RADIUS

Exactly.

The switch takes the credentials provided by the supplicant and forwards them to the third piece of the puzzle, the RADIUS server.

A RADIUS server.

Let's define what that actually does in this ecosystem.

A RADIUS server functions as the central authentication brain of the network.

It holds the master directory of all valid users, certificates, and device health policies.

Oh, so it's the ultimate authority.

Yes.

That, that user's device sees the eduroam SSID.

Their identity is proxied through RADIUS, secured in an EAP tunnel back to Harvard.

It connects to Harvard's identity provider, and then Harvard's identity provider just responds back with a yes or no.

So what we do on the eduroam federation server is really very simple.

Uh, in Europe they have this great product called Get Eduroam.

It's hosted by the, like, Regional Education Network, and it allows sites, if they have, like, cloud identity, like Entra, they can...

They don't even have to have a local RADIUS server, which is a big blocker for a lot of smaller sites who want to be...

They wanna join eduroam, they don't have a RADIUS server.