NOTE:
This guide was written two years ago, which in Pi years means it's now graduated college, or something. Inevitably, it's at least a little out of date, and it may even be entirely misleading. There are several helpful suggestions in the comments (thanks everyone), and most recently a report that what's here plain doesn't work on current (early 2022) Raspbian. Which isn't even called 'Raspbian' any more.
As of Jan 2022 I'm partially back in my office-which-has-access-to-eduroam, and I do have a need to build up a fresh Pi desktop. If and when I get that working I'll update this guide. In the meantime: good luck, and please leave a comment to report success or failure.
Default Raspbian is not able to connect to wifi networks using corporate security setups, including eduroam. However, the issue is that the packaged networking control widget does not expose the relevant security features, rather than any underlying hardware limitation. The solution has long been to install Network Manager and configure it to handle the wifi interface.
Unfortunately, previous installation approaches didn't work for me on the Raspbian 2020-02-06 image. Following a fresh install, the below is what I did to make it work. Note that this is actually simpler than previous recipes.
sudo apt update
sudo apt install network-manager network-manager-gnome
Check /etc/network/interfaces; this should be empty except for an include from /etc/network/interfaces.d (which is in turn empty).
Edit /etc/dhcpcd.conf, add line:
denyinterfaces wlan0
Back at the prompt, at this point I did sudo systemctl restart dhcpcd. Which probably isn't strictly necessary, since we're shortly going to reboot anyway.
edit /etc/NetworkManager/NetworkManager.conf:
[main]
plugins=ifupdown,keyfile
dhcp=internal
[ifupdown]
managed=true
sudo reboot
At this point, you should have two wifi widgets in the menu bar: the default Raspbian one, showing two red crosses and 'No wireless interfaces found' when clicked, and Network Manager with a full pull-down menu. Once a wifi ssid is selected, the connection dialogue should expose full security settings (PEAP, etc.), allowing access to a wider range of networks.
You can remove the now-defunct default wifi widget by right-clicking the menubar and selecting 'Panel Settings -> Panel Applets'.
Thanks to @aallan for this: it's also possible to bypass all the above and edit wpa_supplicant.conf directly. For eduroam, for example:
network={
ssid="eduroam"
scan_ssid=1
key_mgmt=WPA-EAP
eap=PEAP
identity="your_username"
password="your_password" phase1="peaplabel=0"
phase2="auth=MSCHAPV2"
}
You can combine this with dropping a wpa_supplicant.conf file in /boot to have the Pi connect on boot, which is particularly useful for headless Pis. Alasdair has a more detailed write-up.