Feb. 3, 2021
IAM WG Meeting @ APAN51, Virtual / Islamabad

Off‐campus eduroam deployment
and WBA OpenRoaming
Hideaki Goto Tohoku University / NII, Japan1

Early‐days off‐campus eduroam deployment• 130+ eduroam hotspots at rental meeting rooms, cafes, etc. inthe central area of Tokyo since 2011 (migrating to Cityroam)• eduroam at airports, train stations, etc. in Sweden• eduroam on HotCity (municipal Wi‐Fi) in Luxemburg• eduroam at airports in Norway• eduroam in downtowns of York, Munich, Porto, etc.
• 132 hospitals in the UK (as of 2017)

A lot more!

2Off‐campus eduroam as digital infrastructure

New!

South Africa:
eduroam at most universities, addressing digital
divides and COVID-19 (July, 2020)

Cape Town:
eduroam in 57 public
libraries (Aug. 2019)

RENU in Uganda:
Town-wide eduroam
to help students
learning under COVID-19 (Oct. 2020)3

“Extended virtual campuses” in Ireland (Jan. 2021)

http://www.universitytimes.ie/2021/01/heanet‐to‐extend‐
wifi‐initiative‐for‐students‐to‐90‐new‐locations/4Why City/Free Wi‐Fi & off‐campus eduroam?
 Tourism (not at the moment under COVID-19...) Smart Cities, IoT
 Provide citizens with access means for various

digital services.
 “Wi-Fi for all.” (WiFi4EU by European Commission)
resolving digital divides
 Community supports for Research & Education.

What are needed?
 Secure connections with good usability Free roaming User identity verification and traceability(for security, trusts between operators, and compliance) 5

Cityroam, the secure roaming system for Public Wi‐Fi Both Passpoint and dot1X
 Affordable roaming platform for various Roaming

Consortia and operators (SMB, cities, etc.)
 IdP: eduroam, ANYROAM, Cityroam Cloud IdP, etc.

(planned: telcos/ISPs and cities via OpenRoaming) Our strategies:No roaming fee.
(We make the most of the localecosystem each Free Wi-Fi has.)Utilize existing accounts
as much as possible.
(roaming with telcos/ISPs)

6

Cityroam sites
 Passpoint services on the Cityroam APs in 12 cities/towns.

Cafes, hotels, shopping malls, etc.
Sapporo Gakuin University (for better services for citizens)
Ski resorts (Hakuba47)
Kita-Kyushu Monorail stations
Conference venues (temporary deployment)Internet Week 2018 & 2019, AXIES 2018,
95th-97th Comic Market, etc.
Cityroam supports quick
deployment of eduroam+ Public Wi‐Fi.

New direction:Univ.&Schools
should provide
Public Wi‐Fi, too.

Mobile eduroam/Passpoint AP

eduroam on
vending machines7

WBA OpenRoaming eduroam (GÉANT), Cityroam, ANYROAM, Janet are

already the members of OpenRoaming.

 Developing eduroam/govroam via OpenRoaming network.
 Enabling eduroam/govroam services at OpenRoaming service

areas (cities, facilities, shops, …).
(eduroam CAT now supports eduroam/OpenRoaming)
Sapporo Gakuin Universityin Japan

Nagano City8

WBA OpenRoaming Inter-connect telcos, ISPs, City Wi-Fi, etc.
 Based on the Passpoint and the Wireless Roaming

Intermediary eXchange (WRIX) framework.
 PKI and RadSec + Dynamic Peer Discovery
 Similar to eduroam, but in larger scale.
 Two policies using different RCOIs
 Settled: Accounting and intermediary are required.
 Settlement-free:

No roaming fee. Easier onboarding.

RCOI: Roaming Consortium Organization Identifier9eduroam–OpenRoaming interconnection
eduroam via OpenRoaming ANPs

Universities providing OpenRoaming
service for visitors and residents.)

IdPseduroam.org
Default
eduroam-OR
gateway.us.us.jp.jp
via local hubs
or vendors

RadSec via hubs
or direct
IdPs

ANP: Access Network Provider

10Enabling eduroam at OpenRoaming venues
SchemeCoverage

SSID / Passpoint

standard eduroam

All

SSID=“eduroam”

Most preferred.
Operators need to join eduroam
as SP (registration required).

eduroam RCOI

Opted‐in
IdPs / all ?

Passpoint witheduroam RCOI

Passpoint profile is needed onuser devices.
Operators need to join eduroam
as SP (registration required).

Passpoint with
OR’s RCOI

Not an eduroam service.
Need to encourage operators NOTto drop eduroam service.
Otherwise, users would be
disappointed (not authenticated).

^^
Least recommended as it kicks
out non‐edu users.

(under devel.)

OpenRoaming
settlement‐freeRCOI^OpenRoaming RCOI ^for education

RCOI: Roaming Consortium Organization Identifier

11How to join OpenRoaming?
 eduroam is already a member! By adding DNS NAPTR records, institutions will be able toaccept AuthN requests from OpenRoaming.
 Connection via a local federation, operator, or AP vendor’ssolution.
 Become a WBA member to get the digital certificates foronboarding.
 Membership fee applies. WBAID is assigned.
 Implementer Member is a new and affordable category.

 Get the digital certificates from a WBA agent.
 WBAID with SubID is assigned.
 Subscription fee applies.

12

New directions of eduroam and public Wi‐Fi
 Managed IdP Wi-Fi industry’s movement
 eduroam Managed IdP Utilizing federated IDs, IdPaaS, etc.

(geteduroam) Managed Wi-Fi (SP) Integration of various wireless services. (AP for any)
 Also under discussion at eduroam.org
 AP operations would be liberated from

often-excessively-strict AUP at institutions.
 Easy deployment and operation
 Only APs at institutions.
 Check -> ☑ Enable eduroam
 Check -> ☑ Enable OpenRoaming

13

Please call us if you want todevelop a federation like
Cityroam in your region.
https://cityroam.jp/

If you are interested in trying
OpenRoaming, please ask
Hideaki (me) or Paul@SURFnet

Join https://eduroam.slack.com/
14