Easyroam
Easyroam
Essentially, Easyroam means changing the login to the Eduroam WLAN from a password-based to a certificate-based login. These certificates are person- and device-specific and can be set up or installed in various ways:
- Via the "Easyroam app"
- Manually, if no app is available or it does not work.
Both methods are described below.
Installing and setting up the Easyroam app – explained simply
The Easyroam app can be installed on virtually any device (laptop, mobile phone). There are various versions to choose from:
- Linux: Installation via snap: https://snapcraft.io/easyroam
- Android / iPhone / Mac: Installation from the Play Store / App Store
- Windows: Installation from the “baramundi” software kiosk
- Mac: There is no Easyroam app (yet?), see below for setup instructions!
The installation via the software kiosk on Windows is described below. This is the first step.
In a second step, the app must be set up once. This involves downloading a key file (a “profile”) to the respective device, which then replaces the need to enter a username and password when logging into the Easyroam network. The setup of the app is explained using Windows 11 as an example.
Afterwards, you will no longer need to enter your username and password, and more importantly from an IT security perspective: the Eduroam password (which is also the central user password at UOL) is no longer stored on the computer at all – previously, it was very easy to read on almost all devices.
The respective device will continue to connect automatically to Eduroam.
Installation of the Easyroam app (Linux with Snap, Android, Windows)
Linux (various distributions)
The Easyroam app can be installed via snap on various distributions: https://snapcraft.io/easyroam
ATTENTION: Initial tests indicate that Easyroam only runs with Wayland as the display server, not with X11, at least under Ubuntu 24.04 LTS. Under X11, the app crashes when logging in.
Android / iOS
The Easyroam app is available in the Google Play Store or the App Store.
Windows 11
Option a): MIT software kiosk
Installation is easiest with the software kiosk:
(1) Start Softwarekiosk (icon on the desktop) and search for Easyroam.
(2) Assign Easyroam
(3) Wait one to two hours or start the job directly:
Option b): WITHOUT software kiosk
(1) At https://www.easyroam.de/Auth/Login?entityID=https://idp.uni-oldenburg.de/idp/shibboleth users are directed to the two-factor authentication (2-FA) of the University of Oldenburg:
(2) Download and install the app
...
Setting up the Easyroam app
In a second step, the app must be set up once. This involves downloading a key file (a "profile") to the respective end device, which then replaces the entry of the user name and password when logging into the Easyroam network. The setup of the app is explained using Windows 11 as an example.
After this, it is no longer necessary to enter a user name and password and, more importantly from an IT security point of view, the Eduroam password (which is also the central user password at the UOL) for WiFi is no longer stored on the computer at all - previously it was very easy to read on almost all devices.
The respective end device will continue to connect to the Eduroam automatically.
Setting up the Easyroam app
The easiest way to set up Easyroam is via the Easyroam app. The setup process is explained here using the app on Windows 11 as an example; for Android and iOS, the individual steps are identical apart from a few minor details.
Note: The Easyroam profile (the key file for logging into Eduroam) is valid for one year. We do not yet have any experience with renewal, but we assume that the process will be just as straightforward as the initial setup.
(1) Log in using your UOL login details (2-FA)
→ Then set up 2-FA for UOL (password and token or TOTP).
(2) A profile (a.k.a. key file) must be installed once per device → click once.
(3) Done! The other profiles on other devices are also listed.
Setup without the Easyroam app (Linux, Mac)
The Easyroam app installs "profiles" with which users can log in to Eduroam. However, these profiles can also be set up without the Easyroam app. This is described below for:
- Linux without Snap
- MacOS
Easyroam on macOS
There isn't an app for Mac that handles the installation, but it's not very complicated even without one:
Visit the page https://www.easyroam.de/Auth/Login?entityID=https://idp.uni-oldenburg.de/idp/shibboleth
Log in here using your university credentials and 2FA. A little further down the page, you’ll find the section ‘Apple, Manual Setup for Apple Devices’.
Name the profile to match your device (e.g. ‘My Macbook Air’). A file called ‘MyMacAir.mobileconfig’ will be downloaded and a message will appear asking you to check it via Settings.
To do this, go to System Preferences.
In the top left-hand corner, you will see an option labelled “Profiles Downloaded”. Before clicking on this, delete the “Eduroam” profile from your Wi-Fi settings under “Network”.
Then click on the item, double-click the newly downloaded entry, proceed with ‘Install’ and enter your local admin password – usually the one associated with your account. Eduroam is now added back to the settings. Done!
To check whether the profile is the correct one, go to System Settings / Network WiFi, click on Details for the connected Eduroam, and under the 802.1x section, it should say “802.1x:easyroam SSID eduroam”.
Illustrated instructions can also be found at https://doku.tid.dfn.de/de:eduroam:easyroam#installation_der_eduroam_profile_auf_macos.
Easyroam under Linux without Snap
If you don't like or use Snap, you can easily configure the connection with two scripts from the DFN site, for the sake of simplicity these scripts can also be downloaded here.
There are essentially four steps:
- Download and unpack or copy the scripts.
- Create and download the RechnerName.p12, i.e. visit https://www.easyroam.de/Auth/Login?entityID=https://idp.uni-oldenburg.de/idp/shibboleth, login and click "Linux, Manual Setup". It is best to enter the name of the computer to be set up as the profile name. The download of the file starts automatically.
- Unpack the information from the pkcs file in /etc/easyroam-certs, execute the command `sudo PFAD_ZU_SCRIPTEN/easyroam-extract PFAD_ZUR_P12_DATEI/RechnerName.p12` in a console, e.g. `sudo ~/Downloads/easyroam-scripts/easyroam-extract ~/Downloads/RechnerName.p12`.
- The last step is to configure the network connection, usually the second downloaded script should be sufficient: `sudo PFAD_ZU_SCRIPTEN/easyroam-nmcli` then eduroam should be selectable in the Network Manager.
