Hi,
In my experience the iOS devices will not automatically switch over to the secure SSID (SSID B).
The users will need to manually change over. As the final step on the Onboard the browser will tell the user that they need to do this.
Also keep in mind you will require a commercial certificate to Onboard the iOS devices.
Not sure if this is relevant or not. And I am not 100% if this necessarily pertains to the ability of the iOS devices to auto connect to the secure SSID after Onboarding. I did however find it interesting and wondered if this partially explains it.
Allow the device to be automatically reconnected to the provisioned network
Automatic reconnect is only possible if there is a single network configured with ‘Automatically join network’,
and the controller provides both the ‘mac’ and ‘switchip’ parameters to the captive portal.
Reconnect is only supported by iOS 5+ and OS X 10.7+ (Lion or later) devices.
This comes from ClearPass Onboard > Provisioning Settings > <Your Profile> > iOS & OSX > Under Reconnect
Cheers