Skip to content

Commit 3d33bae

Browse files
benjaminkrausbenjaminkraus
authored
Add support for WPA-Enterprise (#5194)
* Squashed commit of the following: commit 70fe1fc Author: Benjamin Kraus <ben@benkraus.com> Date: Fri Oct 31 20:52:13 2025 -0400 Added support for enterprise WiFi. * Updated based on feedback from CodeRabbit. * Fixed issue with strncmp identified by CodeRabbit. * Replaced split declaration-then-assignment with a single statement. * Revert whitespace only changes. * Move WPA enterprise behind a feature flag.
1 parent 1ca55e4 commit 3d33bae

8 files changed

Lines changed: 141 additions & 2 deletions

File tree

‎wled00/cfg.cpp‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,17 @@ bool deserializeConfig(JsonObject doc, bool fromFS) {
107107
multiWiFi[n].staticIP = nIP;
108108
multiWiFi[n].staticGW = nGW;
109109
multiWiFi[n].staticSN = nSN;
110+
#ifdef WLED_ENABLE_WPA_ENTERPRISE
111+
byte encType = WIFI_ENCRYPTION_TYPE_PSK;
112+
char anonIdent[65] = "";
113+
char ident[65] = "";
114+
CJSON(encType, wifi[F("enc_type")]);
115+
getStringFromJson(anonIdent, wifi["e_anon_ident"], 65);
116+
getStringFromJson(ident, wifi["e_ident"], 65);
117+
multiWiFi[n].encryptionType = encType;
118+
strlcpy(multiWiFi[n].enterpriseAnonIdentity, anonIdent, 65);
119+
strlcpy(multiWiFi[n].enterpriseIdentity, ident, 65);
120+
#endif
110121
if (++n >= WLED_MAX_WIFI_COUNT) break;
111122
}
112123
}
@@ -866,6 +877,13 @@ void serializeConfig(JsonObject root) {
866877
wifi_gw.add(multiWiFi[n].staticGW[i]);
867878
wifi_sn.add(multiWiFi[n].staticSN[i]);
868879
}
880+
#ifdef WLED_ENABLE_WPA_ENTERPRISE
881+
wifi[F("enc_type")] = multiWiFi[n].encryptionType;
882+
if (multiWiFi[n].encryptionType == WIFI_ENCRYPTION_TYPE_ENTERPRISE) {
883+
wifi[F("e_anon_ident")] = multiWiFi[n].enterpriseAnonIdentity;
884+
wifi[F("e_ident")] = multiWiFi[n].enterpriseIdentity;
885+
}
886+
#endif
869887
}
870888

871889
JsonArray dns = nw.createNestedArray(F("dns"));

‎wled00/const.h‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,12 @@ static_assert(WLED_MAX_BUSSES <= 32, "WLED_MAX_BUSSES exceeds hard limit");
211211
#define USERMOD_ID_BRIGHTNESS_FOLLOW_SUN 57 //Usermod "usermod_v2_brightness_follow_sun.h"
212212
#define USERMOD_ID_USER_FX 58 //Usermod "user_fx"
213213

214+
//Wifi encryption type
215+
#ifdef WLED_ENABLE_WPA_ENTERPRISE
216+
#define WIFI_ENCRYPTION_TYPE_PSK 0 //None/WPA/WPA2
217+
#define WIFI_ENCRYPTION_TYPE_ENTERPRISE 1 //WPA/WPA2-Enterprise
218+
#endif
219+
214220
//Access point behavior
215221
#define AP_BEHAVIOR_BOOT_NO_CONN 0 //Open AP when no connection after boot
216222
#define AP_BEHAVIOR_NO_CONN 1 //Open when no connection (either after boot or if connection is lost)

‎wled00/data/settings_wifi.htm‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -118,11 +118,24 @@
118118
gId("wifi_add").style.display = (i<maxNetworks) ? "inline":"none";
119119
gId("wifi_rem").style.display = (i>1) ? "inline":"none";
120120
}
121-
function addWiFi(ssid="",pass="",bssid="",ip=0,gw=0,sn=0x00ffffff) { // little endian
121+
function addWiFi(ssid="",pass="",bssid="",ip=0,gw=0,sn=0x00ffffff,type=-1,anon="",ident="") { // little endian
122122
var i = gId("wifi_entries").childNodes.length;
123123
if (i >= maxNetworks) return;
124+
var encryptionTypeField = "";
125+
if (type >=0 && type < 2) {
126+
encryptionTypeField = `WiFi encryption type:<br>
127+
<select id="ET${i}" name="ET${i}" onchange="E(${i})">
128+
<option value="0"${(type==0) ? ' selected':''}>None/WPA/WPA2</option>
129+
<option value="1"${(type==1) ? ' selected':''}>WPA/WPA2-Enterprise</option>
130+
</select><br>
131+
<div id="IDS${i}" style="${(type==0) ? 'display:none;':''}">
132+
Anonymous identity:<br><input type="text" id="EA${i}" name="EA${i}" maxlength="64" value="${anon}"><br>
133+
Identity:<br><input type="text" id="EI${i}" name="EI${i}" maxlength="64" value="${ident}"><br>
134+
</div>`;
135+
}
124136
var b = `<div id="net${i}"><hr class="sml">
125137
Network name (SSID${i==0?", empty to not connect":""}):<br><input type="text" id="CS${i}" name="CS${i}" maxlength="32" value="${ssid}" ${i>0?"required":""}><br>
138+
${encryptionTypeField}
126139
Network password:<br><input type="password" name="PW${i}" maxlength="64" value="${pass}"><br>
127140
BSSID (optional):<br><input type="text" id="BS${i}" name="BS${i}" maxlength="12" value="${bssid}"><br>
128141
Static IP (leave at 0.0.0.0 for DHCP)${i==0?"<br>Also used by Ethernet":""}:<br>
@@ -185,6 +198,14 @@
185198
rC++;
186199
gId('+').style.display = gId("rml").childElementCount < 10 ? 'inline' : 'none'; // can't append to list anymore, hide button
187200
}
201+
function E(i) {
202+
const select = gId("ET"+i);
203+
if (select.value === "0") {
204+
gId("IDS"+i).style.display = "none";
205+
} else {
206+
gId("IDS"+i).style.display = "";
207+
}
208+
}
188209

189210
</script>
190211
</head>

‎wled00/fcn_declare.h‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,13 +64,26 @@ typedef struct WiFiConfig {
6464
IPAddress staticIP;
6565
IPAddress staticGW;
6666
IPAddress staticSN;
67+
#ifdef WLED_ENABLE_WPA_ENTERPRISE
68+
byte encryptionType;
69+
char enterpriseAnonIdentity[65];
70+
char enterpriseIdentity[65];
71+
WiFiConfig(const char *ssid="", const char *pass="", uint32_t ip=0, uint32_t gw=0, uint32_t subnet=0x00FFFFFF // little endian
72+
, byte enc_type=WIFI_ENCRYPTION_TYPE_PSK, const char *ent_anon="", const char *ent_iden="")
73+
#else
6774
WiFiConfig(const char *ssid="", const char *pass="", uint32_t ip=0, uint32_t gw=0, uint32_t subnet=0x00FFFFFF) // little endian
75+
#endif
6876
: staticIP(ip)
6977
, staticGW(gw)
7078
, staticSN(subnet)
7179
{
7280
strncpy(clientSSID, ssid, 32); clientSSID[32] = 0;
7381
strncpy(clientPass, pass, 64); clientPass[64] = 0;
82+
#ifdef WLED_ENABLE_WPA_ENTERPRISE
83+
encryptionType = enc_type;
84+
strncpy(enterpriseAnonIdentity, ent_anon, 64); enterpriseAnonIdentity[64] = 0;
85+
strncpy(enterpriseIdentity, ent_iden, 64); enterpriseIdentity[64] = 0;
86+
#endif
7487
memset(bssid, 0, sizeof(bssid));
7588
}
7689
} wifi_config;

‎wled00/set.cpp‎

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,18 @@ void handleSettingsSet(AsyncWebServerRequest *request, byte subPage)
2727
char ip[5] = "IP"; ip[2] = 48+n; ip[4] = 0; //IP address
2828
char gw[5] = "GW"; gw[2] = 48+n; gw[4] = 0; //GW address
2929
char sn[5] = "SN"; sn[2] = 48+n; sn[4] = 0; //subnet mask
30+
#ifdef WLED_ENABLE_WPA_ENTERPRISE
31+
char et[4] = "ET"; et[2] = 48+n; et[3] = 0; //WiFi encryption type
32+
char ea[4] = "EA"; ea[2] = 48+n; ea[3] = 0; //enterprise anonymous identity
33+
char ei[4] = "EI"; ei[2] = 48+n; ei[3] = 0; //enterprise identity
34+
#endif
3035
if (request->hasArg(cs)) {
3136
if (n >= multiWiFi.size()) multiWiFi.emplace_back(); // expand vector by one
3237
char oldSSID[33]; strcpy(oldSSID, multiWiFi[n].clientSSID);
3338
char oldPass[65]; strcpy(oldPass, multiWiFi[n].clientPass);
3439

3540
strlcpy(multiWiFi[n].clientSSID, request->arg(cs).c_str(), 33);
36-
if (strlen(oldSSID) == 0 || !strncmp(multiWiFi[n].clientSSID, oldSSID, 32)) {
41+
if (strlen(oldSSID) == 0 || strncmp(multiWiFi[n].clientSSID, oldSSID, 32) != 0) {
3742
forceReconnect = true;
3843
}
3944
if (!isAsterisksOnly(request->arg(pw).c_str(), 65)) {
@@ -49,6 +54,34 @@ void handleSettingsSet(AsyncWebServerRequest *request, byte subPage)
4954
multiWiFi[n].staticGW[i] = request->arg(gw).toInt();
5055
multiWiFi[n].staticSN[i] = request->arg(sn).toInt();
5156
}
57+
58+
#ifdef WLED_ENABLE_WPA_ENTERPRISE
59+
byte oldType = multiWiFi[n].encryptionType;
60+
char oldAnon[65]; strcpy(oldAnon, multiWiFi[n].enterpriseAnonIdentity);
61+
char oldIden[65]; strcpy(oldIden, multiWiFi[n].enterpriseIdentity);
62+
if (request->hasArg(et) && request->hasArg(ea) && request->hasArg(ei)) {
63+
multiWiFi[n].encryptionType = request->arg(et).toInt();
64+
strlcpy(multiWiFi[n].enterpriseAnonIdentity, request->arg(ea).c_str(), 65);
65+
strlcpy(multiWiFi[n].enterpriseIdentity, request->arg(ei).c_str(), 65);
66+
} else {
67+
// No enterprise settings provided, default to PSK
68+
multiWiFi[n].encryptionType = WIFI_ENCRYPTION_TYPE_PSK;
69+
}
70+
71+
if (multiWiFi[n].encryptionType == WIFI_ENCRYPTION_TYPE_PSK) {
72+
// PSK - Clear the anonymous identity and identity fields
73+
multiWiFi[n].enterpriseAnonIdentity[0] = '\0';
74+
multiWiFi[n].enterpriseIdentity[0] = '\0';
75+
}
76+
forceReconnect |= oldType != multiWiFi[n].encryptionType;
77+
if (strncmp(multiWiFi[n].enterpriseAnonIdentity, oldAnon, 64) != 0) {
78+
forceReconnect = true;
79+
}
80+
if (strncmp(multiWiFi[n].enterpriseIdentity, oldIden, 64) != 0) {
81+
forceReconnect = true;
82+
}
83+
#endif
84+
5285
cnt++;
5386
}
5487
}

‎wled00/wled.cpp‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -711,7 +711,39 @@ void WLED::initConnection()
711711
// convert the "serverDescription" into a valid DNS hostname (alphanumeric)
712712
char hostname[25];
713713
prepareHostname(hostname);
714+
715+
#ifdef WLED_ENABLE_WPA_ENTERPRISE
716+
if (multiWiFi[selectedWiFi].encryptionType == WIFI_ENCRYPTION_TYPE_PSK) {
717+
DEBUG_PRINTLN(F("Using PSK"));
718+
#ifdef ESP8266
719+
wifi_station_set_wpa2_enterprise_auth(0);
720+
wifi_station_clear_enterprise_ca_cert();
721+
wifi_station_clear_enterprise_cert_key();
722+
wifi_station_clear_enterprise_identity();
723+
wifi_station_clear_enterprise_username();
724+
wifi_station_clear_enterprise_password();
725+
#endif
726+
WiFi.begin(multiWiFi[selectedWiFi].clientSSID, multiWiFi[selectedWiFi].clientPass);
727+
} else { // WIFI_ENCRYPTION_TYPE_ENTERPRISE
728+
DEBUG_PRINTF_P(PSTR("Using WPA2_AUTH_PEAP (Anon: %s, Ident: %s)\n"), multiWiFi[selectedWiFi].enterpriseAnonIdentity, multiWiFi[selectedWiFi].enterpriseIdentity);
729+
#ifdef ESP8266
730+
struct station_config sta_conf;
731+
os_memset(&sta_conf, 0, sizeof(sta_conf));
732+
os_memcpy(sta_conf.ssid, multiWiFi[selectedWiFi].clientSSID, 32);
733+
os_memcpy(sta_conf.password, multiWiFi[selectedWiFi].clientPass, 64);
734+
wifi_station_set_config(&sta_conf);
735+
wifi_station_set_wpa2_enterprise_auth(1);
736+
wifi_station_set_enterprise_identity((u8*)(void*)multiWiFi[selectedWiFi].enterpriseAnonIdentity, os_strlen(multiWiFi[selectedWiFi].enterpriseAnonIdentity));
737+
wifi_station_set_enterprise_username((u8*)(void*)multiWiFi[selectedWiFi].enterpriseIdentity, os_strlen(multiWiFi[selectedWiFi].enterpriseIdentity));
738+
wifi_station_set_enterprise_password((u8*)(void*)multiWiFi[selectedWiFi].clientPass, os_strlen(multiWiFi[selectedWiFi].clientPass));
739+
wifi_station_connect();
740+
#else
741+
WiFi.begin(multiWiFi[selectedWiFi].clientSSID, WPA2_AUTH_PEAP, multiWiFi[selectedWiFi].enterpriseAnonIdentity, multiWiFi[selectedWiFi].enterpriseIdentity, multiWiFi[selectedWiFi].clientPass);
742+
#endif
743+
}
744+
#else // WLED_ENABLE_WPA_ENTERPRISE
714745
WiFi.begin(multiWiFi[selectedWiFi].clientSSID, multiWiFi[selectedWiFi].clientPass); // no harm if called multiple times
746+
#endif // WLED_ENABLE_WPA_ENTERPRISE
715747

716748
#ifdef ARDUINO_ARCH_ESP32
717749
WiFi.setTxPower(wifi_power_t(txPower));

‎wled00/wled.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,9 @@
7777
#include <Arduino.h>
7878
#ifdef ESP8266
7979
#include <ESP8266WiFi.h>
80+
#ifdef WLED_ENABLE_WPA_ENTERPRISE
81+
#include "wpa2_enterprise.h"
82+
#endif
8083
#include <ESP8266mDNS.h>
8184
#include <ESPAsyncTCP.h>
8285
#include <LittleFS.h>

‎wled00/xml.cpp‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -198,13 +198,26 @@ void getSettingsJS(byte subPage, Print& settingsScript)
198198
memset(fpass,'*',l);
199199
char bssid[13];
200200
fillMAC2Str(bssid, multiWiFi[n].bssid);
201+
#ifdef WLED_ENABLE_WPA_ENTERPRISE
202+
settingsScript.printf_P(PSTR("addWiFi(\"%s\",\"%s\",\"%s\",0x%X,0x%X,0x%X,\"%u\",\"%s\",\"%s\");"),
203+
multiWiFi[n].clientSSID,
204+
fpass,
205+
bssid,
206+
(uint32_t) multiWiFi[n].staticIP, // explicit cast required as this is a struct
207+
(uint32_t) multiWiFi[n].staticGW,
208+
(uint32_t) multiWiFi[n].staticSN,
209+
multiWiFi[n].encryptionType,
210+
multiWiFi[n].enterpriseAnonIdentity,
211+
multiWiFi[n].enterpriseIdentity);
212+
#else
201213
settingsScript.printf_P(PSTR("addWiFi(\"%s\",\"%s\",\"%s\",0x%X,0x%X,0x%X);"),
202214
multiWiFi[n].clientSSID,
203215
fpass,
204216
bssid,
205217
(uint32_t) multiWiFi[n].staticIP, // explicit cast required as this is a struct
206218
(uint32_t) multiWiFi[n].staticGW,
207219
(uint32_t) multiWiFi[n].staticSN);
220+
#endif
208221
}
209222

210223
printSetFormValue(settingsScript,PSTR("D0"),dnsAddress[0]);

0 commit comments

Comments
 (0)