I now have some more information about using 802.1x WiFi with WM5. Keep in mind I haven't looked at third party 802.1x clients at this stage, just the WM5 default client.
I posted in my last blog that I couldn't understand why a username/domain prompt appeared on the device when trying to authenticate to Radius using EAP-TLS. For example, when using an XP machine with EAP-TLS, I just have to provide the personal certificate, and don't have to input anything.
Ok, so why do I get the username / domain prompt with WM 5 EAP-TLS? The answer is this:
-
The WM5 device 802.1x client does not associate a certificate to a SSID connection until connecting for the first time.
-
This means that even though you select a certificate in the client EAP-TLS setup before connecting, the client still doesn't use this certificate for authentication.
-
The username/domain prompt is the mechanism for creating this association.
-
If you have multiple personal certificates on your device, this is when the right cert is used for the right SSID for 802.1x authentication.
The reg key that is set when this association is created is:
HKCU\Comm\EAPOL\Config\<SSID>\Identity (REG_SZ) - <Domain\Username>
My initial thoughts on all this are that I understand why the WM5 client does the check, but is this really needed if you have only one personal certificate? What else is it going to pick?
Once again, if you have successfully rolled out EAP-TLS at all using any 802.1x client on WM5, I'd like to hear from you.
Cheers,
Neil