2

I am following Apple's guidelines for creating an MDM server, and I want to distribute the MDM profile in OTA. Apple's guidelines for OTA consist of 3 steps:

  1. authentication
  2. SCEP
  3. device configuration

in total there can be three configuration profiles delivered to the device - first one after authentication to get device info, second one is for SCEP enrollment and last one is the actual MDM profile. The IdentityCertificate key in the MDM payload is mandatory, so from here I assume I need to combine last two profiles to one profile that has SCEP and MDM payloads (and I refer this key to the SCEP payload). I assume the device will first handle the SCEP payload - is this correct?

Moreover, I want the user to be asked to accept the MDM profile, but from Apple's specs it seems the user is requested to approve only the first configuration profile (the one that asks for device info), and the rest of the OTA is without user intervention.

Is this the case? Am I suppose to combine all profiles into one? How can I distribute the MDM profile and have the user be asked to accept it and let the user know what this MDM profile will be able to control?

Thanks, Michal

4

1 に答える 1

2

実際、ステップ 2 と 3 を組み合わせただけではうまくいきませんでした。むしろ、ステップ 2 を複製し、ステップ 3 の構成プロファイルに追加の SCEP ペイロードを含める必要がありました。この背後にある理由が何であるかはわかりませんが、このアプローチもここで確認されました.

ユーザーが MDM プロファイルを受け入れる場合、iOS は MDM 構成プロファイルをインストールする前にユーザーに尋ねます。

于 2012-12-11T07:54:05.250 に答える