eduroam Delegate Authentication System with Shibboleth SSO 29th APAN Meeting Feb. 8-11, 2010, Sydney, Australia eduroam Delegate Authentication System with Shibboleth SSO Hideaki Goto, Hideaki Sone Tohoku Univ. / NII Ichiro Yamaguchi, Takaaki Suzuki Tohoku Univ.

1,200+ (govt. survey in year 2008) A great challenge … How many higher education institutions are there in Japan? 1,200+ (govt. survey in year 2008) 765 universities (86 national, 90 public) 481 two-year colleges and vocational colleges eduroam deployment: 11 / 1200 = 0.9%

Problems Our solutions A large number of institutions (1,200+) Difficulties in RADIUS deployment Laborious eduroam connection / management work Our solutions Federated Delegate Authentication System with centralized RADIUS server remove RADIUS IdP at each institution Federation using Shibboleth SSO simplify RADIUS tree (higher stability) solve some privacy and security issues Web-based eduroam IdP / SP management system reduce the work at both the eduroam JP office and each institution

Easy-to-join eduroam system 2. eduroam IdP/SP management web Institution’s RADIUS server national top-level <secret key 1> access points RADIUS proxy auth requests <secret key 2> RADIUS IdP 1. Delegate Authentication System (DEAS)

Federated Delegate Authentication System Account Issuer as a Shibboleth SP of Japan’s UPKI inter-university federation Centralized RADIUS server to simplify the RADIUS proxy tree 3 types depending on the needs and federation level Pseudo-anonymized, fixed-term, and traceable roaming IDs

Delegate Authentication System - Type I Japan’s centralized account issuer Institutions RADIUS server The account is temporary and expires within 6 months. pseudonymous accounts IdM Web UI IdM Manual account issue requests by administrators. The system can be used even without IdM. Issuing Guest IDs is possible.

Delegate Authentication System – Type II Japan’s centralized account issuer Institutions RADIUS server The account is temporary and expires within 6 months. pseudonymous account Web UI IdM IdM ID federation using Shibboleth/SAML for administrators only. Administrators can request for user accounts in bulk. Issuing Guest IDs is possible.

Delegate Authentication System – Type III Japan’s centralized account issuer Institutions RADIUS server The account is temporary and expires within a month. pseudonymous account IdM IdM ID federation using Shibboleth/SAML End user can request for personal accounts only.

Web-based eduroam IdP / SP management system development under way Features: Application for eduroam IdP / SP connection via eduroam JP website Online sign-up for institutional administrator(s) ( require approval by the national admin. ) Online registration of institution data Management console for institutions RADIUS server address and secret setting Enable or disable Self-IdP / DEAS / SP(AP) Remote authentication self-testing (planned)

NEWS Negotiation is under way with a commercial Wi-Fi Service Provider We will have hundreds of eduroam APs in the central Tokyo ! Outsourcing campus Wi-Fi system would be a key to success of large-scale deployment.

Summary Large-scale eduroam deployment in Japan -- A great challenge -- Delegate Authentication System ease eduroam deployment Federated ID issuer as a Shibboleth SP simplify eduroam network = stabilize eduroam authentication Web-based eduroam IdP / SP management make eduroam easy-to-join simplify connection and administration work at the national administrative body at each institution

Supplementary slides

Problem details in large-scale deployment Difficult and laborious configurations of RADIUS / APs at each organization. Difficulties in newly constructing an “eduroam account database” or making a RADIUS-IdM bridge for each organization. Many universities do not have Federated IdM yet. Laborious work for institution connection. A lot of paper work RADIUS configuration support Connection testing Troubleshooting … etc. Impossible to deal with hundreds of institutions!

eduroam JP in UPKI project An activity in NII’s UPKI project Promotion and Operation of eduroam JP 11 institutions connected (Feb. 2010) Tutorial & technical documents R&D to solve problems Easy configurations Guest use of local IP addresses Location privacy, etc. Talks with commercial W-ISPs for roaming Shared access points possible? Negotiations are under way.

Threats of ID/PW leakage User ID is logged at proxy servers along the AAA path. Location privacy problem. PW could be logged due to inappropriate configuration by the user. Critical security breach if an important PW is used. logged Worldwide RADIUS tree potential leakage logged logged logged ID database RADIUS Access Request AP RADIUS Access Accept / Reject