Nextcloud AAI evaluation : Didmos

[darnold-zalf]

Steps done so far (all done on production nextcloud https://nextcloud.fairagro.net unless noted otherwise)

Carmen/I are keeping this documented updated : https://nextcloud.fairagro.net/apps/onlyoffice/18081?filePath=%2FFAIRagro%2F06_TA_Ordner%2FTA4%2FM4.2%2Fmeetings%20-%20protocols%2FIAM4NFDI%20Inkubator%2FDidmos_Meeting_Notes.docx

• [x] SAML entries manually entered into nextcloud at https://nextcloud.fairagro.net/settings/admin/saml
  • [x] x509 self-signed certificate uploaded
  • [x] metadata file generated and provided to Didmos/DAASI team
    • [x] Note the metadata file comes with a 2-day validity , however this can be manually adjusted to 1 year in advance.
• [x] 16.October meeting w/ Ali Haider (Didmos)/Carsten/Carmen/Stephan
  • [x] Verified SAML metadata file (once Ali manually updated the validUntil field to 1 year in future)
    • [x] Ail needed to jenkins-rebuild his staging environment with the updated SAML metadata file (?)
  • [x] Carsten verified SAML connection from https://nextcloud.fairagro.net ('Federated FAIRagro log in') to the Didmos/DAASI staging environment, however ..
  • [x] .. there were issues with the staging LDAP account/service in the auth.staging.nfdi-aai.daasi.de environment
• [x] 16-23 October : Ali fixed the staging LDAP account
  • [x] New test account created at https://auth.staging.nfdi-aai.daasi.de/
  • [x] testuser@nfdi.com
• [x] 23.October: "Account not provisioned" error.
  • [x] Fixed by loading the correct IdP certificate in the correct format
• [x] 23.October-5.November : "IDP parameter for the UID not found. Possible parameters are"
  • [x] Download + install SAML tracer for chrome + give results to Ali
  • [x] Attribute mappings need to be correctly setup
• [x] 5.November: Attribute mappings w/ Ali + Carmen:
  • [x] With the below attributes mapped, the testuser can now SAML-login to NC
    • [x] displayname = urn:oid:2.16.840.1.113730.3.1.241
    • [x] email address = urn:oid:0.9.2342.19200300.100.1.3
    • [x] Group Mapping Prefix, default: SAML_ = urn:geant:dfn.de:nfdi.de:group
• [ ] Still todo: 'Group too long error'
  • [ ] Ali to check with his team and get back to us.
  • [ ] note: Carmen Scheuner (?) created the proper nextcloud groups in the production didmos environment, but we are currently testing against the staging didmos environment, so the groups we setup in prod aren't in staging.
  • [ ] 18.November : sent followup email to Ali
    • [ ] group-too-long-error
    • [ ] testuser@nfdi.com no longer works
    • [ ] although we config didmos SAML against staging didmos, the didmos-login connects to the prod login portal

NC notes

These MUST be backported into the repo/helm:

1. self-signed cert/key we manually created
2. The attribute mappings

SAML notes

https://auth.didmos.nfdi-aai.de/Saml2/saml2_backend.xml https://auth.staging.nfdi-aai.daasi.de/Saml2/saml2_backend.xml