User's Manual

92 | Onboard Dell Networking W-ClearPass Guest 6.4 | User Guide
Figure 15 Sequence Diagram for the W-Onboard Workflow on iOS Platform
1. When a BYOD device first joins the provisioning network it does not have a set of unique device credentials.
This will trigger the captive portal for that device, which brings the user to the mobile device provisioning
page.
2. A link on the mobile device provisioning page prompts the user to install the enterprise’s root certificate.
Installing the enterprise’s root certificate enables the user to establish the authenticity of the provisioning
server during device provisioning.
3. The user then authenticates with their provisioning credentials – these are typically the user’s enterprise
credentials from Active Directory. If the user is authorized to provision a mobile device, the over-the-air
provisioning workflow is then triggered (see Figure 16, below).
4. After provisioning has completed, the device switches to EAP-TLS authentication using the newly
provisioned client certificate. Mutual authentication is performed (the authentication server verifies the
client certificate, and the client verifies the authentication server’s certificate).
5. The device is now onboard and is able to securely access the provisioned network.
Over-the-air provisioning is used to securely provision a device and configure it with network settings. Figure
16 shows a sequence diagram that explains the steps involved in this workflow.
Figure 16 Over-the-Air Provisioning Workflow for iOS Platform