removing
> geronimo-javamail_1.4_mail-1.8.4.jar
> from the lib/ folder and restarting the server.
>
> Hope that helps someone in the future :-)

Thanks a lot!

Will be fixed in the next release, was dragged into distro as a 
transitive dependency.

Krzysztof

[Unity-idm-discuss] Sending mail - NoSuchProviderException

[D B. <ba...@aw...>]

Hi,

I ran into issues with sending verification emails for newly registered
users in unity 3.2.0 last week. The exception in the logs was

javax.mail.NoSuchProviderException: No provider for address type rfc822

which lead me to

https://www.devsumo.com/technotes/2014/03/javamail-random-nosuchproviderexception-errors-sending-smtp-mail/

I could resolve the problem by removing
geronimo-javamail_1.4_mail-1.8.4.jar
from the lib/ folder and restarting the server.

Hope that helps someone in the future :-)
D

[Unity-idm-discuss] Translation profile sys:saml

[D B. <ba...@aw...>]

Hi,

I'd like to define a saml (output) translation profile and understand
the handling of translation profiles better.

Where is sys:saml defined? I can't find the translation profile
definition screen in the console, only the example json files in the
samples folder. But there's not json file for sys:saml that I could find.

I assume json is now the preferred way of defining profiles? How can I
load them? Or, if defining profiles in the UI is still possible: where
is that located?

Cheers,
D

Re: [Unity-idm-discuss] Relative SAML SP metadata paths

[D B. <ba...@aw...>]

Hi,

if I remember correctly the 2.5 installation was rpm, the 3.2 is tar.gz
(now).

D

On 06/03/2020 09:32, Krzysztof Benedyczak wrote:
> Hi,
> 
> W dniu 05.03.2020 o 15:23, D Baum pisze:
>> Hi,
>>
>> I just ran into the fact that between version 2.5 and 3.2 the
>> acceptedSPMetadataSource.*.url setting changed behaviour when using
>> file:// urls. It now interprets these URLs relative to the unity
>> directory, so what was formerly
>> unity.saml.acceptedSPMetadataSource.sp.url=file:///etc/unity-idm/metadata.xml
>>
>> became
>> unity.saml.acceptedSPMetadataSource.sp.url=file:///metadata.xml
>>
>> Could you mention that in the docs in the description for
>> unity.saml.acceptedSPMetadataSource .*.url ?
>>
>> It's really not obvious from the error message in the logs:
>>
>> ERROR unity.server.URIAccessServiceImpl: Can not read uri:
> 
> Sure, we can improve docs.
> 
> One question: both versions of you installation were RPM? Or one was RPM
> and another tar.gz?
> 
> Best
> Krzysztof
> 

Re: [Unity-idm-discuss] Relative SAML SP metadata paths

[Krzysztof B. <kb...@un...>]

Hi,

W dniu 05.03.2020 o 15:23, D Baum pisze:
> Hi,
>
> I just ran into the fact that between version 2.5 and 3.2 the
> acceptedSPMetadataSource.*.url setting changed behaviour when using
> file:// urls. It now interprets these URLs relative to the unity
> directory, so what was formerly
> unity.saml.acceptedSPMetadataSource.sp.url=file:///etc/unity-idm/metadata.xml
> became
> unity.saml.acceptedSPMetadataSource.sp.url=file:///metadata.xml
>
> Could you mention that in the docs in the description for
> unity.saml.acceptedSPMetadataSource .*.url ?
>
> It's really not obvious from the error message in the logs:
>
> ERROR unity.server.URIAccessServiceImpl: Can not read uri:

Sure, we can improve docs.

One question: both versions of you installation were RPM? Or one was RPM 
and another tar.gz?

Best
Krzysztof

Re: [Unity-idm-discuss] IdP name from metadata for preselected authentication

[Krzysztof B. <kb...@un...>]

Hi Sander,

W dniu 05.03.2020 o 13:22, Sander Apweiler pisze:
> Hi Krzysztof,
> one of our SPs want to test the preselected authentication feature.
> Because we are using the IdP federation of our NREN all IdPs are
> fetched from metadata file and unity shows them as checksum, e.g.
> samlWeb._entryFromMetadata_00173b3ee19d3f5762f57d918a6eaa7a+1.
>
> Is there a way to identify which IdP this is? Maybe using the entityID
> of the IdPs might be more understandable by the users.

It is not that easy as this id is used in many places, including such 
like CSS, where using entityId would not be possible.

Although point taken. At least easier identification is need, and/or 
some alias support only in case of preselected idp. Will open a ticket.


Thanks,
KB

[Unity-idm-discuss] Relative SAML SP metadata paths

[D B. <ba...@aw...>]

Hi,

I just ran into the fact that between version 2.5 and 3.2 the
acceptedSPMetadataSource.*.url setting changed behaviour when using
file:// urls. It now interprets these URLs relative to the unity
directory, so what was formerly
unity.saml.acceptedSPMetadataSource.sp.url=file:///etc/unity-idm/metadata.xml
became
unity.saml.acceptedSPMetadataSource.sp.url=file:///metadata.xml

Could you mention that in the docs in the description for
unity.saml.acceptedSPMetadataSource .*.url ?

It's really not obvious from the error message in the logs:

ERROR unity.server.URIAccessServiceImpl: Can not read uri:
file:///etc/unity-idm/metadata.xml
pl.edu.icm.unity.exceptions.EngineException: Can not read file from uri:
file:///etc/unity-idm/metadata.xml
        at
pl.edu.icm.unity.engine.files.URIAccessServiceImpl.readUriInternal(URIAccessServiceImpl.java:148)
~[unity-server-engine-3.2.0.jar:?]
        at
pl.edu.icm.unity.engine.files.URIAccessServiceImpl.readURI(URIAccessServiceImpl.java:71)
~[unity-server-engine-3.2.0.jar:?]

Cheers,
D

[Unity-idm-discuss] IdP name from metadata for preselected authentication

[Sander A. <sa....@fz...>]

Hi Krzysztof,
one of our SPs want to test the preselected authentication feature.
Because we are using the IdP federation of our NREN all IdPs are
fetched from metadata file and unity shows them as checksum, e.g.
samlWeb._entryFromMetadata_00173b3ee19d3f5762f57d918a6eaa7a+1.

Is there a way to identify which IdP this is? Maybe using the entityID
of the IdPs might be more understandable by the users.

Best regards,
Sander
-- 
Federated Systems and Data
Juelich Supercomputing Centre

phone: +49 2461 61 8847
fax: +49 2461 61 6656
email: sa....@fz...

----------------------------------------------------------------------
-----------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich
Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Volker Rieke
Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender),
Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt,
Prof. Dr. Sebastian M. Schmidt
-----------------------------------------------------------------------
-----------------------------------------------------------------------

Re: [Unity-idm-discuss] The mysterious case of the missing stylesheet

[D B. <ba...@aw...>]

Hi!

On 28/02/2020 10:26, Roman Krysiński wrote:
> It is very likely that not all of the directories' permissions are
> sufficient. Please run the following command:
> 
> sudo find /var/lib/unity-idm -type d -exec chmod u+x {} \;

Ahh, I didn't pay attention to the directories! Yes, that helps, thanks!

The directories get installed like that by the rpm (see attached), I
guess that's another thing that should be fixed when you touch the rpm.

I'm going to finally heed Krzysztof's advice and install from tar.gz for
now.

Thanks!
D


> czw., 27 lut 2020 o 22:11 D Baum <ba...@aw... <mailto:ba...@aw...>>
> napisał(a):
> 
>     Hi,
> 
>     sure, output is attached. From that output, I can't guess what I'd need
>     to change to fix it.
> 
>     Best
>     D
> 
>     On 27/02/2020 18:59, Roman Krysiński wrote:
>     > Hi,
>     >
>     > Could you double check the permission and ownership of files in
>     > unity-idm installation dir.
>     > In particular, it would be interesting to see output from the
>     following
>     > command: 
>     > find /var/lib/unity-idm -printf "%M %g %u %p\n"
>     >
>     > Best,
>     > Roman
>     >
>     >
>     >
>     > czw., 27 lut 2020 o 18:07 D Baum <ba...@aw...
>     <mailto:ba...@aw...> <mailto:ba...@aw... <mailto:ba...@aw...>>>
>     > napisał(a):
>     >
>     >     Hi!
>     >
>     >     I'm experiencing some weirdness with the admin console
>     stylesheet(s):
>     >     when running unity as user unity-idm, my browser says it's not
>     found
>     >     (404). When running unity as root, it's loaded perfectly fine.
>     >
>     >     The stylesheet in question is:
>     >   
>      https://my-unity:2443/console/VAADIN/themes/sidebarThemeValo/styles.css?v=8.9.2
>     >
>     >     which is present on the system and belongs to the unity user:
>     >     408 -rw-r--r--. 1 unity-idm unity-idm 413760 Feb 27 16:12
>     >   
>      /var/lib/unity-idm/webContents/VAADIN/themes/sidebarThemeValo/styles.css
>     >
>     >     If I start the unity server (as root) with
>     >     unity-idm-server-start
>     >     the stylesheet loads just fine.
>     >
>     >     If I start unity with the service script included in the rpm
>     like this
>     >     systemctl start unity-idm
>     >     unity runs as user unity-idm but doesn't find the stylesheet.
>     >
>     >     Strangely, it finds the favicon located in the same folder without
>     >     issues.
>     >
>     >
>     >     I've already compiled the stylesheets after receiving a warning in
>     >     unity-startup.log:
>     >     INFO: Request for /VAADIN/themes/unityThemeValo/styles.css not
>     handled
>     >     by sass compiler while in production mode
>     >
>     >     with
>     >
>     >     for DIR in /var/lib/unity-idm/webContents/VAADIN/themes/*; do
>     echo $DIR;
>     >     unity-idm-scss-compile $DIR; done
>     >
>     >     Now the warning is gone but the stylesheet still doesn't display.
>     >
>     >     Do you have hints for resolving this?
>     >
>     >     Cheers,
>     >     D
>     >
>     >
>     >
>     >     _______________________________________________
>     >     Unity-idm-discuss mailing list
>     >     Uni...@li...
>     <mailto:Uni...@li...>
>     >     <mailto:Uni...@li...
>     <mailto:Uni...@li...>>
>     >     https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss
>     >
>     >
>     >
>     > --
>     > --
>     > Pozdrawiam,
>     > Roman Krysinski
>     _______________________________________________
>     Unity-idm-discuss mailing list
>     Uni...@li...
>     <mailto:Uni...@li...>
>     https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss
> 

Re: [Unity-idm-discuss] Recommended server resources

[D B. <ba...@aw...>]

Hi!

On 27/02/2020 22:27, Krzysztof Benedyczak wrote:
>> Creating an empty file /etc/unity-idm/samples/empty solves the problem -
>> so I'm guessing the rpm is missing this file and it should be included.
> 
> Yeah, we don't ship samples in RPM, perhaps should be changed, as in
> default config we in few places use this empty file from samples.

At the risk of being philosophical: an empty file isn't much of an
example, so you could also move the empty file to somewhere else
(modules?) if you wanted to keep the samples folder out of the rpm. ;-)

>> I'm also getting a warning about reflective access, which I'm going to
>> ignore for now
>>
>> WARNING: An illegal reflective access operation has occurred
>> WARNING: Illegal reflective access by
>> org.codehaus.groovy.vmplugin.v7.Java7$1
>> (file:/usr/share/unity-idm/lib/groovy-2.5.6.jar) to constructor
>> java.lang.invoke.MethodHandles$Lookup(java.lang.Class,int)
>> WARNING: Please consider reporting this to the maintainers of
>> org.codehaus.groovy.vmplugin.v7.Java7$1
>> WARNING: Use --illegal-access=warn to enable warnings of further illegal
>> reflective access operations
>> WARNING: All illegal access operations will be denied in a future release
> 
> That's known issue on Java 9+ with groovy - sorry we can't do anything
> about it, besides crossing fingers that groovy guys fix it at some point.
> 
> With Java 11 at least that's harmless.

Thanks, that's good to know!

D

Re: [Unity-idm-discuss] The mysterious case of the missing stylesheet

[Roman K. <ro...@un...>]

Hi D,

It is very likely that not all of the directories' permissions are
sufficient. Please run the following command:

sudo find /var/lib/unity-idm -type d -exec chmod u+x {} \;

Let us know if this helps.

Best,
Roman

czw., 27 lut 2020 o 22:11 D Baum <ba...@aw...> napisał(a):

> Hi,
>
> sure, output is attached. From that output, I can't guess what I'd need
> to change to fix it.
>
> Best
> D
>
> On 27/02/2020 18:59, Roman Krysiński wrote:
> > Hi,
> >
> > Could you double check the permission and ownership of files in
> > unity-idm installation dir.
> > In particular, it would be interesting to see output from the following
> > command:
> > find /var/lib/unity-idm -printf "%M %g %u %p\n"
> >
> > Best,
> > Roman
> >
> >
> >
> > czw., 27 lut 2020 o 18:07 D Baum <ba...@aw... <mailto:ba...@aw...>>
> > napisał(a):
> >
> >     Hi!
> >
> >     I'm experiencing some weirdness with the admin console stylesheet(s):
> >     when running unity as user unity-idm, my browser says it's not found
> >     (404). When running unity as root, it's loaded perfectly fine.
> >
> >     The stylesheet in question is:
> >
> https://my-unity:2443/console/VAADIN/themes/sidebarThemeValo/styles.css?v=8.9.2
> >
> >     which is present on the system and belongs to the unity user:
> >     408 -rw-r--r--. 1 unity-idm unity-idm 413760 Feb 27 16:12
> >
>  /var/lib/unity-idm/webContents/VAADIN/themes/sidebarThemeValo/styles.css
> >
> >     If I start the unity server (as root) with
> >     unity-idm-server-start
> >     the stylesheet loads just fine.
> >
> >     If I start unity with the service script included in the rpm like
> this
> >     systemctl start unity-idm
> >     unity runs as user unity-idm but doesn't find the stylesheet.
> >
> >     Strangely, it finds the favicon located in the same folder without
> >     issues.
> >
> >
> >     I've already compiled the stylesheets after receiving a warning in
> >     unity-startup.log:
> >     INFO: Request for /VAADIN/themes/unityThemeValo/styles.css not
> handled
> >     by sass compiler while in production mode
> >
> >     with
> >
> >     for DIR in /var/lib/unity-idm/webContents/VAADIN/themes/*; do echo
> $DIR;
> >     unity-idm-scss-compile $DIR; done
> >
> >     Now the warning is gone but the stylesheet still doesn't display.
> >
> >     Do you have hints for resolving this?
> >
> >     Cheers,
> >     D
> >
> >
> >
> >     _______________________________________________
> >     Unity-idm-discuss mailing list
> >     Uni...@li...
> >     <mailto:Uni...@li...>
> >     https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss
> >
> >
> >
> > --
> > --
> > Pozdrawiam,
> > Roman Krysinski
> _______________________________________________
> Unity-idm-discuss mailing list
> Uni...@li...
> https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss
>

Re: [Unity-idm-discuss] Recommended server resources

[Krzysztof B. <kb...@un...>]

Hi,

W dniu 26.02.2020 o 16:52, D Baum pisze:
> Hi!
>
> OK, if *you* don't know the dependency then it can't be that important
> for unity. ;-)
>
> I can install with
> rpm -ihv --force --nodeps unity-idm-3.2.0-1.noarch.rpm
>
> On first startup, I get an exception in the logs:
>
> eu.unicore.util.configuration.ConfigurationException: The value of
> unityServer.core.credentials.1.credentialConfigurationFile (Credential
> configuration file)= '/etc/unity-idm/samples/empty', must represent an
> EXISTING and READABLE filesystem path.
>
> Creating an empty file /etc/unity-idm/samples/empty solves the problem -
> so I'm guessing the rpm is missing this file and it should be included.

Yeah, we don't ship samples in RPM, perhaps should be changed, as in 
default config we in few places use this empty file from samples.


> I'm also getting a warning about reflective access, which I'm going to
> ignore for now
>
> WARNING: An illegal reflective access operation has occurred
> WARNING: Illegal reflective access by
> org.codehaus.groovy.vmplugin.v7.Java7$1
> (file:/usr/share/unity-idm/lib/groovy-2.5.6.jar) to constructor
> java.lang.invoke.MethodHandles$Lookup(java.lang.Class,int)
> WARNING: Please consider reporting this to the maintainers of
> org.codehaus.groovy.vmplugin.v7.Java7$1
> WARNING: Use --illegal-access=warn to enable warnings of further illegal
> reflective access operations
> WARNING: All illegal access operations will be denied in a future release

That's known issue on Java 9+ with groovy - sorry we can't do anything 
about it, besides crossing fingers that groovy guys fix it at some point.

With Java 11 at least that's harmless.

Cheers,
KB

Re: [Unity-idm-discuss] The mysterious case of the missing stylesheet

[D B. <ba...@aw...>]

Hi,

sure, output is attached. From that output, I can't guess what I'd need
to change to fix it.

Best
D

On 27/02/2020 18:59, Roman Krysiński wrote:
> Hi,
> 
> Could you double check the permission and ownership of files in
> unity-idm installation dir.
> In particular, it would be interesting to see output from the following
> command: 
> find /var/lib/unity-idm -printf "%M %g %u %p\n"
> 
> Best,
> Roman
> 
> 
> 
> czw., 27 lut 2020 o 18:07 D Baum <ba...@aw... <mailto:ba...@aw...>>
> napisał(a):
> 
>     Hi!
> 
>     I'm experiencing some weirdness with the admin console stylesheet(s):
>     when running unity as user unity-idm, my browser says it's not found
>     (404). When running unity as root, it's loaded perfectly fine.
> 
>     The stylesheet in question is:
>     https://my-unity:2443/console/VAADIN/themes/sidebarThemeValo/styles.css?v=8.9.2
> 
>     which is present on the system and belongs to the unity user:
>     408 -rw-r--r--. 1 unity-idm unity-idm 413760 Feb 27 16:12
>     /var/lib/unity-idm/webContents/VAADIN/themes/sidebarThemeValo/styles.css
> 
>     If I start the unity server (as root) with
>     unity-idm-server-start
>     the stylesheet loads just fine.
> 
>     If I start unity with the service script included in the rpm like this
>     systemctl start unity-idm
>     unity runs as user unity-idm but doesn't find the stylesheet.
> 
>     Strangely, it finds the favicon located in the same folder without
>     issues.
> 
> 
>     I've already compiled the stylesheets after receiving a warning in
>     unity-startup.log:
>     INFO: Request for /VAADIN/themes/unityThemeValo/styles.css not handled
>     by sass compiler while in production mode
> 
>     with
> 
>     for DIR in /var/lib/unity-idm/webContents/VAADIN/themes/*; do echo $DIR;
>     unity-idm-scss-compile $DIR; done
> 
>     Now the warning is gone but the stylesheet still doesn't display.
> 
>     Do you have hints for resolving this?
> 
>     Cheers,
>     D
> 
> 
> 
>     _______________________________________________
>     Unity-idm-discuss mailing list
>     Uni...@li...
>     <mailto:Uni...@li...>
>     https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss
> 
> 
> 
> -- 
> --
> Pozdrawiam,
> Roman Krysinski

[Unity-idm-discuss] The mysterious case of the missing stylesheet

[D B. <ba...@aw...>]

Hi!

I'm experiencing some weirdness with the admin console stylesheet(s):
when running unity as user unity-idm, my browser says it's not found
(404). When running unity as root, it's loaded perfectly fine.

The stylesheet in question is:
https://my-unity:2443/console/VAADIN/themes/sidebarThemeValo/styles.css?v=8.9.2

which is present on the system and belongs to the unity user:
408 -rw-r--r--. 1 unity-idm unity-idm 413760 Feb 27 16:12
/var/lib/unity-idm/webContents/VAADIN/themes/sidebarThemeValo/styles.css

If I start the unity server (as root) with
unity-idm-server-start
the stylesheet loads just fine.

If I start unity with the service script included in the rpm like this
systemctl start unity-idm
unity runs as user unity-idm but doesn't find the stylesheet.

Strangely, it finds the favicon located in the same folder without issues.


I've already compiled the stylesheets after receiving a warning in
unity-startup.log:
INFO: Request for /VAADIN/themes/unityThemeValo/styles.css not handled
by sass compiler while in production mode

with

for DIR in /var/lib/unity-idm/webContents/VAADIN/themes/*; do echo $DIR;
unity-idm-scss-compile $DIR; done

Now the warning is gone but the stylesheet still doesn't display.

Do you have hints for resolving this?

Cheers,
D

Re: [Unity-idm-discuss] Recommended server resources

[D B. <ba...@aw...>]

Hi!

OK, if *you* don't know the dependency then it can't be that important
for unity. ;-)

I can install with
rpm -ihv --force --nodeps unity-idm-3.2.0-1.noarch.rpm

On first startup, I get an exception in the logs:

eu.unicore.util.configuration.ConfigurationException: The value of
unityServer.core.credentials.1.credentialConfigurationFile (Credential
configuration file)= '/etc/unity-idm/samples/empty', must represent an
EXISTING and READABLE filesystem path.

Creating an empty file /etc/unity-idm/samples/empty solves the problem -
so I'm guessing the rpm is missing this file and it should be included.

I'm also getting a warning about reflective access, which I'm going to
ignore for now

WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by
org.codehaus.groovy.vmplugin.v7.Java7$1
(file:/usr/share/unity-idm/lib/groovy-2.5.6.jar) to constructor
java.lang.invoke.MethodHandles$Lookup(java.lang.Class,int)
WARNING: Please consider reporting this to the maintainers of
org.codehaus.groovy.vmplugin.v7.Java7$1
WARNING: Use --illegal-access=warn to enable warnings of further illegal
reflective access operations
WARNING: All illegal access operations will be denied in a future release

D

On 26/02/2020 15:46, Krzysztof Benedyczak wrote:
> Hi,
> 
> W dniu 26.02.2020 o 15:38, D Baum pisze:
>> Hi!
>>
>> thanks! I've now picked 4 GB RAM, 2 cores and 40 GB of disk space on a
>> CentOS 8 instance with
>> java-11-openjdk-headless-11.0.5.10-2.el8_1.x86_64.
>> But installing the rpm throws an error:
>>
>> dnf install unity-idm-3.2.0-1.noarch.rpm
>> Last metadata expiration check: 0:33:00 ago on Wed 26 Feb 2020
>> 13:52:54 UTC.
>> Error:
>>   Problem: conflicting requests
>>    - nothing provides osgi(org.glassfish.hk2.hk2) needed by
>> unity-idm-3.2.0-1.noarch
>> (try to add '--skip-broken' to skip uninstallable packages or '--nobest'
>> to use not only best candidate packages)
>>
>> But the manual promises me that I need nothing but java11! ;-)
>>
> I'll check it (no idea what's that dependency), but anyway I'd suggest
> using tar.gz bundle. It is nicer for performing safe upgrades.
> 
> Best,
> KB
> 

Re: [Unity-idm-discuss] Recommended server resources

[Krzysztof B. <kb...@un...>]

Hi,

W dniu 26.02.2020 o 15:38, D Baum pisze:
> Hi!
>
> thanks! I've now picked 4 GB RAM, 2 cores and 40 GB of disk space on a
> CentOS 8 instance with
> java-11-openjdk-headless-11.0.5.10-2.el8_1.x86_64.
> But installing the rpm throws an error:
>
> dnf install unity-idm-3.2.0-1.noarch.rpm
> Last metadata expiration check: 0:33:00 ago on Wed 26 Feb 2020 13:52:54 UTC.
> Error:
>   Problem: conflicting requests
>    - nothing provides osgi(org.glassfish.hk2.hk2) needed by
> unity-idm-3.2.0-1.noarch
> (try to add '--skip-broken' to skip uninstallable packages or '--nobest'
> to use not only best candidate packages)
>
> But the manual promises me that I need nothing but java11! ;-)
>
I'll check it (no idea what's that dependency), but anyway I'd suggest 
using tar.gz bundle. It is nicer for performing safe upgrades.

Best,
KB

Re: [Unity-idm-discuss] Recommended server resources

[D B. <ba...@aw...>]

Hi!

thanks! I've now picked 4 GB RAM, 2 cores and 40 GB of disk space on a
CentOS 8 instance with
java-11-openjdk-headless-11.0.5.10-2.el8_1.x86_64.
But installing the rpm throws an error:

dnf install unity-idm-3.2.0-1.noarch.rpm
Last metadata expiration check: 0:33:00 ago on Wed 26 Feb 2020 13:52:54 UTC.
Error:
 Problem: conflicting requests
  - nothing provides osgi(org.glassfish.hk2.hk2) needed by
unity-idm-3.2.0-1.noarch
(try to add '--skip-broken' to skip uninstallable packages or '--nobest'
to use not only best candidate packages)

But the manual promises me that I need nothing but java11! ;-)

Cheers,
D

On 25/02/2020 19:21, Krzysztof Benedyczak wrote:
> Hi,
> 
> W dniu 25.02.2020 o 14:10, Sander Apweiler pisze:
>> Hi,
>> it's not an official recommendation, but we are using a VM with 2
>> Cores, 4GB RAM and 40GB Disk and CentOS as OS. This is working quite
>> good for us.
>>
>> Best regards,
>> Sander
>>
>> On Tue, 2020-02-25 at 13:18 +0100, D Baum wrote:
>>> Hi,
>>>
>>> I'm tasked with setting up a Unity IDM instance for productive use in
>>> a
>>> scientific environment with expected number of users in the hundreds
>>> (not very clear atm, might be more or less).
>>>
>>> What are the recommended resources for a virtual machine hosting
>>> Unity
>>> in this usecase, i.e. disksize, RAM, number of processors?
> 
> I can second Sander's recommendations. Disk size use depends on logs
> mostly, the rest is rather fixed well beyond 1GB. CPU - 2-4 will be OK.
> 
> Mem is a longer story. 2GB VM minimum, 4GB recommended, you can use up
> to 8GB VM, above it makes rather no sense.
> 
> With RAM the main user are passwords processors (i.e. checking or
> setting up a password). But you can fine tune the settings, and recent
> versions of Unity manage memory wrt this quite well. In short - the more
> memory you have, the more secure password storage settings you can have.
> Also note that users count doesn't matter, number of concurrently active
> users (e.g. logins, sessions, logouts, admins, ...) matter.
> 
> Below 1GB per unity (note OS use!) it slowly starts to be harder to make
> it working, requires config tweaking.
> 
> HTH,
> Krzysztof
> 
> 

Re: [Unity-idm-discuss] SAML consent screen does not show name and logo

[Krzysztof B. <kb...@un...>]

Hi Sander,

W dniu 25.02.2020 o 08:41, Sander Apweiler pisze:
> Hi Krzysztof, all,
>
> within unity 2.8.2. the consent screen for releasing attributes to a
> SAML SP does not show the name and logo of the SP (see attached
> screenshot). The name and logo was configured for this SP:
>
> unity.saml.acceptedSP.2.name=B2DROP
> unity.saml.acceptedSP.2.logoURI=https://b2drop.eudat.eu/themes/b2drop/core/img/logo.png
> unity.saml.acceptedSP.2.entity=https://b2drop.eudat.eu/apps/user_saml/saml/metadata
> unity.saml.acceptedSP.2.returnURL=https://b2drop.eudat.eu/apps/user_saml/saml/acs
> unity.saml.acceptedSP.2.redirectLogoutEndpoint=https://b2drop.eudat.eu/apps/user_saml/saml/sls
>
> Must the config parameters in a specific sequence? The issue appears
> after reload of SAML web IdP endpoint and restart of the whole unity.

That is a bug in 2.8 (and I guess also earlier versions), which was 
fixed when moving to 3.

HTH
KB

Re: [Unity-idm-discuss] Recommended server resources

[Krzysztof B. <kb...@un...>]

Hi,

W dniu 25.02.2020 o 14:10, Sander Apweiler pisze:
> Hi,
> it's not an official recommendation, but we are using a VM with 2
> Cores, 4GB RAM and 40GB Disk and CentOS as OS. This is working quite
> good for us.
>
> Best regards,
> Sander
>
> On Tue, 2020-02-25 at 13:18 +0100, D Baum wrote:
>> Hi,
>>
>> I'm tasked with setting up a Unity IDM instance for productive use in
>> a
>> scientific environment with expected number of users in the hundreds
>> (not very clear atm, might be more or less).
>>
>> What are the recommended resources for a virtual machine hosting
>> Unity
>> in this usecase, i.e. disksize, RAM, number of processors?

I can second Sander's recommendations. Disk size use depends on logs 
mostly, the rest is rather fixed well beyond 1GB. CPU - 2-4 will be OK.

Mem is a longer story. 2GB VM minimum, 4GB recommended, you can use up 
to 8GB VM, above it makes rather no sense.

With RAM the main user are passwords processors (i.e. checking or 
setting up a password). But you can fine tune the settings, and recent 
versions of Unity manage memory wrt this quite well. In short - the more 
memory you have, the more secure password storage settings you can have. 
Also note that users count doesn't matter, number of concurrently active 
users (e.g. logins, sessions, logouts, admins, ...) matter.

Below 1GB per unity (note OS use!) it slowly starts to be harder to make 
it working, requires config tweaking.

HTH,
Krzysztof

Re: [Unity-idm-discuss] Recommended server resources

[Sander A. <sa....@fz...>]

Hi,
it's not an official recommendation, but we are using a VM with 2
Cores, 4GB RAM and 40GB Disk and CentOS as OS. This is working quite
good for us.

Best regards,
Sander

On Tue, 2020-02-25 at 13:18 +0100, D Baum wrote:
> Hi,
> 
> I'm tasked with setting up a Unity IDM instance for productive use in
> a
> scientific environment with expected number of users in the hundreds
> (not very clear atm, might be more or less).
> 
> What are the recommended resources for a virtual machine hosting
> Unity
> in this usecase, i.e. disksize, RAM, number of processors?
> 
> Cheers,
> D
> 
> 
> _______________________________________________
> Unity-idm-discuss mailing list
> Uni...@li...
> https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss
-- 
Federated Systems and Data
Juelich Supercomputing Centre

phone: +49 2461 61 8847
fax: +49 2461 61 6656
email: sa....@fz...

----------------------------------------------------------------------
-----------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich
Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Volker Rieke
Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender),
Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt,
Prof. Dr. Sebastian M. Schmidt
-----------------------------------------------------------------------
-----------------------------------------------------------------------

[Unity-idm-discuss] Recommended server resources

[D B. <ba...@aw...>]

Hi,

I'm tasked with setting up a Unity IDM instance for productive use in a
scientific environment with expected number of users in the hundreds
(not very clear atm, might be more or less).

What are the recommended resources for a virtual machine hosting Unity
in this usecase, i.e. disksize, RAM, number of processors?

Cheers,
D

[Unity-idm-discuss] SAML consent screen does not show name and logo

[Sander A. <sa....@fz...>]

Hi Krzysztof, all,

within unity 2.8.2. the consent screen for releasing attributes to a
SAML SP does not show the name and logo of the SP (see attached
screenshot). The name and logo was configured for this SP:

unity.saml.acceptedSP.2.name=B2DROP
unity.saml.acceptedSP.2.logoURI=https://b2drop.eudat.eu/themes/b2drop/core/img/logo.png
unity.saml.acceptedSP.2.entity=https://b2drop.eudat.eu/apps/user_saml/saml/metadata
unity.saml.acceptedSP.2.returnURL=https://b2drop.eudat.eu/apps/user_saml/saml/acs
unity.saml.acceptedSP.2.redirectLogoutEndpoint=https://b2drop.eudat.eu/apps/user_saml/saml/sls

Must the config parameters in a specific sequence? The issue appears
after reload of SAML web IdP endpoint and restart of the whole unity.

Cheers,
Sander
-- 
Federated Systems and Data
Juelich Supercomputing Centre

phone: +49 2461 61 8847
fax: +49 2461 61 6656
email: sa....@fz...

----------------------------------------------------------------------
-----------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich
Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Volker Rieke
Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender),
Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt,
Prof. Dr. Sebastian M. Schmidt
-----------------------------------------------------------------------
-----------------------------------------------------------------------

[Unity-idm-discuss] Unity 3.2.0 released.

[Roman K. <ro...@un...>]

Dear Subscribers,

New 3.2.0 release was published, with the following main features:

* Refreshed, intuitive entity creation dialog.
* New attribute syntax, allowing for exposing a public link to a picture
stored as attribute value.
* Support for OAuth JWT Access Token.
* New attribute type option - Global attributes - makes an attribute
visible in all groups. A more convenient and faster alternative for
attribute statements coping shared attributes from the root group.
* Flexible mechanism of pre-filling selected fields of registration form
from URL query parameters.
* Automatic remote sign-up, a similar feature to automatic remote sign-in
that was previously available.

Please take a look at the Downloads <https://www.unity-idm.eu/downloads/> for
a complete list of changes.

Best regards,
Roman

Re: [Unity-idm-discuss] prohibiting login in home endpoint with oauth client credentials

[Sander A. <sa....@fz...>]

Hi Krzysztof,

We want to have some client account, which can't change any stored
data, like password or return URL because we plan to publish this data
that users can use it for their OIDC client. But other OAuth clients
should still be able to change the password or return URLs. I know this
is difficult because we want to handle one account type in two
different ways.

My simple thought was to prohibit the login because normally the
attributes are changed their. I did not had an eye on changes across
the REST API.

Your suggestion with the ro-regular user sounds good.

Best regards,
Sander

On Wed, 2020-02-19 at 08:17 +0100, Krzysztof Benedyczak wrote:
> Hi Sander,
> 
> W dniu 18.02.2020 o 12:07, Sander Apweiler pisze:
> > Hi Krzysztof,
> > we plan to create some public OAauth client which can be used for
> > OIDC
> > agents. We do not want to have changes in the credential or return
> > URL
> > by users of this client and prohibit the login in userhome. We
> > tested
> > it with status login disabled but we got the following error:
> > 
> > '{"message":"Invalid user name, credential or external
> > authentication
> > failed. ","error":"AuthenticationException"}'
> > 
> > With enabled status the client is working.
> > 
> > Do you have some idea or hint how we could reach our target?
> 
> Yeah, login can't be disabled for oauth client entity, as this
> client 
> does log into unity in the oauth process (unless you use implicit
> grant 
> only).
> 
> I don't think I have a good solution at hand. The situation is that 
> blocking of homeUI access for certain users can be easily implemented
> in 
> various ways. But the real problem is authZ of operations - you can 
> change attribute using REST if you are permitted, homeUI is not
> needed.
> 
> Now, I guess that in your case the big picture is that you want a 
> mixture: you have on the same system clients for which you do want
> to 
> allow for changing the returnURL attribute and client(s) for whom
> this 
> should be blocked? So far this can be only controlled globally in
> Unity 
> - attribute type can be set to modifiable by owner or not. What's
> more 
> blocking password change by entity holding it is not supported.
> 
> Implementation wise we have couple of options. I think the simplest
> is 
> to add a new authZ role: limited(RO)-user. I.e. same rights as
> regular 
> user, but with all writes prohibited. This would cover all except
> authZ 
> of HomeUI access, which would need to be covered separately, but
> also 
> would be of minimal priority: ro-regular-user would be able to log
> into 
> homeUI, but would not be able to change anything. How does it sound?
> 
> Best,
> Krzysztof
> 
> 
> 
-- 
Federated Systems and Data
Juelich Supercomputing Centre

phone: +49 2461 61 8847
fax: +49 2461 61 6656
email: sa....@fz...

----------------------------------------------------------------------
-----------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich
Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Volker Rieke
Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender),
Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt,
Prof. Dr. Sebastian M. Schmidt
-----------------------------------------------------------------------
-----------------------------------------------------------------------

Re: [Unity-idm-discuss] prohibiting login in home endpoint with oauth client credentials

[Krzysztof B. <kb...@un...>]

Hi Sander,

W dniu 18.02.2020 o 12:07, Sander Apweiler pisze:
> Hi Krzysztof,
> we plan to create some public OAauth client which can be used for OIDC
> agents. We do not want to have changes in the credential or return URL
> by users of this client and prohibit the login in userhome. We tested
> it with status login disabled but we got the following error:
>
> '{"message":"Invalid user name, credential or external authentication
> failed. ","error":"AuthenticationException"}'
>
> With enabled status the client is working.
>
> Do you have some idea or hint how we could reach our target?

Yeah, login can't be disabled for oauth client entity, as this client 
does log into unity in the oauth process (unless you use implicit grant 
only).

I don't think I have a good solution at hand. The situation is that 
blocking of homeUI access for certain users can be easily implemented in 
various ways. But the real problem is authZ of operations - you can 
change attribute using REST if you are permitted, homeUI is not needed.

Now, I guess that in your case the big picture is that you want a 
mixture: you have on the same system clients for which you do want to 
allow for changing the returnURL attribute and client(s) for whom this 
should be blocked? So far this can be only controlled globally in Unity 
- attribute type can be set to modifiable by owner or not. What's more 
blocking password change by entity holding it is not supported.

Implementation wise we have couple of options. I think the simplest is 
to add a new authZ role: limited(RO)-user. I.e. same rights as regular 
user, but with all writes prohibited. This would cover all except authZ 
of HomeUI access, which would need to be covered separately, but also 
would be of minimal priority: ro-regular-user would be able to log into 
homeUI, but would not be able to change anything. How does it sound?

Best,
Krzysztof