802.1X Ethernet: Global

com.apple.globalethernet.managed

The payload that configures the default fallback global Ethernet interface.

iOS 17.0+macOS 10.13+tvOS 17.0+

Only one instance per profile

Configuration Keys (3)

Key	Type	Description	Default	Range
`SetupModes`array EAP Setup Modes	array	Select "Login Window" to authenticate the Mac to the network when the user logs in.	Default: —	Range: —
`SetupMode`string Setup Mode	string	—	Default: —	Range: System (System), Login Window (Loginwindow)
`EAPClientConfiguration`dict EAP Client Configuration	dict	Specifies 802.1x EAP authentication parameters.	Default: —	Range: —
`AcceptEAPTypes`array Accept EAP Types required	array	The EAP types accepted.	Default: —	Range: —
`EAPType`integer EAP Type	integer	An integer representing an EAP type, inside of the Accept EAP Types array.	Default: —	Range: TLS (13), LEAP (17), TTLS (21), PEAP (25), EAP-FAST (43), EAP-SIM (18), EAP-AKA (23)
`UserName`string Username	string	Username. If not provided, the user may be prompted during login.	Default: —	Range: —
`UserPassword`string Password	string	Password. If not provided, the user may be prompted during login. Depends on: EAPClientConfiguration.AcceptEAPTypes; EAPClientConfiguration.OneTimeUserPassword	Default: —	Range: —
`OneTimeUserPassword`boolean Per-Connection Password	boolean	If set, the user will be prompted for a password each time they connect to the network.	Default: false	Range: —
`PayloadCertificateAnchorUUID`array Certificate Anchor UUID	array	Array of UUIDs corresponding to the trusted certificates for this authentication.	Default: —	Range: —
`CertificateAnchorUUID`string Individual Certificate Anchor UUID	string	A UUID for a trusted certificate	Default: —	Range: —
`TLSTrustedServerNames`array Trusted Server Certificate Names	array	Certificate Common Names expected from authentication server. The wildcard * can be used to match a range of strings.	Default: —	Range: —
`TLSTrustedServerName`string Individual Trusted TLS Server Name	string	An item in the TLS Trusted Server Names array representing a Common Name of a server certificate.	Default: —	Range: —
`TTLSInnerAuthentication`string Inner Authentication	string	Specifies the inner authentication used by the TTLS module. Depends on: EAPClientConfiguration.AcceptEAPTypes	Default: "MSCHAPv2"	Range: PAP, EAP, CHAP, MSCHAP, MSCHAPv2
`OuterIdentity`string Outer Identity	string	Externally visible identification (for TTLS, PEAP, and EAP-FAST). This string is used instead of the user's identity outside the encrypted tunnel. This value can be used to mask the true identity of the person using the network.	Default: —	Range: —
`TLSMinimumVersion`string TLS Minimum Version	string	—	Default: "1.0"	Range: 1.0, 1.1, 1.2, 1.3
`TLSMaximumVersion`string TLS Maximum Version	string	—	Default: "1.2"	Range: 1.0, 1.1, 1.2, 1.3
`EAPFASTUsePAC`boolean Use PAC	boolean	If set, the device will use an existing PAC if it's present. Otherwise the server must present its identity using a certificate.	Default: false	Range: —
`EAPFASTProvisionPAC`boolean Provision PAC	boolean	If set, allows PAC provisioning. Depends on: EAPClientConfiguration.AcceptEAPTypes; EAPClientConfiguration.EAPFASTUsePAC ∈ [true]	Default: false	Range: —
`EAPFASTProvisionPACAnonymously`boolean Provision PAC Anonymously	boolean	If set, provisions the device anonymously. Note that there are known man-in-the-middle attacks for anonymous provisioning.	Default: false	Range: —
`EAPSIMNumberOfRANDs`integer Number of RANDs	integer	The minimum number of RAND values accepted from the server. 3 is the default, and 2 is allowed, but offers less security.	Default: 3	Range: 2, 3
`SystemModeCredentialsSource`string System Profile Credentials Source	string	Use an alternate set of credentials when in System mode (AKA not a loginwindow profile). This can be used to tell EAPOLClient to use the computer password in a bound active directory scenario for authentication.	Default: —	Range: ActiveDirectory
`SystemModeUseOpenDirectoryCredentials`boolean Use OpenDirectory System Profile Credentials	boolean	This indicates if the connection should try to use the OpenDirectory machine credentials.	Default: false	Range: —
`TLSTrustedCertificates`array TLS Trusted Certificates	array	An array of trusted certificates. Each entry in the array must contain certificate data that represents an anchor certificate used for verifying the server certificate.	Default: —	Range: —
`TLSTrustedCertificatesItem`string required	string	A certificate identifier.	Default: —	Range: —
`TLSCertificateIsRequired`boolean	boolean	If 'true', allows for two-factor authentication for EAP-TTLS, PEAP, or EAP-FAST. If 'false', allows for zero-factor authentication for EAP-TLS. If you don't specify a value, the default is 'true' for EAP-TLS, and 'false' for other EAP types.	Default: —	Range: —
`Interface`string Interface required	string	The wired interface to use	Default: —	Range: Any Ethernet (AnyEthernet)