An open discussion list for topics related to the geteduroam service

[Paul Dekkers <paul.dekkers AT surf.nl>]

Hi Simon,

Thanks for checking and reporting; we’ll look into this!

Regards,

Paul

---

Van: geteduroam-request AT lists.geant.org <geteduroam-request AT lists.geant.org> namens Simon Hess <geteduroam AT lists.geant.org>
Verzonden: Tuesday, December 19, 2023 5:35:29 PM
Aan: geteduroam AT lists.geant.org <geteduroam AT lists.geant.org>
Onderwerp: New geteduroam app misconfigures EAP type

 

Hi all,

 

I am about to verify the new geteduroam app for Android and may have found a configuration issue.

 

We must use the EAP-TTLS protocol with an inner method of PAP to authenticate against Microsoft Entra ID. I have set TTLS-PAP as the only supported type in our CAT profile accordingly (see attached screenshot and https://cat.eduroam.org/?idp=2296&profile="8368). This has worked for almost a year now without any problems.

 

However, the new geteduroam app (v2.0) configures the wireless network with MSCHAPv2 as inner method regardless of the actual setting in the CAT profile (see attached screenshot). The device then obviously fails to connect to eduroam with the following error:

 

Event	5400 Authentication failed
Failure Reason	12996 EAP-TTLS inner method MSCHAPv2 is not allowed in Allowed Protocols

 

If I switch back to the current geteduroam app (v1.1), the wireless network will be configured with the expected settings (see attached screenshot). I have tested this behavior on a Samsung Galaxy S22 with the latest android version 14.

 

Are you aware of any issues with this specific authentication method? Any help would be great before the new app gets rolled out publicly.

 

Thanks, Simon

 

Simon Hess

System Engineer

 

Berner Bildungszentrum Pflege

Freiburgstrasse 133, 3008 Bern