The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Paetow <address@concealed>]

What Tomasz suggests. 

Park the real username (or maybe an encoded form of it) in one of the sAN records (mail, dNS, URI...) and leave the CN= as 'anonymous@...' or whatever the specific username is that they want to use.  :-)

Kind regards

Stefan Paetow

Federated Roaming Technical Specialist

eduroam(UK), Jisc – 20 years of free Wi-Fi for the UK R&E sector

email/teams: address@concealed

gpg: 0x3FCE5142

For eduroam support, please contact the eduroam team via address@concealed and mark it for eduroam’s attention.

I am not available on Mondays and Fridays between 12:00 and 15:00 London time (UTC in winter, UTC+0100 in summer).

Note: I don’t expect a reply outside of your working hours, since I work internationally with colleagues in different nationalities with different religions, customs, and holidays. Reply when it is convenient for you.

Jisc is a registered charity (in England and Wales under charity number 1149740; in Scotland under charity number SC053607) and a company limited by guarantee registered in England under company number 05747339, VAT number GB 197 0632 86. Jisc's registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.

Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.

For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice

On 02/10/2026, 08:38, "address@concealed" <address@concealed> wrote:

It is semi-supported. If you click "Installer fine tuning and download"

and you have TLS set in your profile then you will be able to set

EAP-specific options for TLS. One of the is "Turn on EAP-TLS UserName".

If you turn this on the Windows installer will ask the user to provide

the username.

I realise that this is not exactly what you are looking for and I am not

sure how this would work on other systems. Definitely CAT Linux

installers would also ask, o Apple propably the system will ask as well.

However there is probably a much better solution. Create TLS

certificates for users with CN=anonymous@realm  and put the real

username as the mail attribute in the certificate. You also need to

setup your RADIUS server to act on email for user verification. With

this it will univerally work across all platforms without any additional

settings on client side. The CN is used as the RADIUS UserName.

Tomasz

W dniu 2.10.2026 o 08:56, Jan-Frederik Rieckers (via cat-users Mailing

List) pisze:

> Hi all,

>

> one of our institutions wants to use a specific "outer" ID for EAP-TLS.

> (Technical background: The server root certificate expires and they

> want to migrate to a new root using a switch by outer ID)

>

> They use their own certificates, but want to use CAT for configuring

> the devices. On Windows they noticed that the installer does not honor

> the outer ID configuration, apparently the Windows installer doesn't

> even include this.

>

> From what I heard from the admin, windows needs a specific

> "DifferentUsername" property to not use the CN/UPN/... from the

> certificate.

>

> Does the windows installer support it already and we're just holding

> it wrong?

> If not: Is this something that the windows installer could be doing?

>

> Cheers,

> Janfred

>

--

Tomasz Wolniewicz