one-time script to setup McGill wifi & eduroam on linux systems with networkmanager or iwd

mcroam.sh

#!/bin/bash
set -eau pipefail

curl -fsSLo /tmp/discover_data.json --compressed https://discovery.eduroam.app/v2/discovery.json 

PROFILES=$(jq -r '."http://letswifi.app/discovery#v2".institutions[] | select(.name.any == "McGill University") | .profiles' /tmp/discover_data.json)

rm /tmp/discover_data.json

LEN=$(echo $PROFILES | jq '. | length')
if [ $LEN -gt 1 ]; then
  echo "Which profile do you want to use?"
  for ((i=0; i<=LEN; i++)); do
    echo "$i: $(echo $PROFILES | jq \".[$i]\")"
  done
  read NUM
  if [[ "$num" =~ ^[0-9]+$ ]] && [[ "$num" -le "$LEN" ]]; then
    PROFILE=$(echo $PROFILES | jq ".[$num]")
  else
    echo "Error: '$num' is not a valid choice."
  fi
elif [ $LEN -eq 1 ]; then
  PROFILE=$(echo $PROFILES | jq ".[0]")
fi

if [[ -v PROFILE ]]; then
  CONFIG_URL=$(echo $PROFILE | jq -r '.eapconfig_endpoint')
  echo $CONFIG_URL
  curl -fsSLo /tmp/eap_config.xml $CONFIG_URL
  read -r DOMAIN ANONYMOUS COID SSID1 SSID2 CACERT <<< $(python3 -c "
import xml.etree.ElementTree as ET
tree = ET.parse('/tmp/eap_config.xml')
root = tree.getroot()
domain = root.find('ServerID').text
anonymous = root.find('OuterIdentity').text
consortiumoid = root.find('ConsortiumOID').text
#mcgill has two of these so we (flexibly?) hardcoding it
ssids = root.findall('SSID')
ssid1 = ssids[0].text
ssid2 = ssids[1].text
peaptypes = root.findall('Type')
assert peaptypes[0] == 25 && peaptypes[1] == 26, 'EAP types other than PEAP/MSCHAPv2 not implemented'
cacert = root.find("CA").text
print([domain, anonymous, consortiumoid, ssid1, ssid2, cacert].join(' '))
")
  rm /tmp/eap_config.xml
  mkdir -p ~/.local/share/ca-certificates
  echo "-----BEGIN CERTIFICATE-----\n$CACERT\n-----END CERTIFICATE-----" > ~/.local/share/ca-certificates/mcgill_eduroam_ca.crt
  chmod 644 
  read -p "McGill Username (first.last@mail.mcgill.ca or first.last@mcgill.ca): " USERNAME
  read -p "McGill Password: " PASSWORD
  if [[ command -v nmcli ]]; then
    nmcli connection add type wifi con-name "$SSID1-auto" ssid "$SSID1" \
      wifi-sec.key-mgmt wpa-eap \
      802-1x.consortium-org-id "$COID" \
      802-1x.eap peap \
      802-1x.phase2-auth mschapv2 \
      802-1x.anonymous-identity "$ANONYMOUS" \
      802-1x.domain-suffix-match "$DOMAIN" \
      802-1x.ca-cert "$HOME/.local/share/ca-certificates/mcgill_eduroam_ca.crt" \
      802-1x.identity "$USERNAME" \
      802-1x.password "$PASSWORD"
    nmcli connection add type wifi con-name "$SSID2-auto" ssid "$SSID2" \
      wifi-sec.key-mgmt wpa-eap \
      802-1x.consortium-org-id "$COID" \
      802-1x.eap peap \
      802-1x.phase2-auth mschapv2 \
      802-1x.anonymous-identity "$ANONYMOUS" \
      802-1x.domain-suffix-match "$DOMAIN" \
      802-1x.ca-cert "$HOME/.local/share/ca-certificates/mcgill_eduroam_ca.crt" \
      802-1x.identity "$USERNAME" \
      802-1x.password "$PASSWORD"
  elif systemctl is-enabled --quiet iwd; then
    CONFIG="[Security]
EAP-Method=PEAP
EAP-Identity=$ANONYMOUS
EAP-PEAP-Phase2-Method=MSCHAPV2
EAP-PEAP-Phase2-Identity=$USERNAME
EAP-PEAP-Phase2-Password=$PASSWORD
EAP-PEAP-CACert=$HOME/.local/share/ca-certificates/mcgill_eduroam_ca.crt
EAP-PEAP-ServerDomainMask=$DOMAIN

[Settings]
AutoConnect=true"
    sudo tee /var/lib/iwd/eduroam.8021x > /dev/null <<< $CONFIG
    sudo chmod 600 /var/lib/iwd/eduroam.8021x
    sudo chown root:root /var/lib/iwd/eduroam.8021x
    mcgill_filename="/var/lib/iwd/=$(python3 -c 'print(\'wpa.mcgill.ca\'.encode().hex())').8021x"
    sudo tee $mcgill_filename > /dev/null <<< $CONFIG
    sudo chmod 600 $mcgill_filename
    sudo chown root:root $mcgill_filename
    sudo systemctl restart iwd
  else;
    echo "Unsupported network config"
  fi
fi