...
In particular, for participation in OpenRoaming, the following is REQUIRED:
- The contact information concerning the Identity Provider in the eduroam Operations Database needs to be complete and accurate, including at least email address, postal address and telephone number
- The Identity Provider must generate generating Chargeable-User-Identity attributes in authentication responses
populating a DNS The DNS zone for the Identity Provider's realm name must include a NAPTR record for their realm pointing to an eduroam OpenRoaming interchange proxy. The example below targets the general-purpose proxy operated by eduroam OT; the eduroam OpenRoaming Interchange Proxytarget host may be different for eduroam NROs who operate their own proxy:
realm.name. 43200 IN NAPTR 100 10 "s" "aaa+auth:radius.tls.tcp" "" _radsec._tcp.openroaming.eduroam.org.
(or another SRV target if instructed so by their eduroam NRO)
Infrastructure
OpenRoaming
eduroam currently operates a beta-quality central interchange point with OpenRoaming. Third-party SPs find it automatically by looking up NAPTR records in DNS for aaa+auth for the respective realm. Identity Providers need to configure a NAPTR record, see above.
Passpoint Release 2: Online Sign-Up
eduroam plans to operate an OSU server which directs unprovisioned end-users to the eduroam CAT toolset. The provisional URL for this server is
...
- End user devices need to be provisioned with the pertinent settings to recognise OpenRoaming hotspots - see section "End-User Device Settings" below
End-User Device
...
Settings
Starting with version 2.0.3, the eduroam onboarding toolset (eduroam CAT and eduroam Managed IdP) automatically inject network definitions based on the eduroam Roaming Consortium Organisation identifiers (RCOI) on all platforms where this is possible. The platforms and their respective caveats are listed below.
...
(The built-in method of Passpoint R1 provisioning as described in AOSP: Wi-Fi Passpoint R1) is not generally usable as the installation of new, dedicated Wi-Fi root CAs is prohibited by Android API.)
Linux
TBD.
ChromeOS
TBD.
Infrastructure
OpenRoaming
eduroam currently operates a beta-quality central interchange point with OpenRoaming. Third-party SPs find it automatically by looking up NAPTR records in DNS for aaa+auth for the respective realm. Identity Providers need to configure a NAPTR record, see above.
Passpoint Release 2: Online Sign-Up
eduroam plans to operate an OSU server which directs unprovisioned end-users to the eduroam CAT toolset. The provisional URL for this server is
https://cat-osu.eduroam.org/soap/?idp=X
Policy
GeGC to decide on terms and conditions for letting random SPs serve eduroam users.
...