The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Tony Skalski <ajs AT stolaf.edu>]

As others have alluded to, if you only rely on the OS's built-in supplicant, you are relying on the user to evaluate the trustworthiness of an authentication server. With the CAT tool, as well as other on-boarding software, you are pre-configuring the client to *only* trust your authn servers, and to validate the certs they present. Suppose the local coffee shop stands up an SSID named "eduroam" that is not part of the anyroam infrastructure. A pre-configured client will not connect to it, however, a user that clicks trust this server/cert could expose institutional credentials.

With the availability of eduroam in public places like airports and museums, on-boarding is increasingly important.

We have had great luck with the CAT installer.

On Thu, Sep 6, 2018 at 7:21 PM IAM David Bantz <dabantz AT alaska.edu> wrote:

My institution (U Alaska) is transitioning RADIUS implementations, more comprehensive 802.1X and hoping to deprecate current home-grown eduroam profile installers using EAP-TLS.

CAT seemed a great fit but networking team is questioning the need or value of any profile installer, and proposes relying on built-in 802.1X supplicant support in common OS's (macOS, iOS, Windows, Android) for EAP-PEAP authentication. Please validate, challenge, or elaborate on this as a viable strategy.

As I understand their position, if a user initally chooses the eduroam SSID, they will be presented with a challenge for network authentication which is passed via RADIUS to either local AD (for alaska.edu identities) or on to the RADIUS federation for any other realm). The only wrinkle they forsee is the need for users to enter the domain-qualified identity username AT alaska.edu rather than the unqualified username they enter for most authentication.

Thank you,

David Bantz

UA IAM

To unsubscribe, send this message: mailto:sympa AT lists.geant.org?subject=unsubscribe%20cat-users
Or use the following link: https://lists.geant.org/sympa/sigrequest/cat-users

--

Tony Skalski

System Administrator | IT

Office: 507-786-3227

1510 St. Olaf Avenue Northfield, MN 55057

stolaf.edu