The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Hunter Fuller <hf0002 AT uah.edu>]

Tomasz,

I like the approach you alluded to - linking directly to the
installers, etc. The problem is I'm not sure how to do it, or what
methods are supported. Is there documentation about this?

We too have had a lot of issues with the CAT page and specifically the
Android and Chromebook ones since they pop up a bunch of tiny text and
there is a "Continue" button. People usually think a lot of tiny text
is a license agreement or terms of service, so they ignore it and
click "Continue." Then their system downloads a file and they don't
know what to do with it so they open a ticket.

We do have a good relationship with our Office of Marketing and
Communications, so we can have them design our page. And so we would
already be linking directly to the installer but the problem is that
the URL bar does not change if you select an OS in CAT. So we don't
know how to do this. It seems bad to deep link to a download with a
long URL that could change at any time. And I don't see this listed
anywhere as a supported method, so as far as I know, it could change
tomorrow. Is there a summary of how to do this in a supported way?


--
Hunter Fuller (they)
Router Jockey
VBH M-1C
+1 256 824 5331

Office of Information Technology
The University of Alabama in Huntsville
Network Engineering

On Tue, Jul 18, 2023 at 2:39 PM Tomasz Wolniewicz
<cat-users AT lists.geant.org> wrote:
>
> Hi Paul,
>
> I suppose the difference between a static page and a jQuery application
> is a matter of taste.  We have designed CAT so that you can develop
> multiple "skins" that you can specify by the request argument. In fact
> we never got as far as creating another skin, but this possibility would
> allow you to play with an alternative approach while not breaking the
> current GUI.
>
> If you really do not like the workflow provided by CAT than you can
> easily change it. Build your own info pages, then make them to be
> redirection targets from CAT. On your local instruction pages use deep
> links to CAT installers and you will achieve the same result with the
> design that you find best suited for your users. I believe you do pretty
> much that on your pages, but not use CAT redirects.
>
> As Stefan mentioned, we are expecting to turn to the application
> approach. You say you are not  fan, but there are also very good
> arguments why an app is good;
>
> a) With the app approach you do not really need OS specific
> instructions, the workflow can be identical everywhere and the app just
> does most of the work.
>
> b) An app could realise that the root certificate is going to exppire
> and notify to do an update of the installation profile, or do that in
> the background.
>
> c) The app can be well suited for the given OS giving a better user
> experience
>
> d) Our Windows installers are built per institution. They are signed, of
> course, but systems depending on app reputation can give a higher score
> to a single universal app.
>
> e) For Apple devices we provide the mobileconfig files but Apple made it
> quite difficult to install them, again an app just takes care of all the
> complexity.
>
> Your Android instructions are to install the app and then go to CAT to
> het the profile. This is not necessary. Install the app and use it to
> select the institution. The app will pull the profile from CAT and do
> the installation.
>
> You suggest supporting ONC format, this can be done but usng it will
> require very specific instructions for a given device.
>
> Some more answers below
>
>
> W dniu 14.07.2023 o 15:31, Paul Menzel (via cat-users Mailing List) pisze:
> > Dear colleagues,
> >
> >
> > Due to the DFN PKI abandonment, my organization’s Radius server
> > certificate expired and needed to be replaced. (We started to use our
> > own Eduroam CA [1].) Therefore, all user devices needed to be updated.
> >
> > Unfortunately, it wasn’t smooth sailing in several cases. The
> > institute specific cat.eduroam.org URL for our institute [2] is shared
> > with the users, but my expectation, that the page contains all
> > necessary information, is not met, and additional documentation in
> > different languages has to be written. My institute instructions are
> > at the end.
> >
> > If my expectation is not unreasonable, I see the following pain points
> > with the Web page.
> >
> > 1.  The wording is confusing. For Android users it’s not clear, they
> > need to install the “app” first. The small infobox is often overlooked.
>
> You must realize that we have a uniform design for downloads. Android is
> a special case. The info box pops up and has the Continue button at the
> bottom. If the users are not willing to read the info then I do not know
> how we can make them by changing the layout. You can force the redirect
> to a local page if you like to provide more detailed info. This can be
> done for a specific device only.
>
> >
> > 2.  The instructions on the Web page also sound like, you get the
> > program from the Web page, but it’s only a configuration file.
>
> The message says:
>
> "Before you proceed with installation on Android systems, please make
> sure that you have installed the geteduroam application. This
> application is available from these sites: Google Play, as local
> download and will use the configuration file downloaded from CAT to
> create all necessary settings."
>
> This gives clear instructions where to get the app from.
>
> >
> >> Laden Sie Ihr Installationsprogramm herunter für Chrome OS
> >
> >> Laden Sie Ihr Installationsprogramm herunter für Apple Gerät
> >
> >> Laden Sie Ihr Installationsprogramm herunter für Android 8 und höher
> >
> > The wording is confusing, as it’s a configuration file for the first
> > two, and for Android users seem to have to install an App from the app
> > store first, which is only shown in the infobox.
> One could argue that we should display the information about downloading
> the app ABOVE the button, however I am quite sure that people would read
> this even less. I believe that the popup draws more attention. To be
> sure we would need to test this with actual users.
> >
> > 3.  Looking at the information/details, there is no difference in the
> > description (i symbol) of the two Android options.
> >
> >     > Android 8 und höher
> >     > Dies ist eine generische Konfigurationsdatei im IETF EAP
> > Metadata -00 XML Format.
> >
> >     > Android 4.3 bis 7
> >     > Dies ist eine generische Konfigurationsdatei im IETF EAP
> > Metadata -00 XML Format.
> This is of course on oversight that should be fixed - unfortunately all
> texts need to go trough the translation process so it is difficult to
> fix this in a moment.
> >
> > 4.  Due to the variety of Android versions, there are always users
> > with phones where the procedure does not work, and need help from the
> > IT staff.
> >
> > 5.  The information is hidden behind buttons, when clicked on opening
> > a popup, which often contains only little text. This information
> > should be directly and more prominently visible.
> I am not sure what you mean by this, could you be more specific?
> >
> > 6.  The download URL for files is not visible, hovering over the buttons.
> Again, could you provide some screens? On my devices the download links
> are clearly visible in the download confirmation page.
> >
> > 7.  Back and forward buttons do not work, when switching the operating
> > system, as it’s not separate pages.
> Correct. This is how we have designed it I suppose one could consider
> implementing reactions to back and forward.
> >
> > 8.  The Web site does not offer to just show the configuration and to
> > download the certificate for manual use.
> This would be against the very idea of CAT. Providing certificates and
> instructions was how we were beginning with eduroam. CAT was made to
> relieve users of this task. Only experienced users are capable of doing
> the manual installation.
> >
> > 9.  The Web site is not responsive, and therefore looks bad on a
> > mobile device.
> I agree that responsiveness is not perfect but saying that the interface
> is just not responsive seems an overstatement.
> >
> > 10.  My institute name is spelled differently in German and English,
> > so sometimes it’s not found in the apps. Sometimes it’s not found at all.
> Stefan has already replied to that, and I suppose you have added both
> names - I checked that searching does work correctly.
> >
> > 11. Accessing the page 1.86 MB are transferred (1.17 MB for
> > jquery.js). It takes over 500 ms to load.
> 0,5s does not seem to be a very long time to me. Also please remember
> that a single user is going to use this page once for each device. One
> important part of tuning is the download if the list of available
> institutions. This is happening in the background. Normally the user
> will open the page and probably hang for a few moments before moving on.
> In this time the list is already available and appears instantly.
> >
> > 12. According to PageSpeed Insights, it’s not fully accessible [3][4].
> >
> > As every second saved in setup time saves the user and the support
> > staff time, for this many Eduroam users (millions?), it would be
> > really great, if a new (static) Web site could be created.
>
> Do you really think that saving  a few seconds per user is going to make
> a change? Multiplying by millions makes this BIG but we re not serving
> millions in our institutions. And in fact this is another argument for
> the app approach, we are hearing that number of support cases drop
> drastically when people start using geteduroam.
>
> Cheers
>
> Tomasz
>
>
> >
> >
> > Kind regards,
> >
> > Paul
> >
> >
> > PS: Why is a script for Linux created instead of extending
> > NetworkManager to support a configuration file? Users should not have
> > to run random unverifiable scripts from the internet. I created a
> > ticket for NetworkManager for ONC support [5].
> >
> >
> > [1]: https://github.com/buczek/eduroam-ca/
> > [2]: https://cat.eduroam.org/?idp=5807
> > [3]:
> > https://pagespeed.web.dev/analysis/https-cat-eduroam-org/0hp5z32jx6?form_factor=mobile
> > [4]:
> > https://pagespeed.web.dev/analysis/https-cat-eduroam-org/0hp5z32jx6?form_factor=desktop
> > [5]:
> > https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/1348
> >      "No support for Open Network Configuration (ONC) configuration
> > files (#1348)"
> >
> > PPS: Our instructions in the intranet (also translated to German):
> >
> > for Android:
> >
> >     For Android 8 and newer: Install the geteduroam-App from the
> > Google Play store
> > (https://play.google.com/store/apps/details?id=app.eduroam.geteduroam)
> >     For Android 7 and older: Install the eduroam CAT-App from the
> > Google Play store
> > (https://play.google.com/store/apps/details?id=uk.ac.swansea.eduroamcat)
> >     Use the eduroam CAT (Configuration Assistent Tool) at
> > https://cat.eduroam.org/?idp=5807
> >     Enter your username according to user AT molgen.mpg.de and your
> > password (ideally set at the start of the setup)
> >
> > for iOS (iPhones and iPads):
> >
> >     On iPhones and iPads, make sure to use the Safari browser (not
> > Chrome). You should have installed at least iOS 12.1.1
> >     Use the eduroam CAT (Configuration Assistent Tool) at
> > https://cat.eduroam.org/?idp=5807
> >     After installing the profile from the CAT-tool, please remove any
> > existing WLAN eduroam (“Forget This Network”) and then activate the
> > downloaded profile via Settings > General > Profiles & Device Management.
> >     In newer version of iOS you can find the profiles via Settings >
> > General > VPN & Device Management.
> >     If you are asked for credentials use your username acording to
> > user AT molgen.mpg.de and your password (ideally set at the start of the
> > setup)
> >
> > for GNU/Linux:
> >
> >     Use the eduroam CAT (Configuration Assistent Tool) at
> > https://cat.eduroam.org/?idp=5807
> >     You might need to execute the file from the command line. Open a
> > terminal, enter `python ` (with space at the end), and drag the file
> > into the terminal. Then, press the enter key.
> >     If you are asked for credentials use your username acording to
> > user AT molgen.mpg.de and your password (ideally set at the start of the
> > setup)
> >
> > for Windows / macOS:
> >
> >     Use the eduroam CAT (Configuration Assistent Tool) at
> > https://cat.eduroam.org/?idp=5807
> >     If you are asked for credentials use your username according to
> > user AT molgen.mpg.de and your password (ideally set at the start of the
> > setup)
> > To unsubscribe, send this message:
> > mailto:sympa AT lists.geant.org?subject=unsubscribe%20cat-users
> > Or use the following link:
> > https://lists.geant.org/sympa/sigrequest/cat-users
>
> --
> Tomasz Wolniewicz
>            twoln AT umk.pl        http://www.home.umk.pl/~twoln
>
> Uniwersteckie Centrum Informatyczne   Information&Communication Technology 
> Centre
> Uniwersytet Mikolaja Kopernika        Nicolaus Copernicus University,
> pl. Rapackiego 1, Torun               pl. Rapackiego 1, Torun, Poland
> tel: +48-56-611-2750                  tel kom.: +48-693-032-576
>