The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Winter <address@concealed>]

Hello,

> I've question from institution which is using EAP-TLS, they get
> interested in eduroam CAT, but eduroam CAT doesn't support EAP-TLS if I
> correctly understand.

You can review the EAP type support for all platforms by visiting
https://cat.eduroam.org -> About eduroam CAT

You'll see that EAP-TLS is supported on many platforms, but not all.

This is due to the fact that we need to craft installers which configure
the system to use client certificates - but we can't pack the client
certificate itself, because we don't have and don't want it.

The client certificate needs to be installed by arbitrary other means,
and so we rely on the device capability to ask the user which
certificate to use, and where to find it.

The UI for that is typically out of our hands and works with varying
degrees of satisfaction.

> Is there any chance that CAT v2 will support it anyhow?

CAT 2.0 will continue to support EAP-TLS just fine :-)

> I think that hosted eduroam IdP was designed to use EAP-TLS including
> user certificates distribution, they are quite skill full so they might
> be possible to run CAT on their own and integrate it with their CA. Are
> source codes available? Or maybe documentation?

Even better: we have *both*!

The source code is at

https://github.com/GEANT/CAT

and (deployer's) documentation is in the subdirectory "tutorials", e.g.:
https://github.com/GEANT/CAT/blob/master/tutorials/Configuration.md

The source code is entirely shared between the "traditional" CAT and
eduroam Managed IdP - as you rightly pointed out, they do almost the
same job except that eduroam Managed IdP produces and embeds a client
certificate directly, rather than relying on the external referencing.

And here is even more goodness:

We have an extension point that allows to plug in your own CA just fine.
Look at the config-confassistant.conf setting

'CA' => ["type" => "embedded"]

which you can change; you then only need to write actual code for that
other CA in the respective switch/case statements elsewhere in the code.
All of which should be contained in the single class
core/SilverbulletCertificate.php . I'm sure a good developer will find
them. :-)

If you have any issues or questions which are more code-related than
usage-related, please hop over to the development mailing list
(address@concealed).

Greetings,

Stefan Winter

-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
2, avenue de l'Université
L-4365 Esch-sur-Alzette

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

Attachment: 0xC0DE6A358A39DC66.asc
Description: application/pgp-keys

Attachment: signature.asc
Description: OpenPGP digital signature