Re: support for multiple EAP methods in one config?

[James Prestwood <prestwoj@gmail.com>]

On 1/9/25 6:40 AM, Michael John wrote:
> Hi James,
>
>> Hi Michael,
>> On 1/9/25 5:37 AM, Michael John wrote:
>>> Hello,
>>>
>>> I'm looking to see if IWD supports the ability to support multiple EAP method, like what can be done in wpa_supplicant.
>> At the moment no, there is no way to configure this.
>>> network={
>>>       ssid="example"
>>>       key_mgmt=WPA-EAP
>>>       eap=TTLS PEAP
>>>       identity="username"
>>>       password="password"
>>>       # Try basically every common inner method
>>>       phase2="autheap=MSCHAPV2 autheap=MD5 autheap=GTC autheap=OTP autheap=TLS auth=MSCHAPV2 auth=MSCHAP auth=PAP auth=CHAP auth=GTC"
>>> }
>>>
>>> My use case is that I'm given a username and password for a network but don't know the outer or inner protocols (or even if its personal or enterprise but I can determine that from the broadcast beacon).
>> So does the network actually support multiple inner methods? or is this
>> just more of a "debugging" feature to determine which (single) method it
>> supports. I'd be interested in the motivation for a feature like this.
>> Is it:
>>
>>    - There are _real_ networks that exist which support multiple EAP
>> methods, or...
>>
>>    - Your network administrators are not providing their clients with
>> enough information.
>>
> I don't have enough information. The product I'm working on would go into medical offices and could be connected by a range of users and the username and password is all the information that is provided. So the user connecting the product will likely not know anything further about the network configuration.
>
> I can determine PSK and Enterprise via the beacon, yes. For Enterprise with wpa_supplicant it allows multiple outer and inner methods to be supported. My understanding is the client sends the EAP-Request to the AP and then the AP proposes the EAP method to use and the client can decide to accept or reject the method, and when defining the multi 'eap' methods in wpa_supplicant you're defining which methods to accept. Allowing the configuration to work with multiple methods and not requiring the user from needing to know this information.

Ok, kinda makes sense, but at the same time even wpa_supplicant's 
support is going to be fragile at best. Yes there are similarities 
between EAP methods, but also there are differences which a single 
profile can't possibly account for. Your example above allowing 
TTLS/PEAP might work (both are tunneled) but e.g. TLS and PEAP aren't 
going to take the same configuration values. Let alone stuff like PWD 
which is completely user/password based... I'll have to think if there 
is a way to support this in a sane way. Maybe Denis has some input as well.

Thanks,

James

>
>> I do know its possible to configure/allow multiple EAP methods with
>> hostapd at least, so it is _possible_ that networks like this exist. I'm
>> more just curious if its done ever in practice, and if so I guess that's
>> something IWD might want to support.
>>
>> Also, you should be able to determine at least if its PSK or enterprise
>> based on the AKM in the beacon. And IWD will also print this in the
>> debug logs when it scans.
>>
>> Thanks,
>>
>> James
>>
>>
>>> Thanks,
>>>
>>> Michael John
>>> Midmark Corporation
>>>
> Thanks,
> Michael
>
> CONFIDENTIALITY NOTICE: This message, including any attachments, contains confidential information intended for a specific individual and purpose. If you are not the intended recipient, you should delete this message and any disclosure, copying, or distribution of this message, or the taking of any action based on it, by you is strictly prohibited.