Hi, I have some problems setting up eduroam. I am in charge of CS department inside my university. I have credential both in CS department and at the university level. I can use my CS credential to authenticate to eduroam, whether I am in my CS department network or anywhere else in the university network (and in the world according to some roaming users). I can use my university credentials to authenticate to eduroam when I am on the university network, but it does not work when I am in CS department network. I don't know if it is working anywhere else in the world. CS department network and university network are not connected, futhermore they both refer to the national eduroam gateway for authentication (for historical reason, there is no hierarchy). How can I check why I cannot authenticate? It could be 2 reasons: - I do not proxy properly to the national eduroam gateway - my university side of eduroam is not receiving/answering to the authenication requests coming from upper level. I have no credential outside of my CS department and university that I can use for testing. Best regards, Olivier --
Sorry not at work at the moment but CS dept used to have a separate eduroam registration for cs.york.ac.uk While the rest of the uni used york.ac.uk We used to proxy requests for cs.york.....to your radius servers but haven't done that for a long time, in fact I think the JISC entry for cs.york.ac.uk might have been removed a while back. Really I you should be using your @york.ac.uk account now for connectivity everywhere I'll check this tomorrow Rgds Alex Sent from my iPhone 6 plus
On 8 Feb 2017, at 10:17, Olivier <Olivier.Nicole@cs.ait.ac.th> wrote:
Hi,
I have some problems setting up eduroam. I am in charge of CS department inside my university.
I have credential both in CS department and at the university level.
I can use my CS credential to authenticate to eduroam, whether I am in my CS department network or anywhere else in the university network (and in the world according to some roaming users).
I can use my university credentials to authenticate to eduroam when I am on the university network, but it does not work when I am in CS department network. I don't know if it is working anywhere else in the world.
CS department network and university network are not connected, futhermore they both refer to the national eduroam gateway for authentication (for historical reason, there is no hierarchy).
How can I check why I cannot authenticate? It could be 2 reasons: - I do not proxy properly to the national eduroam gateway - my university side of eduroam is not receiving/answering to the authenication requests coming from upper level.
I have no credential outside of my CS department and university that I can use for testing.
Best regards,
Olivier -- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I have some problems setting up eduroam. I am in charge of CS department inside my university.
Are you in charge of the eduroam servers of your university? It sounds like you aren't?
CS department network and university network are not connected, futhermore they both refer to the national eduroam gateway for authentication (for historical reason, there is no hierarchy).
That sounds like whoever is in charge of your CS network treats any authentications that come in from the national proxy as visitors and hence they are not allowed on to your CS network.
How can I check why I cannot authenticate? It could be 2 reasons: - I do not proxy properly to the national eduroam gateway - my university side of eduroam is not receiving/answering to the authenication requests coming from upper level.
I have no credential outside of my CS department and university that I can use for testing.
Given that both university and CS networks refer to the national proxy, that should be enough. Use eapol_test (read http://deployingradius.com/scripts/eapol_test/) to do a test authentication to your CS-level eduroam server, and see what response you get. If you get an access-accept, it means that authentication *does* succeed at your university-level eduroam server. I would suggest running your CS-level eduroam server in debug mode for this, so that you can see what happens. If you get an access-reject returned from the proxy (the national level one), then yes, have a word with the person in charge of your university-level eduroam server to check. Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
Sigh!! Really sorry about that , really really was a senior moment. All I can say is that I had other things on my mind as I was sitting in A&E at the time I did a cursory glance at my work email . Guess I put 2 + 2 together and mar 15! Rgds Alex On 8 February 2017 at 12:33, Stefan Paetow <Stefan.Paetow@jisc.ac.uk> wrote:
I have some problems setting up eduroam. I am in charge of CS department inside my university.
Are you in charge of the eduroam servers of your university? It sounds like you aren't?
CS department network and university network are not connected, futhermore they both refer to the national eduroam gateway for authentication (for historical reason, there is no hierarchy).
That sounds like whoever is in charge of your CS network treats any authentications that come in from the national proxy as visitors and hence they are not allowed on to your CS network.
How can I check why I cannot authenticate? It could be 2 reasons: - I do not proxy properly to the national eduroam gateway - my university side of eduroam is not receiving/answering to the authenication requests coming from upper level.
I have no credential outside of my CS department and university that I can use for testing.
Given that both university and CS networks refer to the national proxy, that should be enough. Use eapol_test (read http://deployingradius.com/scripts/eapol_test/) to do a test authentication to your CS-level eduroam server, and see what response you get. If you get an access-accept, it means that authentication *does* succeed at your university-level eduroam server.
I would suggest running your CS-level eduroam server in debug mode for this, so that you can see what happens. If you get an access-reject returned from the proxy (the national level one), then yes, have a word with the person in charge of your university-level eduroam server to check.
Regards
Stefan Paetow Moonshot Industry & Research Liaison Coordinator
t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet
jisc.ac.uk
Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
On Feb 8, 2017, at 5:17 AM, Olivier <Olivier.Nicole@cs.ait.ac.th> wrote:
I can use my university credentials to authenticate to eduroam when I am on the university network, but it does not work when I am in CS department network. I don't know if it is working anywhere else in the world.
That looks like the RADIUS server that is responsible for authenticating your CS network does not proxy the requests for non-CS usernames correctly. I am not familiar with Thailand and it could be that the upstream proxy does not allow authentication of users with subdomains of the institutional domain (cs.ait.ac.th versus ait.ac.th), i.e. it wouldn’t “reflect” it back to your campus-wide service. You probably have to proxy user@ait.ac.th directly to the university server instead of upstream. - Michael
participants (4)
-
Alex Sharaz -
Michael Hocke -
Olivier -
Stefan Paetow