EAP TLS identity requriements

Question

I am using freeradius to test EAP-TLS. Authorization only succeeds if I specify an identity. It doesn't even have to match any fields in the client certificate. Why is that required if I have a cert and private key? I know the EAP protocol has a response message that has to include an identity string. Is there a configuration where the AS accepts an empty field?

My stack is:

• AP (NAS): Openwrt running HostAP
• AS: freeradius
• supplicant: wpa_supplicant

Answer 1

The EAP-Identity response typically contains a username or some identifier that can be used by the AS to facilitate the authentication process.

You can set a default identity in the eap configuration file, typically located at /etc/freeradius/version number/mods-enabled/eap. Find the tls section and add the following line: identity = "default"

Replace "default" with the default identity you want to use when the client provides an empty identity.

OR

You can configure to accept anonymous identities by modifying the 'sites-enabled/default' or 'sites-enabled/inner-tunnel' configuration files. Look for the authorize section and modify the if condition that checks the username to something like:

if (User-Name == "anonymous" || User-Name == "") {
    update control {
        Cleartext-Password := "<some-random-string>"
    }
    update request {
        Stripped-User-Name := "anonymous"
        Realm := "NULL"
    }
}