The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[IAM David Bantz <dabantz AT alaska.edu>]

My institution (U Alaska) is transitioning RADIUS implementations, more comprehensive 802.1X and hoping to deprecate current home-grown eduroam profile installers using EAP-TLS.

CAT seemed a great fit but networking team is questioning the need or value of any profile installer, and proposes relying on built-in 802.1X supplicant support in common OS's (macOS, iOS, Windows, Android) for EAP-PEAP authentication. Please validate, challenge, or elaborate on this as a viable strategy.

As I understand their position, if a user initally chooses the eduroam SSID, they will be presented with a challenge for network authentication which is passed via RADIUS to either local AD (for alaska.edu identities) or on to the RADIUS federation for any other realm). The only wrinkle they forsee is the need for users to enter the domain-qualified identity username AT alaska.edu rather than the unqualified username they enter for most authentication.

Thank you,

David Bantz

UA IAM