1. EAP-TLS in eduroam using TCS Personal Certificates José Manuel Macías Luna, RedIRIS Juan C. Sánchez-DelBarrio, BSC TF-MnM Lyon, 16 Feb 2011

2. 1. what... ? Use of TCS Personal Certificates in eduroam Id P SIR attributes CSR

3. 2. how... ? FreeRADIUS 2.1.10 added extended validation of client certificates see verify { client } in eap.conf we made a proof-of-concept validation script: validates client certificate and attributes CN,O,UID against our LDAP directory Radiator also supports this kind of validation EAPTLS_CertificateVerifyHook additional checks possible too... CRL checking, expiration,...

4. 2. how... ? FreeRADIUS 2.1.10 added extended validation of client certificates See verify { client } in eap.conf We made a proof-of-concept validation script: Validates client certificate attributes CN,O,UID against our LDAP directory Radiator also supports this kind of validation EAPTLS_CertificateVerifyHook Additional checks possible... CRL checking, expiration,... common name home organization My OpenID, yes... ;-) user identifier Attributes that can be validated Ho me IdP SIR 2 X.509 X.509 2 LDAP LDAP 2 SIR

5. 3. what for...? ok, it's not rocket science, but... remember EAP-TLS is included in Windows by default an alternative (or complement) to EAP-GTC too easy recipe for the server side it would promote other services: TCS, SIR drawbacks... a fail-over authentication method? it seems easy to deploy but... easier than others? (EAP-EKE is not yet there...) how well does it scale?

6. ...any questions?