unity-idm-discuss — Unity discussion and support

[Unity-idm-discuss] Cannot disable TLS_RSA_WITH_3DES_EDE_CBC_SHA cipher suite

[Shiraz M. <a....@fz...>]

Hi Krzysztof,

Unity v1.9.6 (probably underlying jetty) cannot disable the TLS_RSA_WITH_3DES_EDE_CBC_SHA cipher suite despite of being declared inside the unityServer.conf, see below, the conf snippet and the ssl test screenshot:

unityServer.core.httpServer.disabledCipherSuites=TLS_ECDHE_RSA_WITH_RC4_128_SHA SSL_RSA_WITH_RC4_128_MD5 SSL_RSA_WITH_RC4_128_SHA TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 TLS_DHE_RSA_
WITH_AES_128_CBC_SHA256 TLS_DHE_RSA_WITH_AES_128_CBC_SHA SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA TLS_DHE_RSA_WITH_AES_256_CBC_SHA TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 TLS_DHE_RSA_WITH_A
ES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA

[Inline image 1]

Our network dept. is also complaining about this too. Can you guide me how to disable the given cipher?

Thanks,
Shiraz
--
Shiraz Memon
Federated Systems and Data
Jülich Supercomputing Centre (JSC)

Phone: +49 2461 61 6899
Fax:     +49 2461 61 6656


------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich
Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Dr. Karl Eugen Huthmacher
Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender),
Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt,
Prof. Dr. Sebastian M. Schmidt
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------

Re: [Unity-idm-discuss] limit number of log files

[Sander A. <sa....@fz...>]

Hi Krzysztof,


Am Dienstag, den 30.05.2017, 08:55 +0200 schrieb Krzysztof Benedyczak:
> Hi Sander,
> 
> W dniu 29.05.2017 o 12:26, Sander Apweiler pisze:
> > Hi Krzysztof,
> > 
> > I want to limit the number of logiles. I know there is an option
> > log4j.appender.NAME.MaxBackupIndex for RollingFileAppender. I
> > tested
> > with log4j.appender.LOGFILE.MaxBackupIndex=30 but it didn't work.
> > Is
> > the another option to limit the number of logfiles?
> 
> Another option is cron ;-)
Sure cron would be an option.
> 
> Regarding MaxBackupIndex - what appender do you use precisely? 
> org.apache.log4j.RollingFileAppender or
> org.apache.log4j.rolling.RollingFileAppender?
> 
>  From what I recall (but used it looong ago) MaxBakupIndex was only 
> working on the first one. 2nd is from log4j-extras (also included in
> Unity).

I use the second one. Now I know why it did not work.

Thanks for your answer,
Sander
> 
> HTH,
> Krzysztof
> 
> 
-- 
Federated Systems and Data
Juelich Supercomputing Centre

phone: +49 2461 61 8847
fax: +49 2461 61 6656
email: sa....@fz...

-----------------------------------------------------------------------
-----------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich
Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Dr. Karl Eugen Huthmacher
Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender),
Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt,
Prof. Dr. Sebastian M. Schmidt
-----------------------------------------------------------------------
-----------------------------------------------------------------------

Re: [Unity-idm-discuss] Eudat SAML - Federated authentication

[Krzysztof B. <kb...@un...>]

Hi Goncalo,

W dniu 31.05.2017 o 07:26, Sander Apweiler pisze:
> Hi Goncalo,
>
> We configured eduGain with an Metadata URL. We got the Metadata URL from
> our NREN where we requested the eduGain membership as SP. Our
> configuration in remoteSamlAuth.properties looks like this:
>
> unity.saml.requester.metadataSource.edugain.url=METADATAURL
> unity.saml.requester.metadataSource.edugain.perMetadataTranslationProfile=YOUR_TRANSLATION_PROFILE
> unity.saml.requester.metadataSource.edugain.signaturVerification=require
> unity.saml.requester.metadataSource.edugain.signatureVerificationCertificate=YOUR_CERT_FROM_PKI_PROPERTIES
> unity.saml.requester.metadataSource.edugain.perMetadataRegistrationForm=YOUR_REGISTRATION_FORM
>

A small supplement to what Sander wrote:
-) regarding endpoint: at first you can add the saml authenticator to 
any of internal Unity endpoints, so its access will be protected by 
federated login. So you can test the Unity->eduGAIN part alone and the 
above example config covers this aprt.

After you have this done, you can work on configuring your own SP(s) to 
authenticate using Unity. Then you will need an edpoint or endpoints in 
Unity to enable remote authN SP->Unity. Here you won't be forced to use 
SAML, you can also use OAuth.

-) translation profile configures your mapping of data coming from 
edugain IdPs to your desired format (you can filter, modify values, 
names of attributes etc). Typically this is the most difficult part of 
configuration and most often changed.

Best,
Krzysztof

Re: [Unity-idm-discuss] Eudat SAML - Federated authentication

[Sander A. <sa....@fz...>]

Hi Goncalo,
We configured eduGain with an Metadata URL. We got the Metadata URL
from our NREN where we requested the eduGain membership as SP. Our
configuration in remoteSamlAuth.properties looks like this:
unity.saml.requester.metadataSource.edugain.url=METADATAURLunity.saml.r
equester.metadataSource.edugain.perMetadataTranslationProfile=YOUR_TRAN
SLATION_PROFILEunity.saml.requester.metadataSource.edugain.signaturVeri
fication=requireunity.saml.requester.metadataSource.edugain.signatureVe
rificationCertificate=YOUR_CERT_FROM_PKI_PROPERTIESunity.saml.requester
.metadataSource.edugain.perMetadataRegistrationForm=YOUR_REGISTRATION_F
ORM
Best regards,Sander
P.S. I'm going to close your EUDAT ticket and refer to this mailing
list.
Am Dienstag, den 30.05.2017, 11:58 +0100 schrieb Gonçalo Barata:
> Hi
>  
> Im trying to implement the federated authentication (EDUGAIN), like
> in the documentation, but I’m struggling for days.
> From what I understand I know I need to do this through SAML HTTP-
> POST and HTTP-Redirect bindings.. And I know I must have 2 files
> (SAML Endpoint, SAML Authenticator ), and I know I must enable this
> on unityServer.conf. Can someone point me to the right direction?
>  
> 
>  
> Best Regards Gonçalo Barata
> 
> Fundação para a Ciência e a Tecnologia Unidade FCCN – Computação
> Científica Nacional
> Av. do Brasil, 101
> 1700-066 Lisboa | Portugal
> Email: gon...@fc...
> http://www.fccn.pt 
> Aviso de Confidencialidade
>  
> Esta mensagem é exclusivamente destinada ao seu destinatário, podendo
> conter informação CONFIDENCIAL, cuja divulgação está expressamente
> vedada nos termos da lei. Caso tenha recepcionado indevidamente esta
> mensagem, solicitamos-lhe que nos comunique esse mesmo facto por esta
> via ou para o telefone +351 218440100 devendo apagar o seu conteúdo
> de imediato.
>  
> -------------------------------------------------------------------
> -----------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> Unity-idm-discuss mailing list
> Uni...@li...
> https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss
-- 
Federated Systems and Data
Juelich Supercomputing Centre

phone: +49 2461 61 8847
fax: +49 2461 61 6656
email: sa....@fz...

-----------------------------------------------------------------------
-----------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich
Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Dr. Karl Eugen Huthmacher
Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender),
Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt,
Prof. Dr. Sebastian M. Schmidt
-----------------------------------------------------------------------
-----------------------------------------------------------------------

[Unity-idm-discuss] Eudat SAML - Federated authentication

[Gonçalo B. <gon...@fc...>]

Hi

 

Im trying to implement the federated authentication (EDUGAIN), like in the
documentation, but I’m struggling for days.

>From what I understand I know I need to do this through SAML HTTP-POST and
HTTP-Redirect bindings.. And I know I must have 2 files (SAML Endpoint, SAML
Authenticator ), and I know I must enable this on unityServer.conf. Can
someone point me to the right direction? 

 



 

Best Regards Gonçalo Barata 



Fundação para a Ciência e a Tecnologia Unidade FCCN – Computação Científica
Nacional

Av. do Brasil, 101

1700-066 Lisboa | Portugal

Email:  <mailto:gon...@fc...> gon...@fc... 

 <http://www.fccn.pt/> http://www.fccn.pt 

Aviso de Confidencialidade

 

Esta mensagem é exclusivamente destinada ao seu destinatário, podendo conter
informação CONFIDENCIAL, cuja divulgação está expressamente vedada nos
termos da lei. Caso tenha recepcionado indevidamente esta mensagem,
solicitamos-lhe que nos comunique esse mesmo facto por esta via ou para o
telefone +351 218440100 devendo apagar o seu conteúdo de imediato.

 

Re: [Unity-idm-discuss] limit number of log files

[Krzysztof B. <kb...@un...>]

Hi Sander,

W dniu 29.05.2017 o 12:26, Sander Apweiler pisze:
> Hi Krzysztof,
>
> I want to limit the number of logiles. I know there is an option
> log4j.appender.NAME.MaxBackupIndex for RollingFileAppender. I tested
> with log4j.appender.LOGFILE.MaxBackupIndex=30 but it didn't work. Is
> the another option to limit the number of logfiles?

Another option is cron ;-)

Regarding MaxBackupIndex - what appender do you use precisely? 
org.apache.log4j.RollingFileAppender or
org.apache.log4j.rolling.RollingFileAppender?

 From what I recall (but used it looong ago) MaxBakupIndex was only 
working on the first one. 2nd is from log4j-extras (also included in Unity).

HTH,
Krzysztof

[Unity-idm-discuss] limit number of log files

[Sander A. <sa....@fz...>]

Hi Krzysztof,

I want to limit the number of logiles. I know there is an option
log4j.appender.NAME.MaxBackupIndex for RollingFileAppender. I tested
with log4j.appender.LOGFILE.MaxBackupIndex=30 but it didn't work. Is
the another option to limit the number of logfiles?

Best regards,
Sander
-- 
Federated Systems and Data
Juelich Supercomputing Centre

phone: +49 2461 61 8847
fax: +49 2461 61 6656
email: sa....@fz...

-----------------------------------------------------------------------
-----------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich
Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Dr. Karl Eugen Huthmacher
Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender),
Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt,
Prof. Dr. Sebastian M. Schmidt
-----------------------------------------------------------------------
-----------------------------------------------------------------------

Re: [Unity-idm-discuss] user attributes in enquiry form

[Sander A. <sa....@fz...>]

Hi Krysztof,

sorry for the delay. Thank a lot for your feedback. I don't think that
we need a bulk action for adding attributes.

Best regards,
Sander

Am Freitag, den 12.05.2017, 08:22 +0200 schrieb Krzysztof Benedyczak:
> Sander,
> 
> W dniu 11.05.2017 o 11:15, Sander Apweiler pisze:
> > Hi Krzysztof,
> > 
> > we want to change the type of our email attribute from string into
> > verifiableEmail. We created a new attribute and want to copy the
> > values
> > from the old one to the new one. Because of vacations, business
> > travels
> > and other possible reasons, we do not prefer a copy with rest api.
> > 
> > We want to do the mapping with an enquiry form. But in our test the
> > enquiry form did not create a new attribute. The enquiry form has
> > two
> > automatically assigned settings.
> > 1. Auto acceptance of the form
> > 2. Add Attribute mail with expression: attr['email'] (condition:
> > true)
> > 
> > I guess the new attribute is not created because attr['email'] is
> > not
> > present. The same setting in registration from works. But in
> > registration form the user enters the attribute 'email'.
> > 
> > Is there a way to use existing user attributes in enquiry forms?
> 
> Yes, you are guessing correctly: attr is not holding existing user 
> attributes, rather those requested. We wold need to add existing 
> attributes to the enquiry MVEL context for this purpose what sounds
> as 
> anyway good idea. Though I think rather in Unity 2 branch where this 
> will be easier.
> 
> That said, I don't think that enquiry form is the best choice for
> this 
> use case. For automation of user-related tasks we have the bulk
> entity 
> operations feature. So what this call for is an action set attribute
> - 
> what is bit of work but shouldn't be too difficult. In context of
> Unity 
> 2 we should add even more powerful feature that will be ultimate 
> solution (even if bit harder to use): groovy entity processor. Then
> we 
> will have an opportunity to do just everything.
> 
> So if you want we can open a ticket for addAttribute bulk action.
> Anyway 
> I'll open 2 tickets for U2: groovy bulk action and adding existing 
> attributes to enquiry automation context.
> 
> Best
> Krzysztof
-- 
Federated Systems and Data
Juelich Supercomputing Centre

phone: +49 2461 61 8847
fax: +49 2461 61 6656
email: sa....@fz...

-----------------------------------------------------------------------
-----------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich
Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Dr. Karl Eugen Huthmacher
Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender),
Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt,
Prof. Dr. Sebastian M. Schmidt
-----------------------------------------------------------------------
-----------------------------------------------------------------------

Re: [Unity-idm-discuss] Formatting of dates shown in UI

[Willem E. <wi...@cl...>]

Hi Krzysztof,


On 16/05/2017 08:39, Krzysztof Benedyczak wrote:
> Hi Willem,
>
> W dniu 15.05.2017 o 16:13, Willem Elbers pisze:
>> Hello Krzysztof,
>>
>> can we customize the date format for dates shown in the UI? Currently
>> they are yy/mm/dd and we would like to have them shown as dd/mm/yy(yy).
>
> Hard to say - as this depends on which dates you are referring to.
> Besides few exceptions, in general Unity uses default format for the
> locale you use on the server. You can either change it for the server
> or overwrite for Unity only with options
>
Yes I was not very specific but meant the date format in general.
Overwriting with JVM options should be sufficient. I will test this.
> -Duser.country=CA -Duser.language=fr
> (in startup.properties, the OPTS variable)
>
> We can rather easily give a possibility to configure date format,
> however this would need rather complex setup. Sometimes we display
> only "short" date, sometime short date+time, sometimes full date+time
> etc.
>
I expect the global format to be sufficient for our needs. If not I'll
come back to you.
> Best,
> Krzysztof
Best,
Willem

-- 
Willem Elbers
CLARIN ERIC
www.clarin.eu | skype: wjm.elbers

Re: [Unity-idm-discuss] Formatting of dates shown in UI

[Krzysztof B. <kb...@un...>]

Hi Willem,

W dniu 15.05.2017 o 16:13, Willem Elbers pisze:
> Hello Krzysztof,
>
> can we customize the date format for dates shown in the UI? Currently
> they are yy/mm/dd and we would like to have them shown as dd/mm/yy(yy).

Hard to say - as this depends on which dates you are referring to.
Besides few exceptions, in general Unity uses default format for the 
locale you use on the server. You can either change it for the server or 
overwrite for Unity only with options

-Duser.country=CA -Duser.language=fr
(in startup.properties, the OPTS variable)

We can rather easily give a possibility to configure date format, 
however this would need rather complex setup. Sometimes we display only 
"short" date, sometime short date+time, sometimes full date+time etc.

Best,
Krzysztof

[Unity-idm-discuss] Formatting of dates shown in UI

[Willem E. <wi...@cl...>]

Hello Krzysztof,

can we customize the date format for dates shown in the UI? Currently
they are yy/mm/dd and we would like to have them shown as dd/mm/yy(yy).

Best,

Willem

-- 
Willem Elbers
CLARIN ERIC
www.clarin.eu | skype: wjm.elbers

Re: [Unity-idm-discuss] user attributes in enquiry form

[Krzysztof B. <kb...@un...>]

Sander,

W dniu 11.05.2017 o 11:15, Sander Apweiler pisze:
> Hi Krzysztof,
>
> we want to change the type of our email attribute from string into
> verifiableEmail. We created a new attribute and want to copy the values
> from the old one to the new one. Because of vacations, business travels
> and other possible reasons, we do not prefer a copy with rest api.
>
> We want to do the mapping with an enquiry form. But in our test the
> enquiry form did not create a new attribute. The enquiry form has two
> automatically assigned settings.
> 1. Auto acceptance of the form
> 2. Add Attribute mail with expression: attr['email'] (condition: true)
>
> I guess the new attribute is not created because attr['email'] is not
> present. The same setting in registration from works. But in
> registration form the user enters the attribute 'email'.
>
> Is there a way to use existing user attributes in enquiry forms?

Yes, you are guessing correctly: attr is not holding existing user 
attributes, rather those requested. We wold need to add existing 
attributes to the enquiry MVEL context for this purpose what sounds as 
anyway good idea. Though I think rather in Unity 2 branch where this 
will be easier.

That said, I don't think that enquiry form is the best choice for this 
use case. For automation of user-related tasks we have the bulk entity 
operations feature. So what this call for is an action set attribute - 
what is bit of work but shouldn't be too difficult. In context of Unity 
2 we should add even more powerful feature that will be ultimate 
solution (even if bit harder to use): groovy entity processor. Then we 
will have an opportunity to do just everything.

So if you want we can open a ticket for addAttribute bulk action. Anyway 
I'll open 2 tickets for U2: groovy bulk action and adding existing 
attributes to enquiry automation context.

Best
Krzysztof

[Unity-idm-discuss] user attributes in enquiry form

[Sander A. <sa....@fz...>]

Hi Krzysztof,

we want to change the type of our email attribute from string into
verifiableEmail. We created a new attribute and want to copy the values
from the old one to the new one. Because of vacations, business travels
and other possible reasons, we do not prefer a copy with rest api.

We want to do the mapping with an enquiry form. But in our test the
enquiry form did not create a new attribute. The enquiry form has two
automatically assigned settings.
1. Auto acceptance of the form
2. Add Attribute mail with expression: attr['email'] (condition: true)

I guess the new attribute is not created because attr['email'] is not
present. The same setting in registration from works. But in
registration form the user enters the attribute 'email'.

Is there a way to use existing user attributes in enquiry forms?

Best regards,
Sander
-- 
Federated Systems and Data
Juelich Supercomputing Centre

phone: +49 2461 61 8847
fax: +49 2461 61 6656
email: sa....@fz...

-----------------------------------------------------------------------
-----------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich
Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Dr. Karl Eugen Huthmacher
Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender),
Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt,
Prof. Dr. Sebastian M. Schmidt
-----------------------------------------------------------------------
-----------------------------------------------------------------------

[Unity-idm-discuss] Output profile issue introduced in 1.9.6

[Krzysztof B. <kb...@un...>]

Dear All,

Unfortunately the release 1.9.6 introduced a problem related to loading 
of certain output profiles which were created with earlier versions.

A loud error is logged if you are affected, similar to this one:

ERROR unity.server.TranslationActionInstance - Can not load action 
createAttribute with parameters: [.....]. This action will be ignored 
during profile's execution. Fix the action definition.

Fixing the issue in the majority of cases is very simple:
1) Open Admin UI, go to Server Management->Translation profiles->Output 
profiles
2) Open each of your output profiles for editing (Edit option) and 
simply save if just after opening (OK button)


Note that there is one case where you have to actually fix one thing 
manually in the profile's definition. If you use the *create persisted 
attribute* action, then for each such action please verify the *group* 
for the persisted attribute. By default it will be reset to '/'.

I'm sorry for the inconvenience. At the same time thanks to Shiraz for 
noticing this issue.

Best regards,
Krzysztof

Re: [Unity-idm-discuss] Text truncated for free text attribute in accept registration screen

[Willem E. <wi...@cl...>]

Hi Krzysztof, Shiraz,

+1 for toggle behavior. An alternative could be to show a popup with the
full text.

If toggle behavior is added, a toggle all option might also be useful.

Best,

Willem


On 05/05/2017 16:55, Shiraz Memon wrote:
> Krzysztof,
>
> On Thu, May 4, 2017 at 8:54 PM, Krzysztof Benedyczak <kb...@un...
> <mailto:kb...@un...>> wrote:
>
>     Willem, Shiraz,
>
>     W dniu 01.05.2017 o 13:03, Willem Elbers pisze:
>     > Dear Krzysztof,
>     >
>     > we have noticed that for one of our attributes (unlimited free
>     text),
>     > supplied via a registration form, the content is truncated
>     "[...]" in
>     > the accept registration window.
>     >
>     > Is there any way to view the full content of the attribute, before
>     > accepting the request from the UI?
>
>
>     Right, this is something to be improved.
>     We have a special reusable component used to display attribute with
>     values. It truncates the values, in different ways to fit to the UI
>     without cluttering it.
>
>     What I can propose:
>     a) currently attribute's type description (if present) is added as a
>     tooltip for all the values. We can assign it to the attribute name
>     only
>     and on values add the full text representation.
>
>     b) in selected cases (as those two that you mentioned) we can
>     change the
>     UI to put the full representation.
>
>
> With proposal a (if I understand it correctly) users have to go
> through multiple truncated attributes (if there are many) one by one
> and wait for the tooltip to appear, I'd prefer proposal b instead to
> show the whole attribute value(s), ideally without cluttering.
>
>
>     If you have any better ideas please write,
>
>
> Perhaps enhanced b with toggle behavior, that is, expanding the value
> by clicking the [...] or [>] or [+] and hide back after the second
> mouse click, do you think it make sense and/or technically feasible.
> However, other ideas from the subscribers of this list are most welcome. 
>
> Cheers,
> Shiraz
>  
>
>     Krzystof
>
>     ------------------------------------------------------------------------------
>     Check out the vibrant tech community on one of the world's most
>     engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>     <http://sdm.link/slashdot>
>     _______________________________________________
>     Unity-idm-discuss mailing list
>     Uni...@li...
>     <mailto:Uni...@li...>
>     https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss
>     <https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss>
>
>
>
>
> -- 
> Shiraz Memon
> Federated Systems and Data
> Jülich Supercomputing Centre (JSC)
>
> Phone: +49 2461 61 6899
> Fax:     +49 2461 61 6656
>
>
> ------------------------------------------------------------------------------------------------
> ------------------------------------------------------------------------------------------------
> Forschungszentrum Juelich GmbH
> 52425 Juelich
> Sitz der Gesellschaft: Juelich
> Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
> Vorsitzender des Aufsichtsrats: MinDir Dr. Karl Eugen Huthmacher
> Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender),
> Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt,
> Prof. Dr. Sebastian M. Schmidt
> ------------------------------------------------------------------------------------------------
> ------------------------------------------------------------------------------------------------
>

-- 
Willem Elbers
CLARIN ERIC
www.clarin.eu | tel: +31-(0)85-0091277 | skype: wjm.elbers

Re: [Unity-idm-discuss] Oauth-RP problem

[Krzysztof B. <kb...@un...>]

Hi Tim,

W dniu 05.05.2017 o 10:14, Tim Kreuzer pisze:
> Hi Krzysztof,
>
> Sander and I are working together on this.
>
>
> We send a Bearer access-token to UNICORE, which includes the user
> informations (tested by a manual HTTP Get-Request to /oauth2/tokeninfo
> and /oauth2/userinfo). We assume UNICORE is forwarding this token
> properly to unity (based on attached log - line 229), but we'll take a
> closer look at it. I updated the log4j.properties file to
>
> ...
> log4j.logger.unity.server=DEBUG
> log4j.logger.unity.server.oauth=TRACE
> log4j.logger.unity.server.rest=TRACE
> log4j.logger.unity.server.ws=TRACE
> ...
>
> and attached the result. This test was done with
>
> ...
> unity.oauth2-rp.verificationProtocol=internal
> ...
>
> and no defined unity.oauth2-rp.profileEndpoint (see attached log - line
> 230).

Yeah, this is clear now.

What is happening:
1) your token is sent by Unicore, and is validated fine
2) as you wrote the token verification is not using any profile URL. The 
result is that the data you associate with OAuth access token (using 
output profile) is never used. The only input OAuth verificator gets is 
the access token (it is verified).
3) Identity of the access token owner is an extra data provided out of 
the box by the internal token validator after it validates successfully 
the access token.
4) your input translation profile tries to match the obtained data about 
access token owner assuming that you have the x500Name attribute. But 
this attribute is absent - as said in (3) you have only the token's 
owner identity, nothing more.

So the harder way to fix this scenario is to configure getting the 
owner's data from the tokeninfo endpoint, i.e. the data associated with 
the access token by use of output profile. However this is an overkill 
in this situation: it would be useful if the token verification would be 
done remotely.
As verification is done on the same server that issued the tokenyou can 
simplify: your intput profile can reuse the owner's identifier to match 
the remote person to the local one (as in this scenario the remote 
person is also the local one so the matching is trivial). And at this 
point you have everything you need - a complete entity.

Action: mapIdentity
unityIdentityType: identifier
expression: id
(and you don't need the _CREATE flag, as this match will always work 
besides the case when the access token issuer is deleted between UNICORE 
manages to submit the request)

Also the output profile is not necessary then as you have the local 
access to all attributes.

Then UNICORE call is both authenticated as done by the original issuer 
and the answer (SOAP) will have the data for that principal.

HTH,
Krzysztof

Re: [Unity-idm-discuss] javascript bootstrap load error (v1.9.6)

[Shiraz M. <a....@fz...>]

Hi,

On Fri, May 5, 2017 at 5:18 PM, Krzysztof Benedyczak <kb...@un...<mailto:kb...@un...>> wrote:
Hi,

W dniu 05.05.2017<tel:05.05.2017> o 15:11, Shiraz Memon pisze:
Hi Krzysztof,

I have configured unity to redirect to home ui, if the uri/context-path
is set to /, below is the config

unityServer.core.endpoints.4.endpointType=UserHomeUI
unityServer.core.endpoints.4.endpointConfigurationFile=conf/endpoints/userhome.properties

unityServer.core.endpoints.4.contextPath=/
...

Now, with / and /home uri unity redirects to the home ui without issues,
however /home/home leads to the following bootstrap error, which is
upsetting our existing users who are still not aware of the new uri.

Inline image 1

Is it an intended behavior. Contrarily /admin and /admin/admin works
without any issues whatsoever, might be the admin ui is not configured
for the root / path.

No, Unity won't work if you set contextPath of an endpoint to '/'. This creates unsolvable routing and cookie issues.

If you want to have home attached to the root address you can configure the new redirect option (unityServer.core.defaultWebPath), so that user entering
https://unity.example.com
will be redirected automatically to
https://unity.example.com/home

Great, setting the context & default Web path correctly has actually solved both:logo and javascript loading issues.

Many thanks,
Shiraz



Cheers,
Krzysztof



--
Shiraz Memon
Federated Systems and Data
Jülich Supercomputing Centre (JSC)

Phone: +49 2461 61 6899
Fax:     +49 2461 61 6656


------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich
Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Dr. Karl Eugen Huthmacher
Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender),
Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt,
Prof. Dr. Sebastian M. Schmidt
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------

Re: [Unity-idm-discuss] javascript bootstrap load error (v1.9.6)

[Krzysztof B. <kb...@un...>]

Hi,

W dniu 05.05.2017 o 15:11, Shiraz Memon pisze:
> Hi Krzysztof,
>
> I have configured unity to redirect to home ui, if the uri/context-path
> is set to /, below is the config
>
> unityServer.core.endpoints.4.endpointType=UserHomeUI
> unityServer.core.endpoints.4.endpointConfigurationFile=conf/endpoints/userhome.properties
>
> unityServer.core.endpoints.4.contextPath=/
> ...
>
> Now, with / and /home uri unity redirects to the home ui without issues,
> however /home/home leads to the following bootstrap error, which is
> upsetting our existing users who are still not aware of the new uri.
>
> Inline image 1
>
> Is it an intended behavior. Contrarily /admin and /admin/admin works
> without any issues whatsoever, might be the admin ui is not configured
> for the root / path.

No, Unity won't work if you set contextPath of an endpoint to '/'. This 
creates unsolvable routing and cookie issues.

If you want to have home attached to the root address you can configure 
the new redirect option (unityServer.core.defaultWebPath), so that user 
entering
https://unity.example.com
will be redirected automatically to
https://unity.example.com/home

Cheers,
Krzysztof

Re: [Unity-idm-discuss] Text truncated for free text attribute in accept registration screen

[Shiraz M. <a....@fz...>]

Krzysztof,

On Thu, May 4, 2017 at 8:54 PM, Krzysztof Benedyczak <kb...@un...<mailto:kb...@un...>> wrote:
Willem, Shiraz,

W dniu 01.05.2017 o 13:03, Willem Elbers pisze:
> Dear Krzysztof,
>
> we have noticed that for one of our attributes (unlimited free text),
> supplied via a registration form, the content is truncated "[...]" in
> the accept registration window.
>
> Is there any way to view the full content of the attribute, before
> accepting the request from the UI?


Right, this is something to be improved.
We have a special reusable component used to display attribute with
values. It truncates the values, in different ways to fit to the UI
without cluttering it.

What I can propose:
a) currently attribute's type description (if present) is added as a
tooltip for all the values. We can assign it to the attribute name only
and on values add the full text representation.

b) in selected cases (as those two that you mentioned) we can change the
UI to put the full representation.

With proposal a (if I understand it correctly) users have to go through multiple truncated attributes (if there are many) one by one and wait for the tooltip to appear, I'd prefer proposal b instead to show the whole attribute value(s), ideally without cluttering.


If you have any better ideas please write,

Perhaps enhanced b with toggle behavior, that is, expanding the value by clicking the [...] or [>] or [+] and hide back after the second mouse click, do you think it make sense and/or technically feasible. However, other ideas from the subscribers of this list are most welcome.

Cheers,
Shiraz

Krzystof

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Unity-idm-discuss mailing list
Uni...@li...<mailto:Uni...@li...>
https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss



--
Shiraz Memon
Federated Systems and Data
Jülich Supercomputing Centre (JSC)

Phone: +49 2461 61 6899
Fax:     +49 2461 61 6656


------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich
Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Dr. Karl Eugen Huthmacher
Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender),
Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt,
Prof. Dr. Sebastian M. Schmidt
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------

[Unity-idm-discuss] Custom logo disappeared (v1.9.6)

[Shiraz M. <a....@fz...>]

Hi Krzysztof,

Our custom logo has disappeared after updating from v1.9.5 to v1.9.6, I had replaced the later's webContents directory with the former distribution during the update process. Is there anything I should add/change to bring back the logo?

v1.9.5
[Inline image 1]

v1.9.6
[Inline image 2]

Cheers,
Shiraz
--
Shiraz Memon
Federated Systems and Data
Jülich Supercomputing Centre (JSC)

Phone: +49 2461 61 6899
Fax:     +49 2461 61 6656


------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich
Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Dr. Karl Eugen Huthmacher
Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender),
Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt,
Prof. Dr. Sebastian M. Schmidt
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------

[Unity-idm-discuss] javascript bootstrap load error (v1.9.6)

[Shiraz M. <a....@fz...>]

Hi Krzysztof,

I have configured unity to redirect to home ui, if the uri/context-path is set to /, below is the config

unityServer.core.endpoints.4.endpointType=UserHomeUI
unityServer.core.endpoints.4.endpointConfigurationFile=conf/endpoints/userhome.properties
unityServer.core.endpoints.4.contextPath=/
...

Now, with / and /home uri unity redirects to the home ui without issues, however /home/home leads to the following bootstrap error, which is upsetting our existing users who are still not aware of the new uri.

[Inline image 1]

Is it an intended behavior. Contrarily /admin and /admin/admin works without any issues whatsoever, might be the admin ui is not configured for the root / path.

Cheers,
Shiraz
--
Shiraz Memon
Federated Systems and Data
Jülich Supercomputing Centre (JSC)

Phone: +49 2461 61 6899
Fax:     +49 2461 61 6656


------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich
Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Dr. Karl Eugen Huthmacher
Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender),
Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt,
Prof. Dr. Sebastian M. Schmidt
------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------

Re: [Unity-idm-discuss] Oauth-RP problem

[Tim K. <t.k...@fz...>]

Hi Krzysztof,

Sander and I are working together on this.


On 04.05.2017 20:35, Krzysztof Benedyczak wrote:
> hi Sander,
>
> W dniu 04.05.2017 o 15:22, Sander Apweiler pisze:
>> Hi Krzysztof,
>>
>> we want to start unicore jobs by jupyterhub server authenticated by
>> unity.
> Sounds interesting :-)
>
>> The users signs into jupytherhub by unity (with oauth
>> authorization server). This authentication works fine. The generated
>> token is transferred to unicore. Unicore should use this token to
>> request user attributes from unity. While this request unity throws an
>> AuthenticationException because of an anonymous principal.
> Are you sure that UNICORE part does this job properly and the *access
> token* is indeed added to the HTTP Auth header properly? If this is the
> case can you enable TRACE logging (on the rest (the first stage -
> picking up the token from the request) and oauth (actual verification)
> loggers plus maybe also ws) and check whether this token is picked up by
> Unity at all and then checked? We should know at which stage the
> authentication of UNIORE request fails.

We send a Bearer access-token to UNICORE, which includes the user 
informations (tested by a manual HTTP Get-Request to /oauth2/tokeninfo 
and /oauth2/userinfo). We assume UNICORE is forwarding this token 
properly to unity (based on attached log - line 229), but we'll take a 
closer look at it. I updated the log4j.properties file to

...
log4j.logger.unity.server=DEBUG
log4j.logger.unity.server.oauth=TRACE
log4j.logger.unity.server.rest=TRACE
log4j.logger.unity.server.ws=TRACE
...

and attached the result. This test was done with

...
unity.oauth2-rp.verificationProtocol=internal
...

and no defined unity.oauth2-rp.profileEndpoint (see attached log - line 
230).

>
> [CUT]
>
>> Why do we need an input translation profile for internal oauth resource
>> provider?
> This is a generic feature - Unity isolates endpoints and authenticators,
> so internal verification is separate part to what you map the client to.
> But yes - for this special case when unity validates a token issued by
> itself so is both OAuth AS and RP we may think about some simplified
> config - i.e. map to the owner of the access token and do not perform
> any modification.
>
>
>> If we define the userinfo endpoint to unity itself, unity
>> rejects the request because it does not trust his own demo certificate.
>> (SunCertPathBuilderException: unable to find valid certification path to
>> requested target)
>> Do you have any hint for us?
> I'm sure what do you precisely mean by "define the userinfo endpoint to
> unity itself" but in general when not using the internal verification
> (which uses the internal API call) but any other mean then the network
> connection is made and true - you can get any sort of TLS error.
> Authenticator's truststore (httpClientTruststore property) needs to
> include CA certificate of the unity server certificate (which is used by
> the oauth endpoint).
>
> Best
> Krzysztof
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> Unity-idm-discuss mailing list
> Uni...@li...
> https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss

Thanks and best regards,
Tim Kreuzer

Re: [Unity-idm-discuss] Text truncated for free text attribute in accept registration screen

[Krzysztof B. <kb...@un...>]

Willem, Shiraz,

W dniu 01.05.2017 o 13:03, Willem Elbers pisze:
> Dear Krzysztof,
>
> we have noticed that for one of our attributes (unlimited free text),
> supplied via a registration form, the content is truncated "[...]" in
> the accept registration window.
>
> Is there any way to view the full content of the attribute, before
> accepting the request from the UI?


Right, this is something to be improved.
We have a special reusable component used to display attribute with 
values. It truncates the values, in different ways to fit to the UI 
without cluttering it.

What I can propose:
a) currently attribute's type description (if present) is added as a 
tooltip for all the values. We can assign it to the attribute name only 
and on values add the full text representation.

b) in selected cases (as those two that you mentioned) we can change the 
UI to put the full representation.

If you have any better ideas please write,
Krzystof

Re: [Unity-idm-discuss] Oauth-RP problem

[Krzysztof B. <kb...@un...>]

hi Sander,

W dniu 04.05.2017 o 15:22, Sander Apweiler pisze:
> Hi Krzysztof,
>
> we want to start unicore jobs by jupyterhub server authenticated by
> unity.

Sounds interesting :-)

> The users signs into jupytherhub by unity (with oauth
> authorization server). This authentication works fine. The generated
> token is transferred to unicore. Unicore should use this token to
> request user attributes from unity. While this request unity throws an
> AuthenticationException because of an anonymous principal.
Are you sure that UNICORE part does this job properly and the *access 
token* is indeed added to the HTTP Auth header properly? If this is the 
case can you enable TRACE logging (on the rest (the first stage - 
picking up the token from the request) and oauth (actual verification) 
loggers plus maybe also ws) and check whether this token is picked up by 
Unity at all and then checked? We should know at which stage the 
authentication of UNIORE request fails.

[CUT]

> Why do we need an input translation profile for internal oauth resource
> provider?
This is a generic feature - Unity isolates endpoints and authenticators, 
so internal verification is separate part to what you map the client to. 
But yes - for this special case when unity validates a token issued by 
itself so is both OAuth AS and RP we may think about some simplified 
config - i.e. map to the owner of the access token and do not perform 
any modification.


> If we define the userinfo endpoint to unity itself, unity
> rejects the request because it does not trust his own demo certificate.
> (SunCertPathBuilderException: unable to find valid certification path to
> requested target)
> Do you have any hint for us?

I'm sure what do you precisely mean by "define the userinfo endpoint to 
unity itself" but in general when not using the internal verification 
(which uses the internal API call) but any other mean then the network 
connection is made and true - you can get any sort of TLS error. 
Authenticator's truststore (httpClientTruststore property) needs to 
include CA certificate of the unity server certificate (which is used by 
the oauth endpoint).

Best
Krzysztof

[Unity-idm-discuss] Oauth-RP problem

[Sander A. <sa....@fz...>]

Hi Krzysztof,
we want to start unicore jobs by jupyterhub server authenticated by
unity. The users signs into jupytherhub by unity (with oauth
authorization server). This authentication works fine. The generated
token is transferred to unicore. Unicore should use this token to
request user attributes from unity. While this request unity throws an
AuthenticationException because of an anonymous principal.
Our configurations are:oauth-rp
authenticator:unityServer.core.authenticators.6.authenticatorName=oauth
RP-cxfunityServer.core.authenticators.6.authenticatorType=oauth-rp with
cxf-oauth-
bearerunityServer.core.authenticators.6.retrievalConfigurationFile=conf
/authenticators/empty.jsonunityServer.core.authenticators.6.verificator
ConfigurationFile=conf/authenticators/internalOAuthRP.properties
internalOAuthRP.properties:unity.oauth2-
rp.verificationProtocol=internalunity.oauth2-
rp.translationProfile=inputProfileOAuthunity.oauth2-
rp.clientSecret=bogusunity.oauth2-rp.httpClientHostnameChecking=WARN
SAML Unicore
endpoint:unityServer.core.endpoints.11.endpointType=SAMLUnicoreSoapIdPu
nityServer.core.endpoints.11.endpointConfigurationFile=conf/endpoints/s
aml-
webidp.propertiesunityServer.core.endpoints.11.contextPath=/unicore-
soapidp-
oidcunityServer.core.endpoints.11.endpointRealm=defaultRealmunityServer
.core.endpoints.11.endpointName=UNITY UNICORE OIDC SOAP SAML
serviceunityServer.core.endpoints.11.endpointAuthenticators=oauthRP-cxf

output translation profile for oauth authorization server:
1: condition true
Action: createAttribute
attribute name: urn:jupyterhub:username
expression: idsByType['userName']

2: condition true
Action: createAttribute
attribute name: userName
expression: idsByType['userName']

3: condition true
Action: createAttribute
attribute name: x500Name
expression: idsByType['x500Name']

Input translation profile for oauth-rp:
1: condition true
Action: mapIdentity
unityIdentityType: x500Name
expression: attr['x500Name']
credential requirement: Password requirement
effect: CREATE_OR_MATCH

Why do we need an input translation profile for internal oauth resource
provider? If we define the userinfo endpoint to unity itself, unity
rejects the request because it does not trust his own demo certificate.
(SunCertPathBuilderException: unable to find valid certification path
to requested target)
Do you have any hint for us?

Best regards,
Sander
-- 
Federated Systems and Data
Juelich Supercomputing Centre

phone: +49 2461 61 8847
fax: +49 2461 61 6656
email: sa....@fz...

-----------------------------------------------------------------------
-----------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich
Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Dr. Karl Eugen Huthmacher
Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender),
Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt,
Prof. Dr. Sebastian M. Schmidt
-----------------------------------------------------------------------
-----------------------------------------------------------------------