Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

What is Dynamic Discovery?

eduroam has traditionally used a hierarchy of RADIUS servers. All national roaming authentication traffic was aggregated into a national proxy server; all international roaming traffic was aggregated into a set of international proxy servers.

...

For realms in generic top-level domains like .net, .org, .com etc. it is also RECOMMENDED to add these entries; and it may become mandatory at a later point in time.

Adding Dynamic Discovery hints to the IdP's DNS zone

To add Dynamic Discovery hints to your zone, you must first contact your national eduroam operator to determine which target name they have set up on the national proxy server; because you need to enter that discovery target in your DNS entry. In this documentation example, let's assume your national operator told you that the target name in your federation "Antarctica" is "_radsec._tcp.eduroam.aq". Let's further assume that your realm for eduroam and DNS domain is "greatidp.aq".

...

Don't worry, RADIUS software knows how to interpret this further (smile) If you are curious though, the next section explains what all these entries mean.

NAPTR explained

NAPTR records are more complex than, say, "A" records - the A record has only one piece of information to convey, namely the IP address which belongs to a name.

...

So let's take a look at the parts of the above entry:

EntryMeaning
greatidp.aq.This is the zone name (label) for which the NAPTR entry is defined
43200DNS caching lifetime of the entry (just like any other DNS resource record)
INThis entry is meant for consumption in the INternet (just like any other DNS resource record)
NAPTR

This entry is a Network Authority PoinTeR

100

Order: if multiple NAPTR entries are defined for the label, prefer lower order number over higher ones

(Note: since eduroam requires only one single entry, any number is fine here, unless your national federation operator instructs you otherwise)

10

Preference: if multiple NAPTR entries with the same Order are defined for this label, alternate between all those entries when resolving names

(Note: since eduroam requires only one single entry, any number is fine here, unless your national federation operator instructs you otherwise)

"s"

This NAPTR entry should be resolved to hostnames by doing a subsequent SRV lookup on the target label

(Note: eduroam only works with "s" labels; it is a configuration error to use "a" or "u" targets)

"x-eduroam:radius.tls"

This is the service; only resolve the later target name if you want to use the service - otherwise ignore the NAPTR response

(Note: this string is fixed in eduroam, as the roaming service with Dynamic Discovery is exclusively defined for RADIUS/TLS)

""

Regular Expression: some very advanced uses of NAPTR records allow transformation of target names according to regular expressions.

(Note: eduroam does not make use of this feature. The regular expression field MUST be the empty string; it is a configuration error to speciffy anything else)

_radsec._tcp.eduroam.aqThe target: please contact this server (after resolving its IP addresses and port numbers) if you want to use the "x-eduroam" service

 


At this point you may wonder: so how does this eventually yield an IP address of my national authentication server?

...

Finally, the querying server will then either ask for A or AAAA records to get to the IP address of the responsible server - and the discovery process is complete.