android: Use %any as AAA identity, but disable EAP-only authentication
[strongswan.git] / src / frontends / android / jni / libandroidbridge / backend / android_service.c
index 41df5fb..960edbe 100644 (file)
@@ -657,6 +657,8 @@ static bool add_auth_cfg_cert(private_android_service_t *this,
        {
                auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_EAP);
                auth->add(auth, AUTH_RULE_EAP_TYPE, EAP_TLS);
+               id = identification_create_from_string("%any");
+               auth->add(auth, AUTH_RULE_AAA_IDENTITY, id);
        }
        else
        {
@@ -729,11 +731,7 @@ static job_requeue_t initiate(private_android_service_t *this)
        gateway = identification_create_from_string(this->gateway);
        auth->add(auth, AUTH_RULE_IDENTITY, gateway);
        auth->add(auth, AUTH_RULE_IDENTITY_LOOSE, TRUE);
-       /* for EAP-TLS we don't add an auth class to allow pubkey and EAP-only */
-       if (!streq("ikev2-eap-tls", this->type))
-       {
-               auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
-       }
+       auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
        peer_cfg->add_auth_cfg(peer_cfg, auth, FALSE);
 
        child_cfg = child_cfg_create("android", &lifetime, NULL, TRUE, MODE_TUNNEL,