Release of eduroam(UK) Tech Spec v1.3
Audience - eduroam(UK) system administrators and implementors
The eduroam(UK) Technical Specification 1.3 has now been released. The update primarly addresses the issues arising from the emergence of managed Visited service provision by commercial companies for existing eduroam participants. Such services are becoming widely included as part of out-sourced student accommodation agreements. Other changes are to the requirement for the maximum retention period of logs to not exceed 6 months. This has been removed since this is matter for the organisation's general data protection compliance and not the eduroam tech spec.
Changes introduced in Tech Spec 1.3
- The discussion of participation models in chapter 2, Common Requirement and Recommendations, has been expanded in the interest of clarification and to illustrate that it is possible for a service to be provided on an out-sourced basis or on a completely managed basis.
- Requirement 6, the stipulation of a six months maximum retention period for RADIUS logs has been deleted since the maximum retention period is a matter decided by the participant's general data protection compliance or other policy.
- Wording added to the discussion section 2.3.2 to provide the reasoning behind removal of the maximum period for log keeping and to indicate best practice together with emphasising the reference to the Janet technical guide on logging. Minor wording changes also made to the first paragraph on time reference to improve readability.
- Requirement 32, non-local realm name defined to describe names other than those associated with the local participating organisation or partners of an organisation providing a managed service. Authentication requests containing user names with such non-local realm must be forwarded to the NRPS but forwarding of requests containing local realm names to the NRPS is explicitly prohibited.
- Requirement 35 and 36 expanded to include partner organisations in relation to administration of DNS domains from which realms are derived.
- New Requirement 37 inserted to mandate forwarding of local authentication requests directly to a partner organisation’s Home RADIUS servers where a Visited service is provided in partnership with another organisation, for instance by a managed service provider, and to prohibit forwarding by the managed service provider of such authentication requests to the NRPS.
- New Requirement 38 inserted to prohibit forwarding of requests between multiple partners where the partners are independent eduroam participants; i.e. bypassing the NRPS for authentications between partner organisations is prohibited. Note, this does not proscribe inter-organisation authentication between members of an association of co-operating organisations in which the association is a member of eduroam(UK) but individual organisations are not members in their own right.
- Requirement 37 renumbered to 39 and all subsequent requirements to 54 incremented by 2.
- Appendices updated.
Full specification published at:
https://community.ja.net/groups/eduroam/document/eduroamuk-technical-specification-v13
Also includes downloadable Word version of latest Technical Specification
Full web version and pdf of Technical Specification published at:
https://community.ja.net/library/janet-services-documentation/eduroamuk-technical-specification
