...
Service Provider settings
Also see Passpoint / Hotspot 2.0
OpenRoaming ANPs
Participating in OpenRoaming as an ANP means
...
Vendors that do support Hotspot 2.0 are Aruba, Meraki and , Cisco (obviously) Ciscoand Ubiquiti. This list is not exclusive. We know that some vendors are categorically not supporting Hotspot 2.0.
Some vendors only make Hotspot 2.0 features available on request. One example is Meraki, where you must contact support through the Meraki online management portal to request that Hotspot 2.0 is enabled.
...
- Baseline Participation: OpenRoaming for All Identities, settlement-free, no personal data requested, baseline QoS - includes, but is not limited to users in education and research
5A-03-BA-00-00 - usage of the hotspot is governed by the OpenRoaming End-User Terms and Conditions - Education-Only Participation: OpenRoaming Visited Network Providers who want to signal that they specifically welcome educational and research (i.e. eduroam) visitors settlement-free, should add the following RCOI instead:
5A-03-BA-08-00 - usage of the hotspot is governed by the OpenRoaming End-User Terms and Conditions
(this option makes sense if the hotspot is also welcoming other identities but on different terms, e.g. with-settlement) - The OpenRoaming framework allows announcing better QoS levels ("Silver" and "Gold") which come with their own RCOIs, differing from the above in one hexit. Since there is no benefit for an ANP in giving higher guarantees, it is suggested not to announce those RCOIs.
- Note, as of 8 Feb 2021: some onboarding tools and IdPs still use exclusively the pre-standard RCOI from Cisco times. This includes most notably: Cisco "OpenRoaming" app; the Samsung OneUI onboarding workflow. If you want to support users with IdPs served by these tools, be sure to include the RCOI 00-40-96 in the beacon.
Uplink
- You can calculate other RCOIs supported by OpenRoaming here: https://wireless-broadband-alliance.github.io/OR-rcoi-config/
Uplink
In order to be able to communicate with OpenRoaming, you have to either set In order to be able to communicate with OpenRoaming, you have to either set yourself up as an OpenRoaming service provider (called an ANP in OpenRoaming land) by applying for a certificate from the Wireless Broadband Alliance (WBA), or you have to connect your server to an uplink (a proxy that gets you access to the Openroaming network).
- Third-party hotspots which are onboarded in the OpenRoaming ecosystem by a third party need to take no further action. An OpenRoaming ANP uses the normal NAPTR discovery for users from an eduroam realm. This means that eduroam IdPs will need to publish a NAPTR record (see further down) and have it point to an eduroam ↔ OpenRoaming ANP proxy. (eduroam OT provides one such proxy for all eduroam participants; eduroam NROs may provide their own for their own institutional user base).
- Existing eduroam hotspots wishing to make use of eduroam infrastructure as their OpenRoaming uplink provider currently need to connect the Wi-Fi network that has these RCOIs to a proxy run by the eduroam OT Ops Team - contact points for this are Paul Dekkers and Stefan Winter.
- If you intend to be an ANP, depending on your network access provision conditions, you may need to arrange for additional network provision that allows you to route network traffic that does not comply with your existing provision conditions. For example, organisations receiving network access through the UK JANET network must ensure that non-research/educational users are not routed over the existing network connection, but via separate network access (such as a broadband connection from a commercial provider).
Access Point Configuration examples
The configuration snippets that enable OpenRoaming with the "OpenRoaming All" and an uplink to the eduroam OT proxy are on the following pages:
ArubaOS 8.x (stand-alone)
ArubaOS 8.x (controller-based)
Cisco IOS-XE
- Also, if you intend to be an ANP, you must forward accounting requests to your uplink, and they are required to send those on to the identity provider.
Optional mobile network wireless offload
Mobile networks can use OpenRoaming to off-load wireless activity. Currently, only a very limited number of mobile carriers on the planet support this option. This ability is configured using the MCC/MNC Passpoint 2.0 options. The values for the MCC and MNC values can usually be derived from the '@wlan.mncXXX.mccYYY.3gppnetwork.org' username you can see on a network, any 0 prefix can be dropped. AT&T for example has two pairs, '310 280' and '310 410', while T-Mobile USA has one: '310 260'. The planet's MCC and MNC values can be looked up at https://mcc-mnc.net/
To date we are aware that in the US, AT&T and T-Mobile configure their SIMs to use OpenRoaming if their MCC/MNC pair is advertised, but we're also aware that Swisscom also potentially supports this. If you have a Swisscom phone, please let us know whether you can make this work!
Access Point Configuration examples
The configuration snippets that enable OpenRoaming with the "OpenRoaming All" and an uplink to the eduroam OT proxy are on the following pages:
ArubaOS 8.x (stand-alone)
ArubaOS 8.x (controller-based)
Cisco IOS-XE
FortiWiFi or FortiAP
Meraki OpenRoaming (cloud controller managed)
Ubiquiti UniFi OpenRoaming (Network controller managed)
...
eduroam SPs
Beacon Settings
...
Both for eduroam CAT and eduroam Managed IdP, the eduroam Passpoint profile is always included and the OpenRoaming Passpoint profile is optionally included. Installation of these may fail if the chipset and driver on the machine does not support Passpoint. Such failures are silently ignored (and only the eduroam SSID configuration is then installed); no user inconvenience.
Apple (Mac OS X, macOS, iOS, iPadOS)
For eduroam Managed IdP, eduroam Passpoint-based profiles are always installed alongside the SSID-based ones. This is expected to work throughout the product palette of Apple, and with no additional user interaction. OpenRoaming is not currently enabled on Managed IdP.
eduroam CAT will install OpenRoaming Passpoint profiles when enabled (all EAP types); it will however only install the eduroam Passpoint profile if the IdP's chosen EAP type is "EAP-TLS". This is because of known user nuisances regarding multiple username/password prompts for multiple SSID and Passpoint profiles which CAT minimises by omitting that extra prompt for eduroam Passpoint.
Android
eduroam Passpoint profiles and the optional OpenRoaming Passpoint profiles can be installed only with the new geteduroam app (i.e. not with the predecessor "eduroamCAT"). geteduroam has varying support for Passpoint profiles depending on the Android version and whether the IdP chose "Ask" vs. "Always" - the "Always" variant currently has better support across all supported Android versions; "Ask" support needs special IdP workarounds.
Intrinsic support for OpenRoaming exists on later (read, newer) devices and versions of Android. For example, recent Google Pixel devices (Pixel 5 and later) show "OpenRoaming" as a network when a HS2.0 hotspot is detected. You then have the choice to enable roaming to this network by choosing to use your Google account associated with your Android phone. Apps like 'Cisco Openroaming' also enable an account on the same network. CAT profiles installed with geteduroam will show "<realm name> via Passpoint" instead but do not associate with the "OpenRoaming" SSID. On some Samsung devices, you may see "OpenRoaming available using Samsung Account" instead, which will function in a similar fashion as the Google Pixel.
Linux
TBD.
ChromeOS
TBD.
Infrastructure
OpenRoaming
eduroam currently operates a beta-quality central interchange point with OpenRoaming. Third-party SPs find it automatically by looking up NAPTR records in DNS for aaa+auth for the respective realm. Identity Providers need to configure a NAPTR record, see above.
UK eduroam operator Jisc also operates a beta-quality central interchange point with OpenRoaming. eduroam(UK) members should contact their eduroam helpdesk to gain access and join the trial.
Passpoint Release 2: Online Sign-Up
eduroam plans to operate an OSU server which directs unprovisioned end-users to the eduroam CAT toolset. The provisional URL for this server is
...
installed); no user inconvenience.
Apple (Mac OS X, macOS, iOS, iPadOS)
For eduroam Managed IdP, eduroam Passpoint-based profiles are always installed alongside the SSID-based ones. This is expected to work throughout the product palette of Apple, and with no additional user interaction. OpenRoaming is not currently enabled on Managed IdP.
eduroam CAT will install OpenRoaming Passpoint profiles when enabled (all EAP types); it will however only install the eduroam Passpoint profile if the IdP's chosen EAP type is "EAP-TLS". This is because of known user nuisances regarding multiple username/password prompts for multiple SSID and Passpoint profiles which CAT minimises by omitting that extra prompt for eduroam Passpoint.
Android
eduroam Passpoint profiles and the optional OpenRoaming Passpoint profiles can be installed only with the new geteduroam app (i.e. not with the predecessor "eduroamCAT"). geteduroam has varying support for Passpoint profiles depending on the Android version and whether the IdP chose "Ask" vs. "Always" - the "Always" variant currently has better support across all supported Android versions; "Ask" support needs special IdP workarounds.
Intrinsic support for OpenRoaming exists on later (read, newer) devices and versions of Android. For example, recent Google Pixel devices (Pixel 5 and later) show "OpenRoaming" as a network when a HS2.0 hotspot is detected. You then have the choice to enable roaming to this network by choosing to use your Google account associated with your Android phone. Apps like 'Cisco Openroaming' also enable an account on the same network. CAT profiles installed with geteduroam will show "<realm name> via Passpoint" instead but do not associate with the "OpenRoaming" SSID. On some Samsung devices, you may see "OpenRoaming available using Samsung Account" instead, which will function in a similar fashion as the Google Pixel.
Linux
TBD.
ChromeOS
TBD.
Infrastructure
OpenRoaming
eduroam currently operates a beta-quality central interchange point with OpenRoaming. Third-party SPs find it automatically by looking up NAPTR records in DNS for aaa+auth for the respective realm. Identity Providers need to configure a NAPTR record, see above.
UK eduroam operator Jisc also operates a beta-quality central interchange point with OpenRoaming. eduroam(UK) members should contact their eduroam helpdesk to gain access and join the trial.
Passpoint Release 2: Online Sign-Up
eduroam plans to operate an OSU server which directs unprovisioned end-users to the eduroam CAT toolset. The provisional URL for this server is
https://cat-osu.eduroam.org/soap/?idp=X Where to see OpenRoaming in action
OpenRoaming locations, given relative 'novelty' of the technology and its growth, are still somewhat sporadic, depending on location.
The Wireless Broadband Alliance took the eduroam Map as an example (encouraged by eduroam community members) to publish its own map at https://wballiance.com/openroamingmaps/
This map uses the WiGLE service to use crowdsourced data to populate the map and is generally accurate within 24 hours. Non-residential locations generally show up as clusters of at least 4 pins together (a pin per band per SSID).
Policy
GeGC to decide on terms and conditions for letting random SPs serve eduroam users.
...