Certificate-Based Authentication for Managed Devices via Iru Blueprints

Yes, SecureW2 allows full customization of attribute mapping with Iru. You can include standard attributes (such as department, title, groups) and custom attributes through the SecureW2 platform.

In JoinNow, generate an ACME API Token with the vendor set to Iru. This creates a .mobileconfig profile. Add the profile as a configuration payload to the target Iru Blueprint. Iru will push it to all devices in the Blueprint's device assignment the next time those devices check in. For Dynamic SCEP, configure SecureW2 as the External CA in Iru's certificate settings, and add the SCEP profile to the Blueprint the same way. No changes to existing Blueprint assignments are required, other than adding the new profile payload.

Use ACME if your fleet primarily consists of Apple devices running iOS 16+, iPadOS 16+, macOS, or tvOS. ACME integrates with Apple Managed Device Attestation to cryptographically verify that the device is genuine Apple hardware before issuing a certificate it is the stronger option and the one Apple recommends for MDM-managed device certificate enrollment. Use Dynamic SCEP for older OS versions that do not support ACME, or if your Iru environment manages a mix of device types, not all of which support the ACME protocol. Both paths eliminate the static shared secret vulnerability present in traditional SCEP.

SecureW2 requires an Iru API token with read-only access to device records and compliance data. No write access is required. Enter the token in JoinNow when configuring the Iru Identity Lookup Provider. The token is used at certificate issuance to verify that the requesting device is enrolled in Iru, and at RADIUS authentication if you configure the Iru IDP for runtime compliance lookups. Instructions for generating an Iru API token are available in the Iru admin portal under Settings > Access.

SecureW2 addresses this through two mechanisms. First, the Iru Identity Lookup Provider can be configured to run during RADIUS authentication. If the device's compliance state in Iru has changed since the certificate was issued, Cloud RADIUS detects this during the authentication lookup and applies the matching policy, either denying access or placing the device in a restricted VLAN. Second, the auto-revocation workflow runs on a schedule and revokes certificates for devices flagged as non-compliant in Iru, so the next authentication attempt will fail CRL validation regardless of the runtime lookup result. In both cases, the device loses access without any manual action by an administrator.

The Iru integration is designed for Iru-managed devices. Unmanaged or personally owned devices not enrolled in Iru will not pass the Iru identity validation step and will not receive a certificate via this enrollment path. For BYOD devices outside Iru management, SecureW2's JoinNow MultiOS self-service onboarding enables user-initiated certificate enrollment on Windows, macOS, Android, iOS, ChromeOS, and Linux without MDM enrollment. The two paths can coexist: managed devices enroll through Iru Blueprints; unmanaged devices enroll through the JoinNow self-service portal.

Certificate renewal follows the same ACME or Dynamic SCEP enrollment flow used for initial issuance. JoinNow can be configured to issue new certificates before expiration via automatic renewal policies. For ACME, the device re-runs attestation during renewal, refreshing the hardware identity check with each new certificate. For Dynamic SCEP, the device re-enrolls using the Iru External CA configuration. In both cases, renewal is transparent to the end user, and no user interaction or Blueprint changes are required.