802.1X Ethernet: First Active

com.apple.firstactiveethernet.managed

The payload that configures the first wired, active Ethernet interface.

macOS

macOS 10.7+combined

Configuration Keys (3)

Key	Type	Title	Description	Default	Range
`SetupModes`	array	EAP Setup Modes	Select "Login Window" to authenticate the Mac to the network when the user logs in.	—	—
`SetupMode`	string	Setup Mode	—	—
`EAPClientConfiguration`	dict	EAP Client Configuration	Specifies 802.1x EAP authentication parameters.	—	—
`AcceptEAPTypes`required	array	Accept EAP Types	The EAP types accepted.	—	—
`EAPType`	integer	EAP Type	An integer representing an EAP type, inside of the Accept EAP Types array.	—
`UserName`	string	Username	Username. If not provided, the user may be prompted during login.	—	—
`UserPassword`	string	Password	Password. If not provided, the user may be prompted during login. Depends on: EAPClientConfiguration.AcceptEAPTypes; EAPClientConfiguration.OneTimeUserPassword	—	—
`OneTimeUserPassword`	boolean	Per-Connection Password	If set, the user will be prompted for a password each time they connect to the network.	false	—
`PayloadCertificateAnchorUUID`	array	Certificate Anchor UUID	Array of UUIDs corresponding to the trusted certificates for this authentication.	—	—
`CertificateAnchorUUID`	string	Individual Certificate Anchor UUID	A UUID for a trusted certificate	—	—
`TLSTrustedServerNames`	array	Trusted Server Certificate Names	Certificate Common Names expected from authentication server. The wildcard * can be used to match a range of strings.	—	—
`TLSTrustedServerName`	string	Individual Trusted TLS Server Name	An item in the TLS Trusted Server Names array representing a Common Name of a server certificate.	—	—
`TLSAllowTrustExceptions`	boolean	Allow Trust Exceptions	Allows a dynamic trust decision by the user.	true	—
`TTLSInnerAuthentication`	string	Inner Authentication	Specifies the inner authentication used by the TTLS module. Depends on: EAPClientConfiguration.AcceptEAPTypes	"MSCHAPv2"
`OuterIdentity`	string	Outer Identity	Externally visible identification (for TTLS, PEAP, and EAP-FAST). This string is used instead of the user's identity outside the encrypted tunnel. This value can be used to mask the true identity of the person using the network.	—	—
`TLSMinimumVersion`	string	TLS Minimum Version	—	"1.0"
`TLSMaximumVersion`	string	TLS Maximum Version	—	"1.2"
`EAPFASTUsePAC`	boolean	Use PAC	If set, the device will use an existing PAC if it's present. Otherwise the server must present its identity using a certificate.	false	—
`EAPFASTProvisionPAC`	boolean	Provision PAC	If set, allows PAC provisioning. Depends on: EAPClientConfiguration.AcceptEAPTypes; EAPClientConfiguration.EAPFASTUsePAC ∈ [true]	false	—
`EAPFASTProvisionPACAnonymously`	boolean	Provision PAC Anonymously	If set, provisions the device anonymously. Note that there are known man-in-the-middle attacks for anonymous provisioning.	false	—
`EAPSIMNumberOfRANDs`	integer	Number of RANDs	The minimum number of RAND values accepted from the server. 3 is the default, and 2 is allowed, but offers less security.	3
`SystemModeCredentialsSource`	string	System Profile Credentials Source	Use an alternate set of credentials when in System mode (AKA not a loginwindow profile). This can be used to tell EAPOLClient to use the computer password in a bound active directory scenario for authentication.	—
`SystemModeUseOpenDirectoryCredentials`	boolean	Use OpenDirectory System Profile Credentials	This indicates if the connection should try to use the OpenDirectory machine credentials.	false	—
`TLSTrustedCertificates`	array	TLS Trusted Certificates	An array of trusted certificates. Each entry in the array must contain certificate data that represents an anchor certificate used for verifying the server certificate.	—	—
`TLSTrustedCertificatesItem`required	string	—	A certificate identifier.	—	—
`TLSCertificateIsRequired`	boolean	—	If 'true', allows for two-factor authentication for EAP-TTLS, PEAP, or EAP-FAST. If 'false', allows for zero-factor authentication for EAP-TLS. If you don't specify a value, the default is 'true' for EAP-TLS, and 'false' for other EAP types.	—	—
`EAPType`	integer	EAP Type	An integer representing an EAP type, inside of the Accept EAP Types array.	—
`CertificateAnchorUUID`	string	Individual Certificate Anchor UUID	A UUID for a trusted certificate	—	—
`TLSTrustedServerName`	string	Individual Trusted TLS Server Name	An item in the TLS Trusted Server Names array representing a Common Name of a server certificate.	—	—
`TLSTrustedCertificatesItem`required	string	—	A certificate identifier.	—	—
`Interface`required	string	Interface	The wired interface to use	—
`SetupMode`	string	Setup Mode	—	—
`AcceptEAPTypes`required	array	Accept EAP Types	The EAP types accepted.	—	—
`EAPType`	integer	EAP Type	An integer representing an EAP type, inside of the Accept EAP Types array.	—
`UserName`	string	Username	Username. If not provided, the user may be prompted during login.	—	—
`UserPassword`	string	Password	Password. If not provided, the user may be prompted during login. Depends on: EAPClientConfiguration.AcceptEAPTypes; EAPClientConfiguration.OneTimeUserPassword	—	—
`OneTimeUserPassword`	boolean	Per-Connection Password	If set, the user will be prompted for a password each time they connect to the network.	false	—
`PayloadCertificateAnchorUUID`	array	Certificate Anchor UUID	Array of UUIDs corresponding to the trusted certificates for this authentication.	—	—
`CertificateAnchorUUID`	string	Individual Certificate Anchor UUID	A UUID for a trusted certificate	—	—
`TLSTrustedServerNames`	array	Trusted Server Certificate Names	Certificate Common Names expected from authentication server. The wildcard * can be used to match a range of strings.	—	—
`TLSTrustedServerName`	string	Individual Trusted TLS Server Name	An item in the TLS Trusted Server Names array representing a Common Name of a server certificate.	—	—
`TLSAllowTrustExceptions`	boolean	Allow Trust Exceptions	Allows a dynamic trust decision by the user.	true	—
`TTLSInnerAuthentication`	string	Inner Authentication	Specifies the inner authentication used by the TTLS module. Depends on: EAPClientConfiguration.AcceptEAPTypes	"MSCHAPv2"
`OuterIdentity`	string	Outer Identity	Externally visible identification (for TTLS, PEAP, and EAP-FAST). This string is used instead of the user's identity outside the encrypted tunnel. This value can be used to mask the true identity of the person using the network.	—	—
`TLSMinimumVersion`	string	TLS Minimum Version	—	"1.0"
`TLSMaximumVersion`	string	TLS Maximum Version	—	"1.2"
`EAPFASTUsePAC`	boolean	Use PAC	If set, the device will use an existing PAC if it's present. Otherwise the server must present its identity using a certificate.	false	—
`EAPFASTProvisionPAC`	boolean	Provision PAC	If set, allows PAC provisioning. Depends on: EAPClientConfiguration.AcceptEAPTypes; EAPClientConfiguration.EAPFASTUsePAC ∈ [true]	false	—
`EAPFASTProvisionPACAnonymously`	boolean	Provision PAC Anonymously	If set, provisions the device anonymously. Note that there are known man-in-the-middle attacks for anonymous provisioning.	false	—
`EAPSIMNumberOfRANDs`	integer	Number of RANDs	The minimum number of RAND values accepted from the server. 3 is the default, and 2 is allowed, but offers less security.	3
`SystemModeCredentialsSource`	string	System Profile Credentials Source	Use an alternate set of credentials when in System mode (AKA not a loginwindow profile). This can be used to tell EAPOLClient to use the computer password in a bound active directory scenario for authentication.	—
`SystemModeUseOpenDirectoryCredentials`	boolean	Use OpenDirectory System Profile Credentials	This indicates if the connection should try to use the OpenDirectory machine credentials.	false	—
`TLSTrustedCertificates`	array	TLS Trusted Certificates	An array of trusted certificates. Each entry in the array must contain certificate data that represents an anchor certificate used for verifying the server certificate.	—	—
`TLSTrustedCertificatesItem`required	string	—	A certificate identifier.	—	—
`TLSCertificateIsRequired`	boolean	—	If 'true', allows for two-factor authentication for EAP-TTLS, PEAP, or EAP-FAST. If 'false', allows for zero-factor authentication for EAP-TLS. If you don't specify a value, the default is 'true' for EAP-TLS, and 'false' for other EAP types.	—	—
`EAPType`	integer	EAP Type	An integer representing an EAP type, inside of the Accept EAP Types array.	—
`CertificateAnchorUUID`	string	Individual Certificate Anchor UUID	A UUID for a trusted certificate	—	—
`TLSTrustedServerName`	string	Individual Trusted TLS Server Name	An item in the TLS Trusted Server Names array representing a Common Name of a server certificate.	—	—
`TLSTrustedCertificatesItem`required	string	—	A certificate identifier.	—	—