How Does eduroam Work? Federated Campus WiFi Explained

It's the first week of the fall semester. A visiting researcher walks onto campus, and before she reaches the library her phone is already online — no login page, no guest password taped to the wall, no ticket to the help desk. Her home university is an ocean away, but the WiFi here treats her like a local. That's eduroam, and it's quietly one of the most successful identity federations ever built.

If you run a campus network — or a school district or library wondering whether this club is open to you — here's how eduroam actually works under the hood, what joining requires, and how the service is changing in 2026.

What Is eduroam, and Who Runs It?

eduroam is short for "education roaming." Launched in Europe in 2003, it's a global WiFi roaming service for the research and education community: enroll once at your home institution, and your device authenticates automatically at more than 10,000 hotspots in over 100 territories — universities, research centers, academies, and a growing number of schools and libraries.

There's no eduroam headquarters handing out passwords. It's a federation: each participating country has a national roaming operator that connects its institutions, and those national federations interconnect globally. In the United States, that operator is Internet2, with more than 1,000 subscribing organizations. Your institution keeps full control of its own user accounts — eduroam just gives those accounts reach.

How Does eduroam Authentication Actually Work?

Under the branding, eduroam is a textbook piece of network engineering — literally: its architecture is documented in RFC 7593. Three standard building blocks do all the work: 802.1X for port-based access control, EAP for the authentication conversation, and RADIUS for carrying that conversation between organizations.

Say a student with the identity [email protected] opens her laptop at University B. Here's the sequence:

• The device associates with the eduroam SSID, which is a standard WPA-Enterprise (802.1X) network — no traffic passes until authentication completes
• University B reads the realm — everything after the @ — and sees this isn't a local user
• The request climbs the RADIUS hierarchy: from University B to its national federation servers, then — for international visits — through root servers distributed across three continents, then back down to University A
• University A checks the credentials against its own identity store and sends the verdict back along the same path
• An Access-Accept lands at University B, the port opens, and the device is on encrypted WiFi

The trust fabric holding this together is deliberately boring: pre-arranged RADIUS peering between each institution and its federation operator, hop by hop, so every server in the chain belongs to an organization that signed up to the federation's rules.

What Does Joining eduroam Require from Your Network?

Institutions participate in two roles, and most take both. As an identity provider, you authenticate your own users wherever they roam. As a service provider, you broadcast eduroam on your premises for visitors. The technical checklist is short:

• An 802.1X-capable WLAN. Federation technical specifications require WPA2-Enterprise with AES encryption at minimum, and WPA3-Enterprise is increasingly common — it's mandatory if you want eduroam on the 6 GHz band, which has no WPA2 fallback
• The SSID "eduroam," broadcast, in lowercase — that consistency is what lets devices connect automatically everywhere
• A RADIUS server connected to your user directory and peered with your national federation's proxies. This is the piece a cloud RADIUS service can provide without any on-premises hardware
• A sane EAP method. Whether you run PEAP, EAP-TTLS, or EAP-TLS determines how credentials are proven — our EAP methods comparison walks through the trade-offs
• Operational hygiene: authentication logging and a responsive abuse contact, per your federation's policy

For most institutions the RADIUS peering and EAP configuration is the bulk of the project. The WiFi gear you already own almost certainly handles the rest.

Why Are eduroam Logins Moving to Certificates?

eduroam's weak spot has never been the federation — it's device configuration. Password-based EAP methods depend on the device validating the RADIUS server's certificate before it whispers a password into the tunnel. A device set up by hand, with certificate checks skipped, will happily authenticate against anyone broadcasting an SSID named eduroam. The federation's deployment guidance is blunt about the consequence: misconfigured devices can accept any RADIUS server certificate offered, and rogue hotspot operators can exploit exactly that to capture user credentials.

The answer comes in two parts:

• Managed onboarding. The eduroam Configuration Assistant Tool (CAT) and the geteduroam app generate per-institution installers that configure devices correctly — server certificate validation included — instead of trusting users to click through settings screens
• Certificates instead of passwords. geteduroam added support for EAP-TLS client certificates because, as the project puts it, users "get the best security by using EAP-TLS." With a certificate on the device there's no password to phish, mistype, or harvest

Large campuses are already making the jump: Georgia Tech's IT office, for example, announced that digital certificates would replace username-and-password eduroam logins across its campus by early January 2026. Expect the pattern to spread — pairing certificate-based WiFi authentication with automated enrollment through a cloud PKI removes the most common eduroam support ticket (a password change silently breaking WiFi on every saved device) along with the security risk.

The plumbing between servers is hardening too. Long-haul RADIUS proxy paths are exactly the scenario RADIUS over TLS was designed for — our RadSec guide covers how TLS-wrapped RADIUS closes the gaps in the classic UDP transport.

Can K-12 Schools and Libraries Join eduroam?

eduroam long felt like a universities-only club, but that has changed. Internet2 runs an eduroam Support Organization program that lets regional and state education networks bring eduroam to K-12 districts, public libraries, and museums. Following a successful pilot with the Utah Education and Telehealth Network, state networks such as Network Nebraska and the Sun Corridor Network signed on as support organizations, extending the federation to community anchor institutions coast to coast.

The point isn't international roaming for ninth-graders — it's the homework gap. A student's laptop authenticates at school and keeps working at the public library, the museum, the community college down the road — anywhere eduroam is broadcast — with no new accounts and no portal hoops. For under-resourced districts, that's connectivity infrastructure disguised as a WiFi setting.

Where Do Guests Fit In?

One boundary worth keeping crisp: eduroam serves the education community, not everyone who walks in the door. Parents on a campus tour, contractors, and event attendees still need a separate guest network — typically a captive portal on its own SSID and VLAN. The two coexist cleanly: eduroam handles anyone with academic credentials, the guest portal handles everyone else, and neither has to compromise for the other.

Conclusion

eduroam has spent two decades proving that federated network identity works at global scale on plain standards: 802.1X at the edge, EAP end to end, RADIUS in between. Now it's evolving in two directions at once — outward into K-12 districts and libraries through Internet2's support organizations, and forward into certificate-based logins that fix its oldest weakness.

For campus IT, the takeaway is practical. If you're already federated, the 2026 to-do list is onboarding hygiene: managed device configuration and a path off passwords. If you're not — and your school or campus is still juggling shared passwords and portal logins for people who deserve better — the entry requirements are shorter than they've ever been.