Description:

I've used several Thinkpads with Intel wifi cards and I had this problem with most of them but I'm focusing on my current one as I can't reproduce the behavior with another one right now.

To reproduce you need a WPA Enterprise secured wifi network and probably a intel card using the iwlwifi driver. I only tested with networks that use PEAP and MSCHAPV2, so maybe this is related.

I debugged the problem with the help of the debug log on a aruba wifi ap and found out what happens that way.

I'm not sure what causes the problem. Somewhere on the way something is confused by the empty string in the anonymous_identity setting and puts the mac address of the adapter in the identity field. The generated file /run/netctl/wpa_supplicant-wlp59s0.conf still holds the line with the empty string. So I suspect wpa_supplicant or wpa_actiond to be the problem as I'm not sure how these tools play together.

Additional info:
$ lspci
3b:00.0 Network controller: Intel Corporation Wireless 8265 / 8275 (rev 78)

* package version(s)

$ pacman -Q netctl wpa_actiond wpa_supplicant
netctl 1.18-1
wpa_actiond 1.4-3
wpa_supplicant 1:2.6-12

* config and/or log files etc.

$ cat /etc/netctl/wlp59s0-someconfig
Description='some description'
Interface=wlp59s0
Connection=wireless
Security=wpa-configsection
IP=dhcp
WPAConfigSection=(
'ssid="#somewifiwithhash"'
'key_mgmt=WPA-EAP'
'eap=PEAP'
'anonymous_identity=""'
'identity="user.name"'
'password="supersecretpassword"'
'ca_cert="/etc/ssl/certs/somecert.pem"'
'priority=1'
'phase2="auth=MSCHAPV2"'
)


Steps to reproduce:

- Create a wifi network with WPA enterprise that uses PEAP and MSCHAPV2
- Make sure to set debug levels on the wifi AP to see whats going on
- Set anonymous_identity="" in the netctl config
- Set identity, password and all other config entries to the correct values
- Try to connect

- In the dmesg log on the wifi client you will see the following messages:

[522653.449626] wlp59s0: authenticate with de:ad:be:ef:a8:eb
[522653.461426] wlp59s0: send auth to de:ad:be:ef:a8:eb (try 1/3)
[522653.468728] wlp59s0: authenticated
[522653.470875] wlp59s0: associate with de:ad:be:ef:a8:eb (try 1/3)
[522653.475588] wlp59s0: RX AssocResp from de:ad:be:ef:a8:eb (capab=0x1411 status=0 aid=5)
[522653.478952] wlp59s0: associated
[522653.529347] wlp59s0: Limiting TX power to 30 (30 - 0) dBm as advertised by de:ad:be:ef:a8:eb
[522656.506611] wlp59s0: deauthenticating from de:ad:be:ef:a8:eb by local choice (Reason: 3=DEAUTH_LEAVING)
[522657.870837] wlp59s0: authenticate with de:ad:be:ef:d2:9c
[522657.883910] wlp59s0: send auth to de:ad:be:ef:d2:9c (try 1/3)
[522657.886664] wlp59s0: authenticated
[522657.887536] wlp59s0: associate with de:ad:be:ef:d2:9c (try 1/3)
[522657.891418] wlp59s0: RX AssocResp from de:ad:be:ef:d2:9c (capab=0x1411 status=0 aid=19)
[522657.893827] wlp59s0: associated
[522657.917486] wlp59s0: Limiting TX power to 23 (23 - 0) dBm as advertised by de:ad:be:ef:d2:9c
[522706.565304] wlp59s0: deauthenticating from de:ad:be:ef:d2:9c by local choice (Reason: 3=DEAUTH_LEAVING)

- This indicates wrong credentials
- In the log on the wifi AP you will see that the client is trying to login using it's own mac address as the username
- The radius server will correctly deny the authentication attempt

- Now change the anonymous_identity="" in the netctl config to a non-empty string or remove the line completely
- Restart netctl-auto@wlp59s0 to reload the profiles
- Try to connect to the wifi network again
- In the log on the wifi AP you will see that the client is now using the correct identity string from the config to authenticate
- The wifi client will connect successfully