What is “anonymous identity” in enterprise WPA?
Nearly all EAP methods in use for 802.1X with WPA/WPA2 wireless authentication utilize an "outer" authentication method simply to establish a TLS tunnel between the client and the authentication server (i.e. a RADIUS server) and an "inner" authentication to provide actual credentials through the secure TLS tunnel.
The "anonymous identity" is used for the outer authentication process and does not need to match the credentials provided in the inner authentication, although if no anonymous identity is provided, the default is to user the inner identity (aka username) for both.
Who get to see this identity ?
This depends. Since the outer authentication is not protected by any sort of encryption anything that can see/process the outer authentication. This list contains some (but not necessarily all) of the things that can possibly see the outer identity:
- Devices near the client that can "hear" and capture the outer authentication
- The NAS (device that forwards traffic associated with the authentication between the client and RADIUS server) which is typically the AP or wireless controller
- The RADIUS server providing authentication (which actually has access to both outer and inner identities)
- Intermediate RADIUS servers if the first RADIUS server proxies the request to other RADIUS servers
- Any device forming the network path between NAS and RADIUS server or between RADIUS servers (when authentications are proxied) - if the path extends outside the locally controlled network, this may include devices on the Internet or controlled by some third party
- Any system that either has access to data on the above or that the above export data to
What is obfuscated by this anonymous identity ?
As already noted, use of the anonymous identity prevents the default action of using the inner identity for the outer identity as well. What exactly is obfuscated will depend on the OS/EAP supplicant and needs of the authentication process in use.
Specifically, you should always be able to obfuscate [at least part of] the username.
For some EAP supplicants, you can substitute both a different username and domain/realm. For others (Window's native EAP supplicant for one), you may only be able to substitute the username.
Any requirements of the authentication process will also determine what can be obfuscated. For example, if the RADIUS server uses the domain/realm in handling the authentication, you may be required to maintain the domain/realm even if your OS allows you to change it. Or, a RADIUS server could use regex matching on the username to determine how to handle the outer authentication (example: usernames containing xxx are handled locally, others are proxied to another RADIUS server), so your anonymous identity would possibly have to maintain at least the part of the username if it needed to match the regex.