The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Tomasz Wolniewicz <twoln AT umk.pl>]

Hi Paul,

I suppose the difference between a static page and a jQuery application 
is a matter of taste.  We have designed CAT so that you can develop 
multiple "skins" that you can specify by the request argument. In fact 
we never got as far as creating another skin, but this possibility would 
allow you to play with an alternative approach while not breaking the 
current GUI.

If you really do not like the workflow provided by CAT than you can 
easily change it. Build your own info pages, then make them to be 
redirection targets from CAT. On your local instruction pages use deep 
links to CAT installers and you will achieve the same result with the 
design that you find best suited for your users. I believe you do pretty 
much that on your pages, but not use CAT redirects.

As Stefan mentioned, we are expecting to turn to the application 
approach. You say you are not  fan, but there are also very good 
arguments why an app is good;

a) With the app approach you do not really need OS specific 
instructions, the workflow can be identical everywhere and the app just 
does most of the work.

b) An app could realise that the root certificate is going to exppire 
and notify to do an update of the installation profile, or do that in 
the background.

c) The app can be well suited for the given OS giving a better user 
experience

d) Our Windows installers are built per institution. They are signed, of 
course, but systems depending on app reputation can give a higher score 
to a single universal app.

e) For Apple devices we provide the mobileconfig files but Apple made it 
quite difficult to install them, again an app just takes care of all the 
complexity.

Your Android instructions are to install the app and then go to CAT to 
het the profile. This is not necessary. Install the app and use it to 
select the institution. The app will pull the profile from CAT and do 
the installation.

You suggest supporting ONC format, this can be done but usng it will 
require very specific instructions for a given device.

Some more answers below


W dniu 14.07.2023 o 15:31, Paul Menzel (via cat-users Mailing List) pisze:
> Dear colleagues,
>
>
> Due to the DFN PKI abandonment, my organization’s Radius server 
> certificate expired and needed to be replaced. (We started to use our 
> own Eduroam CA [1].) Therefore, all user devices needed to be updated.
>
> Unfortunately, it wasn’t smooth sailing in several cases. The 
> institute specific cat.eduroam.org URL for our institute [2] is shared 
> with the users, but my expectation, that the page contains all 
> necessary information, is not met, and additional documentation in 
> different languages has to be written. My institute instructions are 
> at the end.
>
> If my expectation is not unreasonable, I see the following pain points 
> with the Web page.
>
> 1.  The wording is confusing. For Android users it’s not clear, they 
> need to install the “app” first. The small infobox is often overlooked.

You must realize that we have a uniform design for downloads. Android is 
a special case. The info box pops up and has the Continue button at the 
bottom. If the users are not willing to read the info then I do not know 
how we can make them by changing the layout. You can force the redirect 
to a local page if you like to provide more detailed info. This can be 
done for a specific device only.

> 2.  The instructions on the Web page also sound like, you get the 
> program from the Web page, but it’s only a configuration file.

The message says:

"Before you proceed with installation on Android systems, please make 
sure that you have installed the geteduroam application. This 
application is available from these sites: Google Play, as local 
download and will use the configuration file downloaded from CAT to 
create all necessary settings."

This gives clear instructions where to get the app from.

> > Laden Sie Ihr Installationsprogramm herunter für Chrome OS
>
> > Laden Sie Ihr Installationsprogramm herunter für Apple Gerät
>
> > Laden Sie Ihr Installationsprogramm herunter für Android 8 und höher
>
> The wording is confusing, as it’s a configuration file for the first 
> two, and for Android users seem to have to install an App from the app 
> store first, which is only shown in the infobox.
One could argue that we should display the information about downloading 
the app ABOVE the button, however I am quite sure that people would read 
this even less. I believe that the popup draws more attention. To be 
sure we would need to test this with actual users.
> 3.  Looking at the information/details, there is no difference in the 
> description (i symbol) of the two Android options.
>
>     > Android 8 und höher
>     > Dies ist eine generische Konfigurationsdatei im IETF EAP 
> Metadata -00 XML Format.
>
>     > Android 4.3 bis 7
>     > Dies ist eine generische Konfigurationsdatei im IETF EAP 
> Metadata -00 XML Format.
This is of course on oversight that should be fixed - unfortunately all 
texts need to go trough the translation process so it is difficult to 
fix this in a moment.
> 4.  Due to the variety of Android versions, there are always users 
> with phones where the procedure does not work, and need help from the 
> IT staff.
>
> 5.  The information is hidden behind buttons, when clicked on opening 
> a popup, which often contains only little text. This information 
> should be directly and more prominently visible.
I am not sure what you mean by this, could you be more specific?
> 6.  The download URL for files is not visible, hovering over the buttons.
Again, could you provide some screens? On my devices the download links 
are clearly visible in the download confirmation page.
> 7.  Back and forward buttons do not work, when switching the operating 
> system, as it’s not separate pages.
Correct. This is how we have designed it I suppose one could consider 
implementing reactions to back and forward.
> 8.  The Web site does not offer to just show the configuration and to 
> download the certificate for manual use.
This would be against the very idea of CAT. Providing certificates and 
instructions was how we were beginning with eduroam. CAT was made to 
relieve users of this task. Only experienced users are capable of doing 
the manual installation.
> 9.  The Web site is not responsive, and therefore looks bad on a 
> mobile device.
I agree that responsiveness is not perfect but saying that the interface 
is just not responsive seems an overstatement.
> 10.  My institute name is spelled differently in German and English, 
> so sometimes it’s not found in the apps. Sometimes it’s not found at all.
Stefan has already replied to that, and I suppose you have added both 
names - I checked that searching does work correctly.
> 11. Accessing the page 1.86 MB are transferred (1.17 MB for 
> jquery.js). It takes over 500 ms to load.
0,5s does not seem to be a very long time to me. Also please remember 
that a single user is going to use this page once for each device. One 
important part of tuning is the download if the list of available 
institutions. This is happening in the background. Normally the user 
will open the page and probably hang for a few moments before moving on. 
In this time the list is already available and appears instantly.
> 12. According to PageSpeed Insights, it’s not fully accessible [3][4].
>
> As every second saved in setup time saves the user and the support 
> staff time, for this many Eduroam users (millions?), it would be 
> really great, if a new (static) Web site could be created.

Do you really think that saving  a few seconds per user is going to make 
a change? Multiplying by millions makes this BIG but we re not serving 
millions in our institutions. And in fact this is another argument for 
the app approach, we are hearing that number of support cases drop 
drastically when people start using geteduroam.

Cheers

Tomasz


> Kind regards,
>
> Paul
>
>
> PS: Why is a script for Linux created instead of extending 
> NetworkManager to support a configuration file? Users should not have 
> to run random unverifiable scripts from the internet. I created a 
> ticket for NetworkManager for ONC support [5].
>
>
> [1]: https://github.com/buczek/eduroam-ca/
> [2]: https://cat.eduroam.org/?idp=5807
> [3]: 
> https://pagespeed.web.dev/analysis/https-cat-eduroam-org/0hp5z32jx6?form_factor=mobile
> [4]: 
> https://pagespeed.web.dev/analysis/https-cat-eduroam-org/0hp5z32jx6?form_factor=desktop
> [5]: 
> https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/1348
>      "No support for Open Network Configuration (ONC) configuration 
> files (#1348)"
>
> PPS: Our instructions in the intranet (also translated to German):
>
> for Android:
>
>     For Android 8 and newer: Install the geteduroam-App from the 
> Google Play store 
> (https://play.google.com/store/apps/details?id=app.eduroam.geteduroam)
>     For Android 7 and older: Install the eduroam CAT-App from the 
> Google Play store 
> (https://play.google.com/store/apps/details?id=uk.ac.swansea.eduroamcat)
>     Use the eduroam CAT (Configuration Assistent Tool) at 
> https://cat.eduroam.org/?idp=5807
>     Enter your username according to user AT molgen.mpg.de and your 
> password (ideally set at the start of the setup)
>
> for iOS (iPhones and iPads):
>
>     On iPhones and iPads, make sure to use the Safari browser (not 
> Chrome). You should have installed at least iOS 12.1.1
>     Use the eduroam CAT (Configuration Assistent Tool) at 
> https://cat.eduroam.org/?idp=5807
>     After installing the profile from the CAT-tool, please remove any 
> existing WLAN eduroam (“Forget This Network”) and then activate the 
> downloaded profile via Settings > General > Profiles & Device Management.
>     In newer version of iOS you can find the profiles via Settings > 
> General > VPN & Device Management.
>     If you are asked for credentials use your username acording to 
> user AT molgen.mpg.de and your password (ideally set at the start of the 
> setup)
>
> for GNU/Linux:
>
>     Use the eduroam CAT (Configuration Assistent Tool) at 
> https://cat.eduroam.org/?idp=5807
>     You might need to execute the file from the command line. Open a 
> terminal, enter `python ` (with space at the end), and drag the file 
> into the terminal. Then, press the enter key.
>     If you are asked for credentials use your username acording to 
> user AT molgen.mpg.de and your password (ideally set at the start of the 
> setup)
>
> for Windows / macOS:
>
>     Use the eduroam CAT (Configuration Assistent Tool) at 
> https://cat.eduroam.org/?idp=5807
>     If you are asked for credentials use your username according to 
> user AT molgen.mpg.de and your password (ideally set at the start of the 
> setup)
> To unsubscribe, send this message: 
> mailto:sympa AT lists.geant.org?subject=unsubscribe%20cat-users
> Or use the following link: 
> https://lists.geant.org/sympa/sigrequest/cat-users

--
Tomasz Wolniewicz
          twoln AT umk.pl        http://www.home.umk.pl/~twoln

Uniwersteckie Centrum Informatyczne   Information&Communication Technology 
Centre
Uniwersytet Mikolaja Kopernika        Nicolaus Copernicus University,
pl. Rapackiego 1, Torun               pl. Rapackiego 1, Torun, Poland
tel: +48-56-611-2750                  tel kom.: +48-693-032-576

Attachment: smime.p7s
Description: Kryptograficzna sygnatura S/MIME