Skip to main content

External EMS

The External EMS group manages integration with third-party exam-management systems (Moodle, ANS, Remindo) through the SES proxy and the SES exam-entry page.

How it works now​

There are two types of access restriction, depending on what the external EMS supports:

1. IP-restricted EMS (ANS, Remindo)​

On import, SES sets the SES server (proxy) IP as a restriction on the exam via the EMS API:

  • Remindo — SES creates a SES Proxy location with the SES IP and sets restrict_to_location on each imported test moment.
  • ANS — SES adds the SES Proxy location to the assignment's accessibility settings.

2. Plugin-restricted EMS (Moodle)​

Moodle does not support per-exam IP restriction via API. Instead, access is enforced by a plugin that restricts the exam to the SES proxy.

Because the exam is restricted to the SES server, a student cannot open the exam directly in the external EMS. They must use the SES Exam Entry page — enter the Exam Access Code and start a Safe Exam Browser session (SES then forwards the session to the EMS through the proxy).

Security on the SES exam entry​

Beyond OIDC, SES adds several layers:

ControlWhat it does
OIDC / SSOThe student must authenticate with the institute's identity provider on the SES exam-entry page.
Exam access code8-character code (A-Z0-9) validated against a published exam of the same institute; generic error when invalid (no exam enumeration).
Strict-time windowServer-side enforcement of the exam's start/end window.
Safe Exam BrowserWhen a browser configuration is set, the .seb file (with session) is served and SEB is required.
Proxy HMAC session tokenThe proxy validates the signed session token before forwarding any request to the EMS.
Rate limitingPer-IP and per-code attempt limits, exponential backoff (2 s → 120 s) and a math challenge after repeated failures (IP-bound, expiry).
Session lifecycleNo duplicate sessions, rejects already-submitted attempts, load-test header only for staff.
IP binding + auditThe session records the last IP; IP changes are logged for audit/fraud detection (not hard-blocked, because exam rooms use NAT).
Student entry flow
  1. Student opens the SES Exam Entry page and authenticates via OIDC.
  2. Student enters the 8-character Exam Access Code.
  3. SES creates/activates a session and serves the .seb file (SEB).
  4. SEB launches; SES forwards the session to the EMS through the proxy (the EMS only accepts traffic from the SES IP).

External EMS environments​

An environment connects SES to an external EMS via the proxy.

  1. Go to Administration → External EMS → Add
  2. Fill in, in order:
    • EMS Configuration
    • EMS brand: Moodle, ANS or Remindo
    • Name: display name (e.g. "Moodle Production")
    • EMS slug: URL-safe identifier, determines the proxy path /proxy/<slug>/
    • Browser type: SEB or SES Client
    • Active: enabled/disabled
    • Proxy Settings — Backend URL: the EMS backend URL
    • Exam Import Setup
      • Exam import: enabled/disabled
      • API URL: the full API endpoint (for exam import)
      • Exam import API key
      • Default SEB configuration
      • Exam import interval (minutes)
  3. Save

For exam import, enable Exam import, set the Exam import API key and choose an Exam import interval (minutes). SES then fetches the exams and, for ANS/Remindo, applies the IP restriction via the API.

External EMS exams​

External exams are imported from the external EMS or created by hand; students take them via the SES exam-entry page.

  1. Go to Administration → External EMS → Exams → Add
  2. Fill in Exam name, EMS environment, optional Faculty, and Browser configuration
  3. Configure the schedule (Start/End, Strict time, Session cleanup delay)
  4. Set the Owner (and optionally Additional owners)
  5. Save

When exam import is enabled, exams are fetched from the external EMS API on a schedule instead of being created by hand.