1. The DAMe’s First Steps: eduroam and NAS-SAML
Diego R. Lopez - RedIRIS

2. Deploying Authorization Mechanisms for Federated Services in eduroam (DAMe)
DAME is a project that builds upon:
eduroam, which defines an inter-NREN roaming architecture based on AAA servers (RADIUS) and the 802.1X standard,
Shibboleth and eduGAIN
NAS-SAML, a network access control approach for AAA environments, developed by the University of Murcia (Spain), based on SAML (Security Assertion Markup Language) and XACML (eXtensible Access Control Markup Language) standards.
[1st =]
Usually, those proposals don’t explain how certificates are issued by the authorities (it is usually application-dependent)
[2nd =]
In complex environments, a structured and distributed system must be provided (and application independent)

3. First Goal: extNA First Goal: Extension of eduroam using NAS-SAML
Connect. Communicate. Collaborate
First Goal: extNA
First Goal: Extension of eduroam using NAS-SAML
Policy Decision Point
Source Attribute Authority
XACML
RADIUS server
University B
University A
eduroam
Central RADIUS
Proxy server
Authenticator
(AP or switch)
User DB
Supplicant
Gast
User mobility controlled by assertions and policies expressed in SAML and XACML
Signaling
data
SAML

4. Second Goal: eduGAIN as AuthN and AuthR Backend First Goal: extNA
Connect. Communicate. Collaborate
Second Goal: eduGAIN as AuthN and AuthR Backend
First Goal: extNA
Link between the AAA servers (now acting as Service Providers) and eduGAIN

5. Third Goal: Universal Single Sign On
Connect. Communicate. Collaborate
Users will be authenticated once, during the network access control phase
The eduGAIN authentication would be bootstrapped from the NAS-SAML
New method for delivering authentication credentials and new security middleware
4th goal: integrating applications, focusing on grids.

6. eduroam + NAS-SAML Independent AuthR
Connect. Communicate. Collaborate

7. eduroam + NAS-SAML Merged AuthR
Connect. Communicate. Collaborate

8. eduroam+NAS-SAML in Context
The proposal is functionally equivalent to the one discussed in SALSA-FWNA for RADIUS-SAML integration
Compatibility and convergence are the natural way forward
NAS-SAML is
From the inter-realm view, a Diameter binding for SAML
Already available, thus allowing for fast evaluation of ideas
Agree in the basics
Data (NameIdentifier?) exchanged in RADIUS space
Relevant attributes