802.1X Ethernet: First Active

Select "Login Window" to authenticate the Mac to the network when the user logs in.

Specifies 802.1x EAP authentication parameters.

The wired interface to use

Range: First Active Ethernet (FirstActiveEthernet)

Range: System (System), Login Window (Loginwindow)

The EAP types accepted.

Username. If not provided, the user may be prompted during login.

Password. If not provided, the user may be prompted during login.

Depends on: EAPClientConfiguration.AcceptEAPTypes; EAPClientConfiguration.OneTimeUserPassword

If set, the user will be prompted for a password each time they connect to the network.

Default: false

Array of UUIDs corresponding to the trusted certificates for this authentication.

Certificate Common Names expected from authentication server. The wildcard * can be used to match a range of strings.

Allows a dynamic trust decision by the user.

Default: true

Specifies the inner authentication used by the TTLS module.

Depends on: EAPClientConfiguration.AcceptEAPTypes

Default: "MSCHAPv2"

Range: PAP, EAP, CHAP, MSCHAP, MSCHAPv2

Externally visible identification (for TTLS, PEAP, and EAP-FAST). This string is used instead of the user's identity outside the encrypted tunnel. This value can be used to mask the true identity of the person using the network.

Default: "1.0"

Range: 1.0, 1.1, 1.2, 1.3

Default: "1.2"

Range: 1.0, 1.1, 1.2, 1.3

If set, the device will use an existing PAC if it's present. Otherwise the server must present its identity using a certificate.

Default: false

If set, allows PAC provisioning.

Depends on: EAPClientConfiguration.AcceptEAPTypes; EAPClientConfiguration.EAPFASTUsePAC ∈ [true]

Default: false

If set, provisions the device anonymously. Note that there are known man-in-the-middle attacks for anonymous provisioning.

Default: false

The minimum number of RAND values accepted from the server. 3 is the default, and 2 is allowed, but offers less security.

Default: 3

Range: 2, 3

Use an alternate set of credentials when in System mode (AKA not a loginwindow profile). This can be used to tell EAPOLClient to use the computer password in a bound active directory scenario for authentication.

Range: ActiveDirectory

This indicates if the connection should try to use the OpenDirectory machine credentials.

Default: false

An array of trusted certificates. Each entry in the array must contain certificate data that represents an anchor certificate used for verifying the server certificate.

If 'true', allows for two-factor authentication for EAP-TTLS, PEAP, or EAP-FAST. If 'false', allows for zero-factor authentication for EAP-TLS. If you don't specify a value, the default is 'true' for EAP-TLS, and 'false' for other EAP types.

An integer representing an EAP type, inside of the Accept EAP Types array.

Range: TLS (13), LEAP (17), TTLS (21), PEAP (25), EAP-FAST (43), EAP-SIM (18), EAP-AKA (23)

A UUID for a trusted certificate

An item in the TLS Trusted Server Names array representing a Common Name of a server certificate.

A certificate identifier.