Re: [issue] Can't connect to a WPA2-Enterprise network: 4-way handshake timeout

[Arseny Maslennikov <ar@cs.msu.ru>]

[-- Attachment #1: Type: text/plain, Size: 1553 bytes --]

On Mon, Mar 29, 2021 at 11:30:03AM -0500, Denis Kenzior wrote:
> Hi Arseny,
> 
> On 3/28/21 6:05 AM, Arseny Maslennikov wrote:
> > Hi everyone!
> > 
> > I'm running iwd 1.12 on Debian sid, package version 1.12-1.
> > I'm trying to connect to a WPA2-Enterprise network with the following
> > network config file produced by NetworkManager, to no avail:
> > 
> > [Security]
> > EAP-Method=PEAP
> > EAP-Identity=
> 
> So an empty Identity frequently causes some EAP servers to get confused.  In
> theory the outer identity is completely optional, but quite often it is
> required in practice (probably due to a mis-configured RADIUS server).  Try
> setting it to anonymous(a)your.org or using your Phase2 identity.

I have tried EAP-Identity=anonymous(a)example.org (in case just a
non-empty field is required) to no success.
Then I have tried EAP-Identity=<the Phase2 identity>, and it suddenly worked!

The user is not required to know this trick beforehand, though: other
solutions work automagically, and NM + wpa_supplicant in particular
don't require the user to fill in the outer identity.
I'm not sure if this is an issue in IWD (i. e., as a workaround, it should try phase2
identity equal to the outer identity if the connection fails and
EAP-Identity is empty), or in the NM backend (i. e. it should try this
workaround when provisioning settings to IWD), though, or if this is an
AP/RADIUS configuration issue and does not have to be fixed in Wi-Fi
client software at all...

Anyway, thanks a lot for the help!

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]