Skip to main contentSkip to search
Skip to main content

Mac OS & iOS - TTLS + PAP Configuration

Configure Mac and iOS devices to connect to IronWiFi WPA-Enterprise wireless networks using EAP-TTLS with PAP inner authentication. This method is ideal for integrating with external identity providers like Microsoft Entra ID, LDAP directories, and systems that don't support MSCHAPv2.

Overview​

EAP-TTLS (Tunneled Transport Layer Security) with PAP provides a secure authentication method that's particularly useful for:

  • Integration with external identity providers
  • Microsoft Entra ID authentication without password hash sync
  • LDAP directory authentication
  • Systems that don't support MSCHAPv2

Prerequisites​

  • iOS 15+ or macOS 12+
  • Valid user credentials
  • Wireless network configured with WPA2-Enterprise

iOS Configuration​

Manual Setup​

iOS requires a configuration profile for EAP-TTLS - it cannot be configured manually through the Settings app.

Configuration Profile Method​

  1. Create a 
    .mobileconfig
    profile (see template below)
  2. Email the profile to the device, or
  3. Host on a web server and download via Safari
  4. Install the profile in Settings > General > VPN & Device Management

Profile Template​

macOS Configuration​

Using System Settings​

  1. Click the WiFi icon in the menu bar
  2. Select WiFi Settings
  3. Click Advanced (or select your network and click Details)
  4. Click the + button to add a network
  5. Enter the SSID and select WPA2-Enterprise
  6. Click OK
  7. Connect to the network
  8. In the authentication dialog:
    • Mode: TTLS
    • Inner Authentication: PAP
    • Username: Your username
    • Password: Your password

Terminal Configuration (Advanced)​

MDM Deployment​

Microsoft Intune​

  1. Create a Device configuration profile
  2. Platform: iOS/iPadOS or macOS
  3. Profile type: WiFi
  4. Configure:
    • WiFi type: Enterprise
    • EAP type: EAP-TTLS
    • Inner authentication method: PAP
    • Non-EAP method for authentication: Unencrypted password (PAP)
  5. Deploy to device groups

Jamf Pro​

  1. Create a Configuration Profile
  2. Add Network payload
  3. Configure:
    • Security Type: WPA2-Enterprise
    • Protocols: TTLS
    • Inner Authentication: PAP
    • Outer Identity: anonymous (optional)
  4. Scope to appropriate devices

Apple Configurator 2​

  1. File > New Profile
  2. Add WiFi payload
  3. Security Type: WPA2-Enterprise
  4. Protocols: Check TTLS
  5. Inner Authentication: PAP
  6. Export and deploy

Identity Privacy​

EAP-TTLS supports anonymous outer identity:

  • Outer Identity: Sent unencrypted - use 
    anonymous@domain.com
  • Inner Identity: Your real username, protected by TLS tunnel

Configure in profile:

Troubleshooting​

Profile Won't Install​

  1. Check the profile isn't corrupted
  2. Verify XML syntax is valid
  3. Ensure UUIDs are unique
  4. Check device isn't supervised with restrictions

Authentication Fails​

  1. Verify PAP is enabled on IronWiFi
  2. Check username format matches IronWiFi configuration
  3. Review authentication logs in IronWiFi console

Cannot Select TTLS in Settings​

iOS doesn't allow manual TTLS configuration - you must use a profile.

Certificate Trust Required​

If server certificate validation is enabled:

  1. Include the CA certificate in the profile
  2. Or install CA certificate separately
  3. Trust the certificate in Settings

Use Cases​

Microsoft Entra ID Integration​

TTLS + PAP works well with Microsoft Entra ID when:

  • Password hash sync isn't available
  • Using passthrough authentication
  • Federated authentication is configured

External Identity Providers​

Suitable for:

  • Okta
  • Google Workspace
  • Custom LDAP directories
  • SAML-based authentication

Same protocol on other devices

Other protocols on macOS & iOS

Foundational reading

Was this page helpful?