A Proposal for Extending the Eduroam Infrastructure with Authorization Mechanisms

Identity federations are emerging in the last years in order to make easier the deployment of resource sharing environments among organizations. One common feature of those environments is the use of access control mechanisms based on the user identity. However, most of those federations have realized that user identity is not enough to offer a more grained access control and value added services. Therefore, additional information, such as user attributes, need to be taken into account. This paper presents how one of those real and widely spread identity federations, eduroam, has been extended in order to make use of user attributes and to adopt authorization decisions during the access control process. This authorization framework has been integrated by means of the NASSAML infrastructure, which defines a network access control service based on SAML and the AAA architecture.