eduroam Turkey Participation Agreement
1 Introduction and Purpose
This participation agreement sets out the principles governing the operation and control of roaming network access on the National Academic Network (ULAKNET), operated by the National Academic Network and Information Centre (ULAKBİM), an institute of the Scientific and Technological Research Council of Türkiye (TÜBİTAK). The word eduroam is an all-lowercase abbreviation of “educational roaming” and is a registered trademark of TERENA. Detailed information about eduroam is available at
www.eduroam.org and www.eduroam.org.tr.
2 Duties and Responsibilities of the eduroam Service Provider
2.1 ULAKBİM is the service provider responsible for the national eduroam service of Türkiye. It is the authority for the eduroam Turkey federation in cooperation with the European eduroam Confederation.
2.2 ULAKBİM ensures coordination by maintaining contact information among participating institutions and maintains the connections with the authentication servers of the European eduroam confederation and its federations.
2.3 ULAKBİM establishes and operates the national authentication server hierarchy.
2.4 So that users can obtain technical support, ULAKBİM keeps the broadcast and connection information of eduroam member institutions and publishes it, together with the institutions' contact information, at www.eduroam.org.tr.
2.5 ULAKBİM ensures that participating institutions comply with the rules and procedures set out in this agreement.
2.6 ULAKBİM may not charge any fee for the services it provides, nor use them for commercial purposes.
3 Duties and Responsibilities of the Participating Institution
3.1 An eduroam Turkey Participating Institution assumes two different roles: Identity Provider and Resource Provider.
3.2 As a Resource Provider or Identity Provider, the Participating Institution may not charge any fee for the services it provides, nor use them for commercial purposes.
3.3 Duties and Responsibilities of the eduroam Identity Provider
3.3.1 An eduroam Identity Provider is an eduroam Turkey participating institution that offers an authentication service via username–password or certificate so that its own users, as defined in the ULAKNET Acceptable Use Policy, can access the network within the institution and on eduroam member networks.
3.3.2 The identity provider must set up an authentication server in accordance with the provisions of this policy. A secondary authentication server is preferred for redundancy.
3.3.3 The identity provider's authentication servers must be reachable by the ULAKBİM eduroam national authentication server.
3.3.4 The identity provider must create an eduroam test account and send the username and password to ULAKBİM for checking connections and configuration. ULAKBİM must be notified before the test account is closed or its password is changed.
3.3.5 The identity provider must provide the technical support its users need to connect through any eduroam resource provider.
3.4 Duties and Responsibilities of the eduroam Resource Provider
3.4.1 An eduroam Resource Provider is an eduroam Turkey participating institution that provides network access on its campus to users of eduroam member institutions within the framework of the ULAKNET Acceptable Use Policy.
3.4.2 The resource provider must set up an infrastructure compliant with IEEE 802.1x authentication standards.
3.4.3 The resource provider may use any medium it wishes for eduroam access.
3.4.4 The resource provider must broadcast the eduroam SSID (wireless network name) visibly. The SSID must be “eduroam” in all lowercase letters.
3.4.5 The resource provider must allow at least the following services for eduroam users:
• Standard IPSec VPN: IP protocols 50 (ESP) and 51 (AH) inbound and outbound; UDP/500 (IKE) outbound only,
• OpenVPN 2.0: UDP/1194 ,
• IPv6 Tunnel Broker service: IP protocol 41 inbound and outbound,
• IPsec NAT-Traversal UDP/4500 ,
• Cisco IPSec VPN over TCP: TCP/10000 outbound only,
• PPTP VPN: IP protocol 47 (GRE) inbound and outbound; TCP/1723 outbound only,
• SSH: TCP/22 outbound only,
• HTTP: TCP/80 outbound only,
• HTTPS: TCP/443 outbound only,
• IMAP2+4: TCP/143 outbound only,
• IMAP3: TCP/220 outbound only,
• IMAPS: TCP/993 outbound only,
• POP: TCP/110 outbound only,
• POP3S: TCP/995 outbound only,
• Passive FTP: TCP/21 outbound only,
• SMTPS: TCP/465 outbound only,
• SMTP – STARTTLS: TCP/587 outbound only,
• RDP: TCP/3389 outbound only,
• SIP: UDP/5060 inbound and outbound,
• RTP: UDP/16384 to UDP/16484 inbound and outbound,
3.4.6 If it wishes, the resource provider may define a dedicated VLAN for those connecting to the eduroam network.
3.4.7 The resource provider is required to keep logs of users' network connections so that username, MAC address and IP address information can be accessed at a later date. Logs obtained from the RADIUS server must contain at least the following information:
• The exact date and time of the authentication request;
• Details of the requesting RADIUS server;
• The response to the authentication request;
• The reason for rejection of a rejected authentication request.
3.4.8 The resource provider must record and store access logs in accordance with the provisions of the Turkish Penal Code, and submit them when deemed necessary by legal authorities.
3.4.9 The resource provider must publish local information about its eduroam service in Turkish and English in a dedicated section of its institutional website (Example: http://eduroam.universite.edu.tr). The published information must include at least the following items:
• A statement that this agreement must be complied with, and a link to this agreement (http://eduroam.org.tr/eduroam_politika.pdf);
• A URL link to the ULAKNET Acceptable Use Policy;
• A URL link to the resource provider's Acceptable Use Policy;
• A list or map showing the SSID information and coverage
areas of the eduroam connection on campus;
• The resource provider's web caching server settings, if any;
• A URL link to www.eduroam.org.tr and the official eduroam logo;
• Contact information for eduroam technical support;
• If user activities are monitored, the method of monitoring, how long the logs
are kept and who can access them must be clearly stated.
3.5 Duties and Responsibilities of eduroam Users
3.5.1 The user's home institution is the identity provider; the institution the user visits and where they wish to connect to the eduroam network is the resource provider.
3.5.2 Users are obliged to comply with the ULAKNET Acceptable Use Policy and, if any, the identity provider's “Acceptable Use Policy”. Therefore, the identity provider must inform its users of the policies they must comply with.
3.5.3 Users are responsible for the credentials they use for network access. The identity provider supplies its users with credentials such as a username–password or certificate.
3.5.4 Users are responsible for verifying that they are connected to the genuine eduroam service and for the security measures to be applied. They should connect only to broadcasts at locations specified by the eduroam federation and member institutions, via the 802.1x secure network.
3.5.5 If users suspect that their access credentials have been obtained by third parties, they must report this to their identity provider.
3.5.6 Users should report service interruptions and problems encountered on the eduroam network to the resource provider and the identity provider.
4 Contact
4.1 ULAKBİM can be reached on eduroam-related matters at [email protected].
4.2 ULAKBİM operates the [email protected] mailing list, which includes the technical contact points of all eduroam Turkey Participating Institutions.
4.3 The Participating Institution must notify ULAKBİM of the contact details of two technical contact points. Any future changes to contact details must be reported to ULAKBİM.
4.4 The Participating Institution must report matters such as security breaches, misuse or inappropriate use, and service interruptions to ULAKBİM as soon as possible.
5 Implementation
5.1 This agreement has been prepared by ULAKBİM. Any agreement the participating institution applies to its users must comply with this agreement.
5.2 ULAKBİM may amend this agreement at the request of the European eduroam Confederation. The amended agreement must be re-signed by the Participating Institution.
5.3 The participating institution may terminate the agreement without giving any reason. The termination request must be notified to ULAKBİM at least 2 months in advance so that the necessary changes to the eduroam service can take effect.
5.4 Where urgent intervention is required, ULAKBİM may partially or completely suspend the eduroam service to protect the integrity and security of ULAKNET. In such a case, ULAKBİM informs participating institutions of the incident and its consequences.
5.5 ULAK-CSIRT warns participating institutions by e-mail about security vulnerabilities, security breaches and uses contrary to the agreement. If the warnings are ignored or the problem persists, ULAKBİM suspends the participating institution's eduroam access.
5.6 To protect the security and integrity of its own network, the resource provider may block a particular user or identity provider, informing ULAKBİM.
5.7 The identity provider may block one or more of its users from using the eduroam service.