eduroam CAT - admin improvements andtesting RADIUS infrastructure

Tomasz Wolniewicz
Maja Górecka-Wolniewicz
Poznan supercomputing and networking center
Mobility Day – TNC24, Rennes, 10.06.2024
Publicwww.geant.org

CAT release 2.1.2• support for device-specific options displayed only for devices they belong to• warnings about certificate expiry and certificates without CA extensions to the profile management interface,
block adding bad certificates to the system• read-only mode for NRO admins and superadmins; enhancement of the NRO management page, in particular
icons showing status, certificate validity problems and OpenRoaming readiness• new script to be used to test the OpenRoaming readiness of IdPs
• per-idp statistics to the API calls STATISTICS-FED• FLAG-NO-LOGO flag for DATADUMP-FED to eliminate logos from the dump
• replace Quetto icons with the Tabler ones
• new SUPPORT role with read-only access to IdP settings• a rewrite of dynamic connectivity tests• extensions to the eduPKI server certificates interface to display detailed information about certificates to beissued• multiple improvements to the code, in particular eliminating the deprecated FILTER_SANITIZE_STRING usage• optional local cache of the external (eduroam) database• replaced slow SQL queries in Managed IdP area with much faster ones
• fixed blocking of Ajax requests caused by php sessions• new language - Welsh
2

www.geant.org

Device-specific options

3

www.geant.org

Server certificates and missing CA extensions

4

www.geant.org

Blocking bad certificates5

www.geant.org

Admin API extensions• Introduced flags as possible names for PARAMETERS withadmissible values of TRUE or FALSE (currently just oneflag exists)• Action DATADUMP-FED• New flag FLAG-NO-LOGO• Removes logos from the federation dump to make it smaller and easierto handle• Action STATISTICS-FED (request by Stefan Paetow)• New attribute ATTRIB-DETAIL• Possible values: FEDERATION, ORGANISATIONS, PROFILES• Adds download statistics of appropriate detail6

www.geant.org

The geteduroam download page

7

www.geant.org

New geteduroam download pages in CAT• Only 24 profiles (23 institutions) are production-ready withgeteduroam option set correctly and no redirection

8Profile
QMUL eduroam
eduroam@wcg
eduroam TEST profile
Eduroam
University of Warwick
No Intermediate
personnels ou prestataires
Eduroam-AD(staff)
Older username/password method - Staff and Students
MPIPKS eduroam + pks-members
Bilborough College
Gateway College
SMUCB Eduroam
eduroam
USask - eduroam
Pravni fakultet u Kragujevcu

Organisation
Queen Mary University of London
Warwickshire College Group
HEAnet CLG
University of Franche-Comte
University of Warwick
CAT Training Organization
GIP RENATER
University of Foggia
Birmingham Newman University
Max Planck Institute for the Physics of Complex Systems MPIPKS
BFmat
BFmat
St Mary's University College, Belfast
Karadeniz Technical University
University of Saskatchewan
Faculty of Law, University of Kragujevac

FedUKUKIEFRUKCAFRITUKDEUKUKUKTRCARSAll Groups
Met Office (2024)
Havforskningsinstituttet
eduroam

CISIA - Consorzio Interuniversitario Sistemi Integrati per l'Accesso
Queen's University at Kingston
Met Office
Havforskningsinstituttet
Deutsches Zentrum fuer Luft- und Raumfahrt e. V.

ITCA
UKNO
DEeVA.eduroam.ca

TUBITAK ULAKBIM
eduroam Visitor Access CanadaTRCAGaziantep UniversityTR

www.geant.org

The NRO page functionality• Quick name/realm filter• Checkbox filters• bad/incomplete configuration• OpenRoaming settings• Expiring/expired certificates• If multiple federations are managed, filters act separatelyon each
• Ability to view all federations for superadmin and support• Quick demo
9

www.geant.org

10

www.geant.org

11

www.geant.org

12

www.geant.org

13

www.geant.org

14

www.geant.org

15

www.geant.org

16

www.geant.org

Some OpenRoaming statistics from CAT• 11 federations allowing OpenRoaming for their IdPs

How many institutions are using this?

17

www.geant.org

Some OpenRoaming statistics from CAT• Only 8 profiles are production-ready with OpenRomaing set
and no redirection and they come from 5 institutions
ProfileInstitution

FedOpenRoaming TEST Profile

HEAnet CLG

IE

Eduroam para Colaboradores
FCCN

FCCN - Unidade da FCT I.P.

PT

student

Perdana University

MYvisitor

Perdana University

MYstaff

Perdana University

MYeduroam plus edu RCOI

Camford University (eduroam UK)

UK

Personnel ESIEAESIEA - École supérieure d'informatique électronique automatique

FREtudiants ESIEAESIEA - École supérieure d'informatique électronique automatique

FR18

www.geant.org

Reachability / Diagnostics tests• Organisation Overview page for each defined profile when a profile realm is setbutton
to conduct a test for a given realm• Diagnostic tests are also available from Help menu
o tests for end-usero tests for eduroam administrator• Realm check tests in both places are executedalmost in the same way
o tests are done in parallelo UDP reachability – via eapol_testo additional tests when realm is declared as dynamic,
i.e. having NAPTR, SRV records or openroaming – via openssl
o “check realm reachability” test of profile prepared
for an institution includes such settings as outer identityand verifies server certificate using CA certificate indicated in this profile

19

www.geant.org

Dynamic connectivity tests• Include
o getting information on all dynamic hostso verifying CA certificate (as an eduPKI certificate with correctly set policies)o checking communication with each host using different client certificates: correct, expired, revoked,
with wrong policies setting, issued by not accredited CA• Openssl commando used from the very beginning for tests
o after switching to Ubuntu 22 and openssl 3 some issues appearedo openssl does not give a precise return code and never done that before – the command output has
to be analysedo messages on stdout / stderr mixed and some buffering problems to catch full output when stderr
outputs last line (problem seen when openssl is executed in batch and PHP code)o running openssl with sites having TLSv1.3 enabled is very problematic – it happens that information
on errors disappears
o we decided to avoid using TLSv1.3 for running tests▪ for now all servers with enabled TLSv1.3 have TLSv1.2 enabled as well20www.geant.org

Connectivity tests• Sslscan command as an alternativeo reports the protocol versions, cipher suites, key exchanges etc.
o has a possibility to connect with a client certificate but it does not work as expected in my tests
o can output a result in XML format
buto when called without any limitations the command output is very extensive
o it can take a long while…
o v. 2.0.7 coming with Ubuntu 22 package is really poor – no connect timeout and sometimes freezes forvery long
fortunately
o git version 2.1.3 is much bettero we plan to add sslscan test to diagnostics/reachability test and improve diagnostics messages to show
enabled protocols etc.

• UDP connectivity test – few problems spotted and fixedo openssl used to verify a server certificate – again mixed stdout / stderr in openssl 3
o a site with given CRL Distribution Points but getting it “last forever” – a timeout added to get notavailable quicker
21

www.geant.org

Some stats• over 5000 unique realms in CAT profiles• only 490 have dynamic connectivity settings (less than 10%)• leaders:

22

countrydyn. realms

all realms

%

UK

193

418

46,2

DE

145

407

35,6FR

24

300

8,0

ES

22

145

15,2

CH

1765

25,2

PT

1468

20,5

PL

13102

12,7NL1195

11,5CZ

9333

2,7ZA

832

25,0
www.geant.org

Some stats• 76 dynamic servers:

23

countryservers

countryservers

AM

1IE

3

AT

2

IT

2

BE

2LU

2

BR

2

MY

2

CH

2

NL

7CZ

2

NO

3

DE

5

PL

10

ES

2PT

16

FI

2

UA

1

FR

2

UK

3HU

3ZA

2
www.geant.org

Some stats• TLS protocol support:• some servers are not available ~10 (e.g. BR, UA, AM, two servers for DE– handling hs-fulda.de)• 11 servers have TLSv1.0 and 1.1 enabled (PT – 4, NO – 2, NL – 2, PL – 2, CZ – 1)
• all available servers have TLSv1.2 enabled• 34 servers support TLSv1.3• Sslscan results• time-consuming, relatively fast responses 1-3 secs for UK, IE, CH, AT and NL, for other servers theaverage time was 3-8 secs, for MY > 40 secs and for ZA ~30 secs

• Openssl results for different client certificates• revoked client certificate – only 20 servers respond properly on revoked client certificate: DE, LU,MY, ZA, PT (4) and PL (7)• expired and wrong-policy client certificate is treated correctly by all available servers but
received openssl error is not always “expired” or “certificate unknown”, some servers respondwith “unexpected eof while reading”

24

www.geant.org

Thank you
Any questions?

www.geant.org© GÉANT Association on behalf of the GN4 Phase 3 project (GN4-3).
The research leading to these results has received funding fromthe European Union’s Horizon 2020 research and innovation
programme under Grant Agreement No. 856726 (GN4-3).

The scientific work is published for the realization of the international
project co-financed by Polish Ministry of Science and Higher Educationfrom financial resources of the programme entitled "PMW"