Getting access to the Internal Wiki

From neicext
Jump to navigation Jump to search

Prerequisistes

Make sure you are legit to get access to the internal wiki: What is your context to NeIC (member of steering group, reference group, staff in one of the projects, technical advisor, NeIC alumni, NeIP, ..)? Ask your main NeIC contact for what groups you should be part of in the internal wiki.

Variant A: Federated Login

We can provide federated login though members of eduGAIN thanks to WAYF.

You just have to find out what your service specific pseudonym is. It is the pseudonym presented by the identity provider to the service. If you missed it during the login process, you can see it at https://login.nbi.ku.dk/wayf/info.


In order to find out what your service specific pseudonym is you log in via your identity provider (e.g. WAYF) and just read it on the login page or on the next page (e.g. login.nbi.dk) as "WebAuth Confirm". The pseudonym has the format of abbreviation of federation (like "WAYF-DK-") followed by a hexadecimal number.

Variant B: X.509 Certificate

A web server providing https, authenticates itself to visitors using an X.509 server certificate. Symmetrically, you can authenticate yourself to the web server with a X.509 user certificate.

Getting a Certificate

If you don't have a certificate yet, you can try to request one from DigiCert via Single-Sign-On. Select the Grid Premium if you have that option, otherwise Premium will work too, and omit the "CSR" for automatic installation into the web browser. We can add support for other accredited providers. If you are familiar with X.509 infrastructure, see also "Expert Options" for additional accredited sources. Otherwise, Petter Urkedal can provide you with a certificate for internal use.

If the certificate was not installed during during the request process, you should have received a download in PKCS#12 (*.p12) format (or see the "Expert Options"). The download can be installed into the certificate registry by double clicking or by a browser-dependent option. From Firefox use "Preferences" / "Privacy and Security" / "Certificates" / "View Certificates" / "Your Certificates" / "Import...".

Expert Options

In addition to DigiCert, any IGTF accredited CA is accepted, see EUGridPMA for a full list. With this option, you will typically generate and receive certificates in PEM format. See the instructions from SNIC on how to convert it. Note that the created cert+key.p12 file is to be equally protected as your previous userkey.pem!. See also SNIC Docs Introduction to certificates.

Determining Its Subject DN

A distinguished name (DN) is an identifier for a person, organization, etc. in the format used by the X.509 standard. The subject DN of an X.509 certificate is the owner of the certificate. It serves as your identity when you allow a web page to authenticate you with using the certificate. Depending on the provider, your subject DN may look something like

/DC=org/DC=terena/DC=tcs/C=SE/O=Example Organization/CN=John Doe jdoe@example.org

Assuming you already installed the certificate in your browser, you can check your subject DN at https://wiki.neic.no/my-id.

Enabling your credentials for the wiki

Variant A: In the case of federated log-in

Send your service specific pseudonym to Petter Urkedal together with the context why you need access to the internal wiki and eventual groups you should get access to. Make sure to CC your main NeIC contact. Petter will then add it to the access control list for the wiki and thereby enable you.

After you have been enabled you will be able to login via the "login via Kalmar2 " button in the upper right corner of the wiki page.

Variant B: In the case of certificate log-in

Send the subject name of your certificate to Petter Urkedal together with the context why you need access to the internal wiki and eventual groups you should get access to. Make sure to CC your main NeIC contact. Petter will then add it to the access control list for the wiki and thereby enable you.

Afterwards you will be able to login via the "login with X509" button in the upper right corner of the wiki page.