Feature request: 802.1X (WPA-Enterprise) in the network settings

    Hi,

    connman fully supports 802.1X and correctly identifies enterprise networks —
    `connmanctl services` lists them as `managed_ieee8021x`. But the network
    settings offer no input fields for it. Selecting such a network gives no
    prompt for EAP method, identity or anonymous identity.

    The only route today is hand-writing a .config file into
    /storage/.cache/connman/:

    [service_myssid]
    Type = wifi
    Name = my-ssid
    EAP = peap
    Phase2 = MSCHAPV2
    Identity = devicename
    AnonymousIdentity = anonymous
    Passphrase = secret

    That works — I'm running it here against FreeRADIUS with PEAP/MSCHAPv2.
    But it needs SSH, and every edit drops the very connection you're working
    over. On a device that's permanently mounted, that can mean pulling it out
    of the wall to recover.

    Why this would be useful: segmented home networks are getting more common.
    With 802.1X and dynamic VLAN assignment, every device gets its own
    credentials and lands in the right VLAN automatically. Devices that can't
    do 802.1X have to sit on a separate SSID with a shared password — which
    rather undermines the point of segmenting in the first place.

    The scope looks modest: when connman reports a service as ieee8021x, show
    additional fields for EAP method, Phase 2, identity, anonymous identity and
    password. Writing the connman config is something the addon already does
    for PSK networks.

    So the backend is already there — only the UI is missing.

    Thanks for reading!

    The historic reason for not implementing the GUI side of those auth methods is simply that nobody on staff has ever had access to networks that used them and thus nothing could be tested; and since OpenELEC days that hasn't changed, and no user with the need for the capabilities and the developer skills to implement it themselves has shown up either. However, to not alienate the very-occasional user who showed up in the forum we left the compile options alone so ConnMan supports those features and config can be hand-rolled over SSH when needed. I do think it would be good to document that process in the wiki so that it's searchable, but (again) that requires a user with practical experience submitting the changes - and so far that has never happened.

    I do agree that domestic network kit is ever-more capable these days, but I don't see evidence of Enterprise auth methods being used in the support questions we see in the forum. On that basis (and since we still cannot test things) I don't feel that we need to make the effort. If that changes in the coming years we'll always revisit the requirement.