I am looking for a userfriendly way to setup a WiFi connection with
WPA2-EAP username+password authorization in Android devices.

It used to be possible to scan a QR code with ZXing but this no longer
works in recent Android versions. The QR code scanner included with
the phone supports only WPA2-PSK.

Connecting a WPA2-EAP WiFi involves:

- downloading a CA certificate to local storage
- installing the certificate from local storage to cert store
(can no longer be done from the download, has to be separate step)
- connecting to the WiFi and manually typing username, password,
selecting the CA certificate installed above, entering the domain
name for the certificate (another recently added step)

It is all "so much hassle" that I cannot imagine there is some easier
way. But how? A QR code that contains all the required info, but in
a format I do not yet know about?

(it would be even better to use a client certificate but that would
mean another certificate to download and install...)

It seems that device managament solutions offer a solution for this
but I am looking for something that works standalone.

Rob

I guess (almost) nobody is using WPA2-EAP on a smallish scale where
it is a bit cumbersome to configure all the phones but it still is not
large enough to warrant an MDM or special app?

I'm looking for this in many different places but it seems nobody
else is...

Rob <nomail@example.com> wrote:
> I am looking for a userfriendly way to setup a WiFi connection with
> WPA2-EAP username+password authorization in Android devices.
>
> It used to be possible to scan a QR code with ZXing but this no longer
> works in recent Android versions. The QR code scanner included with
> the phone supports only WPA2-PSK.
>
> Connecting a WPA2-EAP WiFi involves:
>
> - downloading a CA certificate to local storage
> - installing the certificate from local storage to cert store
> (can no longer be done from the download, has to be separate step)
> - connecting to the WiFi and manually typing username, password,
> selecting the CA certificate installed above, entering the domain
> name for the certificate (another recently added step)
>
> It is all "so much hassle" that I cannot imagine there is some easier
> way. But how? A QR code that contains all the required info, but in
> a format I do not yet know about?
>
> (it would be even better to use a client certificate but that would
> mean another certificate to download and install...)
>
> It seems that device managament solutions offer a solution for this
> but I am looking for something that works standalone.
>
> Rob

Apparently not something the people in this group know about?

Rob <nomail@example.com> wrote:
> Rob <nomail@example.com> wrote:
> > I am looking for a userfriendly way to setup a WiFi connection with
> > WPA2-EAP username+password authorization in Android devices.
> >
> > It used to be possible to scan a QR code with ZXing but this no longer
> > works in recent Android versions. The QR code scanner included with
> > the phone supports only WPA2-PSK.
> >
> > Connecting a WPA2-EAP WiFi involves:
> >
> > - downloading a CA certificate to local storage
> > - installing the certificate from local storage to cert store
> > (can no longer be done from the download, has to be separate step)
> > - connecting to the WiFi and manually typing username, password,
> > selecting the CA certificate installed above, entering the domain
> > name for the certificate (another recently added step)
> >
> > It is all "so much hassle" that I cannot imagine there is some easier
> > way. But how? A QR code that contains all the required info, but in
> > a format I do not yet know about?
> >
> > (it would be even better to use a client certificate but that would
> > mean another certificate to download and install...)
> >
> > It seems that device managament solutions offer a solution for this
> > but I am looking for something that works standalone.
> >
> > Rob
>
> Apparently not something the people in this group know about?

It's something I have investigated in the past, more for use on Linux
than on Android, and it's difficult. I never managed to get to a
satisfactory solution. The specific thing you want is probably EAP-SIM.

--
Chris Green
·

Rob wrote:

>> I am looking for a userfriendly way to setup a WiFi connection with
>> WPA2-EAP username+password authorization in Android devices.
>>
>> It used to be possible to scan a QR code with ZXing but this no longer
>> works in recent Android versions.
>
> Apparently not something the people in this group know about?

Back in 2013 a customer had some "big wigs" visiting site, the usual
guest SSID was fairly restricted so they wanted to allow them access to
a "reserved" SSID with no restrictions, I created a poster with the
details on it and included a QR code.

Just found the PDF of the poster and scanned it with ZXing and it still
offers to join the network ...

This was only PSK not EAP/username/pwd, but my point is that ZXing
itself does still allow connecting to wifi via a QR code on Android 11

What format of WIFI: string have you got?

Chris Green <cl@isbd.net> wrote:
> Rob <nomail@example.com> wrote:
>> Rob <nomail@example.com> wrote:
>> > I am looking for a userfriendly way to setup a WiFi connection with
>> > WPA2-EAP username+password authorization in Android devices.
>> >
>> > It used to be possible to scan a QR code with ZXing but this no longer
>> > works in recent Android versions. The QR code scanner included with
>> > the phone supports only WPA2-PSK.
>> >
>> > Connecting a WPA2-EAP WiFi involves:
>> >
>> > - downloading a CA certificate to local storage
>> > - installing the certificate from local storage to cert store
>> > (can no longer be done from the download, has to be separate step)
>> > - connecting to the WiFi and manually typing username, password,
>> > selecting the CA certificate installed above, entering the domain
>> > name for the certificate (another recently added step)
>> >
>> > It is all "so much hassle" that I cannot imagine there is some easier
>> > way. But how? A QR code that contains all the required info, but in
>> > a format I do not yet know about?
>> >
>> > (it would be even better to use a client certificate but that would
>> > mean another certificate to download and install...)
>> >
>> > It seems that device managament solutions offer a solution for this
>> > but I am looking for something that works standalone.
>> >
>> > Rob
>>
>> Apparently not something the people in this group know about?
>
> It's something I have investigated in the past, more for use on Linux
> than on Android, and it's difficult. I never managed to get to a
> satisfactory solution. The specific thing you want is probably EAP-SIM.

Thanks!
EAP-SIM looks like a clever solution to put the authentication info
on the phone without having to enter it manually, but it likely is
useful mainly for public WiFi networks accessible to subscribers of
a specific phone network provider, where the provider can put info
on the SIM card. We are not in that position.

We are a small company with an indoor WiFi network in 4 subsidiaries,
which we are now trying to migrate from WPA2-PSK (everyone on the
same SSID with the same password) to WPA2-EAP with an individual
user-id and password for each phone or laptop. We could also support
a separate client certficate for each device.

But the hurdle is to do this conversion (as described above) on all
of the devices. Asking the user to come by at the IT helpdesk and
performing these actions. Takes a few minutes per device, but it is
really boring. It would be so much more convenient when it could be
done using a QR code or similar, as we do with WPA2-PSK...
There should be a QR code format for WPA2-EAP but I cannot find it
documented anywhere...

Rob wrote:

> There should be a QR code format for WPA2-EAP but I cannot find it
> documented anywhere...

<https://github.com/zxing/zxing/blob/2e2b5ba757b6cbc2fdeaaa0ed6dcdd794abb5b2e/core/src/main/java/com/google/zxing/client/result/WifiResultParser.java#LC27>

Andy Burns <usenet@andyburns.uk> wrote:
> Rob wrote:
>
>>> I am looking for a userfriendly way to setup a WiFi connection with
>>> WPA2-EAP username+password authorization in Android devices.
>>>
>>> It used to be possible to scan a QR code with ZXing but this no longer
>>> works in recent Android versions.
>>
>> Apparently not something the people in this group know about?
>
> Back in 2013 a customer had some "big wigs" visiting site, the usual
> guest SSID was fairly restricted so they wanted to allow them access to
> a "reserved" SSID with no restrictions, I created a poster with the
> details on it and included a QR code.
>
> Just found the PDF of the poster and scanned it with ZXing and it still
> offers to join the network ...
>
> This was only PSK not EAP/username/pwd, but my point is that ZXing
> itself does still allow connecting to wifi via a QR code on Android 11

OK.. On the phones we use (Samsung A series with Android 11) it looks
like customer-installed apps can no longer manage WiFi settings.
Probably done "for security". However, the built-in QR code scanner
can still do it. But only for PSK.

> What format of WIFI: string have you got?

I have created the string expected by ZXing. And on an old phone
it works. The format is:

WIFI:T:WPA2-EAP;S:[ssid];E:PEAP;A:[user];I:[user];P:[pass];D:[domain];;

Where [ssid] [user] [pass] and [domain] are the values also entered
in the join wifi dialog.

The Samsung QR scanner does not recognize this.
And I think the labels for these fields are not standardized, the
usual WiFi QR code has:

WIFI:S:[SSID];T:WPA;P:[pass];;

This is of course recognized by the QR scanner. But not useful for me.

Andy Burns <usenet@andyburns.uk> wrote:
> Rob wrote:
>
>> There should be a QR code format for WPA2-EAP but I cannot find it
>> documented anywhere...
>
> <https://github.com/zxing/zxing/blob/2e2b5ba757b6cbc2fdeaaa0ed6dcdd794abb5b2e/core/src/main/java/com/google/zxing/client/result/WifiResultParser.java#LC27>

Yes but I think that is a ZXing-invented format only implemented
in ZXing. That is what I mentioned in another reply, it works on an
old phone with ZXing but not in any other QR scanner.

There appears to be no "standard" format other than the usual PSK one.

Rob wrote:

> Andy Burns wrote:
>
>> <https://github.com/zxing/zxing/blob/2e2b5ba757b6cbc2fdeaaa0ed6dcdd794abb5b2e/core/src/main/java/com/google/zxing/client/result/WifiResultParser.java#LC27>
>
> Yes but I think that is a ZXing-invented format only implemented
> in ZXing. That is what I mentioned in another reply, it works on an
> old phone with ZXing

I can't see the section of code within zxing that does the actual adding
of an SSID to the phone (to see why it might not work on all phones)
just the part that parses it from the WIFI: string.

> but not in any other QR scanner.
> There appears to be no "standard" format other than the usual PSK one.

May well be.

Rob wrote:
> Andy Burns <usenet@andyburns.uk> wrote:
>> Rob wrote:
>>
>>>> I am looking for a userfriendly way to setup a WiFi connection with
>>>> WPA2-EAP username+password authorization in Android devices.
>>>>
>>>> It used to be possible to scan a QR code with ZXing but this no longer
>>>> works in recent Android versions.
>>>
>>> Apparently not something the people in this group know about?
>>
>> Back in 2013 a customer had some "big wigs" visiting site, the usual
>> guest SSID was fairly restricted so they wanted to allow them access to
>> a "reserved" SSID with no restrictions, I created a poster with the
>> details on it and included a QR code.
>>
>> Just found the PDF of the poster and scanned it with ZXing and it still
>> offers to join the network ...
>>
>> This was only PSK not EAP/username/pwd, but my point is that ZXing
>> itself does still allow connecting to wifi via a QR code on Android 11
>
> OK.. On the phones we use (Samsung A series with Android 11) it looks
> like customer-installed apps can no longer manage WiFi settings.

Mine is a Pixel3, the ZXing app is v4.7.8 from the app store, it has
permissions for camera (while app in use) contacts, files+media

> Probably done "for security". However, the built-in QR code scanner
> can still do it. But only for PSK.
>
>> What format of WIFI: string have you got?
>
> I have created the string expected by ZXing. And on an old phone
> it works. The format is:
>
> WIFI:T:WPA2-EAP;S:[ssid];E:PEAP;A:[user];I:[user];P:[pass];D:[domain];;
>
> Where [ssid] [user] [pass] and [domain] are the values also entered
> in the join wifi dialog.

seems about right.

> The Samsung QR scanner does not recognize this.
> And I think the labels for these fields are not standardized, the
> usual WiFi QR code has:
>
> WIFI:S:[SSID];T:WPA;P:[pass];;
>
> This is of course recognized by the QR scanner. But not useful for me.

Andy Burns <usenet@andyburns.uk> wrote:
>> OK.. On the phones we use (Samsung A series with Android 11) it looks
>> like customer-installed apps can no longer manage WiFi settings.
>
> Mine is a Pixel3, the ZXing app is v4.7.8 from the app store, it has
> permissions for camera (while app in use) contacts, files+media

When I install the ZXing app on a Samsung A40 or A41 it already warns
me that the app is for an older Android version and probably isn't going
to work. It scans QR codes OK but when a WIFI QR code is presented
it correctly shows the contents but it cannot set the WiFi connection!

Well, there is another issue with this: the ZXing scanner does not allow
for a certificate to be selected. It installs the WiFi connection
"without certificate verification". That will stop working in the next
Android update. So I want to be prepared and have certificate validation
configured.

"everywhere" you read that WPA2-EAP is so much better for security than
WPA2-PSK (and certainly it is better for management, as individual
accounts can be withdrawn and copying of credentials between devices
is not allowed by Android and Windows), but why should it be so hard
to setup??? No idea...