On 15.08.19 03:24, Alan DeKok wrote:
What you should be doing is:
* all users log in with a non-empty outer identity. * *your* users log in with outer identity of "@my.domain.tld" * the FreeRADIUS configuration has that domain as a local one * everything else gets proxied to eduroam
A long and detailed guide is in the Wiki: https://wiki.freeradius.org/guide/eduroam
If I may add, as an University admin having to deal with foreign (meaning not from my University) users: For the love of $deity, enforce the existence of a realm in the Eduroam SSID for every user, even your local ones. I really really really hate all the users from other universities who try to log in to our Eduroam SSID using only "username" instead of "username@uni.ver.sity", causing unneccesary chatter and rejects from the local RADIUS servers. This additionally serves the purpose of ensuring that your *own* users have a realm configured, so their configuration continues to work in foreign Eduroam networks. Please, don't allow just "username" for your local users to work in your Eduroam, you will create a heap of problems for you and your users down the line. Believe me, I was down that line and it was a real mess to clean up. Grüße, Sven.