ECCS v2.1.0eduGAIN Connectivity Check Service
24 May 2022

Networks · Services · People

www.geant.org

Marco Malavolti - marco.malavolti@garr.it

Index•••••••PurposeArchitecture
FunctioningFeatures
DemoDevelopers
References

Networks · Services · People

www.geant.org

2Marco Malavolti - marco.malavolti@garr.it

Purpose
index > purpose > architecture > functioning > features > demo > developers > references

Determine where possible whether an eduGAIN IdP consumes
the eduGAIN SAML 2.0 Metadata provided by its own Federation.
Increase the service overall quality and user experience of the eduGAIN
interfederation service by making federation and Identity Provider operators
aware of configuration problems.

Networks · Services · People

www.geant.org

3

Marco Malavolti - marco.malavolti@garr.itArchitectureindex > purpose > architecture > functioning > features > demo > developers > references

INPUT
list_feds

list_eccs_idps

pyFF

FRONTEND

ECCS
results
fileECCS
API

NREN SP1 & SP2

eduGAIN DB API

STORAGE (file based)

BACKEND
Parallelizer

IdP
html
sp1
IdP
html
sp2

ECCSGUIIdP
htmlsp3 - random

OUTPUT

x 30
……
ECCS
check

ECCScheck

Networks · Services · People

ECCScheckwww.geant.org

ECCScheck4(94min x 4695 IdPs)
Marco Malavolti - marco.malavolti@garr.it

Functioning
index > purpose > architecture > functioning > features > demo > developers > references

eduGAIN DB API

pyFF

Networks · Services · People

www.geant.org

eduGAIN DB API’s called actions:● the IdPs to check => list_eccs_idps● the Federations datas => list_fed
python Federation Feeder (pyFF) v2.0.0 is used to:● download NREN SPs metadata via IDEM MDX● validate signature and syntax metadata● generate input/sps-metadata.xml

5Marco Malavolti - marco.malavolti@garr.it

Functioningindex > purpose > architecture > functioning > features > demo > developers > references

The Parallelizer is a Python scriptthat has the goal of running several ECCS check in parallel.
The default number of parallel commands is set to 30.
Parallelizer

The Parallelizer uses the asyncio library to run concurrent
subprocesses using the async/await syntax and a queue.

Networks · Services · Peoplewww.geant.org

6

Marco Malavolti - marco.malavolti@garr.it

Functioning
index > purpose > architecture > functioning > features > demo > developers > references

ECCScheck

Networks · Services · People

The ECCS check is written in Python and it is the core of the eduGAIN
Connectivity Check Service:
1. it doesn’t check the disabled IdPs
2. it verifies the SSL certificate of the IdP SSO HTTP-Redirect Location
3. it tests the IdP with 3 different SPs (2 real + 1 fake)
4. it returns the result

www.geant.org

7

Marco Malavolti - marco.malavolti@garr.it

Functioning - No check for disabled IdPs
index > purpose > architecture > functioning > features > demo > developers > references

The ECCS check allows owners to disable the check for their IdP:
1. By the robots.txt file into the DocumentRoot of their IdP HTTP-Redirect SSO Location
2. By asking to the eduGAIN Operation Team through their Federation Operators

Networks · Services · People

www.geant.org

8Marco Malavolti - marco.malavolti@garr.it

Functioning - SSL Validationindex > purpose > architecture > functioning > features > demo > developers > references

ECCS check validates the SSL certificate used by the IdP SSO HTTP-Redirect Location
before doing the check and stops itself by returning the ERROR status if the certificate is
not valid.

Networks · Services · People

www.geant.org

9Marco Malavolti - marco.malavolti@garr.it

Functioning - IdP Login Page test
index > purpose > architecture > functioning > features > demo > developers > references

Networks · Services · People

www.geant.org

10Marco Malavolti - marco.malavolti@garr.it

Functioning - IdP Login Page testindex > purpose > architecture > functioning > features > demo > developers > references

ECCS handles two type of result:
1. ECCS Check Result:
the result of the ECCS check performed for an IdP on a single SP (checkResult)
2.

ECCS Status:
the result of the sum of all ECCS check results performed for an IdP (status)

ECCS Status

Networks · Services · People

www.geant.org

ECCS
Check
ResultECCS
CheckResultECCS
CheckResult

NREN SP 1

NREN SP 2

FAKE SP

11

Marco Malavolti - marco.malavolti@garr.it

Functioning - IdP Login Page test
index > purpose > architecture > functioning > features > demo > developers > references

ECCS Check Results

ReasonOKThe IdP most likely correctly consumes eduGAIN metadata and returns a validlogin page or an HTTP Basic Authentication form.

Disabled

The IdP has been excluded by either robots.txt or admin request.

Unable-To-Check

The IdP can’t be checked because it does not return a recognised login pageor an error recognised by check.

No-SP-Metadata-Error

The IdP most likely does not consume the eduGAIN metadata correctly
because it returns a message like "No return endpoint available for relying
party" or "No metadata found for relying party" or other recognised error.
The message is detected on the login page code by a regular expression.

Networks · Services · People

www.geant.org

12

Marco Malavolti - marco.malavolti@garr.it

Functioning - IdP Login Page test
index > purpose > architecture > functioning > features > demo > developers > references

ECCS Check Results

ReasonConnection-Error

The IdP can’t be check because ECCS met a connection problem during theopening of the login page.

IdP-Generic-Error

The IdP returns a recognised error instead of a recognised login page.
The error is detected on the login page code by a regular expression.

SSL-Error

The IdP has an SSL problem on its SSO HTTP-Redirect Location

Timeout

The IdP does not display its Login page within 60 seconds.

403-Forbidden

Networks · Services · People

www.geant.org

The IdP returns a 403 HTTP status code

13

Marco Malavolti - marco.malavolti@garr.it

Functioning - IdP Login Page test
index > purpose > architecture > functioning > features > demo > developers > references

ECCS Check Result
ECCS Status
SP1 (IDEM)

SP2 (SWITCH)

SP3 (FAKE)

Disabled

Disabled

Disabled

DISABLED

OKOK

Any check result, but not OK

OK

OK

OK

OK

UNKNOWN

Unable-To-CheckOK

Any check result

UNKNOWN

Networks · Services · People

www.geant.org

14

Marco Malavolti - marco.malavolti@garr.it

Functioning - IdP Login Page test
index > purpose > architecture > functioning > features > demo > developers > references

ECCS Check Result
ECCS Status
SP1 (IDEM)

SP2 (SWITCH)

SP3 (FAKE)

Connection-ErrorOK

Any check resultERROROK

IdP-Generic-Error

Any check result

ERROR

SSL-ErrorOK

Any check result

ERROR

OKTimeout

Any check result

ERROR

403-ForbiddenOK

Any check result

ERROR

OK

No-SP-Metadata-Error

Any check result

ERROR

Networks · Services · People

www.geant.org

15

Marco Malavolti - marco.malavolti@garr.it

Functioning - Returning the check result
index > purpose > architecture > functioning > features > demo > developers > references{

The output is a Python dictionary
with the results of all ECCS
checks performed for the IdP"displayName":"ABC","entityID":"https://idp.example.org/idp/shibboleth","registrationAuthority":"http://www.federation.org/","contacts":{"technical":"mailto:technical1@example.org,mailto:technical2@example.org","support":"mailto:support1@example.org"},"status":"OK","sp1":{"entityID":"https://sp-demo.idem.garr.it/shibboleth","checkTime":"2022-05-02T05:30:33Z","checkResult":"OK"},"sp2":{"entityID":"https://attribute-viewer.aai.switch.ch/interfederation-test/shibboleth","checkTime":"2022-05-02T05:30:56Z","checkResult":"OK"},"sp3":{"entityID":"https://syrugumqau.org/shibboleth","checkTime":"2022-05-02T05:31:06Z","checkResult":"No-eduGAIN-Metadata"}}

Networks · Services · People

www.geant.org

16

Marco Malavolti - marco.malavolti@garr.it

Functioning
index > purpose > architecture > functioning > features > demo > developers > references

ECCS
results
file

The results of the ECCS check are stored in JSON and HTMLfiles and then used by the ECCS API and ECCS GUI to display
the results quickly.

IdP
html
sp1
IdP
html
sp2
IdP
html
sp3 - random
Networks · Services · People

www.geant.org

17

Marco Malavolti - marco.malavolti@garr.it

Functioning
index > purpose > architecture > functioning > features > demo > developers > references

The ECCS API provides two actions:● eccsresults: Returns ECCS results● fedstats: Returns federation statistics

ECCS
API

Networks · Services · People

www.geant.org

18

Marco Malavolti - marco.malavolti@garr.it

Functioning
index > purpose > architecture > functioning > features > demo > developers > references

The ECCS GUI uses the power of DataTables to quickly load theJSON produced by the ECCS API and display the results:ECCSGUINetworks · Services · People

www.geant.org

19Marco Malavolti - marco.malavolti@garr.it

Featuresindex > purpose > architecture > functioning > features > demo > developers > references

1.
2.
3.

4.
5.
6.

7.

History of the results: the user can see the results of the check run in the past
SSL validation on IdP SSO HTTP-Redirect Location
ECCS check switch off by the user or their own Federation Operators: the user canuse a simple ‘robots.txt’ file or ask to their own Federation Operator to disable
her/his own IdP with the help of eduGAIN Operation Team member.
JSON API: providing several kind of information
Customizable Data Set: the data showed in the results table can be customized
through parameters in the service URL
Simple: No database needed, The service manages simple text files only, Only 4
possible statuses: ERROR, OK, DISABLED, UNKNOWN. The check stops at the login
page or at SSL Certificate validation, hence, No complete login happens.
Fast: 1,2 seconds average to check an IdP

Networks · Services · People

www.geant.org

20

Marco Malavolti - marco.malavolti@garr.it

Demoindex > purpose > architecture > functioning > features > demo > developers > references

https://technical.edugain.org/eccs

Networks · Services · People

www.geant.org

21

Marco Malavolti - marco.malavolti@garr.it

Demo - Customized Data Set
index > purpose > architecture > functioning > features > demo > developers > references

https://technical.edugain.org/eccs?reg_auth=http://ukfederation.org.uk&status=ERROR
https://technical.edugain.org/eccs?reg_auth=http://ukfederation.org.uk&check_result=SSL-Error

Networks · Services · Peoplewww.geant.org

22

Marco Malavolti - marco.malavolti@garr.it

Demo - JSON API
index > purpose > architecture > functioning > features > demo > developers > references

https://technical.edugain.org/eccs/api/eccsresults?reg_auth=http://ukfederation.org.uk&
status=ERROR&format=simple
https://technical.edugain.org/eccs/api/fedstats?reg_auth=http://ukfederation.org.uk&date=2022-05-23

Networks · Services · People

www.geant.org

23

Marco Malavolti - marco.malavolti@garr.it

Developers
index > purpose > architecture > functioning > features > demo > developers > references• Main Developer•

Marco Malavolti (marco.malavolti@garr.it)• GUI Developers•

Valentin Pocotilenco (valentin.pocotilenco@renam.md)

Networks · Services · People

www.geant.org

24

Marco Malavolti - marco.malavolti@garr.it

Referencesindex > purpose > architecture > functioning > features > demo > developers > references• Géant GitLab Repository:•

https://gitlab.geant.org/edugain/eccs• Géant Wiki Documentation:•

https://wiki.geant.org/display/eduGAIN/eduGAIN+Connectivity+Check

Networks · Services · People

www.geant.org

25Marco Malavolti - marco.malavolti@garr.it

Thanks a lot to…
●
●●
●
●

Davide Vaghetti: for the several tips given
Peter Brant: for the useful issues shared
Lukas Hämmerle: for feedback and new features suggested
Tomasz & Maja Wolniewicz: for feedback, support and useful suggestions
Giuseppe De Marco: for valuable help in the early stages of development

Networks · Services · People

www.geant.org

26

Marco Malavolti - marco.malavolti@garr.it

Thank you all!

Marco Malavolti
marco.malavolti@garr.it
Consortium GARR

Networks · Services · People
www.geant.org

Networks · Services · People

www.geant.org

27