@@ -59,6 +59,8 @@ There are some situations where the check cannot work reliably. In those cases i
...
@@ -59,6 +59,8 @@ There are some situations where the check cannot work reliably. In those cases i
* IdP does not support HTTPS with at least SSLv3 or TLS1 or newer (these IdPs are insecure anyway)
* IdP does not support HTTPS with at least SSLv3 or TLS1 or newer (these IdPs are insecure anyway)
* IdP is part of a Hub & Spoke federation (some of them manually have to first approve eduGAIN SPs)
* IdP is part of a Hub & Spoke federation (some of them manually have to first approve eduGAIN SPs)
* IdP does not use web-based login form (e.g. Account Chooser Authentication or X.509 login)
* IdP does not use web-based login form (e.g. Account Chooser Authentication or X.509 login)
* IdP does not allow requests coming from the ECCS servers: technical-test.edugain.org / technical.edugain.org
* IdP that uses more than one nested `<iframe>` inside the login page.
## Disable Checks
## Disable Checks
...
@@ -79,13 +81,13 @@ If an IdP is not able to create its own `robots.txt`, it can be disabled by an e
...
@@ -79,13 +81,13 @@ If an IdP is not able to create its own `robots.txt`, it can be disabled by an e
The tool uses following status for IdPs:
The tool uses following status for IdPs:
* ERROR (red):
* ERROR (red):
* The IdP's response contains an error or the web page is not returned due a Timeout, Connection or IdP Generic error.
* The IdP's response contains an error or the web page is not returned due to a Timeout, Connection or IdP Generic error.
***Timeout**: considers those IdPs that do not load a standard username/password login page within 60 seconds.
***Timeout**: considers those IdPs that do not load a standard username/password login page <u>within 60 seconds</u>.
***Connection-Error**: considers those IdPs that are not reachable due to a connection problem. View the "Page Source" content to discover which problem has the IdP.
***Connection-Error**: considers those IdPs that are not reachable due to a connection problem. View the "<u>Page Source</u>" content to discover which problem has the IdP.
***IdP-Generic-Error**: considers those IdPs that the returned web page does not contain a Login Form, but an unspecified error such as "*An error occured*". This kind of error has been seen on Micrsoft ADFS based IdPs.
***IdP-Generic-Error**: considers those IdPs that the returned web page does not contain a Login Form, but an unspecified error such as "*An error occured*". This kind of error has been seen on Microsoft ADFS based IdPs.
* The IdP most likely does not consume the eduGAIN metadata correctly.
* The IdP most likely does not consume the eduGAIN metadata correctly.
***No-SP-Metadata-Error**: considers those IdPs that returns a message like "*No return endpoint available for relying party*" or "*No metadata found for relying party*" instead of the Login Page.
***No-SP-Metadata-Error**: considers those IdPs that return a message like "*No return endpoint available for relying party*" or "*No metadata found for relying party*" instead of the Login Page.
* The IdP has an SSL problem on the HTTP-Redirect Location used by the check:
* The HTTP SSL certificate used by the IdP is invalid:
***SSL-Error**
***SSL-Error**
* OK (green):
* OK (green):
* The IdP most likely correctly consumes eduGAIN metadata and returns a valid username/password login page. This is no guarantee that login on this IdP works for all eduGAIN services but if the check is passed for an IdP, this is probable.
* The IdP most likely correctly consumes eduGAIN metadata and returns a valid username/password login page. This is no guarantee that login on this IdP works for all eduGAIN services but if the check is passed for an IdP, this is probable.
...
@@ -93,8 +95,8 @@ The tool uses following status for IdPs:
...
@@ -93,8 +95,8 @@ The tool uses following status for IdPs:
* The IdP can't be checked because the returned Login Page content is not recognized or the Login Page is always returned, also for the fake SP.
* The IdP can't be checked because the returned Login Page content is not recognized or the Login Page is always returned, also for the fake SP.
***Unable-To-Check**: considers those IdPs that do not load a standard username/password login page and do not return messages like "*No return endpoint available for relying party*" or "*No metadata found for relying party"*.
***Unable-To-Check**: considers those IdPs that do not load a standard username/password login page and do not return messages like "*No return endpoint available for relying party*" or "*No metadata found for relying party"*.
* DISABLED (white)
* DISABLED (white)
* The IdP is excluded because it cannot be checked reliably. The "*Page Source*" column content, when an entity is disabled, shows the reason of the disabling.
* The IdP is excluded because it cannot be checked reliably. The "<u>Page Source</u>" column, when an entity is disabled, is populated with the reason for the disabling.
***Disabled**: considers those IdPs that are disabled from the check by an eduGAIN Operator or "robots.txt" file.
***Disabled**: considers those IdPs that are disabled from the check by an eduGAIN Operation Team member or "*robots.txt*" file.