Hi,
Eduroam should really be creating a routing protocol for RADIUS. I don't think it would be hard: git + ssh + text files. See Section 2.7 of:
firstly, its 'eduroam', not 'Eduroam' - minor point but none the less.... :-) secondly - the current system uses a rpoxy heirarchy because that was the lowest common capable denominator when the federation was created and its fairly easy for sites/countries to get connected. there are currently moves underway to investigate/implement moves to using dynamic RADIUS/REALM lookups etc however there are then fundamental changes that need to be undertaken - such as having required 'membership' - eg certificate extension to prove you are a valid eduroam site - couple that with requirements to use eg RADSEC for secure transit (cant used shared secrets with random other sites!) .... and then theres what to do to the countless RADIUS servers in use that dont (and maybe wont) support such features... sure , sure 'RADSecProxy' is a tech answer but I've already approached sites big on Windows servers and IAS/NPS - the thought of running some non-MS software on their server makes them very angry/angsty.... it looks like a proxy system would need to kept into place to keep those sites in (as well as imagine telling them to open ports up to their MS server to the world......) currently, the proxy system doesnt involve even more CA/PKI stuff and it doesnt open system to the world...a lot of sites like that..... :-| ...but anyway..even when the new system becomes functional/proved it will take quite some time for sites to migrate... and I've already proposed that sites can publish the national proxy as their SRV (or whatever method is chosen) record alan