Is the certificate per-user or per-computer? Could you have a script that looks for the specific variable, insert that into the payload, and deploy from there?
Another thing you can try is this:
sudo -u $( /usr/bin/who | /usr/bin/awk '/console/{ print $1 }' ) profiles -I -F /path/to/file.configprofile
This would install the profile as the current logged in user. Is this what you're asking for? I don't know if this will work, since even though it will be from a policy or Self Service it will be sudo-ing as the current user, and profiles require admin privileges to install. Though, you could grant admin privileges before that line and revoke them, like this:
#!/bin/bash
cur_user=`/bin/ls -l /dev/console | /usr/bin/awk '/ / { print $3}'`
dseditgroup -o edit -a $cur_user -t user admin
sudo -u $cur_user profiles -I -F /path/to/file.configprofile
dseditgroup -o edit -d $cur_user -t user admin
Without more details on XpressConnect and the "full enrollment", I'm afraid this is all I can help with.
