Connect. Communicate. Collaborate eduroam: towards a managed European service Miroslav Milinović,...

Connect. Communicate. Collaborate

eduroam: towards a managed European service

Miroslav Milinović, Srce, Zagreb, Croatiaeduroam SA, GÉANT2 <miro@srce.hr>

Wi-Fi Workshop, Barcelona, Spain

Connect. Communicate. CollaborateContents

• Roaming acitivity in GEANT2 (JRA5, SA5) • eduroam technology• eduroam service

– organisation– infrastructure elements– supporting elements

• Current status and plans

Connect. Communicate. CollaborateGEANT2 & roaming

• JRA5: Roaming and Authorisation – How to organise access to resources in the research and

education area in a sufficiently safe and easy to handle way?– Work items: roaming (eduroam), AAI (eduGAIN), uSSO– JRA5 roaming vision: To build a roaming infrastructure enabling

full mobility of members of the scientific community in Europe

• SA5: eduroam service activity– continue on JRA5 results in order to build and maintain reliable

European eduroam service– provide: “open your laptop and be online”

Connect. Communicate. CollaborateRoaming requirements

• Identify users uniquely at the edge of the network

• Enable guest usage

• Scalable– local user administration and authentication

• Easy to install and use– at the most one-time installation by the user

• Open

• Secure

Connect. Communicate. Collaborateeduroam technology• Security based on 802.1X

– Integration with VLAN assignment– Protection of credentials

• Authentication based on EAP– Different authentication mechanisms possible by using EAP

(Extensible Authentication Protocol)

• Roaming based on RADIUS proxying– Remote Authentication Dial In User Service– Transport-protocol for authentication information

• Trust fabric based on:– Technical: RADIUS hierarchy– Policy (federation agreement): Documents/contracts that define the

responsibilities of user, institution, NREN and the respective federation

Connect. Communicate. CollaborateConnect. Communicate. Collaborate

RADIUS server

University B

RADIUS server

University A

XYZnet

Central RADIUS

Proxy server

Authenticator

(AP or switch) User DB

User DB

Supplicant

user

joe@university_b.hr

StudentVLAN

CommercialVLAN

EmployeeVLAN

data

signalling

• Trust: RADIUS & policy documents

• 802.1X + EAP

• (VLAN assignment)

eduroam architecture: ubiquitous network access

Connect. Communicate. Collaborate

eduroam confederationRADIUS hierarchy Connect. Communicate. Collaborate

.DK .PT

inst-1 inst-2 inst-3 inst-4

tom@inst-1.dk

confederation level servers

federation (NREN) levelservers

institutional levelservers

Connect. Communicate. Collaborateeduroam goes global

http://www.eduroam.org

Connect. Communicate. Collaborate

(European) eduroam service

• eduroam user experience: “open your laptop and be online”

• To provide secure network access inside the confederation boundaries (to the end users)

• eduroam is a secure international roaming service for members of the European eduroam confederation (a confederation of autonomous roaming services)

• First steps in transition to service:– Service Definition and Implementation Plan– Policy

Connect. Communicate. Collaborate

European eduroam confederation principles

• Members are European NRENs/NROs

• Members sign European eduroam policy commiting to the organisational and technical requirements

• Mutual access – no fees (for end users)

• Authentication at home - Authorisation at visited institution

• Home institutions are/remain responsible for their users abroad

• Members promote eduroam in their countries

• European eduroam may peer with other regions (confederation level)

Connect. Communicate. Collaborate

Confederated eduroam service

• Encompasses all the elements necessary to support the Service– confederation infrastructure– establishing trust between the member federations– monitoring and diagnostic facilities– central data repository (eduroam database)– confederation level user support

Connect. Communicate. Collaborate

eduroam service model

national eduroam service

(provided by NREN/NRO)

national eduroam service

(provided by NREN/NRO)

eduroam confederation service

(provided by OT)

eduroam service (governed by SA5)

...

Connect. Communicate. Collaborateeduroam service elements

• Technology infrastructure• Supporting infrastructure

– monitoring and diagnostics– eduroam web site (http://www.eduroam.org)– eduroam database– trouble ticketing system (TTS)– mailing lists

Connect. Communicate. CollaborateUsers vs. service elements

Service elements User group

End user Inst. Level personnel Federation-level personnel

Basic monitoring facilities Yes Yes Yes

Full monitoring and diagnostics facilities

No Yes (limited to the information regarding the respective inst.)

Yes

Public access to the eduroam web site

Yes Yes Yes

Access to the internal eduroam web site

No Yes (limited to the information regarding the respective inst.)

Yes

Public access to the eduroam database

Yes Yes Yes

Access to the all information in the eduroam database

No Yes (limited to the information regarding the respective inst.)

Yes

TTS No Yes Yes

SA5/OT Mailing lists No No Yes

Support from OT No No Yes

Connect. Communicate. Collaborateeduroam infrastructure

Top-level RADIUS Server(s)

Home Federation Remote Federation

Federation (National) top level RADIUS proxy Server(s)

HI IdP

Federation (National) top level RADIUS proxy Server(s)

RI SP

networkUser U access

RADIUS RADIUS

AuthN S

RADIUS RADIUS

HIRADIUS Server

RIRADIUS Server

RADIUS

Eduroam confederation infrastructure

Connect. Communicate. CollaborateMonitoring: problem definition

• Monitor functionality of the eduroam infrastructure– servers– infrastructure– user experience

• It is not enough to know that host is accessible

• Ultimate goal is to test real users experience – (very) different workflows at RADIUS servers for Accept and Reject– perform both accept and reject logic tests

Connect. Communicate. CollaborateMonitoring: concept

• Monitoring client is RADIUS client capable of sending various types of RADIUS request (PAP, EAP, …)

• RADIUS Proxy Server is monitored server

• IdP RADIUS Server is the server that issues the response thus acting as loop-back server. It’s function is to close the tunnel and create standard well format and specified response. This function might be realized on the monitored server (RADIUS proxy server)

Monitoring Client

IdP RADIUS Server

RADIUS Proxy Server

Connect. Communicate. CollaborateMonitoring servers

monitoringdatabase

monitoring client

TLRS

FLRS

Connect. Communicate. CollaborateMonitoring infrastructure

monitoringdatabase

monitoring client

TLRS(s)

FLRS(s)

TLRS(s)

FLRS(s)

Connect. Communicate. CollaborateTesting on demand

monitoringdatabase

monitoring client

TLRS(s)TLRS(s)

realm B

FLRS(s)

realm A

FLRS(s)

Connect. Communicate. Collaborateeduroam database

• The information stored in the eduroam database includes:– NRO representatives and respective contacts– Local-institutions (both SP and IdP) official contacts– Information about eduroam hot spots (SP location, technical info)– Monitoring information– Information about the usage of the service

• NROs:– should provide respective data (general and usage data)– in the defined XML format available at the specified URL address– should be accessible only from the eduroam database server

Connect. Communicate. Collaborate

User support: problem escalation scenario (1)

visited federation

fed.-level admin.

local institution admin.

user

home federation

fed.-level admin.

local institution admin.

OT

1,2

3

4

Connect. Communicate. Collaborate

User support: problem escalation scenario (2)

visited federation

fed.-level admin.

local institution admin.

user

home federation

fed.-level admin.

local institution admin.

OT

1,2

3

6

4a

5

4b

4

Connect. Communicate. CollaborateImplementation plan

service

definition

& policy

monitoring

web site

TTS

eduroam

database

Sep07 Jan08Dec07 Mar08Feb08 Apr08 Aug08 Feb09

M37 M41M40 M43M42 M44 M48 M54

Connect. Communicate. Collaborate

eduroam current status:connected to the TLRSs

• 33 countries

• 2 TLRSs

Connect. Communicate. Collaborate

eduroam current status:monitored TLRS/FLRS

• monitoring service is in place

• will be publicly available via www.eduroam.org (end of April 2008)

• further development is planned

Connect. Communicate. Collaborate

eduroam current status:demographics/user maps

• demographics info:– no of SPs, IdPs– location of SPs– usage– coverage– contacts

• user oriented maps• based on eduroam database• will be publicly available via

www.eduroam.org (end of April 2008)

• further development is planned

Connect. Communicate. Collaborate

http://www.eduroam.org