Another Way to Enable Wi-Fi At Login Window (with Profiles!)

The Premise:

Nick McSpadden and I were both working on a similar goal this week: getting Macs to connect to Wi-Fi at the loginwindow. By default, adding preferred wireless networks will only connect once a user is logged in, either via the networksetup command or Profiles. By using a modified .mobileconfig from the iPhone Configuration Utility, we can achieve this goal without having to use Profile Manager.

We shared a common goal in this, to be able to bootstrap new MacBook Airs over Wi-Fi using Munki. I had an additional goal, to be able to authenticate to Active Directory over Wi-Fi. Without a Wi-Fi connection at the loginwindow, Directory Services must rely on cached credentials, which interferes with some authentication  methods as well as Kerberos, and also prevents new users from signing in.

Nick created a script which is run by a LaunchAgent that makes this work on Snow Leopard and later, but if you are using Lion or Mountain Lion, this can all be accomplished with the built-in functionality of Profiles.

The iPhone Configuration Utility can make .mobileconfig profiles, but these are ‘User’ profiles, in that wireless networks and credentials are installed in the current user’s Keychain. In order to achieve our goal, we need a ‘System’ profile, so this information is stored in the System Keychain and therefore usable by any user. We also must instruct the computer to connect at the loginwindow, and not just after users log in.

By using this setup, you will no longer need an Ethernet connection to setup new machines and users, and it will make it much easier to keep your fleet of portables updated. Be careful when bootstrapping over Wi-Fi, as a few machines downloading tens of gigabytes can easily overwhelm poorly-configured or cheap access points.

The Setup:

Download and install the iPhone Configuration Utility, and create a .mobileconfig profile for your Wi-Fi network(s). If you use 802.1x, be sure to include any certificates. Export the profile, and open it in your favorite text editior.

Your initial .mobileconfig should look like the following example. This example contains two Wi-Fi networks, a WPA2-PSK network and a WPA2-Enterprise, 802.1x authenticated network. We must make some manual modifications to this file.

1. To have the Wi-Fi networks installed into System.keychain, add this key to each Wi-Fi network’s dict, underneath the SSID_STR key.

1. To tell the computer to connect to these Wi-Fi networks at the loginwindow in addition to when users log in, add this key to the main dict, underneath the PayloadRemovalDisallowed key.

The resulting .mobileconfig should look like this:

As DeployStudio and Munki cannot currently install profiles themselves, a payload-free package should be created with it, using this command to install as a device profile:

Here is an example of a postflight script to use to install this profile:

If installing with DeployStudio, be sure to mark it as a postponed installation, as the profiles command can only install on the currently booted disk. Adding this resulting package to your current DeployStudio or other thin/no-imaging workflow will make the machine connect to your Wi-Fi network and bootstrap with Munki, no Ethernet required.

Samuel Keeley

Samuel Keeley can frequently be found in ##osx-server on Freenode, or on Twitter @keeleysam.

More Posts - Website

Follow Me: