identityReference in NEVPNProtocol not found in keychain with User Enrollment

My current suspicion is that this is related to the separation between the Managed Apple ID resources and the regular Apple ID resources.

The stuff I've seen says that there are separate keychains for the two, and since the cert is on the system under the managed profile, and yet not in the keychains we're allowed access to, this seems likely to be related.

The problem here is that the system should be handling this for us--we're just a lowly Network Extension provider, and know nothing about Apple IDs of any sort...

Has anyone succeeded in running in this configuration? Did you have to do anything special?

Do you have access to the

com.apple.managed.vpn.shared

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

We are also facing the same issue with NEAppProxyProvider despite having access to "com.apple.managed.vpn.shared". It works fine in device enrollment but not is user enrollment due to cert lookup failing. This happens only when the VPN app is pushed as VPP. If we install it manually from AppStore then it works fine.

Hi Quinn. Yes, we have access to that keychain.

Our app works fine with MDMs in general, and can access the distributed certificates for per-App VPN configurations that specify certificate based authentication when the device is enrolled normally.

The problem is specifically with MDMs doing User Enrollment.

I've verified that there are Managed Apple IDs set up on the devices showing the problem.

SecItemCopyMatching() shows no matching items in any keychains, but since one feature of User Enrollment is separate keychains I'm wondering whether SecItemCopyMatching() is searching the right keychain in this case.

I’m posting a link to sanaw’s thread because they seem to be further along with this.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Yes, I was on that thread already. The lack of response was why I opened this thread.

I'm assuming that this means there are no known issues with User Enrollment and certificate-based VPN authentication? Or has anyone been using this successfully in the wild?

Did anyone find a solution for this? We are also having the same issue. I really appreciate any help you can provide.