The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Matthew Slowe <matthew.slowe AT jisc.ac.uk>]

Tomasz and Chris,

Ah, and the "what do assumptions make?" adage comes back to bite...!

Thanks for correcting me... pain and suffering to follow.

Cheers,
Matthew

On 19/01/2023 14:59, Tomasz Wolniewicz (via cat-users Mailing List) wrote:
> OK,
>
>    I should read carefully before replying.
>
> What you describe is indeed an expected behaviour. When you read the 
> PEAP spec, it turns out that they only allow assigning the user part in 
> the AnonymousUserName
> and this is how Microssoft are implementing this. They just take the 
> realm from the enetered user identifier, replacing the user part with 
> the string set in AnonymousUserName. Everyone else obviously considers 
> this to be silly and they are implementing PEAP allowing to set the full 
> name, but in fact they are violating the original spec.
>
> If your org want the behaviour they expect they should switch to TTLS. 
> Here Microsof allows you to enter the full anonymous user.
>
> Tomasz
>
>
> W dniu 19.01.2023 o 15:19, Matthew Slowe (via cat-users Mailing List) 
> pisze:
> > On 19/09/2022 11:06, Tomasz Wolniewicz (via cat-users Mailing List) 
> > wrote:
> > > 1. For PEAP - there was a problem manifesting itself for 
> > > organisations which have defined the empty username part of the outer 
> > > name. This was causing an installation error.
> >
> > Hi Tomasz,
> >
> > I have a member organisation that's using the "Enable Anonymous Outer 
> > Identity" setting (set to an empty string, so we expect " AT example.edu" 
> > as an outer identity).
> >
> > During install users enter an internal only UPN into the username box 
> > (eg. user AT example.local) to be used in the Inner credential exchange. 
> > This works fine on macos, iOS and Android.
> >
> > They're reporting a problem on Windows (specifically Windows 10 but 
> > may not be limited to that) where it's setting the "Enable Identity 
> > Privacy" setting in the PEAP settings but the outer username is being 
> > sent as:
> >
> >     @example.local
> >
> > It appears to be getting it _half_ right... anonymous yes, but wrong 
> > outer realm!
> >
> > Not sure if this is related to your fixes in September, but it's 
> > suspiciously close!
> >
> > Any ideas?
> >
> > Thanks,

--
Matthew Slowe [he/him] (GPG: 0x6BE0CF7D04600314)
Principal technical consultant and infrastructure specialist, Jisc
Team: 01235 822185
Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG