通过Intune在Android上configurationWi-Fi。 缺lessWi-Fi证书问题

Android手机无法从Intune获得正确的WiFiconfiguration策略时遇到问题。 Intune处于“云模式”(非混合)

我在Intune中configuration了以下策略:

  • 部署根CA证书(工作正常)
  • 部署SCEP证书(工作正常)
  • 部署WiFiconfiguration(这是问题所在)

注意事项:

  1. iOS设备的configuration完全相同。 因此,Intune和WiFi的configuration是好的,这似乎是一个configurationAndroid设备WiFi政策的问题。
  2. 我尝试使用PFX证书而不是SCEP,希望能够帮助解决问题。 它没
  3. Android能够从Intune获得SCEP证书,但是它被放置在系统商店中,而不是在WiFi商店中。 因此,Android无法使用证书进行WiFi身份validation

以下博客文章为Intune混合设置提供了解决scheme。 不幸的是,它不能用于基于云的Intune部署。 所以我最终根据博客的信息为Android设备创build了OMA-URIconfiguration(感谢Scott Breen的博客文章)。

重要:在OMA-URIconfiguration中replace下列值

  • Corporate WiFi :应该是您的WiFi SSID名称的名称
  • 1234567890ABCDEF :应该是您的WiFi SSID名称的hex ( hex SSID名称的确切情况)
  • 00 11 22 33 44 55 66 77 88 99 00 AA BB CC DD EE FF 00 11 22 :根CA证书的SHA-1散列

OMA-URIconfiguration

设置名称: Corporate WiFi (将其replace为您的SSID)

datetypes: String

OMA-URI(区分大小写): ./Vendor/MSFT/WiFi/Profile/Corporate WiFi/Settings Corporate WiFi ./Vendor/MSFT/WiFi/Profile/Corporate WiFi/Settings (用您的SSIDreplaceCorporate WiFi

价值:(取代前面提到的价值)

 <?xml version="1.0"?> <WLANProfile xmlns="http://www.microsoft.com/networking/WLAN/profile/v1"> <name>Corporate WiFi</name> <SSIDConfig> <SSID> <hex>1234567890ABCDEF</hex> <name>Corporate WiFi</name> </SSID> </SSIDConfig> <connectionType>ESS</connectionType> <connectionMode>auto</connectionMode> <MSM> <security> <authEncryption> <authentication>WPA2</authentication> <encryption>AES</encryption> <useOneX>true</useOneX> <FIPSMode xmlns="http://www.microsoft.com/networking/WLAN/profile/v2">false</FIPSMode> </authEncryption> <PMKCacheMode>disabled</PMKCacheMode> <preAuthMode>disabled</preAuthMode> <OneX xmlns="http://www.microsoft.com/networking/OneX/v1"> <cacheUserData>false</cacheUserData> <authMode>User</authMode> <EAPConfig> <EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig"> <EapMethod> <Type xmlns="http://www.microsoft.com/provisioning/EapCommon">13</Type> <VendorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorId> <VendorType xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorType> <AuthorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</AuthorId> </EapMethod> <Config xmlns="http://www.microsoft.com/provisioning/EapHostConfig"> <Eap xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1"> <Type>13</Type> <EapType xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV1"> <CredentialsSource> <CertificateStore> <SimpleCertSelection>true</SimpleCertSelection> </CertificateStore> </CredentialsSource> <ServerValidation> <DisableUserPromptForServerValidation>false</DisableUserPromptForServerValidation> <ServerNames></ServerNames> <TrustedRootCA>00 11 22 33 44 55 66 77 88 99 00 AA BB CC DD EE FF 00 11 22 </TrustedRootCA> </ServerValidation> <DifferentUsername>false</DifferentUsername> <PerformServerValidation xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">false</PerformServerValidation> <AcceptServerName xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">false</AcceptServerName> <TLSExtensions xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2"> <FilteringInfo xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV3"> <CAHashList Enabled="true"> <IssuerHash>00 11 22 33 44 55 66 77 88 99 00 AA BB CC DD EE FF 00 11 22 </IssuerHash> </CAHashList> <EKUMapping> <EKUMap> <EKUName>Encrypting File System</EKUName> <EKUOID>1.3.6.1.4.1.311.10.3.4</EKUOID> </EKUMap> <EKUMap> <EKUName>Secure Email</EKUName> <EKUOID>1.3.6.1.5.5.7.3.4</EKUOID> </EKUMap> </EKUMapping> <ClientAuthEKUList Enabled="true"> <EKUMapInList> <EKUName>Encrypting File System</EKUName> </EKUMapInList> <EKUMapInList> <EKUName>Secure Email</EKUName> </EKUMapInList> </ClientAuthEKUList> </FilteringInfo> </TLSExtensions> </EapType> </Eap> </Config> </EapHostConfig> </EAPConfig> </OneX> </security> </MSM> </WLANProfile>