Deploying 802.1x Profiles

[pbrooks]

Hi,

We’re having a lot of trouble trying to deploy a Configuration Profile for machine based wired 802.1x configuration settings using Casper.

Sending the profile out as a Configuration Profile isn’t the preferred option for this as we would have to open our restricted 802.1x guest/fail VLANs to communicate with Apple’s APN servers. That means they can’t pick up the 802.1x profile until they have already authenticated via 802.1x – so a catch 22 situation!

I’ve therefore been trying to deploy the exported .mobileconfig file as a PKG with a postinstall script to install it using the OSX profiles command. This is possible as clients can communicate with our Casper server from the 802.1x guest VLANs.

What I’m finding is:

The PKG installs the profile fine regardless of how it is installed.

If the PKG was installed manually the 802.1x authentication works fine.

If installed via Self Service the 802.1x the authentication works fine.

If set to install on check-in, and I manually tell the client to check in (sudo jamf policy) the authentication works fine.
However:

If the PKG is installed by an on enrolment policy, the package installs but the authentication doesn’t work.

If the PKG is installed by an automatic check-in with an ongoing policy, the package installs but the authentication doesn’t work. Even if the authentication was working OK before (i.e. installed manually/Self Service/manual policy check in), when it re-runs on the next check in it causes it to stop working.

If installed during a Configuration (with the package marked as ‘install after reboot’), the package installs but the authentication doesn’t work.

If the .mobileconfig profile is installed in the image, the related certificate in the System keychain is preserved when captured by Composer and the image is deployed, the authentication doesn’t work.

What I mean by “doesn’t work” above is that the IP address remains as the guest VLAN address and the Network preference pane says it is constantly ‘authenticating’. If I stop that process and click Connect, it prompts for a username and password (which we don’t want as authentication should be machine based). If I then delete the profile and manually reinstall, it then works!

Given that we are using this in computer labs we need this to work automatically – it’s not practical for us to install it manually on several hundred Macs after they installed.

I know our 802.1x profile works because a) it works when manually installed and b) I’ve tried importing the profile we used last year (created on our old Profile Manager server).

We are running v9.32 of the Suite. In v9.31 we had to bypass the JSS because of the known issue with network profiles, so we used our old (unsigned) .mobileconfig file directly. I’ve tried both this file and the one created in the JSS since we moved to v9.32.

Any idea why this isn’t working for us when installed automatically?

[thoule]

What is the command you are using to install the profile in the package? Could it be you are installing to a user profile and not the computer profile? -i vs -I

[pbrooks]

It's -I, is that the right one for a computer profile? In full it's

profiles -I -F /private/tmp/Wired802-1xSettings.mobileconfig -f

Where the package is obviously copying the Wired802-1xSettings.mobileconfig to /private/tmp.

[thoule]

-I Install a configuration profile for a particular user from a profile file.

-i Install a provisioning profile from a profile file.

Capitol I is for a user, lowercase i is a computer one... Not sure if it'll help, but I recommend trying to switch it and rebuild your package...

[pbrooks]

thank you Thoule

i will try this then let you know the outcome

thanks

Pete

[jhbush]

@pbrooks I had some of the same issues with 802.1x profiles using the JSS to distribute them. I was using a login window profile. The profile would work along side FV2 and prompt for credentials as they aren't passed at the FV2 login window due to the bypass of FV2. Anyway using the JSS for the profile would always result in users being unable to connect, etc. Packaging the profile and running the standard Profiles commands worked fine every time. It's been that way since they brought profiles into the JSS and AFAIK is still not working as expected in 9.31.

[pbrooks]

@jhbush1973 are you running the profiles command manually or via a Casper Policy/Casper deployed script?