10.12.1 Update Breaks Wireless SSO / Authentication

jkarpenske
Contributor

We use a mobileconfig file that gives our faculty and staff Wireless Single Sign On capability. In other words, if they've never signed into a particular mac before, they can enter their domain credentials at the login screen, and the mac will use those to connect to the secure wireless network and authenticate them with the domain servers. This worked fine in OS 10.11. I created a new mobileconfig file for OS 10.12, which worked as expected until the MacOS 10.12.1 update. After the update, the selection box for wireless networks disappeared from the login screen (it went back to username and password only) Luckily my credentials had been cached, so I could log in. I noticed that the mac was not automatically connecting to the wireless network as it had in the past. When I selected the wireless network SSID from the list, I was prompted for domain credentials. I entered them, but then got an error saying that "The identity of the authentication server cannot be verified," and the connection failed. The only way to get the Mac to connect to the wireless network is to trash the settings in the "Profiles" pane in System Preferences and manually set up the connection. Not sure if it's related, but I also noticed that after the 10.12.1 update, Calendar was no longer able to sync with our Exchange server - it would fail with an invalid username/password error every time. However, Calendar still continued to work with my Google accounts.

I did a full "nuke and pave" install of OS 10.12 on a test machine this morning, and was able to duplicate the issue - WIreless SSO works in 10.12.0, but once the 10.12.1 update is applied, it stops working. Has anyone else seen this issue? Any suggestions on how to fix it?

2 REPLIES 2

barnesaw
Contributor III
The identity of the authentication server cannot be verified

I suspect you need the cert(s) and associated hostname(s) in the appropriate sections of the profile

jkarpenske
Contributor

Those were already defined and working - the profile works like a charm in 10.12.0 - it's once the 10.12.1 upgrade is run that it stops working.