An open discussion list for topics related to the geteduroam service

[Paul Dekkers <paul.dekkers AT surf.nl>]

Hi,

 

You could in fact also use Shibboleth in the letswifi-portal, but most of that work is in a non-committed branch. It’s not the best approach, Shibboleth has more limitations than SimpleSAMLphp, in particular if you want to run the service on multiple hosts.

Either way I would advise you to look at the OAUTH path, it really has advantages.

And I’ll get in touch off-list, of course I’m interested to hear more 😊

 

Paul

 

 

From: James Potter <Jim.Potter AT jisc.ac.uk>
Date: Thursday, 20 June 2024 at 10:30
To: Paul Dekkers <paul.dekkers AT surf.nl>
Cc: geteduroam AT lists.geant.org <geteduroam AT lists.geant.org>
Subject: RE: eap-config format supported by geteduroam

Hi Paul,

 

Thanks for quick answers!

 

OK – I’ll give that a go from the xsd file. And base64 PKCS12, spot on.

 

I’d found the LetsWifi portal after I’d written a chunk of my service… I’ve not used OAuth, I used SAML (we do shibboleth support, I’ve stuck to what I know here), not sure how well that will integrate with geteduroam, we’ll find out. It works nicely on windows…

 

I’ve built my service to be multi tenant, HSM backed + have an OCSP responder, happy to do a show + tell if you’re interested.

 

Thanks,

 

Jim

Jisc

 

From: Paul Dekkers <paul.dekkers AT surf.nl>
Sent: Thursday, June 20, 2024 9:15 AM
To: James Potter <Jim.Potter AT jisc.ac.uk>
Cc: geteduroam AT lists.geant.org
Subject: Re: eap-config format supported by geteduroam

 

Hi,

On 20/06/2024 10:07, James Potter (via geteduroam Mailing List) wrote:

I’ve created a service which creates customised eap-config files, the plan is that users download them, they open in geteduroam + set up the wifi profile, but I’m having issues with getting geteduroam to accept the config (it says “Not a valid eap-config file” at the moment).

So basically you recreated the geteduroam portal? ;-) (I hope you knew about its existence!)

(That's fine, no judgement, but I hope you also do it via OAUTH to mimic the geteduroam native workflow and have it most secure, and then there's an alternative for admins to choose software and it would make sense and integrate well with the Apps and authentication.)

I’ve started with a config from eduroam CAT and added custom ClientSideCredential subelements.

 

So I’ve taken inspiration from https://datatracker.ietf.org/doc/html/draft-winter-opsawg-eap-metadata-02#section-2.2.2.3 for what I should be including, but have some queries:

I think a better and more current source is in the CAT repo:

https://github.com/GEANT/CAT/blob/master/devices/eap_config/eap-metadata.xsd

1. The config from CAT contains InnerIdentitySuffix and InnerIdentityHint, these aren’t mentioned in the above doc
2. I’ve added the following:

 

                <ClientSideCredential>

                                <AnonymousIdentity>jim AT ti.dev.ja.net</AnonymousIdentity>

                                <UserName>jim AT ti.dev.ja.net</UserName>

                                <allow-save>true</allow-save>

                                <ClientCertificate> SOME BASE64 </ClientCertificate>

                                <Passphrase>asdfqwerqwer</Passphrase>

                </ClientSideCredential>

 

Are these the correct subelements? And what form should the ClientCertificate take? I’ve tried cert pem + encrypted private key (crashes) and Base64 encoded pkcs12 (complains, not a valid eap-config file)

 

I’m having trouble deducing this from the app source code – any hints here would be great.

I think it's easier to test with the .eap-configs that the letswifi-portal produces, or the output from CAT itself. Looking at what letswifi-portal produces, it looks like:

<ClientSideCredential>
<OuterIdentity>pseudo-id AT realm.tld</OuterIdentity>
<ClientCertificate format="PKCS12" encoding="base64">... (base64 here)...</ClientCertificate>
</ClientSideCredential>

Hope this helps,

Regards,
Paul

 

I’ve attached the eap-config I’m working with (cert + passphrase work but are revoked)

 

Thanks,

 

Jim Potter

Jisc