configure safari preferences for all users on mac

Check Console.app for logging related to Keychain or Security.Īs always, I hope this information helps you along the path to building a great end-user experience.Validate that the behavior works correctly if manually creating the identity preference in Keychain Access.app.Ensure that the certificate is present on the user’s device and in the correct Keychain (the login keychain, and NOT the system keychain).The certificate authentication endpoint URL may not be the same as the Username/Password URL. Validate the URL is the actual certificate authentication endpoint.Check for a mistyped URL in the identity preference payload (autocorrect fail, anyone?).Admins can troubleshoot the functionality using the following steps: If the identity preferences are not working, the issue may require troubleshooting from the affected device. Some useful examples of Custom Settings (such as this one) are available on the EUC-Samples GitHub Repository. In the Custom Settings payload, the AutoSelectCertificateforUrls key allows administrators to map specific certificate identities to URL patterns. Google Chrome doesn’t leverage the built-in macOS Identity Preference and therefore requires a Custom Settings payload to configure.

Configure an Identity Preference for Google Chrome Additionally, if you are uploading a credential in a Credential payload, admins can configure a Certificate Preference, which creates similar behavior on the end-user’s device.

Click Save and Publish, then click Publish.įigure 1: Adding Identity Preferences for a macOS Credentials Payload for SafariĪs mentioned previously, Workspace ONE UEM supports identity preferences for a Defined CA in either a Credentials or a SCEP payload.

Enter a URL in the Identity Preference section (and optionally click Add to add up to 14 more preference URLs).

Select the check box to allow access to all applications.

Select the Defined Certificate Authority as the credential source and choose the appropriate Certificate Authority and Request Template.

Click the Credentials payload and click Configure.

Enter a Name for the profile (such as “ Safari Identity Preference“) and choose an assignment group consisting of your testing/validation devices.

In the Workspace ONE UEM console, click Add > Profile > macOS > User Profile.

To configure the identity preference in Workspace ONE UEM, perform the following: Identity Preferences (and Certificate Preferences) apply to Safari and Webkit-based applications on macOS. Configure an Identity Preference for Safari

Workspace ONE UEM version 2005 and later (specific to the new Identity Preference payload keys).Įxpand the drop-down menus to view details for each step.

VMware Workspace ONE Access (formerly VMware Identity Manager) authentication method “Certificate (Cloud)” configured to trust certificates issued by the CA’s root certificate authority.

An admin has a certificate authority and template configured for Workspace ONE UEM (or an SCEP endpoint whereby a user can request a certificate).Similar to the previous blog post, a few prerequisites are required to make this work: Additionally, the certificate details (subject alternative name or common name) might not readily provide an end-user enough information to choose the correct authentication certificate for a site if they have multiple certificates installed. Think of it as the certificate equivalent of “autofill.” Without identity (or certificate) preferences managed via UEM, users must manually create an identity preference via the Keychain Access app or the security command in Terminal.

This convenient feature eliminates Safari’s pop-up certificate selection when authenticating to a website. What are Identity Preferences?Ī slight oversight on my part as the previous blog didn’t cover this! Identity Preferences (and their close cousin, Certificate Preferences) are a feature of the macOS keychain where a user can choose a specific certificate as their identity for a URL. Now with Workspace ONE UEM version 2005, Identity Preferences (and Certificate Preferences) are a built-in payload for macOS user profiles that can help you manage user certificates on macOS version 10.12 and later. The lack of native support forced admins to do some careful crafting with a custom settings payload to facilitate easier SSO for their end-users. At the time, VMware Workspace ONE UEM did not natively support the identity preference payload for credentials. I previously wrote about managing identity preferences to streamline single sign-on in macOS.

Configure safari preferences for all users on mac