About Enterprise Connect

@bcbackes whoops looks like I copy/pasted the wrong key. Boy this eggnog is good! ;)

Corrected:

$ defaults read ~/Library/Preferences/com.apple.Enterprise-Connect daysToExpire
33

Do you happen to know if the AD option - "user must change password at next logon" will be tested/checked when connecting with Enterprise Connect?
Right now if we set this on the account in AD, a user is unable to sign in... where it should simply be prompted with relevant dialog boxes to change the password.... Thanks

It appears we are about to get Enterprise Connect in our district with our next order. Got a demo that tested positively and appears that it will work for our staff laptops (shared devices would still need joined to the domain).

Is AEC dead now that macOS 10.15 has this built in?

Was definitely thinking this as I watched the WWDC preso called "What's New in Managing Apple Devices"! It says that the extension is based on EC - so sounds like it is a replacement?

@mbezzo @kericson - I've read this now in a couple places, but can't find specifics on it. Would be nice to know more on this...going to search the dev portal, but so far, this thread is as close as I've come to it.

I think it's safe to say that EC is going away. I received an email from Apple Pro Services last week, with the following line:

...*With these changes, we’d like you to begin testing and planning an eventual migration away from Enterprise Connect. Although we will continue to provide critical maintenance updates for Enterprise Connect for at least one year, we will be focusing new development efforts on functionality related to the new extension

Additional documentation and test plans around the new functionality will be published through AppleSeed for IT throughout the summer. Feedback should be submitted through Feedback Assistant for any kind of single sign-on functionality going forward..*

@KMerendaTFMC - thanks for that. Pretty much spells it out!

SSO…

Anybody find any documentation for enterprise connect in Catalina? I haven't seen anything on the Appleseed pages..

Thanks

C

@gachowski The Apple developer documentation for the MDM API has some bits on the Kerberos SSO extension payload for config profiles, if I remember correctly. When I reviewed it (a few months ago) the documentation was very limited.

I found it ... it's all in the seed program, but it's the seed program for ABM accounts. My normal seed account wasn't linked to our ABM accounts.

C

I know that the SSO extension is going to be replacing most of the functionality of Enterprise Connect (and EC may be EOL as a consequence), but does anyone know if EC 2.0.x will work fine with Catalina?
I'm really just thinking of it as a stop-gap measure if we don't get the SSO extension working right away...

@kstrick Enterprise Connect is fully supported with Catalina.

how are you guys getting EC 2.x? we have 1.9.5 (1) and i have no clue where to even get updates.

the app signature expired on our EC app so now users are unable to deploy it.

while i know theres 2 options:
1. expand and flatten without a signature
2. cache it then run a command to install package with -allowuntrusted

if would be better if we could test a later/newer version, especially since theres a residual package distributed with EC 1.9.5 called "Install Enterprise Connect First Launch.dmg" that im not quite sure what it does :(

is the download only from a dev link?

We get an email from APS-ETS aps-ets@apple.com that Enterprise Connect has been update. You might want to contact them.

We are getting an error while we are trying to get AEC installed on 1 particular machine. It simply says that apple enterprise connect is not installed properly please get in touch with your System Administrator for assistance.
Is this something anyone of us has seen?
We have already removed the application couple of times and installed it back but still no luck once we have completed a restart on the mac it stops working.

@SeetendraPanda I used this script to uninstall AEC completely then re-install

#!/bin/bash
#variable for storing the current users name

currentuser=`stat -f "%Su" /dev/console`
echo $currentuser

su "$currentuser" -c "security delete-generic-password -l 'Enterprise Connect'"


file="/Library/LaunchAgents/com.apple.ecAgent.plist"
if [ -f "$file" ]
then
    launchctl unload /Library/LaunchAgents/com.apple.ecAgent.plist
    sudo rm -rf /Library/LaunchAgents/com.apple.ecAgent.plist
else
    echo "$file not found."
fi


sudo killall 'Enterprise Connect Menu'

sudo rm -rf /Applications/Enterprise Connect.app 


sudo jamf recon

#Call policy to reinstall
/usr/local/bin/jamf policy -event ec-install

exit 0

Has anyone had any success migrating their password change script to the Kerberos SSO extension? The script we're using calls /usr/bin/security find-generic-password -l "Enterprise Connect" to grep the current credentials from Enterprise Connect, and obviously these entries no longer exist.

The 802.1X script greatly improves the password change experience by clearing cached credentials, so I'd really like to figure out an alternative as we gradually move away from Enterprise Connect.

Thanks!