eduroam: towards a managed European service
description
Transcript of eduroam: towards a managed European service
Connect. Communicate. Collaborate
eduroam: towards a managed European serviceMiroslav Milinović, Srce, Zagreb, Croatiaeduroam SA, GÉANT2 <[email protected]>
Wi-Fi Workshop, Barcelona, Spain
Connect. Communicate. CollaborateContents• Roaming acitivity in GEANT2 (JRA5, SA5) • eduroam technology• eduroam service
– organisation– infrastructure elements– supporting elements
• Current status and plans
Connect. Communicate. CollaborateGEANT2 & roaming• JRA5: Roaming and Authorisation
– How to organise access to resources in the research and education area in a sufficiently safe and easy to handle way?
– Work items: roaming (eduroam), AAI (eduGAIN), uSSO– JRA5 roaming vision: To build a roaming infrastructure enabling
full mobility of members of the scientific community in Europe
• SA5: eduroam service activity– continue on JRA5 results in order to build and maintain reliable
European eduroam service– provide: “open your laptop and be online”
Connect. Communicate. CollaborateRoaming requirements• Identify users uniquely at the edge of the network• Enable guest usage• Scalable
– local user administration and authentication
• Easy to install and use– at the most one-time installation by the user
• Open• Secure
Connect. Communicate. Collaborateeduroam technology• Security based on 802.1X
– Integration with VLAN assignment– Protection of credentials
• Authentication based on EAP– Different authentication mechanisms possible by using EAP
(Extensible Authentication Protocol)
• Roaming based on RADIUS proxying– Remote Authentication Dial In User Service– Transport-protocol for authentication information
• Trust fabric based on:– Technical: RADIUS hierarchy– Policy (federation agreement): Documents/contracts that define the
responsibilities of user, institution, NREN and the respective federation
Connect. Communicate. CollaborateConnect. Communicate. Collaborate
RADIUS serverUniversity B
RADIUS serverUniversity A
XYZnet
Central RADIUSProxy server
Authenticator(AP or switch) User
DBUser DB
Supplicant
userjoe@university_b.hr
StudentVLAN
CommercialVLAN
EmployeeVLAN
data
signalling
• Trust: RADIUS & policy documents
• 802.1X + EAP• (VLAN assignment)
eduroam architecture: ubiquitous network access
Connect. Communicate. Collaborate
eduroam confederationRADIUS hierarchy Connect. Communicate. Collaborate
.DK .PT
inst-1 inst-2 inst-3 inst-4
confederation level servers
federation (NREN) levelservers
institutional levelservers
Connect. Communicate. Collaborateeduroam goes global
http://www.eduroam.org
Connect. Communicate. Collaborate
(European) eduroam service• eduroam user experience: “open your laptop and be online”
• To provide secure network access inside the confederation boundaries (to the end users)
• eduroam is a secure international roaming service for members of the European eduroam confederation (a confederation of autonomous roaming services)
• First steps in transition to service:– Service Definition and Implementation Plan– Policy
Connect. Communicate. Collaborate
European eduroam confederation principles
• Members are European NRENs/NROs
• Members sign European eduroam policy commiting to the organisational and technical requirements
• Mutual access – no fees (for end users)
• Authentication at home - Authorisation at visited institution
• Home institutions are/remain responsible for their users abroad
• Members promote eduroam in their countries
• European eduroam may peer with other regions (confederation level)
Connect. Communicate. Collaborate
Confederated eduroam service
• Encompasses all the elements necessary to support the Service– confederation infrastructure– establishing trust between the member federations– monitoring and diagnostic facilities– central data repository (eduroam database)– confederation level user support
Connect. Communicate. Collaborateeduroam service model
national eduroam service
(provided by NREN/NRO)
national eduroam service
(provided by NREN/NRO)
eduroam confederation service
(provided by OT)
eduroam service (governed by SA5)
...
Connect. Communicate. Collaborateeduroam service elements
• Technology infrastructure• Supporting infrastructure
– monitoring and diagnostics– eduroam web site (http://www.eduroam.org)– eduroam database– trouble ticketing system (TTS)– mailing lists
Connect. Communicate. CollaborateUsers vs. service elements
Service elements User group
End user Inst. Level personnel Federation-level personnel
Basic monitoring facilities Yes Yes Yes
Full monitoring and diagnostics facilities
No Yes (limited to the information regarding the respective inst.)
Yes
Public access to the eduroam web site
Yes Yes Yes
Access to the internal eduroam web site
No Yes (limited to the information regarding the respective inst.)
Yes
Public access to the eduroam database
Yes Yes Yes
Access to the all information in the eduroam database
No Yes (limited to the information regarding the respective inst.)
Yes
TTS No Yes Yes
SA5/OT Mailing lists No No Yes
Support from OT No No Yes
Connect. Communicate. Collaborateeduroam infrastructure
Top-level RADIUS Server(s)
Home Federation Remote Federation
Federation (National) top level RADIUS proxy Server(s)
HI IdP
Federation (National) top level RADIUS proxy Server(s)
RI SP
networkUser U access
RADIUS RADIUS
AuthN S
RADIUS RADIUS
HIRADIUS Server
RIRADIUS Server
RADIUS
Eduroam confederation infrastructure
Connect. Communicate. CollaborateMonitoring: problem definition
• Monitor functionality of the eduroam infrastructure– servers– infrastructure– user experience
• It is not enough to know that host is accessible
• Ultimate goal is to test real users experience – (very) different workflows at RADIUS servers for Accept and Reject– perform both accept and reject logic tests
Connect. Communicate. CollaborateMonitoring: concept
• Monitoring client is RADIUS client capable of sending various types of RADIUS request (PAP, EAP, …)
• RADIUS Proxy Server is monitored server• IdP RADIUS Server is the server that issues the response thus acting as loop-back
server. It’s function is to close the tunnel and create standard well format and specified response. This function might be realized on the monitored server (RADIUS proxy server)
Monitoring Client
IdP RADIUS Server
RADIUS Proxy Server
Connect. Communicate. CollaborateMonitoring servers
monitoringdatabase
monitoring client
TLRS
FLRS
Connect. Communicate. CollaborateMonitoring infrastructure
monitoringdatabase
monitoring client
TLRS(s)
FLRS(s)
TLRS(s)
FLRS(s)
Connect. Communicate. CollaborateTesting on demand
monitoringdatabase
monitoring client
TLRS(s)TLRS(s)
realm B
FLRS(s)
realm A
FLRS(s)
Connect. Communicate. Collaborateeduroam database• The information stored in the eduroam database includes:
– NRO representatives and respective contacts– Local-institutions (both SP and IdP) official contacts– Information about eduroam hot spots (SP location, technical info)– Monitoring information– Information about the usage of the service
• NROs:– should provide respective data (general and usage data)– in the defined XML format available at the specified URL address– should be accessible only from the eduroam database server
Connect. Communicate. Collaborate
User support: problem escalation scenario (1)
visited federation
fed.-level admin.
local institution admin.
user
home federation
fed.-level admin.
local institution admin.
OT
1,2
3
4
Connect. Communicate. Collaborate
User support: problem escalation scenario (2)
visited federation
fed.-level admin.
local institution admin.
user
home federation
fed.-level admin.
local institution admin.
OT
1,2
3
6
4a
5
4b
4
Connect. Communicate. CollaborateImplementation plan
servicedefinition& policy
monitoring
web site
TTS
eduroamdatabase
Sep07 Jan08Dec07 Mar08Feb08 Apr08 Aug08 Feb09
M37 M41M40 M43M42 M44 M48 M54
Connect. Communicate. Collaborate
eduroam current status:connected to the TLRSs
• 33 countries
• 2 TLRSs
Connect. Communicate. Collaborate
eduroam current status:monitored TLRS/FLRS
• monitoring service is in place
• will be publicly available via www.eduroam.org (end of April 2008)
• further development is planned
Connect. Communicate. Collaborate
eduroam current status:demographics/user maps
• demographics info:– no of SPs, IdPs– location of SPs– usage– coverage– contacts
• user oriented maps• based on eduroam database• will be publicly available via
www.eduroam.org (end of April 2008)
• further development is planned
Connect. Communicate. Collaborate
http://www.eduroam.org