The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Paetow <Stefan.Paetow AT jisc.ac.uk>]

Hi Giuseppe,

 

Yes, the labelling is not quite clear (and is a potential place for confusion), and we also have had to explain to our admins that it is only the ‘CN=’ part of the Subject, as a hostname, which should be entered there, and which must also have a corresponding ‘dNSName’ in the SubjectAlternativeName portion of the certificate.

 

Also, the old ‘eduroam CAT’ app in the Play Store does work with Android 5.0.1, but I have found that you must only use one certificate (not a chain), and you must also be very specific about the settings to make sure it works. The old app is arguably horrible to use, so there are some of our members who provide the root certificate blob as a file to download and install manually, followed by manual instructions for specifically the old versions out there.

 

Kind regards

 

Stefan Paetow

Federated Roaming Technical Specialist

eduroam(UK), Jisc

 

email/teams: stefan.paetow AT jisc.ac.uk

gpg: 0x3FCE5142

 

For eduroam support, please contact the eduroam team via help AT jisc.ac.uk and mark it for eduroam’s attention.

On Wednesdays and Fridays, I am not available between 12:00 and 15:00.

 

jisc.ac.uk

 

Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB Tel: 020 3697 5800.

 

 

From: <cat-users-request AT lists.geant.org> on behalf of Giuseppe Mainardi <cat-users AT lists.geant.org>
Organisation: Università di Foggia
Reply to: Giuseppe Mainardi <giuseppe.mainardi AT unifg.it>
Date: Tuesday, 24 October 2023 at 09:18
To: "cat-users AT lists.geant.org" <cat-users AT lists.geant.org>
Subject: [[cat-users]] [cat] [android] why does the "realm" field gets the "Name (CN) of Authentication Server"?

 

Positive.

1. I set up     Name (CN) of Authentication Server  = freeradius.unifg.it
2. I checked the field realm on the client (android 13). It contained      freeradius.unifg.it
3. but using the APP the configuration worked as well (android 5 and android 13).

Thanks for the help.

Giuseppe

 

 

Il 20/10/2023 13:17, Giuseppe Mainardi ha scritto:

Greetings to all,
I'm trying CAT for the first times and I see an unexpected behaviour.
When I build CAT I set     Name (CN) of Authentication Server  = CN=freeradius,DC=unifg,DC=it
because that is the radius server to use for that profile (Eduroam-AD). We have two profiles, but only this one is production-published.

When I load the eap-config file into getEduroam, the field "realm" gets the value "CN=freeradius,DC=unifg,DC=it" and the authentication doesn't work.
If I change the value, typing "unifg.it", as it is supposed to be, the authentication works.

Looking into the config file, the only place where that value is mentioned is: <ServerID>CN=freeradius,DC=unifg,DC=it</ServerID>

Where is the realm mentioned in the config file? Nowhere, unless... <InnerIdentitySuffix>unifg.it</InnerIdentitySuffix> but that setting is related to "Enforce realm suffix in username".

Is it my fault that I didn't understand what is "Name (CN) of Authentication Server" purpose?

Is there a more detailed documentation in order to better understand what values to set up for a fully functioning CAT config?

Trials made on Android 13 last update.

 

Second request:

is eduroamCAT fully compatible with Android 5.0.1? The first tests with that O.S. are negative. It is impossible to choose the SSID to connect with, the only SSID given by eduroamCAT is "eduroam" which is not the one we have to use in this test phase.

 

Thanks in advance.

-- 

Giuseppe Mainardi

Università di Foggia

Area Sistemi Informativi

Servizio Amministrazione di sistemi informativi, accounting e single-sign-on (Resp.)

Via Gramsci, 89/91 - 71122 Foggia

Tel.: 0881/338440

-- 

Giuseppe Mainardi

Università di Foggia

Area Sistemi Informativi

Servizio Amministrazione di sistemi informativi, accounting e single-sign-on (Resp.)

Via Gramsci, 89/91 - 71122 Foggia

Tel.: 0881/338440

To unsubscribe, send this message: mailto:sympa AT lists.geant.org?subject=unsubscribe%20cat-users
Or use the following link: https://lists.geant.org/sympa/sigrequest/cat-users