802.1X please translate the NetworkManager conf to wpa_supplicant conf

Question

OS: (Arch Linux) Linux HP-Arch 4.17.4-1-ARCH

NetworkManager is able to connect to my AP, "SYSU-SECURE", which requires 802.1X authentication. However, I would like to run wpa_supplicant directly with a shell script now.

NetworkManager conf on "SYSU-SECURE" is here:
(generated by the GUI nm-applet)
(file: /etc/NetworkManager/system-connections/SYSU-SECURE)

[connection]
id=SYSU-SECURE
uuid=<SOME_UUID>
type=wifi
permissions=user:<SOME_LOCAL_ACCOUNT>:;

[wifi]
mac-address=00:DB:DF:78:F6:9F
mac-address-blacklist=
mode=infrastructure
ssid=SYSU-SECURE

[wifi-security]
auth-alg=open
key-mgmt=wpa-eap

[802-1x]
eap=peap;
identity=<SOME_USERNAME>
password=<SOME_PASSWORD>
phase2-auth=mschapv2

[ipv4]
dns-search=
method=auto

[ipv6]
addr-gen-mode=stable-privacy
dns-search=
method=auto

The conf above succeeds. But what I want is something like this:
(file: /usr/local/bin/connect_to_SYSU-SECURE.sh)

#!/bin/bash
wpa_supplicant -B -i wlo1 -c <(echo '
network={
  ssid="SYSU-SECURE"
  key_mgmt=IEEE8021X
  eap=PEAP
  phase2="auth=MSCHAPV2"
  identity="<SOME_USERNAME>"
  password="<SOME_PASSWORD>"
}')
dhcpcd -4 wlo1

The shell script above fails. Please correct it for me.
Thank you.

Answer 1

For modern WPA-Enterprise you need to set key_mgmt to WPA-EAP. (You might have noticed that most values in NM are practically identical to what wpa_supplicant accepts directly.)

There are two different ways of using 802.1X for Wi-Fi, and choosing IEEE8021X actually selects "WEP dynamic keying" mode (or possibly even a plaintext, authentication-only mode).

---

I would suggest staying with NetworkManager and just removing the permissions= option, so that the connection becomes system-wide.