Change Server URL in Profile Manager Enrollment Process?

It appears devices learn the IP or URL of their MDM server during the Profile Manager enrollment process. It must be part of the configuration profile sent to the device. It also appears this is based on the machine's host name. Is there anyway to change that URL - as when the host name of the server changes? If so, where are the files located on the server.
I believe in the previous iPhone Configuration Utility there was a "server URL" and "Check in URL" that could be set. We can't seem to find any parameters in Profile Manger to control the same. Thanks for any help.

Hi Jonathan,
I stumbled on your responses because I was looking for an answer to my own issues.
I am like most just a lay user, although wth 20 years Mac experience.
The issue is as folllows:
I set up Lion Server and I host a Wiki page and I try to run Profile Manager.
I do not have a registered host name. The hostname is server.name.private.
In order to reach the server from the Internet my clients use a DynDNS hostname such as "name.dyndns.org".
My clients can access the Wiki pages with no problems and Safari shows https://name.dyndns.org in the address line.
However, if they want to connect to Profile manager, the server re-directs https://name.dyndns.org/profilemanager https://server.name.private/auth?redirect=https://server.name.private/devicemana gement/api/authentication/callback
which the client's browser cannot resolve because the internal hostname is unknown to public DNS servers.
Why does Profile Manager redirect in the first place ?
Can this issue be resolved without obtaining an "officially registered" hostname ?
Thank you for helping.
Regards,
Twistan

Similar Messages

Can Profile Manager Enroll the Server Itself?

Hi all,
I can successfully enroll clients, but when I try to enroll the server itself, I receive the error message, "Profile installation failed. The profile "Remote Management (com.apple.config.myserver.com.mdm)" could not be installed due to an unexpected error."
I created a seperate local network user account (a different user name) for this purpose and did not use the local admin's account for device enrollment. On the server machine itself, I logged into http://myserver.com/mydevices and used the admin's local network acount to begin enrollment. The trust profile successfully installs first, but enrollment fails.
I would like to group server machines using Profile Manager and I would like to setup a configuration payload is for Software Update.
Many Thanks!

I really doubt you can enroll your server in it's own MDM.
If all you're trying to do is set the software update server, it's a lot easier to just do this...
sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate
CatalogURL http://myserver.com:8088/index.sucatalog

PKCS12 certificate payloads in OS X Server 10.9 Profile Manager

Hi all,
I'm unable to successfully push .p12 packaged certificate identities to devices managed by OS X Server 10.9 Profile Manager. The problem is that while the file is pushed to the device, it doesn't get unpacked and hence is unable to be used.
I've identified the problem as Profile Manager setting the payload type incorrectly to "com.apple.security.pkcs1" in the profile rather than "com.apple.security.pkcs12". If I strip the profile signing data and edit it, the profile works perfectly when manually installed.
So the questions I have:
1) What's the best way of getting Apple's attention for someone to fix this bug, or is this possibly a browser JavaScript issue incorrectly identifying the payload type (using latest Safari though)?
2) Does anyone know of a workaround to allow this to still be automatically pushed out without having to manually edit and install on each device?
(SCEP is out at the moment due to another issue base64 decoding the SCEP request from Mac OS X devices that I'm taking up with the SCEP server vendor - but iOS works fine)
Thanks!
Al

I'm new to OS X Server and Radius, and have just spent way too many hours trying to figure out what I was doing wrong. I could connect to our enterprise wifi perfectly fine when selecting the certificate from the keychain, but I just couldn't get it to work when I uploaded the .p12 file and used it as the WiFi identity. I tried so many combinations of passphrase, no passphrase, pem format, pkcs12 format, resetting Radius server, resetting whole PKI... But I'd always see Certificate: ?Error_-25257? in the Settings window while I was trying to install the profile, and I couldn't see anything useful in the Radius logs when I tried to connect.
But it turns out, all I needed to do was:
sed -i '' -e '1s/pkcs1/pkcs12/;t' -e '1,/pkcs1/s//pkcs12/' wifi_profile.mobileconfig
(changes the first instance of pkcs1 to pkcs12 - don't change both! I was wondering why it was asking me for a password for our public certificate.)
Will try to update and see if that fixes the problem.

Print server, AD, and Profile Manager

Having a number of issues that I can resolve regarding printing--I am trying to set up profiles in the Profile Manager, but printers are not available or visable. However they are visable in the workgroup manager. The printers reside on Windows print server (2008 R2). Further I can add the printers to my server, but they are not visable in the "Printer Sharing" section of "sharing". So with that, I have a few questions:
1. Do I need to turn on Kerberos in CUPS? User's don't authenticate to our printers via Kerberos, but via the Account manager of the individual printers.
2. Why do settings in Workgroup manager not apply? I can add the printers via LDAP the the new groups I have added, but when I open profile manager the changes or printers are not implemented.
3. How do I make printers visible in Profile Manager?
I have scoured the net and several manuals, but I can seem to stumble upon the correct answer.

Hi,
I have the same issue, very frustrating. Using a Win 2003 AD and 10.8.2 server and clients. If i use WGM I can see all users and groups correctly, but Server.app and Profile Manager does not show them correct.
Strange that we see issues like this since Profile Manager has been around for a while, really interested to hear other peoples experiences.
PS I see a similar thing here: https://discussions.apple.com/thread/4417085?start=0&tstart=0

Push config files made in Server app with Profile manager

As I understand the manual you can distribuate configuration files with Profile manager.
A bit confused now when I want to use Profile manager to distribuate a configuration file I´ve made in Server app.
I saved a VPN configuration file and want to distribuate it with Profile manager but how do I import or add that file into the settings pane for my devices in profile manager?

Hi,
I have the same issue, very frustrating. Using a Win 2003 AD and 10.8.2 server and clients. If i use WGM I can see all users and groups correctly, but Server.app and Profile Manager does not show them correct.
Strange that we see issues like this since Profile Manager has been around for a while, really interested to hear other peoples experiences.
PS I see a similar thing here: https://discussions.apple.com/thread/4417085?start=0&tstart=0

Profile Manager Enrollment - iOS - Server Certificate Invalid

I have been getting an error trying to enroll iOS devices into profile manager. My MacBook and iMac enroll just fine. However my iPhone and iPad do not.
When I enroll my MacBook Pro, I first log into https://(FQDN)/mydevices, select profiles, Install Trusted Profile. I then go back to devices, and click 'Enroll now'. When I check the Profiles section of System Preferences, I see that the 'Trusted Profile' has added two certificates refering to my server. I can only assume one matches the Self Signed I generated shortly after making my hostname public, and the other Apple Push generated for me.
However when I do this exact same process on my iPad/iPhone, when I attempt the 'Enroll Now' step, I get the error "The server certificate for "https://(FQDN)/devicesmanagement/api/device/ota_service" is invalid.
My searches for this issue have turned up issues close to this, but never exactly this, and the solutions don't seem to work for me. Here are some key points to note:
1. Tried demoting to standalone, re-promote to OD Master, then deleted all certificates, and regenerated all (including the Push cert from Apple)
2. Ran sudo changeip -checkhostname
3. DNS routes forward and reverse correctly in my local LAN
4. I had been getting "Remote Verification failed: (os/kern) failure" / "TEAVerifyCert() returned NULL" in my logs every 3 seconds until I did the steps listed in '1'
Looking forward to 10.7.1

@hombre7777
Thanks for the info. That makes sence what you are telling me. Their instuctions are kind of bland and dont make sence as much as they should.
The only thing that scares me on this one is now we need to put a device in the dmz....
So now upgrading our xserv to 10.7 when it becomes stable would now be using the magic triangle, and trying to only have 1 to manage osx machines / and now ios devices. Edit our wiki's thats already in place, and have important databases on filemaker is now going to reside in the dmz....
So someone wasn't thinking on this one!!! haha
It looks like we will have to seperate things now, so ios devices are managed on their own machine in the dmz with now a hole leaked in the firewall for AD to authenticate so we can pull users down to associate profiles with them.
Our osx machine will then contain a seperate spot to manage osx devices bound to user accounts, as well as manage filemaker and wiki's that are in use already.
It would be nice if they had figured out a way to do this a little different so we wern't opening holes in the firewall.
The funny thing is I was able to get the ipad to bind and enroll the very first time when i was on a vpn tunnel from my house trying things out.
So I know you can do it, without having to go public, although the push service wasn't working properly and I was not able to bind osx and enroll. So i stared over.
Ill play around to see what I can figure out later. Thanks for the help. If you find out the port numbers please let me know as well! Im not able to move the box to an outside firewall right now. I have to much to do. I can probably do that next week.

Profile manager enrolled device names

I have been playing around with profile manger on 10.7.3 enrolling and iPhone and a couple of iPads.
The iPhone enrolls correctly and the name in the devices tab shows the device name "xxx's iphone" and I can see the information about the device including encryption, apps installed etc.
Both iPads appear to enroll correctly however instead of showing "xxx's iPad" they show the device name of "New Device". I even tried pre-enrolling the device using the serial number and UUID and gave the device a meaningful name, however when then enrolling the device it accepts the enrollment and promptly chnages the name from the meaningful name back to "New Device".
I have tried this on both and iPad 2 and iPAd 3 running the latest IOS.
I also notice that the jobs that communicate with the device to collect the device informantion never complete, where they do for the iPhone.
I am sure this was working before the IOS 5.1 update.

I would try demoting your Open Directory server from Master to Standalone in the Server Admin app - there's an assistant in Server Admin > Open Directory > Settings > General > click the change button.
Once it's demoted to a standalone, restart.
From there, don't create an OD Master again - go to Profile Manager in Server.app and run through the wizard again. In the process, it will create an OD Master for you.
Hope that helps,
Chris

Set or Change Device Name in Profile Manager

Hello,
Is it possible to set or change the device name of an enrolled device using profile manager?
I notice WGMs old 'Set computer name to computer record name' is still there under Login Window options, but I couldn't find away to actually change the record name.
Am I missing something obvious?

The only way I have found to change the device name in Profile Manager is to change it on the device itself, then wait for the updated info to reach PM.
The option to "set the computer name to computer record name" will set the computer name to the name of a computer record that matches in Open Directory (based on MAC). This option would allow you to change the device name in Profile Manager in a round about way... change the computer record name in OD, wait for the change to make it's way to the computer, then back up to the Profile Manager. In my experience, this doesn't take too long.

Can I use OS X Server 4.0 Profile Manager to distribute iOS apps with iOS Developer Enterprise Program (iDEP)?

We are developing an iOS and complementary Mac OS X app for in house use by about 1500 users. I need to manage the devices and distribute the in-house app to these users.
We have an iOS Developer Enterprise Program (iDEP) licence.
Can I combine OSX Server and iDEP to distribute and manage the app? Or do I nee dot move to something like Air Watch?

You should not have to do anything the user/group import should be automatic and you should not have to manually create any accounts and it does onging syncs automatically but I do not know how often.
Once you are install and connect to profile manager all the accounts should show up just by clinking on users or the groups icons and they will work with that. You should not need to mess with them in the actual server application Although I would assume the other services all ink into the OD directory I don't know exactly how services like email, file sharing or VPN work as we have other more full featured better scaling services for that like MS Exchange for email/calendar and Cisco VPN.
We are only using OD, Profile Manager and Software Update.
Just a note I am using Server 3.2 on OS 10.9.5 if you are using Server 4.X your mileage will probably vary slightly as I am not sure what the areas of major change are.

OS X Server 10.7 Profile Manager - Force User Pin

Hi.
My company has hit a show stopper with OS X Server 10.7 and its Profile Manager. We would like to use OS X as a mobile device manager for iOS but we cannot find the option to force a PIN lock and deny the user the ability to remove the PIN lock. The iPhone configuration utility does have this option however. The user cannot remove the PIN without a master password that we define in the iPhone Config Utility.
The omission of this feature seriously undermines the usefulness of the Profile Manager.
Is this a known bug? Can a PIN lock be applied and not removed by the user in the latest OS X server 10.8?
Thanks for your help.
James

I'm new to OS X Server and Radius, and have just spent way too many hours trying to figure out what I was doing wrong. I could connect to our enterprise wifi perfectly fine when selecting the certificate from the keychain, but I just couldn't get it to work when I uploaded the .p12 file and used it as the WiFi identity. I tried so many combinations of passphrase, no passphrase, pem format, pkcs12 format, resetting Radius server, resetting whole PKI... But I'd always see Certificate: ?Error_-25257? in the Settings window while I was trying to install the profile, and I couldn't see anything useful in the Radius logs when I tried to connect.
But it turns out, all I needed to do was:
sed -i '' -e '1s/pkcs1/pkcs12/;t' -e '1,/pkcs1/s//pkcs12/' wifi_profile.mobileconfig
(changes the first instance of pkcs1 to pkcs12 - don't change both! I was wondering why it was asking me for a password for our public certificate.)
Will try to update and see if that fixes the problem.

Server 10.8 Profile Manager error

I hope some one just help me out here:
Last week, shortly after the 2.2 update came out, I installed the update. Unfortunately, doing so made our NetInstall service run very badly. We rolled back the Server.app from a Time Machine backup. That caused out Profile Manager process to not be able to find it's info. I suspect it was updated with the first 2. update and rolling back the server.app confused it. So, we reapplied the update to 2.2. That allowed Profile Manager to work, and we have been living with the poorly working NetImage. Now, we seem to have an error with Profile Mamager not being able to start due to errors. I would like to restore the database from Time machine and perhaps even the postgreSQL and DeviceManager process to get it working, but I can't figure out which folders I need to restore. I've spent the better aprt of the day surfing for answers to a non functional Profile Manager, but nothing works.
What is the proper location for the Profile Manager database ?
How can I tell that postgreSQL is looking in the right place ?
Can I reindex the database to repair it ?

I hope some one just help me out here:
Last week, shortly after the 2.2 update came out, I installed the update. Unfortunately, doing so made our NetInstall service run very badly. We rolled back the Server.app from a Time Machine backup. That caused out Profile Manager process to not be able to find it's info. I suspect it was updated with the first 2. update and rolling back the server.app confused it. So, we reapplied the update to 2.2. That allowed Profile Manager to work, and we have been living with the poorly working NetImage. Now, we seem to have an error with Profile Mamager not being able to start due to errors. I would like to restore the database from Time machine and perhaps even the postgreSQL and DeviceManager process to get it working, but I can't figure out which folders I need to restore. I've spent the better aprt of the day surfing for answers to a non functional Profile Manager, but nothing works.
What is the proper location for the Profile Manager database ?
How can I tell that postgreSQL is looking in the right place ?
Can I reindex the database to repair it ?

Beginner needs help to fix server web, wiki, profile manager

Hi All,
I seem to have messed up my server by changing settings for the hostname.
Now I cant get profile manager, wiki, web to show in Safari anymore.
Can someone please help me with a step by step walkthrough?
Greatly appreciate any help I can get

I have had the same thing and a hostname change is killing for your configuration.
What I suggest is that you backup your stuff and reinstall your server with the correct hostname if possible.

Server 4.1 Profile Manager - Something Went Wrong

Hi,
I just updated my Mac Mini Server from 10.10.2 to 10.10.3, updating to Server 4.1.
It seemed to go okay, but now Profile Manager is messed up. When users try to log in, they get the message:
We're sorry, but something went wrong.
We've been notified about this issue and we'll take a look at it shortly.
(If you're the administrator of this website, then please read the log file "profilemanager.log" to find out what went wrong.)
When I look through the logs I find this:
[2015/04/09 23:15:47.194] F: ActiveRecord::StatementInvalid (PG::Error: ERROR: relation "view_all_user_groups_users_flat" does not exist
[2015/04/09 23:15:47.195] I: Rendering /Applications/Server.app/Contents/ServerRoot/usr/share/devicemgr/backend/public /500.html (500 Internal Server Error)
Any suggestions?
Thanks!
Frederick

mscott_mdm wrote:
Frederick,
Can you look at the /Library/Logs/ProfileManager/migration_tool.log file and paste in the last 50 or so lines?
Thanks for the help!
Here is the entire migration_tool.log file from updating:
[20723] [2015/04/09 17:13:17.136] -[SULogFileCollection setGlobalLogLevelPrefix:]: YES
0:: [20723] [2015/04/09 17:13:17.138]
    migration_tool-886.204 (PID:20723, OS:14D131, SERVER:14S1092, ARCH:x86_64) starting
    LA: migration_tool
0:: [20723] [2015/04/09 17:13:17.203] Waiting for postgres to startup....
0:: [20723] [2015/04/09 17:13:17.624] +[PGConnection reloadPreferences]: DBDebug = NO, DBLogNotices = NO, DBLogSQL = NO, DBMonitor = NO
0:: [20723] [2015/04/09 17:13:19.409] +[PGConnection reloadPreferences]: DBDebug = NO, DBLogNotices = NO, DBLogSQL = NO, DBMonitor = NO
0:: [20723] [2015/04/09 17:13:20.476] Dropping views...
0:: [20723] [2015/04/09 17:13:21.427] Dropping trigger functions...
0:: [20723] [2015/04/09 17:13:22.172] Dropping remaining non-dependent functions...
0:: [20723] [2015/04/09 17:13:23.810] MIGRATE_00885.001 completed successfully
0:: [20723] [2015/04/09 17:13:23.949] MIGRATE_00885.003 completed successfully
0:: [20723] [2015/04/09 17:13:24.566] EXCEPTION: Postgres <-[PGConnection executeCSQL:] (/SourceCache/RemoteDeviceManagement/RemoteDeviceManagement-886.204/Compiled/Fr amework-Models/Postgres/PGConnection.m:339): "Postgres error 2BP01 (ERROR: cannot drop function dm_current_timestamp() because other objects depend on it
    DETAIL: default for table devices column last_update_info_time depends on function dm_current_timestamp()
    HINT: Use DROP ... CASCADE to drop the dependent objects too.
    )">
    USERINFO: {
        SQLSTATE = 2BP01;
        errorMessage = "ERROR: cannot drop function dm_current_timestamp() because other objects depend on it\nDETAIL: default for table devices column last_update_info_time depends on function dm_current_timestamp()\nHINT: Use DROP ... CASCADE to drop the dependent objects too.\n";
0:: [20723] [2015/04/09 17:13:24.566] SQL Module failed at statement:
    DROP FUNCTION dm_current_timestamp();
    -[PGConnection executeCSQL:] (/SourceCache/RemoteDeviceManagement/RemoteDeviceManagement-886.204/Compiled/Fr amework-Models/Postgres/PGConnection.m:339): "Postgres error 2BP01 (ERROR: cannot drop function dm_current_timestamp() because other objects depend on it
    DETAIL: default for table devices column last_update_info_time depends on function dm_current_timestamp()
    HINT: Use DROP ... CASCADE to drop the dependent objects too.
0:: [20723] [2015/04/09 17:13:24.567] Caught unhandled exception -[PGConnection executeCSQL:] (/SourceCache/RemoteDeviceManagement/RemoteDeviceManagement-886.204/Compiled/Fr amework-Models/Postgres/PGConnection.m:339): "Postgres error 2BP01 (ERROR: cannot drop function dm_current_timestamp() because other objects depend on it
    DETAIL: default for table devices column last_update_info_time depends on function dm_current_timestamp()
    HINT: Use DROP ... CASCADE to drop the dependent objects too.
0:: [20723] [2015/04/09 17:13:24.567] Migration failed at MIGRATE_00885.004 (final step is MIGRATE_00886.204)
0:: [20723] [2015/04/09 17:13:24.764] +[PGConnection reloadPreferences]: DBDebug = NO, DBLogNotices = NO, DBLogSQL = NO, DBMonitor = NO
0:: [20723] [2015/04/09 17:13:24.769] ShutdownMigrator: 2015-04-10 00:13:24 +0000
0:: [20723] [2015/04/09 17:13:24.770] BYE
[22210] [2015/04/09 22:45:34.642] -[SULogFileCollection setGlobalLogLevelPrefix:]: YES
0:: [22210] [2015/04/09 22:45:34.657]
    migration_tool-886.204 (PID:22210, OS:14D131, SERVER:14S1092, ARCH:x86_64) starting
    LA: migration_tool
0:: [22210] [2015/04/09 22:45:34.799] +[PGConnection reloadPreferences]: DBDebug = NO, DBLogNotices = NO, DBLogSQL = NO, DBMonitor = NO
0:: [22210] [2015/04/09 22:45:35.010] +[PGConnection reloadPreferences]: DBDebug = NO, DBLogNotices = NO, DBLogSQL = NO, DBMonitor = NO
0:: [22210] [2015/04/09 22:45:35.637] Dropping views...
0:: [22210] [2015/04/09 22:45:35.638] Dropping trigger functions...
0:: [22210] [2015/04/09 22:45:35.683] Dropping remaining non-dependent functions...
0:: [22210] [2015/04/09 22:45:36.515] EXCEPTION: Postgres <-[PGConnection executeCSQL:] (/SourceCache/RemoteDeviceManagement/RemoteDeviceManagement-886.204/Compiled/Fr amework-Models/Postgres/PGConnection.m:339): "Postgres error 2BP01 (ERROR: cannot drop function dm_current_timestamp() because other objects depend on it
    DETAIL: default for table devices column last_update_info_time depends on function dm_current_timestamp()
    HINT: Use DROP ... CASCADE to drop the dependent objects too.
    )">
    USERINFO: {
        SQLSTATE = 2BP01;
        errorMessage = "ERROR: cannot drop function dm_current_timestamp() because other objects depend on it\nDETAIL: default for table devices column last_update_info_time depends on function dm_current_timestamp()\nHINT: Use DROP ... CASCADE to drop the dependent objects too.\n";
0:: [22210] [2015/04/09 22:45:36.548] SQL Module failed at statement:
    DROP FUNCTION dm_current_timestamp();
    -[PGConnection executeCSQL:] (/SourceCache/RemoteDeviceManagement/RemoteDeviceManagement-886.204/Compiled/Fr amework-Models/Postgres/PGConnection.m:339): "Postgres error 2BP01 (ERROR: cannot drop function dm_current_timestamp() because other objects depend on it
    DETAIL: default for table devices column last_update_info_time depends on function dm_current_timestamp()
    HINT: Use DROP ... CASCADE to drop the dependent objects too.
0:: [22210] [2015/04/09 22:45:36.548] Caught unhandled exception -[PGConnection executeCSQL:] (/SourceCache/RemoteDeviceManagement/RemoteDeviceManagement-886.204/Compiled/Fr amework-Models/Postgres/PGConnection.m:339): "Postgres error 2BP01 (ERROR: cannot drop function dm_current_timestamp() because other objects depend on it
    DETAIL: default for table devices column last_update_info_time depends on function dm_current_timestamp()
    HINT: Use DROP ... CASCADE to drop the dependent objects too.
0:: [22210] [2015/04/09 22:45:36.548] Migration failed at MIGRATE_00885.004 (final step is MIGRATE_00886.204)
0:: [22210] [2015/04/09 22:45:36.842] +[PGConnection reloadPreferences]: DBDebug = NO, DBLogNotices = NO, DBLogSQL = NO, DBMonitor = NO
0:: [22210] [2015/04/09 22:45:36.847] ShutdownMigrator: 2015-04-10 05:45:36 +0000
0:: [22210] [2015/04/09 22:45:36.848] BYE

Reg change in the status profile in the process order

Dear all,
By default one status profile ZPI0001 has been assigned to an order type ZP10 in a plant, the requirement is at the time of process order creation we want to change the status profile to ZPI0002 and create . this is applicable for one plant only
Please let me know the settings to be done for that
Thanks in advance
Regards
venkat

HI Venkat,
I am not sure why do you need different status profile at the creation of process order...
First define the status profile ZPI0002 using Tcode BS01/BS02 and assign it to the order type ZP10 using CORN. The same order type is defined to plant using COR4..Here you can only have only one status profile for each order type, however, you can define different custom user status for the status profile..Say ZOCL - Order Completely closed after system status TECO to stop all goods movements...You can't have separate status profile while creating process order and at other stage of process order..Gurus please correct me if I am wrong..
Thanks
Sree...

Is there a way to have separate permissions between Server app and Profile manager?

I'm running OS X 10.10.1 (Yosemite) with Server app 4.0 installed.
I am a System Administrator for a University. I want to give our college techs the ability to manage Profile Manager, but if I grant them Admin rights on the Apple server they will also have access to the Server app, if they have the server app installed on their computer.
Is there a way to limit access to the Server app, but allow certain individuals admin right to Profile Manager?

This provides instructions:
How to use multiple iPods, iPads, or iPhones with one computer

Change Server URL in Profile Manager Enrollment Process?

Similar Messages

Maybe you are looking for