I have been working with Apple Enterprise on this since last October. In the case of devices that have built in ethernet the profile configuration I am using generally works with one caveat. If the network interface is removed and re-added then authentication via System Mode profile never applies.
For devices with no Ethernet built in the behavior is very inconsistent, especially in our environment where it is not assured a 1:1 relationship of dongle-device. IF, and it is a big if. I can ensure the dongle used when the profile is installed is the only dongle ever used with the device, generally the system mode profile works and authenticates automatically, though I have seen it periodically fail and User Mode authentication request credentials. I have worked with apple on modifying some delay timers on this.
I need to be able to install a system mode profile with specified credentials (certificate, machine credentials, etc...) and be able to plug in any ethernet adapter with an assumption the device will authenticate.
Apple keeps coming back to problems with the profile but it works until it doesn't work. There is something wrong with the framework, not the profile. I don't know if it is an issue with enumerating ethernet devices as they are connected and disconnected or what but I am growing increasingly frustrated with the amount of manual massaging I have to be doing to have device authentication in our environment.
I have both Apple Enterprise cases and Radar's logged for these issues, you can contact me off list if you would like to contact your apple representatives to get attached to those.
