Configuration Profile Reference - Apple Developer

1 ConfigurationProfileReference |Copyright |Copyright ,networksettings,orcertificatestoalargen umberofdevices, ,including: Restrictionsondevicefeatures Wi-Fisettings VPNsettings Emailserversettings Exchangesettings LDAP directoryservicesettings CalDAVcalendarservicesettings Webclips , ,withPayloadRemovalDisallowedsettotrue,c anberemovedmanually, , : UsingAppleConfigurator2,availableintheAp pStore Inanemailmessage Onawebpage Usingover-the-airconfigurationasdescribe dinOver-the-AirProfileDeliveryandConfigu ration OvertheairusingaMobileDeviceManagementSe rver2019-05-03|Copyright , (iOS5orlater)orbyusingtheDeviceEnrollmen tProgram(iOS7orlater).

2 ForinformationaboutAppleConfigurator, ,visitApple , , , ,aprofilepropertylistcontainsthefollowin gkeys:KeyType ContentPayloadContentArray , Areverse-DNSstyleidentifier( ,forexample) |Copyright ContentPayloadUUIDS tring , , ,theusercannotdeletetheprofile(unlessthe profilehasaremovalpasswordandtheuserprov idesit).PayloadTypeString , , ,itdeterminesthelocationofthecertificate items, ,payloads,likeVPN, , , : Foreachlanguageinwhichaconsentorlicensea greementisavailable,akeyconsistingoftheI ETFBCP47identifierforthatlanguage(forexa mple,enorjp) Theoptionalkeydefaultwithitsvalueconsist ingoftheunlocalizedagreement(usuallyinen ).

3 Thesystemchoosesalocalizedversionintheor derofpreferencespecifiedbytheuser(macOS) orbasedontheuser scurrentlanguagesetting(iOS).Ifnoexactma tchisfound, , , |Copyright Payload :KeyType ContentPayloadTypeString ,changestotheVPNsoftwareiniOSmightintrod uceanewpayloadversiontosupportadditional features, , , (describedinPayloadDictionaryKeysCommont oAllPayloads), |Copyright (CA)usingDCE/ :KeyType ValueAllowAllAppsAccessBoolean Iftrue, TemplateNameasitappearsintheGeneraltabof thetemplate sobjectintheCertificateTemplates Webenrollment, (CN)oftheActiveDirectoryentry:CN=<yourCAname>,CN= CertificationAuthorities ,CN= PublicKeyServices ,CN= Services ,orCN= Configuration ,<yourbaseDomainName>.

4 CertificateRenewalTimeIntervalInteger Iftrue, , Optional; (CSR). , |Copyright Type (ignoredotherwise).Ifpresent, , :Key Type ValueDeviceIDString TheDeviceIDoftheAirPlaydestination,inthe formatxx:xx:xx:xx: :Key Type ValueDeviceNameString ThenameoftheAirPlaydestination(usedoniOS ).DeviceIDString TheDeviceIDoftheAirPlaydestination(usedo nmacOS).PasswordString |Copyright ,thispayloaddefinesthefollowingkeys:KeyT ype ValueSecurityTypeString :PASSCODE_ONCE,PASSCODE_ALWAYS, |Copyright :KeyType ValueIPAddressString : printers/Canon_MG5300_series printers/Xerox_Phaser_7600 ipp/print Epson_IPP_PrinterPortInteger IftrueAirPrintconnectionsaresecuredbyTra nsportLayerSecurity(TLS).

5 |Copyright , , , :Key Type ValueAppDictionary ,inturn,containsthefollowingkey:KeyType ValueIdentifierString ,ifpresent,cancontainthefollowingkeys( ):KeyType ValueDisableTouchBoolean , , , , , , , |Copyright ValueDisableAutoLockBoolean , , , , , , , , , , , ,ifpresent,cancontainthefollowingkeys( ):KeyType ValueVoiceOverBoolean , , , , , , , |Copyright :KeyType Valuerestrict-store-require-admin-to-ins tallBoolean |Copyright userapproved ,including,butnotlimitedto,keyloggingand userinterfacemanipulationoutsideoftheapp lication ,thispayloaddefinesthefollowingkey:KeyTy pe ValueAllowedApplicationsArray :KeyType ValueBundleIdentifierString Theapplication , Thedeveloper , |Copyright ,thispayloaddefinesthefollowingkeys:KeyT ype ValueCalDAVA ccountDescriptionString , Theuser , , tprovideapassword,becauseauto-discoveryo ftheservicewillfailandtheaccountwon ,thispayloaddefinesthefollowingkeys.

6 KeyType ValueSubCalAccountDescriptionString Theuser Theuser |Copyright ,thispayloadtypesupportsobtainingCardDAV U sernameandCardDAVP asswordfromanIdentificationPayload, ,thispayloaddefinesthefollowingkeys:KeyT ype ValueCardDAVA ccountDescriptionString Theuser |Copyright : Nomorethanonecellularpayloadcanbeinstall edatanytime. ,whichissupported, ,thispayloaddefinesthefollowingkeys:Key Type ValueAttachAPND ictionary , , :KeyType ValueNameString :1=IPv4,2=IPv6,and3= :1=IPv4,2=IPv6,and3= |Copyright ValueAllowedProtocolMaskInRoamingInteger :1=IPv4,2=IPv6,and3= :1=IPv4,2=IPv6,and3= #1(.)

7 Cer) #1(.cer) #1(.cer) #12(.p12) ,allCertificatepayloadsdefinethefollowin gkeys:KeyType ValuePayloadCertificateFileNameString #12certificates, #12certificates,iftrue, , |Copyright , ,thispayloaddefinesthefollowingkeys:KeyT ype ValueNameString (RFC822) TheUUID ofanotherpayloadwithinthesameprofilethat installedthecertificate;forexample,a |Copyright Itcanonlyappearinadeviceprofile, , , , ,thispayloaddefinesthefollowingkeys:KeyT ype ,butadomainmatchingrulemustnotmatchalldo mainswithinatopleveldomain( . and . areallowedwhile .com and . arenotallowed). ,oneofthefollowingconditionsmustbemet: Thehashisoftheservercertificate ssubjectPublicKeyInfo.

8 ThehashisofasubjectPublicKeyInfothatappe arsinaCAcertificateinthecertificatechain , ,oneormoredirectoryNamenameConstraintsar epresentinthepermittedSubtrees,andthedir ectoryNamecontainsanorganizationNameattr ibute. ThehashisofasubjectPublicKeyInfothatappe arsinaCAcertificateinthecertificatechain ,theCAcertificatehasoneormoreorganizatio nNameattributesinthecertificateSubject,a ndtheserver scertificatecontainsthesamenumberoforgan izationNameattributes,inthesameorder, :Key Type ValueAlgorithmString ,mustbe sha256 .HashData |Copyright ,usethiscommandforaPEMencodedcertificate :openssl x509 -pubkey -in -inform pem | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | base64 IfyourcertificateisDERencoded,usethiscom mand:openssl x509 -pubkey -in -inform der | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | ,usethefilecommandtoidentifyitsencodingt ype.

9 $ file : PEM certificate$ file : ,thispayloaddefinesthefollowingkey:Key Type ValueMessageString ,ConferenceRoomDisplaymodeisactiveandthe usercan |Copyright ,thispayloaddefinesthefollowingkeys:KeyT ype ValueAllowPersonalCachingBoolean ,cachestheuser (hours,days)toreacttochangestothissettin g; ,cachesnon-iCloudcontent, (hours,days)toreacttochangestothissettin g; , ,usetheSharingpreference ,orendwith,/Library/ApplicationSupport/A pple/ (anditsintermediates) (../Library/ApplicationSupport/ Apple /Ass etCache)willbeownedby_ |Copyright ValueDenyTetheredCachingBoolean , , , ,theContentCacheprovidescontenttotheclie ntsintheunionoftheListenRanges, , , , , , |Copyright ValueParentSelectionPolicyString ,parentcachesthataretemporarilyunavailab leareskipped.

10 First- ,secondary,andsubsequentparents. url-path- round- sticky-available:Startingwiththefirstpar entintheParentslist, , ,secondary, , ,theContentCachewillonlypeerwithotherCon tentCachesonthesameimmediatelocalnetwork , , , , |Copyright ValuePortInteger , :Key Type ValuetypeString (IPv4orIPv6). |Copyright ,thispayloaddefinesthefollowingkeys:KeyT ype ValuelockedBoolean , , ,thispayloaddefinesthefollowingkeys:KeyT ype ValueAppBundleIdentifierString ,exceptforAllowDockFixupOverride, ,thispayloaddefinesthefollowingkeys:KeyT ype ValueorientationString ,left, , , , |Copyright Valueminimize-to-applicationBoolean , , , , , , , , , ,AddDockMCXD ocumentsFolder,AddDockMCXS haredFolder, MyApplications OriginalNetworkHome ,usethefilein/Library/ , , |Copyright Valuecontents-immutableBoolean.