The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Philippe Hanset <phanset AT anyroam.net>]

David,

If you have  tried CAT and if the networking group tried it too,

you will have noticed that there is only  an initial challenge for login/password and no need to choose the eduroam SSID, it is done automatically by the profile.

If you choose the anonymous option in CAT configuration (as an admin) your users will not need to enter a domain, they can enter their regular username. Another advantage of CAT: the profile is locked and does a good job preventing man in the middle attack.

Choosing the anymous AT alaska.edu

is also a great privacy protection method!

Let us know if this helps,

Philippe 

Philippe Hanset, CEO

ANYROAM LLC

www.anyroam.net

www.eduroam.us

+1 (865) 236-0770

On Sep 6, 2018, at 8:21 PM, IAM David Bantz <dabantz AT alaska.edu> wrote:

My institution (U Alaska) is transitioning RADIUS implementations, more comprehensive 802.1X and hoping to deprecate current home-grown eduroam profile installers using EAP-TLS.

CAT seemed a great fit but networking team is questioning the need or value of any profile installer, and proposes relying on built-in 802.1X supplicant support in common OS's (macOS, iOS, Windows, Android) for EAP-PEAP authentication. Please validate, challenge, or elaborate on this as a viable strategy.

As I understand their position, if a user initally chooses the eduroam SSID, they will be presented with a challenge for network authentication which is passed via RADIUS to either local AD (for alaska.edu identities) or on to the RADIUS federation for any other realm). The only wrinkle they forsee is the need for users to enter the domain-qualified identity username AT alaska.edu rather than the unqualified username they enter for most authentication.

Thank you,

David Bantz

UA IAM

To unsubscribe, send this message: mailto:sympa AT lists.geant.org?subject=unsubscribe%20cat-users
Or use the following link: https://lists.geant.org/sympa/sigrequest/cat-users