The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Winter <address@concealed>]

Hello,

> i have a question about the profile for chrome os. As far as I can tell
> there is no (specific) CA and subject-match check or?

There is a specific CA match, but no subject match. To the best of my
knowledge, the config file spec ["ONC"] does not allow that information
to be conveyed.

If you download the installer, you will see things like:

    "Certificates": [
        {
            "GUID": "{b8b78fb5-ffb0-4af0-6626-b8465a448240}",
            "Remove": false,
            "Type": "Authority",
[...]
                    "ServerCARefs": [
                        "{b8b78fb5-ffb0-4af0-6626-b8465a448240}"
                    ],

and these are typically imported into ChromeOS just fine. The one known
exception is if you try to import an EV root CA that way. For some
reason, ChromeOS considers these special and no-touch. That's why we
recommend NOT to use EV server certificates in your RADIUS setup.

 And even if there
> is one in the background like on Android, will this setting be kept if
> you edit the connection manually (some Android devices for example
> dropp subject_match if you edit manually...)? Because we tried the
> profile on three devices this week and none of them even set the EAP-
> Type correctly only the anonymous identity got set.

The EAP type really should be set. Again, the file contains things like:

                "EAP": {
                    "Outer": "PEAP",
                    "Inner": "MSCHAPv2",

which are there to specify the EAP type.

> Maybe the Android App will work as ChromeOS now supports them??

That is something I haven't tested yet. If you have a moment to run such
a test, I'm happy to hear about results...

Greetings,

Stefan Winter

-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
2, avenue de l'Université
L-4365 Esch-sur-Alzette

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

Attachment: 0xC0DE6A358A39DC66.asc
Description: application/pgp-keys

Attachment: signature.asc
Description: OpenPGP digital signature