Make "Identity" a required field for EAP-TLS in Wifi config dialog |
||||||
Issue descriptionThe wifi config dialog only regards client cert as a required field for EAP-TLS [1] and lets the user press Connect if Identity is empty. However, shill regards networks without the Identity field as "not connectable" [2] and refuses to attempt to connect to the wifi network. When trying to connect to a network without "Identity" filled in, nothing happens when "Connect" is pressed, which confused customers. The TODO here is: Investigate if the "Identity" string is actually required for EAP-TLS according to the RFC[3] / wpa_supplicant docs[4] and: - if yes, make wifi config dialog require the field - if not, make shill attempt to connect even if the field is empty. [1] See WifiConfigView::CanLogin() in chrome/browser/chromeos/options/wifi_config_view.cc. [2] See EapCredentials::IsConnectable() in aosp/system/connectivity/shill/eap_credentials.cc [3] https://tools.ietf.org/html/rfc5216 [4] https://w1.fi/cgit/hostap/plain/wpa_supplicant/wpa_supplicant.conf ?
,
Jul 24 2017
I think there might be a good reason for this. Please make sure cernekee@ and pstew@ take a look at this before it lands. In particular, if servers can be configured to ignore the identity field, we cannot make it required on the client. We have to be careful here as we could inadvertenly break someone who depends on having this field empty. The real fix to today's problem is better error handling.
,
Jul 24 2017
Happy to let them chime in - Agree that Identity may be optional. But we have a TODO either way - currently shill regards it as required but chrome as optional. Either we make shill regard it as optional too, or chrome as required.
,
Jul 24 2017
+cernekee, +pstew Would you know if "Identity" is a required field for EAP/TLS wifi authentication? (E.g. are there authentication servers which would accept the client even with "Identity" being empty)? Thanks!
,
Jul 28 2017
> Would you know if "Identity" is a required field for EAP/TLS wifi authentication? Not sure, need to investigate. > if servers can be configured to ignore the identity field, we cannot make it required on the client. My experience is consistent with the behavior reported in the OP. i.e. it is *already* required by Chromebook clients, but the UX is confusing.
,
Feb 6 2018
,
Feb 23 2018
,
Oct 19
Some observations on EAP-TLS auth: 1)EAP-TLS authentication with empty username/Identity : throws "error configuring network" 2)EPA-TLS authentication with correct username/Identity : connection successful 3)EPA-TLS authentication with INCORRECT username/Identity:connection successful. Can anyone confirm if this is expected?
,
Jan 4
|
||||||
►
Sign in to add a comment |
||||||
Comment 1 by pmarko@chromium.org
, Jul 24 2017