The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Winter <address@concealed>]

Hello,

I appreciate that you are favoring reality instead of correctness, but if that check gets removed every other institution will receive more support calls from people who don't input the expected NAI domain on the installer.

Can this be a configuration item checked on by default, instead? "inner User-Name domain must match outer (anonymous) identifier's domain"

That is already configurable. You can require the user-entered ID to end in a specific realm (and that is then the same realm as the outer; we only ask for one realm and use it both for outer /and/ for this optional check).

If you unset this "check" checkbox (pun not intended) then the argument is that we shouldn't be performing /any/ checks. Right now we do run those basic checks the IdP didn't ask for; that's the (much smaller) problem space at hand here.

Greetings,

Stefan

Regards,

Alberto

To unsubscribe, send this message: mailto:address@concealed?subject=unsubscribe%20cat-users
Or use the following link: https://lists.geant.org/sympa/sigrequest/cat-users

Attachment: 0xC0DE6A358A39DC66.asc
Description: application/pgp-keys

Attachment: signature.asc
Description: OpenPGP digital signature