Skip to main content

Prerequisites for Access to VISION

Audience​

This document is intended for IT professionals at Texas A&M System member institutions who are responsible for enabling institutional access to VISION.

To provide full access for your campus community, several integrations must be in place and validated. The prerequisites below describe each integration and how to test it.

Cloudflare IdP​

Cloudflare IdP must be configured for each Entra ID tenant that should be able to access VISION.

How to test​

  1. Find your institution in the list below.
  2. Open the link for your tenant.
  3. Sign in using your institutional credentials.
  4. Confirm that you receive the message: “Your connection works!”
  5. Take a screenshot of the result, whether successful or unsuccessful.
warning

All Entra ID tenants that serve your institution must be integrated for your full campus community to access VISION. If a tenant is missing, contact us with:

  • the tenant name, and
  • the population it serves at your institution

Institutions / tenants​

Cloudflare One​

Cloudflare One must be configured so institutional users can establish the required network path to VISION services.

How to test​

  1. Follow the steps in Step 5: Set Up Cloudflare One(opens in new window).
  2. Confirm that you can sign in and connect to Cloudflare One.
  3. You will be attempting to connect to a VISION login node.
  4. Attempt an SSH connection:
    ssh jdoe@login.vision.tamus.edu
  5. This is not a real user account and will not grant access. However, if connectivity is working, you should see:
    • the pre-login banner (authorized-use warning), followed by
    • a Password: prompt
  6. Take a screenshot of the result, whether successful or unsuccessful.
note

The example SSH command above in step 4 should work on MacOS, Linux, Windows with WSL and recent versions of Windows

Important​

If Cloudflare integration is not complete for a tenant, you may not be able to run this test. If that happens, let us know:

  • which tenant was unavailable, and
  • whether the issue was due to incomplete or nonfunctional integration

VISION Account Portal​

The Cirrus proxy integration must be complete and must pass the required user attributes into the VISION Account Portal.

Step 1: Validate attributes through Cirrus​

Test using your institutional account at:

https://tamu-uat.proxy.cirrusidentity.com/demo.php(opens in new window)

After signing in:

  1. Expand the AuthData section.
  2. Review the returned attributes.
  3. Take a screenshot of the results. If needed, take multiple screenshots to capture all values.

Required attributes​

The following attributes are required:

Preferred attributes​

Optional attributes​

Some of the following may only pass through when using an Entra ID integration with Cirrus:

  • tenant_id = ‘http://schemas.microsoft.com/identity/claims/tenantid‘
  • entra_object_id = ‘http://schemas.microsoft.com/identity/claims/objectidentifier‘
  • eduPersonAffiliation (affiliation) = ‘urn:oid:1.3.6.1.4.1.5923.1.1.1.1‘
  • mail (preferred_email) = ‘urn:oid:0.9.2342.19200300.100.1.3‘
  • displayName (full_name) = ‘urn:oid:2.16.840.1.113730.3.1.241‘
  • authnMethods = ‘http://schemas.microsoft.com/claims/authnmethodsreferences‘

Step 2: Validate sign-in to the VISION Account Portal​

Next, test sign-in at:

https://account.vision.tamus.edu(opens in new window)

You should be able to sign in through Cirrus even if you do not yet have an active VISION account.

Important Note​

After your first successful sign-in:

  1. Click your name in the top-left corner
  2. Select Sign out
  3. Sign in again through Cirrus

The second sign-in attempt is required so we can confirm that the id attribute is consistent across logins. In some misconfigurations, the first login may return an incorrect value that does not match later attempts.

Take a screenshot of the result from your second login attempt.

Open OnDemand Portal​

Cloudflare integration must be active for all member Entra tenants and must pass the correct UPN for each tenant.

How to test​

Test at:

https://portal.vision.tamus.edu(opens in new window)

If integration is working but the user does not yet have an active account, you may see a result similar to:

Error -- can't find user for username_domain.name
Run 'nginx_stage --help' ...

The _ character in username_domain.name is expected and intentional. It replaces the @ character.

Take a screenshot of the result, whether successful or unsuccessful.

CILogon​

CILogon integration is required for Globus access.

How to test​

  1. Go to https://cilogon.org/(opens in new window)
  2. Find your institution in the dropdown list
  3. Sign in with your institutional credentials

For additional help, see the CILogon FAQ(opens in new window).

Expected user attributes​

Ideally, the following user attributes should be present. Be sure that ePTID and ePPN both have values.

  • CILogon User Identifier
  • Identity Provider (entityID)
  • ePTID (eduPersonTargetedID)
  • ePPN (eduPersonPrincipalName)
    • This should match userPrincipalName in Active Directory
  • First Name (givenName)
  • Last Name (sn)
  • Display Name (displayName)
  • Email Address
  • AuthnContextClassRef
  • Affiliation

Expected identity provider attributes​

You should also see these identity provider attributes:

Take a screenshot of the result, or note if your institution does not appear in the list.

Globus​

Globus can be enabled after CILogon is working.

How to test​

  1. Go to https://app.globus.org(opens in new window)
  2. Check whether your institution appears in the list of available institutions
  3. If it does, attempt to sign in with your institutional credentials

You may already have Globus access through another method, such as an ACCESS account, but for this validation step you must test your institution’s identity integration.

Take a screenshot of the result, or note if your institution does not appear in the list.

Need Help?​

After testing each prerequisite, if any step does not work, email help@vision.tamus.edu to open a support ticket.

Please include:

  • your institution
  • the integration you tested
  • whether the test succeeded or failed
  • screenshots of the result
  • any relevant notes about missing tenants, missing attributes, or error messages

We will work with you to resolve any issues.