IOS – Does iOS 10 Allow Self-Signed Certificates for PEAP

You should be able to do all the configuration by group.

Add all the users into an OD group and then set all the WiFi preferences there. You should also be able to set a certificate for the group and allow the entire group to authenticate against the Radius server.

When it comes to setting up PKI then you enter into the dark realms of Kerberos. (Be very careful with your DNS or you will never return.)

This is a good guide http://yesdevnull.net/2013/10/os-x-mavericks-server-open-directory-master/

Reading everything Charles Edge writes is always worthwhile :- http://krypted.com/guides/mavericks-server/ - he literally wrote the book on Macs in the enterprise.

If you turn on the web server (which I assume you have for the Profile Manager) the front page provides a nice link to change passwords for OD users.

Just nailed this. The non-Internet-connected network (the one I usually access via AirPort) had its router set up incorrectly. I got a way out from the Unix guys here: https://unix.stackexchange.com/a/113622/21486

Basically if you set up a hostapd wireless access point on a Linux machine and you're using DHCP, you need to make sure you don't have an option routers line in your dhcpd.conf. That line will make the router advertise to clients a spurious default gateway which, depending on the alignment of the planets, will blackhole your traffic intended for the other network.