Package: perun.proxy.utils
Perun proxy utilsScripts and monitoring probes related to Perun ProxyIdP.InstallationInstall via pip:pipinstallperun.proxy.utilsThere are several extras which are required only for some scripts:[ldap]for check_ldap and check_ldap_syncreplthis also requires
installingbuild prerequisites of the python-ldap library[postgresql]for check_pgsqlScriptsrun_probesscript designed to execute multiple monitoring probesoutput is compatible with CheckMKit is required to put configuration file to/etc/run_probes_cfg.yamlFor usage instructions, run:run_probesseparate_ssp_logsScript removes all logs from test accounts from SimpleSAMLphp logs.For usage instructions, run:separate_ssp_logs.py--helpseparate_oidc_logsScript removes all logs from test accounts from mitreID logs.For usage instructions, run:separate_oidc_logs.py--helpmetadata_expirationThis script checks whether there are some metadata close to expiration date.For usage instructions, run:metadata_expiration.py--helpprint_docker_versionsThis script collects system info, docker engine info and the versions of running
containers and then prints it to the stdout in the JSON format.For usage instructions, run:print_docker_versions--helprun_version_scriptThis scripts runs the print_docker_versions script on the given machines. The
collected versions are then printed as a MD table to the stdoutFor usage instructions, run:run_version_script--helpsync_usable_token_types.pyCollects information about the usable token types of each privacyIDEA user and sends it
to Perun. Each user with usable tokens in privacyIDEA is assigned a list of their types,
for example:['backupcode', 'totp']. A token is considered usable when it is **active
** and it is notlockedorrevokedand its rollout state allows logging in.Requires configuration
ofperun connectormodule to work properly. It also needs to be executed in the same environment as
privacyIDEA to acquire its Flask context (e.g. inside privacyIDEA docker container).For more usage instructions, run:sync_usable_token_types--helpExample:python3sync_usable_token_types.py--mfa-active-tokens-attr-name"attr_name"--perun-user-id-regex"\d+"--perun-connector-config-path"/path/to/file"Nagios probesAll nagios scripts are located undernagiosdirectory.check_mongodbNagios monitoring probe for mongodb.Tested options:connectconnectionsreplication_lagreplset_state(some possible options may not work since there are constructs which are not supported
by the latest mongodb versions)For usage instructions, run:check_mongodb--helpcheck_samlSAML authentication check compatible with SimpleSAMLphp and mitreID.Basic OIDC check can be triggered by adding--basic-oidc-checkswitch. This checks
forstateandcodeparameters in the result url after a log in attempt.For more usage instructions, run:check_saml--helpExample:python3check_saml--username"my_username"--password"my_password"--username-field"j_username"--password-field"j_password"--postlogout-string"Successful logout"check_user_loginsCheck users which login in repeatedly more often than a specified threshold (logins per
seconds).For usage instructions, run:check_user_logins--helpExample:python3check_user_logins-p/var/log/proxyaai/simplesamlphp/simplesamlphp/simplesamlphp.log-l5-s60-r"^(?P<datetime>.{20}).*audit-login.* (?P<userid>[0-9]+)@muni\.cz$"-d"%b %d %Y %H:%M:%S"check_ldapCheck whether an LDAP server is available.For usage instructions, run:check_ldap--helpcheck_ldap_syncreplCheck whether an LDAP replica is up to date with the provider.For usage instructions, run:check_ldap_syncrepl--helpcheck_privacyideaCheck whether privacyidea is available by performing TOTP authentication via the API.
Use caching arguments for avoiding failure when one TOTP code is used two times.For usage instructions, run:check_privacyidea--helpcheck_pgsqlCheck connection to PostgreSQL using a configurable query.For usage instructions, run:check_pgsql--helpcheck_oidc_loginCheck that OIDC auth process works by acting as an OIDC client (RP) attempting to
authenticate against an OIDC server (OP). Supports clients with PKCE and non-PKCE
authentication. Additional tag-pkcemust be added to test PKCE log in. Using client
secret is always enforced since some clients might require it on top of PKCE.Target OIDC server (OP) shouldnotrequire authentication for this probe to
work. Itdoes nottest the credentials' validity but rather the OIDC auth process. This
can be achieved, for example, by setting up SATOSA's reflector backend.For usage instructions, run:check_oidc_login--helpExample:python3check_oidc_login--redirect-uri"http://localhost:44322/signin-oidc"--client-id"my_oidc_client_id"--client-secret"my_oidc_pkce_secret"--issuer"https://id.muni.cz"-vvv# verbose debug output-pkce