The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Winter <address@concealed>]

Hello,

> We are currently thinking about a larger scale IdP (100k+ Users) that would 
> use client certificates for authentication.
> To distribute those certificates, the CAT installers/profiles would be a 
> good option (as the v2 Hosted IdP does).
> 
> Is there an API call (like 'generateInstaller') that would accept a 
> certificate .pem to include in the installer?
> Or any other ideas to handle this?

The installer would need to have the certificate *and* private key. Our
basic assumption behind CAT (and MIdP) was that we don't want anyone
else's secrets, and expect nobody to want to send them to us anyway; so
uploading a private key is indeed not foreseen.

For eduroam Managed IdP, the communication is unidirectional. Our system
itself generates a private key, and sends it out in the installer
(PIN-protected on the transport leg).

If you really are comfortable with sending us the future users' private
keys(?) then we could probably create an API call to generate
"MIdP-like" installers from that external source. Unfortunately, some
installers require us to know the private key in clear (ChromeOS
encrypts the entire configuration file with the PIN, not just the
private key portion).

Alternatively, if you can live with becoming a Managed IdP user and with
leaving the cert generation to us: the existing API allows an NRO
operator to remote-control all the important aspects of the system down
to the individual user level. That way, you could create those 100K
users in the system, issue 100K invitation URLs, make us send them to
the users via E-Mail or SMS, and have them pick up their eduroam
credentials with that.

I used those API calls extensively during the development phase for
stresstesting (and my tests went up to 1M users).

The only limitation here would be non-technical: the soft limit for user
count in eduroam Managed IdP is going to be 10K users per NRO. More is
certainly possible, but we'd have to discuss some kind of a paid plan
for that bulk usage.

Greetings,

Stefan Winter

-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
2, avenue de l'Université
L-4365 Esch-sur-Alzette

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

Attachment: 0xC0DE6A358A39DC66.asc
Description: application/pgp-keys

Attachment: signature.asc
Description: OpenPGP digital signature