1 RESTENA Foundation TF-MNM 16 feb 2011 eduroam “next gen” Stefan Winter -

2 Deliverables DJ3.1.2,1 about to be published  hidden somewhere deep in the bowels of the GN3 review process  Summary report about JRA3-T1 actions in the first 18 months of the project (Sep 2010)  Will announce to TF-MNM as soon as published Current work will be reported on in DJ3.1.2,2

3 RADIUS/TLS A PKI PMA, CA and RA have been established  Any CA can apply for being accredited to issue “eduroam Trust Profile” certificates  The CA will be assessed by eduPKI PMA  To get started, one CA has been created as a “catch-all” for eduroam participants (mostly FLR level)  This CA uses the eduroam database to check authorisation (FILL. YOUR. DATA. IN. NOW!!!)  We are already issuing certificates.

4 How to use? Radiator  Product is ready  Full template configuration is being prepared on the “new cookbook” wiki  Caveat: needs Net::SSLeay 1.37 – which isn't released yet; would need to use SVN code :-( radsecproxy  Dynamic discovery needs love  Rest is ready  Config template will also go into cookbook

5 When is.edu not a problem any more? When all FLRs which host a.edu domain have RADIUS/TLS + all.edu domains have set a NAPTR record for eduroam  Then the domains can announce their authoritative FLR via DNS  And TLRs can have a separate Handler for.edu: AuthBy DNSROAM  That way, all.edu request are DNS-discovered either by an FLR or by the TLR Need to get eduroam Trust Profile certificates to U.S. and other non-EUs

6 eduroam Trust Profile PKI “One Sentence” Policy  (paraphrased) A conforming CA will only issue certificates with the policy OID ….foo.1 for authorised eduroam IdP ….foo.2 for authorised eduroam SP  Proxy servers are IdP+SP A well-managed CA would need to put authorisation checks in place which ensure the above.

7 GN3 Year 3 Generic description of work in the “Technical Annex” One (hopefully) particularly interesting project:  Assemble IdP settings in eduroam DB  Create scripted installers for all these IdPs  Hassle-free supplicant deployment for all!  These installers could even be signed for platforms which think they need that  Potential to save thousands of work hours for IdPs and as added “sales” argument for eduroam