Menu
▾
▴
unity-idm-discuss — Unity discussion and support
You can subscribe to this list here.
| 2014 |
Jan
(3) |
Feb
(1) |
Mar
|
Apr
(1) |
May
|
Jun
|
Jul
(2) |
Aug
(2) |
Sep
|
Oct
(3) |
Nov
|
Dec
(1) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2015 |
Jan
(20) |
Feb
(3) |
Mar
|
Apr
|
May
|
Jun
(15) |
Jul
(1) |
Aug
(7) |
Sep
(13) |
Oct
(2) |
Nov
(10) |
Dec
(1) |
| 2016 |
Jan
|
Feb
(2) |
Mar
|
Apr
(2) |
May
(1) |
Jun
|
Jul
(1) |
Aug
(2) |
Sep
(11) |
Oct
(7) |
Nov
(6) |
Dec
(11) |
| 2017 |
Jan
(10) |
Feb
(5) |
Mar
(27) |
Apr
(34) |
May
(25) |
Jun
(14) |
Jul
(7) |
Aug
(17) |
Sep
(11) |
Oct
(6) |
Nov
(14) |
Dec
(10) |
| 2018 |
Jan
(8) |
Feb
(19) |
Mar
(40) |
Apr
(9) |
May
(16) |
Jun
(23) |
Jul
(31) |
Aug
(7) |
Sep
(9) |
Oct
(6) |
Nov
(14) |
Dec
(19) |
| 2019 |
Jan
(4) |
Feb
(6) |
Mar
(1) |
Apr
(2) |
May
(6) |
Jun
(3) |
Jul
|
Aug
|
Sep
|
Oct
(2) |
Nov
(19) |
Dec
(14) |
| 2020 |
Jan
(10) |
Feb
(24) |
Mar
(49) |
Apr
(26) |
May
(12) |
Jun
(4) |
Jul
(13) |
Aug
(32) |
Sep
(13) |
Oct
(10) |
Nov
(4) |
Dec
(16) |
| 2021 |
Jan
(2) |
Feb
(8) |
Mar
(15) |
Apr
(19) |
May
(5) |
Jun
(13) |
Jul
(6) |
Aug
(38) |
Sep
(11) |
Oct
(18) |
Nov
(11) |
Dec
(13) |
| 2022 |
Jan
(10) |
Feb
(21) |
Mar
(28) |
Apr
(3) |
May
(7) |
Jun
(9) |
Jul
(14) |
Aug
(13) |
Sep
(8) |
Oct
(29) |
Nov
(1) |
Dec
(21) |
| 2023 |
Jan
(19) |
Feb
(9) |
Mar
|
Apr
(10) |
May
(7) |
Jun
(10) |
Jul
(14) |
Aug
(17) |
Sep
(1) |
Oct
(9) |
Nov
(5) |
Dec
(14) |
| 2024 |
Jan
(12) |
Feb
(2) |
Mar
(8) |
Apr
(1) |
May
(6) |
Jun
(6) |
Jul
(24) |
Aug
(15) |
Sep
(1) |
Oct
(6) |
Nov
(20) |
Dec
(14) |
| 2025 |
Jan
(12) |
Feb
(2) |
Mar
(10) |
Apr
(11) |
May
(13) |
Jun
(1) |
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: Willem E. <wi...@cl...> - 2017-03-24 09:45:29
|
Dear Krzysztof, is it possible to change the email content encoding (Content-Type header) for the email notification channel to "text/html" (instead of the default "text/plain")? Best, Willem -- Willem Elbers CLARIN ERIC www.clarin.eu | tel: +31-(0)85-0091277 | skype: wjm.elbers |
|
From: Willem E. <wi...@cl...> - 2017-03-24 09:43:21
|
Dear Krzysztof,
On 23/03/17 23:55, Krzysztof Benedyczak wrote:
> Dear Willem,
>
> W dniu 23.03.2017 o 14:00, Willem Elbers pisze:
>> Dear Krysztof,
>>
>> we've recently encountered an issue where a user clicked the link in the
>> email confirmation email. However, the entity within unity-idm wasn't
>> updated and still showed "[confirmation request sent]" in the entity
>> details.
>
> Do you have any more information? There was some problem shown on the
> confirmation page? Maybe the link has expired?
>
Unfortunately not. The user got the activation successful message and I
didn't find any exceptions in the log file. The link was clicked within
90 minutes after account creation, so I doubt it was expired.
>>
>> is it possible to resend the email verification link?
>>
>> (we've removed the entity for now and after recreating it, everything
>> worked as expected)
>
> Yes it is. You can easily trigger this using REST API:
>
> @Path("/confirmation-trigger/identity/{type}/{value}")
> @POST
>
> Triggers sending of confirmation message of identity. Nearly always it
> is a re-send.
>
> @Path("/confirmation-trigger/entity/{entityId}/attribute/{attributeName}")
>
> @QueryParam("group")
> @QueryParam("identityType")
> @POST
>
> Triggers sending of confirmation message for an attribute. Nearly
> always it is a re-send.
Ok thanks. I was hoping for an easy way to do this from the UI.
>
>
> What is more you can quite easily force unity to re-send email
> *attribute* confirmation from Admin UI: edit the attribute, set is a
> confirmed, save, edit again and set back to not-confirmed state.
> It is hard to do this for identity. You can remove identity (removing
> the whole entity is rather too brutal ;) and re-add it. However this
> may loose some context (e.g. metadata of identity real origin).
While testing this can work, for real user accounts this is not really a
nice work around.
>
> Cheers,
> Krzysztof
Best,
Willem
--
Willem Elbers
CLARIN ERIC
www.clarin.eu | tel: +31-(0)85-0091277 | skype: wjm.elbers
|
|
From: Krzysztof B. <kb...@un...> - 2017-03-23 22:55:34
|
Dear Willem,
W dniu 23.03.2017 o 14:00, Willem Elbers pisze:
> Dear Krysztof,
>
> we've recently encountered an issue where a user clicked the link in the
> email confirmation email. However, the entity within unity-idm wasn't
> updated and still showed "[confirmation request sent]" in the entity
> details.
Do you have any more information? There was some problem shown on the
confirmation page? Maybe the link has expired?
>
> is it possible to resend the email verification link?
>
> (we've removed the entity for now and after recreating it, everything
> worked as expected)
Yes it is. You can easily trigger this using REST API:
@Path("/confirmation-trigger/identity/{type}/{value}")
@POST
Triggers sending of confirmation message of identity. Nearly always it
is a re-send.
@Path("/confirmation-trigger/entity/{entityId}/attribute/{attributeName}")
@QueryParam("group")
@QueryParam("identityType")
@POST
Triggers sending of confirmation message for an attribute. Nearly always
it is a re-send.
What is more you can quite easily force unity to re-send email
*attribute* confirmation from Admin UI: edit the attribute, set is a
confirmed, save, edit again and set back to not-confirmed state.
It is hard to do this for identity. You can remove identity (removing
the whole entity is rather too brutal ;) and re-add it. However this may
loose some context (e.g. metadata of identity real origin).
Cheers,
Krzysztof
|
|
From: Willem E. <wi...@cl...> - 2017-03-23 13:00:46
|
Dear Krysztof, we've recently encountered an issue where a user clicked the link in the email confirmation email. However, the entity within unity-idm wasn't updated and still showed "[confirmation request sent]" in the entity details. is it possible to resend the email verification link? (we've removed the entity for now and after recreating it, everything worked as expected) Best, Willem -- Willem Elbers CLARIN ERIC www.clarin.eu | skype: wjm.elbers |
|
From: Krzysztof B. <kb...@un...> - 2017-03-21 06:58:24
|
Shiraz, W dniu 20.03.2017 o 12:45, Shiraz Memon pisze: > Hi Krzysztof, > > In addition to Sander's concerns about release of extra (or unwanted) > attributes to the relying parties, it would also be interesting to know > whether unity allows preventing users from hiding the released (or about > to be released) attributes on the consent screen. So, here I mean, to > block the possibility for the end users to hide the "important" > attributes, which we as an authentication service are committed to > release as a proxy IdP. > > unity.saml.skipConsent=true (and similar for oauth) allows for this, however if you need to keep consent screen but only disable control of exposed information then a new feature is needed. Best, Krzysztof |
|
From: Krzysztof B. <kb...@un...> - 2017-03-21 06:54:03
|
Hi Sander, W dniu 20.03.2017 o 09:33, Sander Apweiler pisze: > Hi Krzysztof, all, > > I'm redesigning our output translation profiles. Therefore I start with > new translation profile with small information. I want to reduce the > output for users in confirmation screen. My output translation profile > (whole profile below) has only four rules, but the confirmation screen > lists eight attributes. Some of them are not requested and not released > by translation profile. So is there a mix up with default output > translation profile? If yes, is it possible to avoid this mix up? As you can read in output profile documentation: 'Output translation profile operates on a data structure which is initially filled by Unity with all attributes and identities of the queried principal. Attributes are from the group configured in the endpoint.' The default profile merely adds dynamic memberOf attribute which is commonly requested. All of this happens as we want to have the most sensible defaults without any output profile. If you want to have a full control over all attributes using your output profile start it from filtering rules. E.g. to filter all attributes use the filterAttribute with .* argument. You can then either "un-hide" selected attribute or release all dynamic ones using createAttribute rule. Cheers, KB |
|
From: Shiraz M. <a....@fz...> - 2017-03-20 11:47:15
|
Hi Krzysztof, In addition to Sander's concerns about release of extra (or unwanted) attributes to the relying parties, it would also be interesting to know whether unity allows preventing users from hiding the released (or about to be released) attributes on the consent screen. So, here I mean, to block the possibility for the end users to hide the "important" attributes, which we as an authentication service are committed to release as a proxy IdP. Cheers, Shiraz On Mon, Mar 20, 2017 at 10:33 AM, Sander Apweiler <sa....@fz... > wrote: > Hi Krzysztof, all, > > I'm redesigning our output translation profiles. Therefore I start with > new translation profile with small information. I want to reduce the output > for users in confirmation screen. My output translation profile (whole > profile below) has only four rules, but the confirmation screen lists eight > attributes. Some of them are not requested and not released by translation > profile. So is there a mix up with default output translation profile? If > yes, is it possible to avoid this mix up? > > Here are some information about my system: > unity 1.9.5 > > Output translation profile: > 1. condition: true > Action: createAttribute > AttributeName: urn:oid:1.2.840.113549.1.9.1 > expression: attr['mail'].toString() > 2. condition: true > Actiopn: createAttribute > attributeName: urn:oid:2.5.4.3 > expression: attr['cn'] > 3. condition: idsByType contains 'persistent' > Action: createAttribute > attributeName: unity:persistent > expression: idsByType['persistent'] > 4. condition: (requester contains 'URL') > Action: createAttribute > attribuetName: memberOf > expression: groups + ['FSD2'] > > Requested Attributes from SP are: unity:persistent, > urn:oid:1.2.840.113549.1.9.1, cn, memberOf > > confirmation screen lists: > 1. mail > 2. unity:persistent > 3. memberOf > 4. sys:FilledEnquires > 5. cn > 6. urn:oid:1.2.840.113549.1.9.1 > 7. urn:oid:2.5.4.3 > 8. o > > So first it looks like email and cn which are created in urn:oid notation > in translation profile are released with their internal names too. > Organisation Name and sys:FilledEnquires was wether released within > translation profile nor requested by SP but they are released too. Do you > know the reason for this behaviour? > > Best regards, > Sander > > -- > > Federated Systems and Data > Juelich Supercomputing Centre > > phone: +49 2461 61 8847 <02461%20618847> > fax: +49 2461 61 6656 <02461%20616656> > email: sa....@fz... > > ----------------------------------------------------------------------- > ----------------------------------------------------------------------- > Forschungszentrum Juelich GmbH > 52425 Juelich > Sitz der Gesellschaft: Juelich > Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 > Vorsitzender des Aufsichtsrats: MinDir Dr. Karl Eugen Huthmacher > Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), > Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt, > Prof. Dr. Sebastian M. Schmidt > ----------------------------------------------------------------------- > ----------------------------------------------------------------------- > > ------------------------------------------------------------ > ------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > _______________________________________________ > Unity-idm-discuss mailing list > Uni...@li... > https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss > > -- Shiraz Memon Federated Systems and Data Jülich Supercomputing Centre (JSC) Phone: +49 2461 61 6899 Fax: +49 2461 61 6656 |
|
From: Sander A. <sa....@fz...> - 2017-03-20 08:33:41
|
Hi Krzysztof, all, I'm redesigning our output translation profiles. Therefore I start with new translation profile with small information. I want to reduce the output for users in confirmation screen. My output translation profile (whole profile below) has only four rules, but the confirmation screen lists eight attributes. Some of them are not requested and not released by translation profile. So is there a mix up with default output translation profile? If yes, is it possible to avoid this mix up? Here are some information about my system: unity 1.9.5 Output translation profile: 1. condition: true Action: createAttribute AttributeName: urn:oid:1.2.840.113549.1.9.1 expression: attr['mail'].toString() 2. condition: true Actiopn: createAttribute attributeName: urn:oid:2.5.4.3 expression: attr['cn'] 3. condition: idsByType contains 'persistent' Action: createAttribute attributeName: unity:persistent expression: idsByType['persistent'] 4. condition: (requester contains 'URL') Action: createAttribute attribuetName: memberOf expression: groups + ['FSD2'] Requested Attributes from SP are: unity:persistent, urn:oid:1.2.840.113549.1.9.1, cn, memberOf confirmation screen lists: 1. mail 2. unity:persistent 3. memberOf 4. sys:FilledEnquires 5. cn 6. urn:oid:1.2.840.113549.1.9.1 7. urn:oid:2.5.4.3 8. o So first it looks like email and cn which are created in urn:oid notation in translation profile are released with their internal names too. Organisation Name and sys:FilledEnquires was wether released within translation profile nor requested by SP but they are released too. Do you know the reason for this behaviour? Best regards, Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Dr. Karl Eugen Huthmacher Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt, Prof. Dr. Sebastian M. Schmidt ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2017-03-14 11:22:22
|
Hi, W dniu 14.03.2017 o 11:43, Shiraz Memon pisze: > Hi, > > Is it possible to get the metadata file generated for saml sp and/or idp > with the following custom extensions? > > <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="https://aai.egi.eu/saml2/idp/metadata.php"> > <md:Extensions> > <mdattr:EntityAttributes xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"> > <saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Name="http://macedir.org/entity-category-support" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> > <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string"> > http://refeds.org/category/research-and-scholarship > </saml:AttributeValue> > </saml:Attribute> > <saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Name="urn:oasis:names:tc:SAML:attribute:assurance-certification" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> > <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">https://aai.egi.eu/LoA#Low</saml:AttributeValue> > <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">https://aai.egi.eu/LoA#Substantial</saml:AttributeValue> > <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">https://aai.egi.eu/LoA#High</saml:AttributeValue> > <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">https://refeds.org/sirtfi</saml:AttributeValue> > </saml:Attribute> > </mdattr:EntityAttributes> > </md:Extensions> > ..... > Generated - not. However you can auto generate the default MD, edit it inserting custom extensions and then configure Unity to return your customized file instead of the autogenerated metadata. Cheers, Krzysztof |
|
From: Shiraz M. <a....@fz...> - 2017-03-14 10:44:13
|
Hi, Is it possible to get the metadata file generated for saml sp and/or idp with the following custom extensions? <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="https://aai.egi.eu/saml2/idp/metadata.php"> <md:Extensions> <mdattr:EntityAttributes xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"> <saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Name="http://macedir.org/entity-category-support" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string"> http://refeds.org/category/research-and-scholarship </saml:AttributeValue> </saml:Attribute> <saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Name="urn:oasis:names:tc:SAML:attribute:assurance-certification" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">https://aai.egi.eu/LoA#Low</saml:AttributeValue> <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">https://aai.egi.eu/LoA#Substantial</saml:AttributeValue> <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">https://aai.egi.eu/LoA#High</saml:AttributeValue> <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">https://refeds.org/sirtfi</saml:AttributeValue> </saml:Attribute> </mdattr:EntityAttributes> </md:Extensions> ..... Cheers, Shiraz -- Shiraz Memon Federated Systems and Data Jülich Supercomputing Centre (JSC) Phone: +49 2461 61 6899 Fax: +49 2461 61 6656 ------------------------------------------------------------------------------------------------ ------------------------------------------------------------------------------------------------ Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Dr. Karl Eugen Huthmacher Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt, Prof. Dr. Sebastian M. Schmidt ------------------------------------------------------------------------------------------------ ------------------------------------------------------------------------------------------------ |
|
From: Krzysztof B. <kb...@un...> - 2017-03-01 23:32:52
|
Dear Subscribers, Subsequent Unity revision - 1.9.5 - is available for download. In the first place it fixes recently found bugs. Additionally one new feature is introduced: it is possible to configure what happens when user triggers account removal (for instance it can be only disabled if some more complicated deprovisioning should be activated). Download links and detailed list of changes is available at: http://www.unity-idm.eu/site/downloads Best regards, Krzysztof |
|
From: Krzysztof B. <kb...@un...> - 2017-03-01 23:28:51
|
Hi Sander, W dniu 01.03.2017 o 15:42, Sander Apweiler pisze: > Hi all, > > I created a new registration form for an additional IdP. Because I'm > not sure if CN is release I chosed "Can be provided by remote IdP; if > not then collected interactively" as was to collect the value. The > manual says: "In this mode the user can fill the data only if it was > not provided by a remote IdP. If it was provided by remote IdP then > this data is hidden in the form." > > The registration form asked me for CN although the IdP has released the > CN. The CN value from IdP was not displayed in registration form. I > entered another CN than the IdP provided. After reading the attributes > in userhome i saw, unity used the CN from IdP and not from user. > > As admin I expect, that CN from IdP is shown in the form or CN is not > collected in form if the IdP provided it. Like it is written in manual. > As user it i don't know why there stored values differs from my input. > Is this behaviour wanted? No, what you described is a bug in UI: in the described case there should be no textfield collecting cn in the form. The rest (use of the remote IdP-provided value) is correct. Will be fixed in the 1.9.5. > Is there a release date for next unity? Yes: couple of minutes ago :-) Best, Krzysztof |
|
From: Sander A. <sa....@fz...> - 2017-03-01 14:42:39
|
Hi all, I created a new registration form for an additional IdP. Because I'm not sure if CN is release I chosed "Can be provided by remote IdP; if not then collected interactively" as was to collect the value. The manual says: "In this mode the user can fill the data only if it was not provided by a remote IdP. If it was provided by remote IdP then this data is hidden in the form." The registration form asked me for CN although the IdP has released the CN. The CN value from IdP was not displayed in registration form. I entered another CN than the IdP provided. After reading the attributes in userhome i saw, unity used the CN from IdP and not from user. As admin I expect, that CN from IdP is shown in the form or CN is not collected in form if the IdP provided it. Like it is written in manual. As user it i don't know why there stored values differs from my input. Is this behaviour wanted? Is there a release date for next unity? Best regards, Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Dr. Karl Eugen Huthmacher Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt, Prof. Dr. Sebastian M. Schmidt ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2017-02-22 08:49:24
|
Hi Willem, W dniu 17.02.2017 o 15:35, Willem Elbers pisze: > Hi Krzyztof, > > is it possible to create entities via the unity REST api without > automatically sending an activation email, but instead retrieve the > activation link and send it in a separate email (manually)? > > An alternative could be if we can send a custom activation email when > creating entities via the REST api (instead of using the registration form). > > I would be happy to hear if (and how) any of these approaches is possible. I'm not sure what you refer to when writing "activation email" and "creating entities"? If you mean email verification email then you can only disable sending of confirmations. However there is another mechanism which can help: invitations. By using invitations you can control sending of email (including manual sending of such email, or activated by REST API). As invitation is received by email, and contains unique one time code you can use it as a proof that the user controls the account. And so you can auto-accept an invited person without any further actions. Cheers Krzysztof |
|
From: Willem E. <wi...@cl...> - 2017-02-17 14:35:39
|
Hi Krzyztof, is it possible to create entities via the unity REST api without automatically sending an activation email, but instead retrieve the activation link and send it in a separate email (manually)? An alternative could be if we can send a custom activation email when creating entities via the REST api (instead of using the registration form). I would be happy to hear if (and how) any of these approaches is possible. Best, Willem -- Willem Elbers CLARIN ERIC www.clarin.eu | skype: wjm.elbers |
|
From: Krzysztof B. <kb...@un...> - 2017-02-14 14:56:45
|
Hi Sander, W dniu 13.02.2017 o 16:10, Sander Apweiler pisze: > Hi Krzysztof, all, > > I want to copy a translation profile and adopt it for a new IdP, > because it is faster/easier than creating a new one. But I'm not able > to change the name of the new translation profile while I'm able to > change all other settings. The name is fix with "Copy of xyz". Is that > behaviour intended? Or is there another way to change the name of new > translation profile while copying it from an existing one? Yes, I can confirm this - that's UI regression. Should be easy to fix. Thanks for the report KB |
|
From: Sander A. <sa....@fz...> - 2017-02-13 15:10:27
|
Hi Krzysztof, all, I want to copy a translation profile and adopt it for a new IdP, because it is faster/easier than creating a new one. But I'm not able to change the name of the new translation profile while I'm able to change all other settings. The name is fix with "Copy of xyz". Is that behaviour intended? Or is there another way to change the name of new translation profile while copying it from an existing one? Best regards, Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Dr. Karl Eugen Huthmacher Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt, Prof. Dr. Sebastian M. Schmidt ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Sander A. <sa....@fz...> - 2017-02-02 07:41:32
|
Hi Krzysztof, thank you very much. Best regards, Sander Am Freitag, den 27.01.2017, 23:18 +0100 schrieb Krzysztof Benedyczak: > Sander, > > follow on: > the bug with required identity was trivial, already fixed will be in > the > next revision release. > > Best, > Krzysztof -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Dr. Karl Eugen Huthmacher Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt, Prof. Dr. Sebastian M. Schmidt ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2017-01-27 22:18:28
|
Sander, follow on: the bug with required identity was trivial, already fixed will be in the next revision release. Best, Krzysztof |
|
From: Krzysztof B. <kb...@un...> - 2017-01-27 21:49:54
|
Hi Sander, W dniu 27.01.2017 o 10:43, Sander Apweiler pisze: > Hi Krzysztof, > > We decided to "upgrade" the CN attribute from optional to mandatory. So > we need to collect the CN from existing users. I want to use an enquiry > form for it, because it seems to be perfect for it. > > On my test instance I created a very simple enquiry form. It is > mandatory for users in root group. It has no email settings. CN is > collected as mandatory attribute. There are no further settings in the > form. > > By testing the form I got the following two issues: > > 1. Users with CN attribute, got this enquiry too. Is it possible to > prevent users with requested attribute from this enquiry? Not directly. Currently you need to create some auxiliary group in Unity, manually drag all users without CN to it and use this group as enquiry base group. We can think about some automation related to this aspect if the above approach is not acceptable for you. > 2. After submitting the CN via enquiry form the user still has no CN > attribute. My test users got the sys:FilledEnquires attribute but no CN > attribute. Did I something wrong or should there no CN attribute? The enquiry request needs to be accepted. Either manually or you can configure your enquiry form to auto-accept requests. The later is configured in form's -> 'automatically assigned settings' tab. Add 'autoProcess' action with 'accept' parameter. Note that I just found one bug around this scenario: enquiry without any identity won't be accepted. I'm working on a fix. Best, Krzysztof |
|
From: Sander A. <sa....@fz...> - 2017-01-27 09:43:56
|
Hi Krzysztof, We decided to "upgrade" the CN attribute from optional to mandatory. So we need to collect the CN from existing users. I want to use an enquiry form for it, because it seems to be perfect for it. On my test instance I created a very simple enquiry form. It is mandatory for users in root group. It has no email settings. CN is collected as mandatory attribute. There are no further settings in the form. By testing the form I got the following two issues: 1. Users with CN attribute, got this enquiry too. Is it possible to prevent users with requested attribute from this enquiry? 2. After submitting the CN via enquiry form the user still has no CN attribute. My test users got the sys:FilledEnquires attribute but no CN attribute. Did I something wrong or should there no CN attribute? Both issues occured in unity 1.9.2 and 1.9.4. Best regards, Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Dr. Karl Eugen Huthmacher Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt, Prof. Dr. Sebastian M. Schmidt ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Willem E. <wi...@cl...> - 2017-01-19 09:35:28
|
Hi, thanks for the quick reply. This is confirmed to solve the question. Best, Willem On 19/01/17 10:07, Krzysztof Benedyczak wrote: > Dear Willem, > > W dniu 19.01.2017 o 10:02, Willem Elbers pisze: >> Dear Krzysztof, >> >> is it possible to skip the list of registration forms when clicking the >> "Register new account" link in "/home/home"? >> >> We would like to have multiple registration forms, however the "register >> new account" link should always open one form and the other forms will >> be managed via invitations or by distributing public links. > > Yes, it is easily possible. See 13.1 section in documentation, > i.e. in endpoint config you will need something like: > > unity.endpoint.web.enabledRegistrationForms.1=yourEnabledForm > > If there is only one allowed form for endpoint, then there shouldn't > be the selector dialog - immediatelly the only available registration > should pop up. > > HTH > Krzysztof -- Willem Elbers CLARIN ERIC www.clarin.eu | tel: +31-(0)85-0091277 | skype: wjm.elbers |
|
From: Krzysztof B. <kb...@un...> - 2017-01-19 09:07:35
|
Dear Willem, W dniu 19.01.2017 o 10:02, Willem Elbers pisze: > Dear Krzysztof, > > is it possible to skip the list of registration forms when clicking the > "Register new account" link in "/home/home"? > > We would like to have multiple registration forms, however the "register > new account" link should always open one form and the other forms will > be managed via invitations or by distributing public links. Yes, it is easily possible. See 13.1 section in documentation, i.e. in endpoint config you will need something like: unity.endpoint.web.enabledRegistrationForms.1=yourEnabledForm If there is only one allowed form for endpoint, then there shouldn't be the selector dialog - immediatelly the only available registration should pop up. HTH Krzysztof |
|
From: Willem E. <wi...@cl...> - 2017-01-19 09:02:24
|
Dear Krzysztof, is it possible to skip the list of registration forms when clicking the "Register new account" link in "/home/home"? We would like to have multiple registration forms, however the "register new account" link should always open one form and the other forms will be managed via invitations or by distributing public links. Best, Willem -- Willem Elbers CLARIN ERIC www.clarin.eu | skype: wjm.elbers |
|
From: Krzysztof B. <kb...@un...> - 2017-01-17 21:57:05
|
Hi Sander, W dniu 16.01.2017 o 08:47, Sander Apweiler pisze: > Good morning, > > I recognised a longer response time if I browse to unity with remote > IdPs loaded from eduGain Metadata file. Last week I had some time to > investigate this "problem". Instance with eduGain IdPs has response > times between five and ten seconds. > > I investigated the communication with network tools from browser. The > POST call, where the browser sends some client information, causes this > delay. Some further investigation with tcpdump and wireshark at server > site shows that there is only traffic between client (browser) and > server (unity). Unity sends some keepalive packages. > > The long response time is on both instances with eduGain IdPs. There is > no delay on two instances without eduGain IdPs. But activating DFN IdPs > (loaded from metadata file) on one of them let increase the time for > POST method from 40ms to 400ms. > > Are there some Options to speed up the server? > Looked a bit into it. Unfortunately during authN UI preparation, there are two operations performed, both are roughly speaking of O(n^2) complexity, where n is the number of configured IdPs. As eduGain has ca 2100 IdPs it gets in fact way too slow. I've opened a ticket to track this with more details, we will need some rather complicated caching to have proper speed. https://app.assembla.com/spaces/unity-public/tickets/580 Let's move this thread to the ticket. Best, Krzysztof |
