Here is a break-down of anonymous outer identity support for some popular EAP types: Outer identity: Inner identity: stefan.winterДЇor eduroam request routing, the part of the outer identity is used to route the request to the realm and to establish a secure tunnel while the real username inside this tunnel which is looked up in a user database is 'stefan.winter'.It does not necessarily have to contain an sign at all, because that username is local to the IdP and is only seen and evaluated there. The inner identity always needs to be fully accurate, because it is used to authenticate the user. behind the sign) always needs to be accurate because it contains the routing information. The IETF-suggested way of obfuscating the username is to leave it empty but it can just as well be replaced with 'anonymous', 'anon' or similar. Since the outer identity is only needed for routing purposes towards the IdP, the local username part does not have to be accurate and can be obfuscated. the second, 'inner' identity, is only revealed inside a cryptographically protected tunnel to the IdP.one identity, the outer identity, is used to route the user's login request from the eduroam SP via the eduroam RADIUS path to the eduroam IdP.This feature needs protocol support by the EAP type in question the basic idea is that there have to be two stages of communicating the client identity: The primary use of anonymous outer identities is for better preservation of privacy for your users a properly configured supplicant will then not even reveal the real username of the user to the visited eduroam SP instead, the username is replaced with a dummy value. Microsoft ActiveDirectory: stores passwords as NT-Hashes.ДЄlmost all EAP types support the use of anonymous outer identities.As a more concrete advice for some IdM backends: Does it store the passwords in a different crypt format? Then you can use EAP-TTLS only.ДЄs you see, the decision is largely dependent on your identity management system so your choices may be limited.Does it store the passwords as either clear text - or - encrypted as NT-Hash? Then you can use EAP-TTLS, PEAP, EAP-FAST, EAP-PWD and more.Does your identity management backend use username/password combinations?.Does your identity management backend support X.509 Client Certificates? Then you can use EAP-TLS.Regarding the identity management backend, the most fundamental differentiation between EAP types is the type of credential they support. Capabilities of your Identity management backendД¬hoices depending on the Identity Management System.The decision which EAP type(s) to deploy on your eduroam IdP depends on several factors:

Mdickie games list