The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Winter <address@concealed>]

Hello,

> Can someone explain to me why it is presented, whether this is a request
> for the user's credentials (repeating the institutional credentials for
> eduroam), and if so why it is OK to ask our users to provide then again?

You only get this prompt if you configured your CAT settings to push
Hotspot 2.0 ("Passpoint") settings to your users.

That's done in IdP-wide or Profile Settings -> Media -> HS20 Consortium OI

Many admins choose not to do that precisely because macOS and iOS
generate this additional credentials prompt.

Indeed the expectation by macOS is that the user types his username and
password a second time. There is no way for the installer file to
express something like "reuse the username/password across all Wi-Fi
settings" unfortunately.

So, the same type-again behaviour would also occur if you'd specify an
additional SSID rather than Hotspot 2.0.

The easy way out if you care about Passpoint less than about your user's
experience is to remove any HS20 Consortium OI setting in your CAT
configuration.

Which is a pity for Passpoint. This really doesn't help its spreading.
If folks at Apple were to slightly tweak their XML to allow such a
cross-reference, people wouldn't have to make a hard choice of either a
good user experience or Passpoint. And "funny" enough: with EAP-TLS and
client certificates, such a cross-reference /is/ possible and you only
need to import the certificate once. That's why we enable Passpoint
settings by default in our new sister product eduroam Managed IdP.

Needless to say that I've opened a bug report stating all that many
years ago when Passpoint first got introduced in Apple products. And
that nothing happened.

Greetings,

Stefan Winter


-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
2, avenue de l'Université
L-4365 Esch-sur-Alzette

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

Attachment: 0xC0DE6A358A39DC66.asc
Description: application/pgp-keys

Attachment: signature.asc
Description: OpenPGP digital signature