Our solution seems way cleaner than what you suggest. There is very few maintenance with our current setup and any student can connect securely to any AP are port in the campus. Our experience with custom scripts is not very satisfying.