Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 38 Packages Projects Releases Wiki Activity

Normalize the naming of mdm settings, update docs and document missing ones (#10681)

Browse Source 
#10408
This commit is contained in:
Martin Angers
2023-03-23 07:30:28 -03:00
committed by GitHub
parent 6294190588
commit 2fb5aa629d
15 changed files with 117 additions and 143 deletions
Download Patch File Download Diff File Expand all files Collapse all files
changes/issue-10408-document-mdm-settings
+1
View File
@@ -0,0 +1 @@
* Updated MDM settings so that they are consistent, and updated documentation for clarity, completeness and correctness.
cmd/fleet/serve.go
+5 -5
View File
@@ -522,7 +522,7 @@ the way that the Fleet server works.
}
}
if config.MDMApple.Enable {
if config.MDM.AppleEnable {
if !config.MDM.IsAppleAPNsSet() || !config.MDM.IsAppleSCEPSet() {
initFatal(errors.New("Apple APNs and SCEP configuration must be provided to enable MDM"), "validate Apple MDM")
}
@@ -670,11 +670,11 @@ the way that the Fleet server works.
initFatal(err, "failed to register integrations schedule")
}
if config.MDMApple.Enable {
if config.MDM.AppleEnable {
if license.IsPremium() && config.MDM.IsAppleBMSet() {
if err := cronSchedules.StartCronSchedule(func() (fleet.CronSchedule, error) {
return newAppleMDMDEPProfileAssigner(ctx, instanceID, config.MDMApple.DEP.SyncPeriodicity, ds, depStorage, logger, config.Logging.Debug)
return newAppleMDMDEPProfileAssigner(ctx, instanceID, config.MDM.AppleDEPSyncPeriodicity, ds, depStorage, logger, config.Logging.Debug)
}); err != nil {
initFatal(err, "failed to register apple_mdm_dep_profile_assigner schedule")
}
@@ -795,10 +795,10 @@ the way that the Fleet server works.
rootMux.Handle("/version", service.PrometheusMetricsHandler("version", version.Handler()))
rootMux.Handle("/assets/", service.PrometheusMetricsHandler("static_assets", service.ServeStaticAssets("/assets/")))
if config.MDMApple.Enable {
if config.MDM.AppleEnable {
if err := service.RegisterAppleMDMProtocolServices(
rootMux,
config.MDMApple.SCEP,
config.MDM,
mdmStorage,
scepStorage,
logger,
cmd/fleetctl/get_test.go
+1 -1
View File
@@ -1229,7 +1229,7 @@ func TestGetCarveWithError(t *testing.T) {
// via the `apply` command.
func TestGetTeamsYAMLAndApply(t *testing.T) {
cfg := config.TestConfig()
cfg.MDMApple.Enable = true
cfg.MDM.AppleEnable = true
_, ds := runServerWithMockedDS(t, &service.TestServerOpts{
License: &fleet.LicenseInfo{Tier: fleet.TierPremium, Expiration: time.Now().Add(24 * time.Hour)},
FleetConfig: &cfg,
docs/Deploying/Configuration.md
+44 -8
View File
@@ -2584,16 +2584,16 @@ packaging:
> MDM features require some endpoints to be publicly accessible outside your VPN or intranet, for more details see [What API endpoints should I expose to the public internet?](./FAQ.md#what-api-endpoints-should-i-expose-to-the-public-internet)
##### mdm_apple.enable
##### mdm.apple_enable
This is the second feature flag required to turn on MDM features. This feature flag must be set to `1` at the same time as when you set the certificate and keys for Apple Push Certificate server (APNs) and Apple Business Manager (ABM). Otherwise, the Fleet server won't start.
This is the second feature flag required to turn on MDM features. This environment variable flag must be set to `1` (or `true` in the `yaml`) at the same time as when you set the certificate and keys for Apple Push Certificate server (APNs) and Apple Business Manager (ABM). Otherwise, the Fleet server won't start.
- Default value: ""
- Environment variable: `FLEET_MDM_APPLE_ENABLE`
- Config file format:
```
mdm_apple:
enable: 1
mdm:
apple_enable: true
```
##### mdm.apple_apns_cert
@@ -2704,7 +2704,7 @@ The content of the PEM-encoded private key for the Simple Certificate Enrollment
-----END RSA PRIVATE KEY-----
```
##### mdm_apple.scep.challenge
##### mdm.apple_scep_challenge
An alphanumeric secret for the Simple Certificate Enrollment Protocol (SCEP). Should be 32 characters in length and only include alphanumeric characters.
@@ -2712,9 +2712,32 @@ An alphanumeric secret for the Simple Certificate Enrollment Protocol (SCEP). Sh
- Environment variable: `FLEET_MDM_APPLE_SCEP_CHALLENGE`
- Config file format:
```
mdm_apple:
scep:
challenge: scepchallenge
mdm:
apple_scep_challenge: scepchallenge
```
##### mdm.apple_scep_signer_validity_days
The number of days the signed SCEP client certificates will be valid.
- Default value: 365
- Environment variable: `FLEET_MDM_APPLE_SCEP_SIGNER_VALIDITY_DAYS`
- Config file format:
```
mdm:
apple_scep_signer_validity_days: 100
```
##### mdm.apple_scep_signer_allow_renewal_days
The number of days allowed to renew SCEP certificates.
- Default value: 14
- Environment variable: `FLEET_MDM_APPLE_SCEP_SIGNER_ALLOW_RENEWAL_DAYS`
- Config file format:
```
mdm:
apple_scep_signer_allow_renewal_days: 30
```
##### mdm.apple_bm_server_token
@@ -2846,15 +2869,28 @@ An URL containing a PDF file that will be used as an EULA during DEP onboarding.
eula_url: https://example.com/eula.pdf
```
##### mdm.apple_dep_sync_periodicity
The duration between DEP device syncing (fetching and setting of DEP profiles). Only relevant if Apple Business Manager (ABM) is configured.
- Default value: 1m
- Environment variable: `FLEET_MDM_APPLE_DEP_SYNC_PERIODICITY`
- Config file format:
```
mdm:
apple_dep_sync_periodicity: 10m
```
##### Example YAML
```yaml
mdm:
apple_enable: true
apple_apns_cert: /path/to/apns_cert
apple_apns_key: /path/to/apns_key
apple_scep_cert: /path/to/scep_cert
apple_scep_key: /path/to/scep_key
apple_scep_challenge: scepchallenge
apple_bm_server_token: /path/to/server_token.p7m
apple_bm_cert: /path/to/bm_cert
apple_bm_key: /path/to/private_key
ee/server/service/mdm.go
+1 -1
View File
@@ -188,7 +188,7 @@ func (svc *Service) MDMAppleOktaLogin(ctx context.Context, username, password st
return apple_mdm.GenerateEnrollmentProfileMobileconfig(
appConfig.OrgInfo.OrgName,
appConfig.ServerSettings.ServerURL+"?"+query.Encode(),
svc.config.MDMApple.SCEP.Challenge,
svc.config.MDM.AppleSCEPChallenge,
svc.mdmPushCertTopic,
)
}
ee/server/service/teams.go
+2 -2
View File
@@ -115,7 +115,7 @@ func (svc *Service) ModifyTeam(ctx context.Context, teamID uint, payload fleet.T
}
if payload.MDM.MacOSSettings != nil {
if !svc.config.MDMApple.Enable && payload.MDM.MacOSSettings.EnableDiskEncryption {
if !svc.config.MDM.AppleEnable && payload.MDM.MacOSSettings.EnableDiskEncryption {
return nil, fleet.NewInvalidArgumentError("macos_settings.enable_disk_encryption",
`Couldn't update macos_settings because MDM features aren't turned on in Fleet. Use fleetctl generate mdm-apple and then fleet serve with mdm configuration to turn on MDM features.`)
}
@@ -737,7 +737,7 @@ func (svc *Service) applyTeamMacOSSettings(ctx context.Context, spec *fleet.Team
if !setFields["custom_settings"] {
field = "enable_disk_encryption"
}
if !svc.config.MDMApple.Enable {
if !svc.config.MDM.AppleEnable {
// TODO(mna): eventually we should detect the minimum config required for
// this to be allowed, probably just SCEP/APNs?
return ctxerr.Wrap(ctx, fleet.NewInvalidArgumentError(fmt.Sprintf("macos_settings.%s", field),
server/config/config.go
+45 -108
View File
@@ -369,40 +369,6 @@ type PackagingConfig struct {
S3 S3Config `yaml:"s3"`
}
// MDMAppleConfig holds all the configuration for Apple MDM.
type MDMAppleConfig struct {
// Enable enables MDM functionality on Fleet.
Enable bool `yaml:"enable"`
// SCEP holds the SCEP protocol and server configuration.
SCEP MDMAppleSCEPConfig `yaml:"scep"`
// DEP holds the MDM DEP configuration.
DEP MDMAppleDEP `yaml:"dep"`
}
// MDMAppleDEP holds the Apple DEP (Device Enrollment Program) configuration.
type MDMAppleDEP struct {
// SyncPeriodicity is the duration between DEP device syncing (fetching and setting
// of DEP profiles).
SyncPeriodicity time.Duration `yaml:"sync_periodicity"`
}
// MDMAppleSCEPConfig holds SCEP protocol and server configuration.
type MDMAppleSCEPConfig struct {
// Signer holds the SCEP signer configuration.
Signer SCEPSignerConfig `yaml:"signer"`
// Challenge is the SCEP challenge for SCEP enrollment requests.
Challenge string `yaml:"challenge"`
}
// SCEPSignerConfig holds the SCEP signer configuration.
type SCEPSignerConfig struct {
// ValidityDays are the days signed client certificates will be valid.
ValidityDays int `yaml:"validity_days"`
// AllowRenewalDays are the allowable renewal days for certificates.
AllowRenewalDays int `yaml:"allow_renewal_days"`
}
// FleetConfig stores the application configuration. Each subcategory is
// broken up into it's own struct, defined above. When editing any of these
// structs, Manager.addConfigs and Manager.LoadConfig should be
@@ -433,7 +399,6 @@ type FleetConfig struct {
Prometheus PrometheusConfig
Packaging PackagingConfig
MDM MDMConfig
MDMApple MDMAppleConfig `yaml:"mdm_apple"`
}
type MDMConfig struct {
@@ -471,6 +436,20 @@ type MDMConfig struct {
OktaClientSecret string `yaml:"okta_client_secret"`
OktaServerURL string `yaml:"okta_server_url"`
EndUserAgreementURL string `yaml:"eula_url"`
// AppleEnable enables Apple MDM functionality on Fleet.
AppleEnable bool `yaml:"apple_enable"`
// AppleDEPSyncPeriodicity is the duration between DEP device syncing
// (fetching and setting of DEP profiles).
AppleDEPSyncPeriodicity time.Duration `yaml:"apple_dep_sync_periodicity"`
// AppleSCEPChallenge is the SCEP challenge for SCEP enrollment requests.
AppleSCEPChallenge string `yaml:"apple_scep_challenge"`
// AppleSCEPSignerValidityDays are the days signed client certificates will
// be valid.
AppleSCEPSignerValidityDays int `yaml:"apple_scep_signer_validity_days"`
// AppleSCEPSignerAllowRenewalDays are the allowable renewal days for
// certificates.
AppleSCEPSignerAllowRenewalDays int `yaml:"apple_scep_signer_allow_renewal_days"`
}
type x509KeyPairConfig struct {
@@ -1019,13 +998,6 @@ func (man Manager) addConfigs() {
man.addConfigBool("packaging.s3.disable_ssl", false, "Disable SSL (typically for local testing)")
man.addConfigBool("packaging.s3.force_s3_path_style", false, "Set this to true to force path-style addressing, i.e., `http://s3.amazonaws.com/BUCKET/KEY`")
// MDM Apple config (prototype)
man.addConfigBool("mdm_apple.enable", false, "Enable MDM Apple functionality")
man.addConfigInt("mdm_apple.scep.signer.validity_days", 365, "Days signed client certificates will be valid")
man.addConfigInt("mdm_apple.scep.signer.allow_renewal_days", 14, "Allowable renewal days for client certificates")
man.addConfigString("mdm_apple.scep.challenge", "", "SCEP static challenge for enrollment")
man.addConfigDuration("mdm_apple.dep.sync_periodicity", 1*time.Minute, "How much time to wait for DEP profile assignment")
// MDM config
man.addConfigString("mdm.apple_apns_cert", "", "Apple APNs PEM-encoded certificate path")
man.addConfigString("mdm.apple_apns_cert_bytes", "", "Apple APNs PEM-encoded certificate bytes")
@@ -1045,33 +1017,11 @@ func (man Manager) addConfigs() {
man.addConfigString("mdm.okta_client_secret", "", "Private client secret of the Okta application")
man.addConfigString("mdm.okta_server_url", "The Okta server URL, eg: https://my-subdomain.okta.com", "")
man.addConfigString("mdm.eula_url", "", "A link to a PDF document containing an EULA document")
// Hide the official MDM flags as we don't want it to be discoverable for users for now
mdmFlags := []string{
"mdm.apple_apns_cert",
"mdm.apple_apns_cert_bytes",
"mdm.apple_apns_key",
"mdm.apple_apns_key_bytes",
"mdm.apple_scep_cert",
"mdm.apple_scep_cert_bytes",
"mdm.apple_scep_key",
"mdm.apple_scep_key_bytes",
"mdm.apple_bm_server_token",
"mdm.apple_bm_server_token_bytes",
"mdm.apple_bm_cert",
"mdm.apple_bm_cert_bytes",
"mdm.apple_bm_key",
"mdm.apple_bm_key_bytes",
"mdm.okta_client_id",
"mdm.okta_client_secret",
"mdm.okta_server_url",
"mdm.eula_url",
}
for _, mdmFlag := range mdmFlags {
if flag := man.command.PersistentFlags().Lookup(flagNameFromConfigKey(mdmFlag)); flag != nil {
flag.Hidden = true
}
}
man.addConfigBool("mdm.apple_enable", false, "Enable MDM Apple functionality")
man.addConfigInt("mdm.apple_scep_signer_validity_days", 365, "Days signed client certificates will be valid")
man.addConfigInt("mdm.apple_scep_signer_allow_renewal_days", 14, "Allowable renewal days for client certificates")
man.addConfigString("mdm.apple_scep_challenge", "", "SCEP static challenge for enrollment")
man.addConfigDuration("mdm.apple_dep_sync_periodicity", 1*time.Minute, "How much time to wait for DEP profile assignment")
}
// LoadConfig will load the config variables into a fully initialized
@@ -1299,38 +1249,30 @@ func (man Manager) LoadConfig() FleetConfig {
ForceS3PathStyle: man.getConfigBool("packaging.s3.force_s3_path_style"),
},
},
MDMApple: MDMAppleConfig{
Enable: man.getConfigBool("mdm_apple.enable"),
SCEP: MDMAppleSCEPConfig{
Signer: SCEPSignerConfig{
ValidityDays: man.getConfigInt("mdm_apple.scep.signer.validity_days"),
AllowRenewalDays: man.getConfigInt("mdm_apple.scep.signer.allow_renewal_days"),
},
Challenge: man.getConfigString("mdm_apple.scep.challenge"),
},
DEP: MDMAppleDEP{
SyncPeriodicity: man.getConfigDuration("mdm_apple.dep.sync_periodicity"),
},
},
MDM: MDMConfig{
AppleAPNsCert: man.getConfigString("mdm.apple_apns_cert"),
AppleAPNsCertBytes: man.getConfigString("mdm.apple_apns_cert_bytes"),
AppleAPNsKey: man.getConfigString("mdm.apple_apns_key"),
AppleAPNsKeyBytes: man.getConfigString("mdm.apple_apns_key_bytes"),
AppleSCEPCert: man.getConfigString("mdm.apple_scep_cert"),
AppleSCEPCertBytes: man.getConfigString("mdm.apple_scep_cert_bytes"),
AppleSCEPKey: man.getConfigString("mdm.apple_scep_key"),
AppleSCEPKeyBytes: man.getConfigString("mdm.apple_scep_key_bytes"),
AppleBMServerToken: man.getConfigString("mdm.apple_bm_server_token"),
AppleBMServerTokenBytes: man.getConfigString("mdm.apple_bm_server_token_bytes"),
AppleBMCert: man.getConfigString("mdm.apple_bm_cert"),
AppleBMCertBytes: man.getConfigString("mdm.apple_bm_cert_bytes"),
AppleBMKey: man.getConfigString("mdm.apple_bm_key"),
AppleBMKeyBytes: man.getConfigString("mdm.apple_bm_key_bytes"),
OktaClientID: man.getConfigString("mdm.okta_client_id"),
OktaClientSecret: man.getConfigString("mdm.okta_client_secret"),
OktaServerURL: man.getConfigString("mdm.okta_server_url"),
EndUserAgreementURL: man.getConfigString("mdm.eula_url"),
AppleAPNsCert: man.getConfigString("mdm.apple_apns_cert"),
AppleAPNsCertBytes: man.getConfigString("mdm.apple_apns_cert_bytes"),
AppleAPNsKey: man.getConfigString("mdm.apple_apns_key"),
AppleAPNsKeyBytes: man.getConfigString("mdm.apple_apns_key_bytes"),
AppleSCEPCert: man.getConfigString("mdm.apple_scep_cert"),
AppleSCEPCertBytes: man.getConfigString("mdm.apple_scep_cert_bytes"),
AppleSCEPKey: man.getConfigString("mdm.apple_scep_key"),
AppleSCEPKeyBytes: man.getConfigString("mdm.apple_scep_key_bytes"),
AppleBMServerToken: man.getConfigString("mdm.apple_bm_server_token"),
AppleBMServerTokenBytes: man.getConfigString("mdm.apple_bm_server_token_bytes"),
AppleBMCert: man.getConfigString("mdm.apple_bm_cert"),
AppleBMCertBytes: man.getConfigString("mdm.apple_bm_cert_bytes"),
AppleBMKey: man.getConfigString("mdm.apple_bm_key"),
AppleBMKeyBytes: man.getConfigString("mdm.apple_bm_key_bytes"),
OktaClientID: man.getConfigString("mdm.okta_client_id"),
OktaClientSecret: man.getConfigString("mdm.okta_client_secret"),
OktaServerURL: man.getConfigString("mdm.okta_server_url"),
EndUserAgreementURL: man.getConfigString("mdm.eula_url"),
AppleEnable: man.getConfigBool("mdm.apple_enable"),
AppleSCEPSignerValidityDays: man.getConfigInt("mdm.apple_scep_signer_validity_days"),
AppleSCEPSignerAllowRenewalDays: man.getConfigInt("mdm.apple_scep_signer_allow_renewal_days"),
AppleSCEPChallenge: man.getConfigString("mdm.apple_scep_challenge"),
AppleDEPSyncPeriodicity: man.getConfigDuration("mdm.apple_dep_sync_periodicity"),
},
}
@@ -1682,12 +1624,7 @@ func SetTestMDMConfig(t testing.TB, cfg *FleetConfig, cert, key []byte, appleBMT
cfg.MDM.appleSCEPPEMCert = cert
cfg.MDM.appleSCEPPEMKey = key
cfg.MDM.appleBMToken = appleBMToken
cfg.MDMApple.Enable = true
cfg.MDMApple.SCEP = MDMAppleSCEPConfig{
Signer: SCEPSignerConfig{
ValidityDays: 365,
},
Challenge: "testchallenge",
}
cfg.MDM.AppleEnable = true
cfg.MDM.AppleSCEPSignerValidityDays = 365
cfg.MDM.AppleSCEPChallenge = "testchallenge"
}
server/service/appconfig.go
+1 -1
View File
@@ -483,7 +483,7 @@ func (svc *Service) validateMDM(
invalid.Append("macos_settings.enable_disk_encryption", ErrMissingLicense.Error())
}
if !svc.config.MDMApple.Enable {
if !svc.config.MDM.AppleEnable {
// TODO(mna): eventually we should detect the minimum config required for
// this to be allowed, probably just SCEP/APNs?
server/service/apple_mdm.go
+2 -2
View File
@@ -1048,7 +1048,7 @@ func (svc *Service) GetMDMAppleEnrollmentProfileByToken(ctx context.Context, tok
mobileconfig, err := apple_mdm.GenerateEnrollmentProfileMobileconfig(
appConfig.OrgInfo.OrgName,
appConfig.ServerSettings.ServerURL,
svc.config.MDMApple.SCEP.Challenge,
svc.config.MDM.AppleSCEPChallenge,
svc.mdmPushCertTopic,
)
if err != nil {
@@ -1424,7 +1424,7 @@ func (svc *Service) BatchSetMDMAppleProfiles(ctx context.Context, tmID *uint, tm
return ctxerr.Wrap(ctx, err)
}
if !svc.config.MDMApple.Enable {
if !svc.config.MDM.AppleEnable {
// NOTE: in order to prevent an error when Fleet MDM is not enabled but no
// profile is provided, which can happen if a user runs `fleetctl get
// config` and tries to apply that YAML, as it will contain an empty/null
server/service/apple_mdm_test.go
+1 -1
View File
@@ -36,7 +36,7 @@ import (
func setupAppleMDMService(t *testing.T) (fleet.Service, context.Context, *mock.Store) {
ds := new(mock.Store)
cfg := config.TestConfig()
cfg.MDMApple.Enable = true
cfg.MDM.AppleEnable = true
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
switch {
case strings.Contains(r.URL.Path, "/server/devices"):
server/service/devices.go
+1 -1
View File
@@ -414,7 +414,7 @@ func (svc *Service) GetDeviceMDMAppleEnrollmentProfile(ctx context.Context) ([]b
mobileConfig, err := apple_mdm.GenerateEnrollmentProfileMobileconfig(
appConfig.OrgInfo.OrgName,
appConfig.ServerSettings.ServerURL,
svc.config.MDMApple.SCEP.Challenge,
svc.config.MDM.AppleSCEPChallenge,
svc.mdmPushCertTopic,
)
if err != nil {
server/service/handler.go
+9 -9
View File
@@ -431,7 +431,7 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC
ue.GET("/api/_version_/fleet/status/live_query", statusLiveQueryEndpoint, nil)
// Only Fleet MDM specific endpoints should be within the root /mdm/ path.
if config.MDMApple.Enable {
if config.MDM.AppleEnable {
ue.POST("/api/_version_/fleet/mdm/apple/enrollmentprofiles", createMDMAppleEnrollmentProfilesEndpoint, createMDMAppleEnrollmentProfileRequest{})
ue.GET("/api/_version_/fleet/mdm/apple/enrollmentprofiles", listMDMAppleEnrollmentsEndpoint, listMDMAppleEnrollmentProfilesRequest{})
ue.POST("/api/_version_/fleet/mdm/apple/enqueue", enqueueMDMAppleCommandEndpoint, enqueueMDMAppleCommandRequest{})
@@ -495,7 +495,7 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC
errorLimiter.Limit("get_device_transparency", desktopQuota),
).GET("/api/_version_/fleet/device/{token}/transparency", transparencyURL, transparencyURLRequest{})
if config.MDMApple.Enable {
if config.MDM.AppleEnable {
// mdm-related endpoints available via device authentication
de.WithCustomMiddleware(
errorLimiter.Limit("get_device_mdm", desktopQuota),
@@ -540,7 +540,7 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC
ne.WithAltPaths("/api/v1/osquery/enroll").
POST("/api/osquery/enroll", enrollAgentEndpoint, enrollAgentRequest{})
if config.MDMApple.Enable {
if config.MDM.AppleEnable {
// These endpoint are token authenticated.
ne.GET(apple_mdm.EnrollPath, mdmAppleEnrollEndpoint, mdmAppleEnrollRequest{})
ne.GET(apple_mdm.InstallerPath, mdmAppleGetInstallerEndpoint, mdmAppleGetInstallerRequest{})
@@ -588,7 +588,7 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC
ne.WithCustomMiddleware(limiter.Limit("login", throttled.RateQuota{MaxRate: loginRateLimit, MaxBurst: 9})).
POST("/api/_version_/fleet/demologin", makeDemologinEndpoint(config.Server.URLPrefix), demologinRequest{})
if config.MDMApple.Enable {
if config.MDM.AppleEnable {
ne.WithCustomMiddleware(limiter.Limit("login", throttled.RateQuota{MaxRate: loginRateLimit, MaxBurst: 9})).
POST("/api/_version_/fleet/mdm/apple/dep_login", mdmAppleDEPLoginEndpoint, mdmAppleDEPLoginRequest{})
}
@@ -693,7 +693,7 @@ func RedirectSetupToLogin(svc fleet.Service, logger kitlog.Logger, next http.Han
// the MDM services to Apple devices.
func RegisterAppleMDMProtocolServices(
mux *http.ServeMux,
scepConfig config.MDMAppleSCEPConfig,
scepConfig config.MDMConfig,
mdmStorage nanomdm_storage.AllStorage,
scepStorage scep_depot.Depot,
logger kitlog.Logger,
@@ -716,7 +716,7 @@ func RegisterAppleMDMProtocolServices(
// Returns the SCEP CA certificate that can be used by verifiers.
func registerSCEP(
mux *http.ServeMux,
scepConfig config.MDMAppleSCEPConfig,
scepConfig config.MDMConfig,
scepCert *x509.Certificate,
scepKey *rsa.PrivateKey,
scepStorage scep_depot.Depot,
@@ -724,10 +724,10 @@ func registerSCEP(
) error {
var signer scepserver.CSRSigner = scep_depot.NewSigner(
scepStorage,
scep_depot.WithValidityDays(scepConfig.Signer.ValidityDays),
scep_depot.WithAllowRenewalDays(scepConfig.Signer.AllowRenewalDays),
scep_depot.WithValidityDays(scepConfig.AppleSCEPSignerValidityDays),
scep_depot.WithAllowRenewalDays(scepConfig.AppleSCEPSignerAllowRenewalDays),
)
scepChallenge := scepConfig.Challenge
scepChallenge := scepConfig.AppleSCEPChallenge
if scepChallenge == "" {
return errors.New("missing SCEP challenge")
}
server/service/handler_test.go
+1 -1
View File
@@ -26,7 +26,7 @@ func TestAPIRoutesConflicts(t *testing.T) {
svc, _ := newTestService(t, ds, nil, nil)
limitStore, _ := memstore.New(0)
cfg := config.TestConfig()
cfg.MDMApple.Enable = true // ensure we test with optional mdm-specific routes
cfg.MDM.AppleEnable = true // ensure we test with optional mdm-specific routes
h := MakeHandler(svc, cfg, kitlog.NewNopLogger(), limitStore)
router := h.(*mux.Router)
server/service/integration_mdm_test.go
+2 -2
View File
@@ -2014,7 +2014,7 @@ func (d *device) scepEnroll() {
},
SignatureAlgorithm: x509.SHA256WithRSA,
},
ChallengePassword: d.s.fleetCfg.MDMApple.SCEP.Challenge,
ChallengePassword: d.s.fleetCfg.MDM.AppleSCEPChallenge,
}
csrDerBytes, err := x509util.CreateCertificateRequest(rand.Reader, &csrTemplate, key)
require.NoError(t, err)
@@ -2048,7 +2048,7 @@ func (d *device) scepEnroll() {
SignerKey: key,
SignerCert: cert,
CSRReqMessage: &scep.CSRReqMessage{
ChallengePassword: d.s.fleetCfg.MDMApple.SCEP.Challenge,
ChallengePassword: d.s.fleetCfg.MDM.AppleSCEPChallenge,
},
}
server/service/testing_utils.go
+1 -1
View File
@@ -285,7 +285,7 @@ func RunServerForTestsWithDS(t *testing.T, ds fleet.Datastore, opts ...*TestServ
if mdmStorage != nil && scepStorage != nil {
err := RegisterAppleMDMProtocolServices(
rootMux,
cfg.MDMApple.SCEP,
cfg.MDM,
mdmStorage,
scepStorage,
logger,