PEAP Identity Privacy Support in Windows7

Summary

EAP identity privacy is provided by certain EAP methods where an empty or an anonymous identity (different from the actual identity) is sent in response to the EAP identity request. PEAP method sends the identity twice during the authentication. In the 1^st phase the identity is sent in plain text and this identity will be used for routing purposes and not for client authentication. The real identity is sent within a secure tunnel (established in the 1^st phase) during the 2^nd phase of the authentication.

PEAP Configuration

Support for Identity Privacy in Protected EAP (PEAP) method is introduced in Windows 7. The PEAP identity that is sent in 1^st phase is configurable in the “Protected EAP Properties” dialog.

If the “Enable Identity Privacy” checkbox is checked then the username in the real identity is replaced with the text in the textbox. If the real identity is jdoe@foo.com, “Enable Identity Privacy” checkbox is checked and the textbox contains “anonymous” then the identity sent in 1^st phase will be anonymous@foo.com. The realm portion of the 1^st phase identity will not be modified as it is used for routing purposes.

Troubleshooting

Network policy server (NPS) is sending EAP-failure immediately after sending the identity response

If the NPS policy is created in the “Network Policies” then identity privacy doesn’t work. The NPS policy has to be created in the “Connection Request Policy”.