Profile Manager - macOS Proxies - PAC File

Server is macOS Sierra 10.12.3, Server.app version 5.2

Client is macOS Sierra 10.12.3


I'm trying to configure the macOS setting "Automatic Proxy Configuration" with the URL pointing to a PAC file. So in Profile Manager I select the profile for the device group, go to macOS > Proxies > Enable Automatic Proxy Configuration, and enter the URL for the PAC file.


On the client, I can see that those settings are getting pushed to the machine by looking in System Information under Managed Client, but they don't actually apply. Any ideas?


-Jeremy

Mac mini, macOS Sierra (10.12.3), Server app 5.2

Posted on Feb 14, 2017 12:29 PM

Reply
2 replies

Feb 15, 2017 5:34 AM in response to Credible ITOps

I personally prefer using 'Auto Proxy Discovery' rather than 'Automatic Proxy Configuration'. (I should since I personally got Apple to add this feature several years ago. 🙂)


'Auto Proxy Discovery' is Apple's name for Web Proxy Auto-Discovery aka WPAD which is a feature actually invented by Microsoft! With this a client device will check via either DHCP or DNS to try and 'automatically' find the proxy PAC details. With DHCP it uses DHCP option code 252 which will contain the URL, with DNS it will try http://wpad.yourdomain.com/wpad.dat the DHCP option has preference over DNS.


Apple's own DHCP server should be able to provide DHCP option codes like 252, this was another feature I got them to do several years ago. You will have to manually edit the /etc/bootpd.plist file. If you are going to use Apple's DHCP server for this then you might want to see http://jelockwood.blogspot.co.uk/2013/06/dhcp-server-on-os-x-server.html


I am not using Profile Manager to turn on this setting instead I run the following script as part of the initial configuration of a Mac.


#!/bin/bash
i=1
while [ $i -le 10 ]
do
mainInt=$(/usr/sbin/networksetup -listnetworkserviceorder | awk '{if(a-->0){print;next}} /\('$i'\)/{a=1}')
# If type of network interface is Ethernet and therefore not WiFi or other
if [[ $mainInt == *"Ethernet"* ]]
then
  # friendly name used for networksetup command
  friendly=$(/usr/sbin/networksetup -listnetworkserviceorder | awk -F'\\) ' '/\('$i'\)/ {print $2}');
  # get interface id e.g. en0
  device=$(echo "$mainInt" | awk -F': ' '/Ethernet/ {print $3}' | sed 's/.$//');
  # check to see if interface is configured for DHCP or manual configuration
  iptype=$(/usr/sbin/networksetup -getinfo "$friendly" | awk 'NR == 1 || /DHCP/');
  # Check if interface using DHCP configuration, only worth setting auto proxy if DHCP as it used DHCP to learn proxy server setting
  if [[ $iptype == "DHCP Configuration" ]]
  then
  # turn auto-proxy discovery on
  /usr/sbin/networksetup -setproxyautodiscovery "$friendly" on;
  fi
fi
(( i++ ))
done
exit 0

Feb 15, 2017 12:56 PM in response to John Lockwood

Thanks, I have a script already that will accomplish this task but the problem is, there are certain people in my organization who have an exemption for the proxy. So I need to be able to selectively deploy the proxy settings to certain groups.


That brings another question - If a device is in multiple device groups, and you have a different login script in each group, does the machine run both scripts?

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Profile Manager - macOS Proxies - PAC File

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.