Skip to main content

Setup

Passpoint onboarding leans on a few privileged iOS capabilities. Turn all of these on before you call connect(), or issuance and install will fail early.

App Attest capability​

App Attest is the only thing Wi-DAS trusts to prove your app is genuine, so it's not optional. Enable it on your app target:

  • Signing & Capabilities → + Capability → App Attest, or add the entitlement directly:
<!-- YourApp.entitlements -->
<key>com.apple.developer.devicecheck.appattest-environment</key>
<string>production</string>
App Attest doesn't work on the Simulator

App Attest runs on real hardware only. On the Simulator, connect() comes back with attestationUnavailable. Test issuance on a device.

Hotspot Configuration entitlement​

Installing a Passpoint profile goes through NEHotspotConfiguration, which needs the Hotspot Configuration entitlement. It's a standard managed entitlement, so there's no special Apple approval to wait on.

  • Signing & Capabilities → + Capability → Hotspot Configuration, or:
<key>com.apple.developer.networking.HotspotConfiguration</key>
<true/>

Shared Keychain access group​

The client certificate and its Secure Enclave key have to sit in a shared Keychain access group so the NetworkExtension can pair them into a SecIdentity. Add a Keychain Sharing group and hand it to the SDK.

The usual group for NetworkExtension sharing is:

<TeamID>.com.apple.networkextensionsharing

Enable Keychain Sharing in Signing & Capabilities, add that group, then pass it when you configure:

let widas = WiDAS(
    clientId: "client-acme",
    keychainAccessGroup: "<TeamID>.com.apple.networkextensionsharing"
)

Pass nil and the SDK uses the app's default access group. Supply your shared group when the client identity needs to be visible to the NetworkExtension.

Register your app with Wi-DAS​

Attestation is checked against your registered identity. Give your Wi-DAS contact your Team ID and your app's bundle ID to register against your clientId. Until that's done, even a real device gets attestationRejected / entitlementMissing.

Checklist​

  • App Attest capability enabled
  • Hotspot Configuration entitlement enabled
  • Keychain Sharing group added and passed as keychainAccessGroup
  • Team ID + bundle ID registered against your clientId
  • Testing on a real device (App Attest is unavailable on the Simulator)

The Entitlements & permissions checklist pulls both platforms together in one place.

Next: Usage.