Project

General

Profile

Feature #2097

Support EAP-TLS in NetworkManager backend

Added by Daniel Stone about 9 years ago. Updated over 5 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Tobias Brunner
Category:
networkmanager (charon-nm)
Target version:
5.8.3
Start date:
30.08.2016
Due date:
Estimated time:
Resolution:
Fixed

Description

Support for EAP-TLS in the NM backend would be very nice, given that it already supports certificate authentication and EAP as well, just not together. This is probably particularly useful since the iOS VPN instructions are all around EAP-TLS, so you can then reuse the same server-side setup for both iOS and UNIX/strongSwan clients.

History

#1 Updated by Tobias Brunner about 9 years ago

  • Status changed from New to Feedback

You can also use plain public key authentication with iOS clients (at least with custom configuration profiles, not sure about the GUI).

But yeah, it probably wouldn't be too hard to add support for this (with a similar feature set as the Android app).

#2 Updated by Daniel Stone about 9 years ago

Tobias Brunner wrote:

You can also use plain public key authentication with iOS clients (at least with custom configuration profiles, not sure about the GUI).

Yeah, you can't do it through the GUI, which makes it really inconvenient.

#3 Updated by Tobias Brunner about 9 years ago

You can also use plain public key authentication with iOS clients (at least with custom configuration profiles, not sure about the GUI).

Yeah, you can't do it through the GUI, which makes it really inconvenient.

However, you could configure the server so that clients authenticated with either method are accepted, unless you want to terminate EAP-TLS on a separate host via RADIUS.

#4 Updated by Daniel Wilhelm almost 9 years ago

Tobias Brunner wrote:

You can also use plain public key authentication with iOS clients (at least with custom configuration profiles, not sure about the GUI).

But yeah, it probably wouldn't be too hard to add support for this (with a similar feature set as the Android app).

Having had a look into the code of the NetworkManager plugin as well as charon-nm itself it seems both components would need an update as the android implementation differs quite a bit. Though I would vote in favour of this feature as I would use it as well.

#5 Updated by Tobias Brunner over 5 years ago

  • Target version set to 5.8.3

Changes that implement this are currently in the 2097-nm-eap-tls branch.

#6 Updated by Tobias Brunner over 5 years ago

  • Status changed from Feedback to Closed
  • Assignee set to Tobias Brunner
  • Resolution set to Fixed