[MOTHBALLED] Can't connect with IWD and WPA2 Enterprise

seekawan · 2026-09-07 17:16:38

Hi there,
Got an issue some of you might be familiar to, connecting Network Manager with IWD to a eduroam-like education network.
As it is an already discussed subject, i'll do my best to explain the specificity of this particular issue and the material I found related to it.
In particular https://bbs.archlinux.org/viewtopic.php?id=276106 which is very similar.

Config is the following:
Network Manager with IWD as backend, config below. For services IWD is disabled - NM is enabled - wpa_supplicant is disabled and dead, only there as a NM dependency.

[device]
wifi.backend=iwd

# Configuration file for NetworkManager.
# See "man 5 NetworkManager.conf" for details.

[device]
wifi.scan-rand-mac-address=no

As for the network config it is using wlan0, WPA & WPA2 Enterprise with TTLS and inner PAP with my credentials.

It used to be PEAP, but the institution does not provide certificates. I similarly have issues connecting even with android.

I used this config in var/lib/iwd, it is the only ".8021x" file. I have to say that previous networks I used were in ".psk" and never experienced issues whatsoever.

[Security]
EAP-Method=TTLS
EAP-Identity=anonymous@tld
EAP-TTLS-Phase2-Method=Tunneled-PAP
EAP-TTLS-Phase2-Identity=username@tld
EAP-TTLS-Phase2-Password=password

[Settings]
AutoConnect=true

Now journalctl -r -u NetworkManager yields :

[1788786152.0904] manager: NetworkManager state is now CONNECTING
[1788786152.0905] device (wlan0): state change: prepare -> config (reason 'none', managed-type: 'full')
[1788786152.0911] device (wlan0): new IWD device state is connecting
[1788786152.4671] device (wlan0): Activation: (wifi) Network.Connect failed: GDBus.Error:net.connman.iwd.Failed: Operation failed
[1788786152.4675] device (wlan0): state change: config -> failed (reason 'no-secrets', managed-type: 'full')
[1788786152.4678] manager: NetworkManager state is now DISCONNECTED
[1788786152.4680] device (wlan0): Activation: failed for connection 'thisNetwork'
[1788786152.4680] device (wlan0): new IWD device state is disconnected
[1788786152.4683] device (wlan0): state change: failed -> disconnected (reason 'none', managed-type: 'full')
[1788786153.8600] device (wlan0): new IWD device state is connecting
[1788786153.8608] device (wlan0): Activation: starting connection 'thisNetwork' (ad3f4d3a-dc29-424a-84c7-9c92bd06c584)
[1788786153.8609] device (wlan0): state change: disconnected -> prepare (reason 'none', managed-type: 'full')
[1788786153.8610] manager: NetworkManager state is now CONNECTING
[1788786153.8611] device (wlan0): state change: prepare -> config (reason 'none', managed-type: 'full')
[1788786155.8667] device (wlan0): new IWD device state is connecting
[1788786155.8668] device (wlan0): IWD is connecting to the wrong AP, replacing activation
[1788786155.8669] device (wlan0): state change: config -> disconnected (reason 'supplicant-disconnect', managed-type: 'full')
[1788786155.8675] manager: NetworkManager state is now DISCONNECTED
[1788786155.8682] device (wlan0): Activation: starting connection 'aOneThatWorks' 

and then it connects successfully to this other network using WPA2 personal

So as you see I have the "no secrets" error, previously with PEAP it was the "supplicant failed" error.
I tried best practices from https://wiki.archlinux.org/title/Iwd#WPA_Enterprise and https://wiki.archlinux.org/title/Networ … n_with_iwd but to no avail.

Please ask me more details if needed

Last edited by seekawan (2026-09-14 08:11:41)

seekawan · 2026-09-14 08:13:20

Tried steps in https://www.math.cmu.edu/~gautam/sj/blo … m-iwd.html that were recommended in the arch iwd wiki section "eduroam".
It did not work unfortunately, it prompts for credentials but nm still gives the "no secrets" error

seth · 2026-09-14 15:02:46

a) does wpa_supplicant work?
b) please post the entire journal covering failure, inc. kernel and iwd messages
c) do you *know* the the network uses https://wiki.archlinux.org/title/Iwd#TTLS-PAP ?

seekawan · 2026-09-15 08:40:18

seth wrote:

a) does wpa_supplicant work?
b) please post the entire journal covering failure, inc. kernel and iwd messages
c) do you *know* the the network uses https://wiki.archlinux.org/title/Iwd#TTLS-PAP ?

Hi thanks for your answer.

a) Last time I managed to connect to it, I was using KDE, and they still use wpa as NM backend. So yes I guess so
c) I do not think so, thats why i reverted to PEAP. The thing is that I originally thought I needed certificates beforehand for PEAP hence why I tried TTLS

I'll share the complete log asap

mithrial · 2026-09-15 09:29:42

For the certificate, either your university should provide one or it's signed by trusted anyway and included in ca-cert=/etc/ca-certificates/extracted/tls-ca-bundle.pem

Beemo · 2026-09-15 10:03:12

Did you have a previous working config (e.g. from KDE) or official instructions for Windows / Android?
Sometimes you'd be able to see quirks of the network from the instructions (e.g. self-signed cert, not supporting anonymous identity etc.)

NetworkManager logs are not as helpful, the backend (wpa_supplicant, iwd) might have more information.

seth · 2026-09-15 10:04:34

They should™ also express the 2nd level authorization process.

I'm not sure what KDE has to do w/ this, but you could set NM to use wpa_supplicant as backend (ie. the default), have it generate an eduroam profile and steal take inspiration from the wpa_supplicant config it writes.
Or just use wpa_supplicant if that doesn't cause other compatibility issues.

Edit: got ninja'd

Last edited by seth (2026-09-15 10:05:20)

seekawan · 2026-09-16 08:28:45

Thanks again for the answers.

I agree that KDE has likely nothing to do with it, it is just the fact that I was specifically using the plasma-nm to connect last time it worked. But under the hood it was a classical NM + wpa_supplicant networking stack.

Now the issue regarding your remarks is that administration is not tech literate. We changed campus and kept the same ESSID but seems like they changed the config behind. They did not issue certificates of specific instructions as well.
From the colleagues I know, only windows and ios/macos users managed to connect to the network. Colleagues using linux or android did not manage however.

Also related to this, even some windows/ios users had trouble connecting because their credentials got tempered from unidentified causes.

This is why I put this post in mothball, I initially thought that the issue was wholly on my side. But seing this, there are a lot of variables that can lead to an inability to connect.

Again thanks for the answers, I will need to investigate further for this post to go anywhere

Arch Linux

#1 2026-09-07 17:16:38

[MOTHBALLED] Can't connect with IWD and WPA2 Enterprise

#2 2026-09-14 08:13:20

Re: [MOTHBALLED] Can't connect with IWD and WPA2 Enterprise

#3 2026-09-14 15:02:46

Re: [MOTHBALLED] Can't connect with IWD and WPA2 Enterprise

#4 2026-09-15 08:40:18

Re: [MOTHBALLED] Can't connect with IWD and WPA2 Enterprise

#5 2026-09-15 09:29:42

Re: [MOTHBALLED] Can't connect with IWD and WPA2 Enterprise

#6 2026-09-15 10:03:12

Re: [MOTHBALLED] Can't connect with IWD and WPA2 Enterprise

#7 2026-09-15 10:04:34

Re: [MOTHBALLED] Can't connect with IWD and WPA2 Enterprise

#8 2026-09-16 08:28:45

Re: [MOTHBALLED] Can't connect with IWD and WPA2 Enterprise

Board footer