Deployment details of Managed IdP for NRO (from NRO admin input)

• Whether it is enabled or not
• max number of users per institution profile
• EAP termination settings

Deployment details of Managed IdP for institution

• whether the admin has accepted the system's ToU
• (pseudonymous) usernames of the institution's users
• expiry date of said pseudonymous usernames
• list of eduroam credentials issued to these users (properties of these credentials in 8, below), linked to the respective username
• list of pending invitation tokens with which users can create new credentials and inquire about their account status (properties of invitation toekns in 9, below)
• status of the usernames (active, inactive)
• data freshness: when were the set of users last checked by the administrator for continued validity?

eduroam credentials (X.509 certificates)

• unique, randomly generated username as certificate Subject (original pseudonymous username is not contained, but system maintains an internal link between pseudonymous username and the Subject of the certificate)
• date of issue and expiry of certificate
• unique, randomly chosen serial number for certificate
• device type for which certificate was generated
• revocation status of certificate
• invitation token (see 9, below) which was used to generate certificate

end-user invitation tokens (URLs with unique, random long identifier)

• pseudonymous username to which invitation token pertains
• number of devices which can be credentialed witht his token
• expiry date of invitation token

RADIUS authentication logs

The RADIUS server is an eduroam IdP in the sense of the dataset "eduroam RADIUS server logs → IdP" above, and the same data set considerations apply.

certificate status server logs

• logs the timestamp when a revocation assertion was requested for a given eduroam credential - revocation assertions typically coincide exactly with the actual authentication happening on the RADIUS server. Does not log the actual revocation state that was returned.

Troubleshooting issues and resolving security incidents.

Recommendation by the eduroam Service Definition.

Troubleshooting issues and resolving security incidents.

Requirement by the eduroam Service Definition is to keep the logs of public IP addresses assigned to users and its relation to users MAC address (no requirement imposed when using NAT).

eduroam database - NRO information & institution information (see datasets above), eduroam SP proxy authentication data (see dataset above)

administrator input

web server and application logs

Data is logged in the Managed SP RADIUS servers when a RADIUS authentication or response passes (user accesses eduroam at a hotspot connected to Managed SP)

Data is stored in the Managed SP RADIUS servers, accessible to the eduroam operational team personnel and the registered hotspot operator

Data is stored in the equipment, accessible only to the hotspot operating personnel.

No

• The authorisation status of administrators who ever logged in is retained permanently.
• hotspot deployment information is kept until the administrator chooses to delete it (then deleted immediately)

Depends on local the policy.

eduPersonTargetedId or equivalent user identifier

Of NRO or SP administrator

First name and Last name

Of NRO or SP administrator

email

Of NRO or SP administrator

Outer EAP-identity

Users username@institution_domain, username can be anonymised but not all users do that

Calling-Station-Id

Users MAC address

Chargeable-User-Identity

Users anonymous ID