eduroam(UK) Technical Specification v 1.2 Main Changes from v 1.1
Audience - eduroam(UK) system administrators and implementors
Although the eduroam(UK) Technical Specification 1.2 has been released for a little while now, with the imminent release of exciting new service features, now might be a good time to review your eduroam service deployment.
Mandatory Requirements introduced in Tech Spec 1.2
1. Emphasised that only RFC 4282 compliant usernames (of the form userID@realm) to be employed for user authentication both for roaming users and for users when at the Home site.
2. Mandatory requirement that Visited sites must not forward malformed usernames to the NRPS (e.g. usernames with realms that are malformed, typos, bad higher level domain).
3. Specification of RADIUS parameters to be logged now include User-ID, Calling-Station-Idendity (CSI) and Chargeable-User-Identity (CUI).
4. Improvement in service status information that must be published on the orgs eduroam service information web site.
5. Removed the different tiers of technical standards from the specification (JRS2/JRS3).
6. Range of Tiers replaced with a ‘base engineering standards’ together with evolutionary progression path for introduction of enhanced standards.
7. Relating to ORPS using RadSec (TLS over TCP) to NRPS i) definition of use of TCP 2083 ii) only Geant eduPKI certificates to be used.
8. Home organisation ORPS must not reject based on NAS-Port-Type not matching a specific value and must process all auth requests against a user database.
9. It is now permitted that NASs can connect multiple users to a single port (to accommodate controller-based systems).
10. Due to simplification of Tiers, although not recommended, NAT permitted regardless of whether or not IPv6 supported.
11. Mandatory ports and protocols additions:
• IP Protocol 41 (IPv6 Tunnel Broker Service)
• TCP/3128 (SQUID Proxy)
• TCP/8080 (HTTP Proxy)
• IP Protocol 50 (ESP)
• IP Protocol 51 (AH)
• UDP/500 (ISAKMP)
12. Removed requirement to support WPA/TKIP – replaced with permission that existing deployments may continue to do so until end December 2014, recommend to phase out asap.
13. All Visited sites MUST now support WPA2/AES and new joiners can only offer WPA2/AES.
14. Emphasized that all NASs must include CSI and NAS-IP-Address.
15. Broadcasting of eduroam SSID at non-operational sites must be limited to test environment.
16. Due to deprecation of PAP authentication, test accounts must now use the EAP method normally used at the organisation and not PAP.
17. List of attributes that must not be filtered out updated to reflect recommendation to use Operator-Name and CUI (ie O-N and CUI must not be filtered out).
Recommendations added in v1.2
1. Recommended that Visited organisations should request Chargeable User Identity in Access-Requests if possible.
2. Recommended that Home organisations should add Chargeable User Identity in accordance with RFC4372 when solicited in Access-Requests.
3. Recommended that IPv6 should be implemented.
4. Recommended to avoid inclusion of VLAN assignment attribute in Access-Accepts where no bilateral agreement exists.
5. Recommended that organisation implement load balancing on ORPS between NRPS.
6. Recommended that Operator-Name should be inserted wherever possible.
Full change log published at:
https://community.ja.net/groups/eduroam/document/eduroamuk-technical-specification-v12
Also includes downloadable Word version of latest Technical Specification
Full web version and pdf of Technical Specification published at:
https://community.ja.net/library/janet-services-documentation/eduroamuk-technical-specification
