Can't connect to wifi Raspberry Pi 3A+

[TheOldPresbyope]

@adam_zzz 
@Tim Curtis 

So I skimmed through the fully annotated 1920-line file /usr/share/doc/wpa_supplicant/examples/wpa_supplicant.conf I mentioned before and concluded this single network configuration stanza should allow my moOde player to connect to my WPA2-PSK router and---in principle!---should work for your mixed-mode WPA2-PSK/WPA3-SAE router too. It obviously builds on some points you brought up.

Code:

#########################################
# This file is automatically generated by
# the player Network configuration page.
#########################################

country=US
ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1

network={
ssid="<my AP>"
priority=100
# allow for either WPA2-PSK or mixed WPA2-PSK/WPA3-SAE using only PSK
key_mgmt=WPA-PSK WPA-PSK-SHA256
scan_ssid=1
psk=<my psk>
# WPA2-PSK router never uses ieee80211w
# mixed-mode WPA2-PSK/WPA3-SAE router apparently always uses ieee80211w
# so make it optional
ieee80211w=1
}

I created a rough-n-ready testbed by hooking the moOde player up to the router via Ethernet, ssh'ing into it, and playing games with wpa_supplicant.conf settings. After each change, I'd kill the wpa_supplicant process and restart it from the command line, e.g.,

Code:

sudo killall wpa_supplicant
sudo wpa_supplicant -B -iwlan0 -c/etc/wpa_supplicant/wpa_supplicant.conf

The stanza shown above works with my moOde player connecting with my WPA2-PSK router. Whether with the original wpa_supplicant.conf in moOde 8.2.5 or with this one, I see the same output if I ask wpa_cli to show the connection status:

Code:

pi@m825p3bp:~ $ wpa_cli -iwlan0 status
bssid=<elided>
freq=5220
ssid=<elided>
id=0
mode=station
pairwise_cipher=CCMP
group_cipher=CCMP
key_mgmt=WPA2-PSK
wpa_state=COMPLETED
ip_address=10.0.0.10
p2p_device_address=<elided>
address=<elided>
uuid=<elided>
ieee80211ac=1

Other tools show similar results.

A quick test shows that I fail to connect if ieee80211w=2.

Let me know if this single stanza works for you too. It would greatly simplify Tim's coding burden.

Personal - I deliberately left out pure WPA3-SAE because we have nothing to test it against and I can't bring myself to suggest allowing unprotected or known to be vulnerable modes.

Regards,
Kent
PS - I wrote this before you posted but got interrupted.