The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[<address@concealed>]

Hi Martin

Thanks to you as well for the informative feedback!

> This is one more quirk of the Windows supplicant, surprisingly this adheres 
> to some old PEAP variety. Windows will NOT allow you to pre-set a realm. 
> You can only provide the username part of the outer identity. If the user 
> is required to enter their username, the realm part will ALWAYS be what the 
> user types after the '@'.

Good to know, did not know about it but makes "sense" __

> OTOH, you do want to make your anonymous outer id mandatory in the 
> freeradius config, as this prevents clueless Android users/devices from 
> naively typing in just the short, realm-less username (both inner and outer 
> ID), along with specifying the weakest of certificate checks This would be 
> "Accept all CAs present in system store" in most cases.

Indeed, but this is already given / mandatory by our FreeRADIUS configuration.

> A mandatory outer ID can be quite tedious for your Windows users though, as 
> the USER must ALWAYS type in their realm correctly.

Those clients we talk about here are all corporate managed by our workplace / 
client team; somehow they will need to figure out, how we can overcome those 
user-based " obstacles". But I will work with them on this topic, I think it 
should be somehow possible to set the predefined anonymous account to 
anonymous@realm via GPO. But they know better than me.

I will go through the testing steps of Tomasz and will get back tot he 
mailing list soon.

Best regards
Dominic