UPDATE ......From Tuesday 8 April 2025 we have changed the way that Single Sign-on works on this wiki. Please see here for more information:
Update
eduroam Development VC Minutes 2022-07-19 1530 CEST
Attendance
Attendees
- Stefan Winter (Restena)
- Maxime Houlbert (Renater)
- Guy Halse (TENET)
- Mike Zawacki (Internet2)
- Sara Jeanes (Internet2)
- Zbigniew Ołtuszyk (PSNC)
- Zenon Mousmoulas (GRNET)
- Stephanie Cooper (ANYROAM)
- Tomasz Wolniewicz (PSNC)
- Christian Rohrer (SWITCH)
- Maja Gorecka-Wolniewicz (PSNC)
- Hideaki Goto (Tohoku University)
- Chris Phillips (CANARIE) - may not be able to stay on for whole call
- Ingimar Jonsson (RHnet)
Regrets
Agenda / Proceedings
Welcome / Agenda Bashing
CAT code (CAT / Managed IdP / Managed SP)
- multiple translation runs had to be done to polish UI
- validated that Apple small/cap letters are handled right by current code
- publishing now imminent
- hopefully done by end of this week
Managed IdP - enabling OpenRoaming by default?
- Enabling OR simply provides more service, without the hassle (NAPTR in our hand, installers auto-generated, client certs prevent Apple multi-prompt problem).
- NRO still needs to turn this on/off for their own NRO space
- IdP also needs to turn on on their tenancy level (yes/no and T&Cs pre-agreed or not)
- next steps: inform those NROs who already use MIdP that this is an opportunity for change for them
- for new NROs: add to the doc that OpenRoaming is a NRO-level and IdP and user decision
CAT API questions/remarks
problem: NRO cannot identify their own IdPs by the identifiers they assign themselves - only foreign identifiers present
see: https://github.com/GEANT/CAT/issues/226SW to check the DB VIEWs whether the NRO-provided identifiers are now visible to CAT; and expose them in DATADUMP-FED subsequently (pending)
Wrap-up of inner vs. outer realm differences
- discussion post-call last time
- since Windows does not allow differences in realms for PEAP
- so, variation in realm part might work for TTLS
- known-working option is to vary the local part of username, but keep same realm
- IusedCAT@realm.tld vs. john.doe@realm.tld -> known to work
- john.doe@configured.realm.tld vs. john.doe@realm.tld -> ? on Windows, only works for TTLS!
AOB / next VC: 16 Aug 2022 1530 CEST