From 2fb5aa629d64d1ba68f8a074a50ee8af390736ce Mon Sep 17 00:00:00 2001 From: Martin Angers Date: Thu, 23 Mar 2023 06:30:28 -0400 Subject: [PATCH] Normalize the naming of mdm settings, update docs and document missing ones (#10681) #10408 --- changes/issue-10408-document-mdm-settings | 1 + cmd/fleet/serve.go | 10 +- cmd/fleetctl/get_test.go | 2 +- docs/Deploying/Configuration.md | 52 ++++++-- ee/server/service/mdm.go | 2 +- ee/server/service/teams.go | 4 +- server/config/config.go | 153 +++++++--------------- server/service/appconfig.go | 2 +- server/service/apple_mdm.go | 4 +- server/service/apple_mdm_test.go | 2 +- server/service/devices.go | 2 +- server/service/handler.go | 18 +-- server/service/handler_test.go | 2 +- server/service/integration_mdm_test.go | 4 +- server/service/testing_utils.go | 2 +- 15 files changed, 117 insertions(+), 143 deletions(-) create mode 100644 changes/issue-10408-document-mdm-settings diff --git a/changes/issue-10408-document-mdm-settings b/changes/issue-10408-document-mdm-settings new file mode 100644 index 0000000000..0217bc9b7e --- /dev/null +++ b/changes/issue-10408-document-mdm-settings @@ -0,0 +1 @@ +* Updated MDM settings so that they are consistent, and updated documentation for clarity, completeness and correctness. diff --git a/cmd/fleet/serve.go b/cmd/fleet/serve.go index 9102ea780d..3eb1530bb6 100644 --- a/cmd/fleet/serve.go +++ b/cmd/fleet/serve.go @@ -522,7 +522,7 @@ the way that the Fleet server works. } } - if config.MDMApple.Enable { + if config.MDM.AppleEnable { if !config.MDM.IsAppleAPNsSet() || !config.MDM.IsAppleSCEPSet() { initFatal(errors.New("Apple APNs and SCEP configuration must be provided to enable MDM"), "validate Apple MDM") } @@ -670,11 +670,11 @@ the way that the Fleet server works. initFatal(err, "failed to register integrations schedule") } - if config.MDMApple.Enable { + if config.MDM.AppleEnable { if license.IsPremium() && config.MDM.IsAppleBMSet() { if err := cronSchedules.StartCronSchedule(func() (fleet.CronSchedule, error) { - return newAppleMDMDEPProfileAssigner(ctx, instanceID, config.MDMApple.DEP.SyncPeriodicity, ds, depStorage, logger, config.Logging.Debug) + return newAppleMDMDEPProfileAssigner(ctx, instanceID, config.MDM.AppleDEPSyncPeriodicity, ds, depStorage, logger, config.Logging.Debug) }); err != nil { initFatal(err, "failed to register apple_mdm_dep_profile_assigner schedule") } @@ -795,10 +795,10 @@ the way that the Fleet server works. rootMux.Handle("/version", service.PrometheusMetricsHandler("version", version.Handler())) rootMux.Handle("/assets/", service.PrometheusMetricsHandler("static_assets", service.ServeStaticAssets("/assets/"))) - if config.MDMApple.Enable { + if config.MDM.AppleEnable { if err := service.RegisterAppleMDMProtocolServices( rootMux, - config.MDMApple.SCEP, + config.MDM, mdmStorage, scepStorage, logger, diff --git a/cmd/fleetctl/get_test.go b/cmd/fleetctl/get_test.go index b9a5e26f17..e6305b4a6e 100644 --- a/cmd/fleetctl/get_test.go +++ b/cmd/fleetctl/get_test.go @@ -1229,7 +1229,7 @@ func TestGetCarveWithError(t *testing.T) { // via the `apply` command. func TestGetTeamsYAMLAndApply(t *testing.T) { cfg := config.TestConfig() - cfg.MDMApple.Enable = true + cfg.MDM.AppleEnable = true _, ds := runServerWithMockedDS(t, &service.TestServerOpts{ License: &fleet.LicenseInfo{Tier: fleet.TierPremium, Expiration: time.Now().Add(24 * time.Hour)}, FleetConfig: &cfg, diff --git a/docs/Deploying/Configuration.md b/docs/Deploying/Configuration.md index ff7a06cbdc..cd117cb0b7 100644 --- a/docs/Deploying/Configuration.md +++ b/docs/Deploying/Configuration.md @@ -2584,16 +2584,16 @@ packaging: > MDM features require some endpoints to be publicly accessible outside your VPN or intranet, for more details see [What API endpoints should I expose to the public internet?](./FAQ.md#what-api-endpoints-should-i-expose-to-the-public-internet) -##### mdm_apple.enable +##### mdm.apple_enable -This is the second feature flag required to turn on MDM features. This feature flag must be set to `1` at the same time as when you set the certificate and keys for Apple Push Certificate server (APNs) and Apple Business Manager (ABM). Otherwise, the Fleet server won't start. +This is the second feature flag required to turn on MDM features. This environment variable flag must be set to `1` (or `true` in the `yaml`) at the same time as when you set the certificate and keys for Apple Push Certificate server (APNs) and Apple Business Manager (ABM). Otherwise, the Fleet server won't start. - Default value: "" - Environment variable: `FLEET_MDM_APPLE_ENABLE` - Config file format: ``` - mdm_apple: - enable: 1 + mdm: + apple_enable: true ``` ##### mdm.apple_apns_cert @@ -2704,7 +2704,7 @@ The content of the PEM-encoded private key for the Simple Certificate Enrollment -----END RSA PRIVATE KEY----- ``` -##### mdm_apple.scep.challenge +##### mdm.apple_scep_challenge An alphanumeric secret for the Simple Certificate Enrollment Protocol (SCEP). Should be 32 characters in length and only include alphanumeric characters. @@ -2712,9 +2712,32 @@ An alphanumeric secret for the Simple Certificate Enrollment Protocol (SCEP). Sh - Environment variable: `FLEET_MDM_APPLE_SCEP_CHALLENGE` - Config file format: ``` - mdm_apple: - scep: - challenge: scepchallenge + mdm: + apple_scep_challenge: scepchallenge + ``` + +##### mdm.apple_scep_signer_validity_days + +The number of days the signed SCEP client certificates will be valid. + +- Default value: 365 +- Environment variable: `FLEET_MDM_APPLE_SCEP_SIGNER_VALIDITY_DAYS` +- Config file format: + ``` + mdm: + apple_scep_signer_validity_days: 100 + ``` + +##### mdm.apple_scep_signer_allow_renewal_days + +The number of days allowed to renew SCEP certificates. + +- Default value: 14 +- Environment variable: `FLEET_MDM_APPLE_SCEP_SIGNER_ALLOW_RENEWAL_DAYS` +- Config file format: + ``` + mdm: + apple_scep_signer_allow_renewal_days: 30 ``` ##### mdm.apple_bm_server_token @@ -2846,15 +2869,28 @@ An URL containing a PDF file that will be used as an EULA during DEP onboarding. eula_url: https://example.com/eula.pdf ``` +##### mdm.apple_dep_sync_periodicity + +The duration between DEP device syncing (fetching and setting of DEP profiles). Only relevant if Apple Business Manager (ABM) is configured. + +- Default value: 1m +- Environment variable: `FLEET_MDM_APPLE_DEP_SYNC_PERIODICITY` +- Config file format: + ``` + mdm: + apple_dep_sync_periodicity: 10m + ``` ##### Example YAML ```yaml mdm: + apple_enable: true apple_apns_cert: /path/to/apns_cert apple_apns_key: /path/to/apns_key apple_scep_cert: /path/to/scep_cert apple_scep_key: /path/to/scep_key + apple_scep_challenge: scepchallenge apple_bm_server_token: /path/to/server_token.p7m apple_bm_cert: /path/to/bm_cert apple_bm_key: /path/to/private_key diff --git a/ee/server/service/mdm.go b/ee/server/service/mdm.go index 5b015cbf85..3314c4a021 100644 --- a/ee/server/service/mdm.go +++ b/ee/server/service/mdm.go @@ -188,7 +188,7 @@ func (svc *Service) MDMAppleOktaLogin(ctx context.Context, username, password st return apple_mdm.GenerateEnrollmentProfileMobileconfig( appConfig.OrgInfo.OrgName, appConfig.ServerSettings.ServerURL+"?"+query.Encode(), - svc.config.MDMApple.SCEP.Challenge, + svc.config.MDM.AppleSCEPChallenge, svc.mdmPushCertTopic, ) } diff --git a/ee/server/service/teams.go b/ee/server/service/teams.go index ca22deb094..0c2630512c 100644 --- a/ee/server/service/teams.go +++ b/ee/server/service/teams.go @@ -115,7 +115,7 @@ func (svc *Service) ModifyTeam(ctx context.Context, teamID uint, payload fleet.T } if payload.MDM.MacOSSettings != nil { - if !svc.config.MDMApple.Enable && payload.MDM.MacOSSettings.EnableDiskEncryption { + if !svc.config.MDM.AppleEnable && payload.MDM.MacOSSettings.EnableDiskEncryption { return nil, fleet.NewInvalidArgumentError("macos_settings.enable_disk_encryption", `Couldn't update macos_settings because MDM features aren't turned on in Fleet. Use fleetctl generate mdm-apple and then fleet serve with mdm configuration to turn on MDM features.`) } @@ -737,7 +737,7 @@ func (svc *Service) applyTeamMacOSSettings(ctx context.Context, spec *fleet.Team if !setFields["custom_settings"] { field = "enable_disk_encryption" } - if !svc.config.MDMApple.Enable { + if !svc.config.MDM.AppleEnable { // TODO(mna): eventually we should detect the minimum config required for // this to be allowed, probably just SCEP/APNs? return ctxerr.Wrap(ctx, fleet.NewInvalidArgumentError(fmt.Sprintf("macos_settings.%s", field), diff --git a/server/config/config.go b/server/config/config.go index cf24b66fa9..3227d529ab 100644 --- a/server/config/config.go +++ b/server/config/config.go @@ -369,40 +369,6 @@ type PackagingConfig struct { S3 S3Config `yaml:"s3"` } -// MDMAppleConfig holds all the configuration for Apple MDM. -type MDMAppleConfig struct { - // Enable enables MDM functionality on Fleet. - Enable bool `yaml:"enable"` - - // SCEP holds the SCEP protocol and server configuration. - SCEP MDMAppleSCEPConfig `yaml:"scep"` - // DEP holds the MDM DEP configuration. - DEP MDMAppleDEP `yaml:"dep"` -} - -// MDMAppleDEP holds the Apple DEP (Device Enrollment Program) configuration. -type MDMAppleDEP struct { - // SyncPeriodicity is the duration between DEP device syncing (fetching and setting - // of DEP profiles). - SyncPeriodicity time.Duration `yaml:"sync_periodicity"` -} - -// MDMAppleSCEPConfig holds SCEP protocol and server configuration. -type MDMAppleSCEPConfig struct { - // Signer holds the SCEP signer configuration. - Signer SCEPSignerConfig `yaml:"signer"` - // Challenge is the SCEP challenge for SCEP enrollment requests. - Challenge string `yaml:"challenge"` -} - -// SCEPSignerConfig holds the SCEP signer configuration. -type SCEPSignerConfig struct { - // ValidityDays are the days signed client certificates will be valid. - ValidityDays int `yaml:"validity_days"` - // AllowRenewalDays are the allowable renewal days for certificates. - AllowRenewalDays int `yaml:"allow_renewal_days"` -} - // FleetConfig stores the application configuration. Each subcategory is // broken up into it's own struct, defined above. When editing any of these // structs, Manager.addConfigs and Manager.LoadConfig should be @@ -433,7 +399,6 @@ type FleetConfig struct { Prometheus PrometheusConfig Packaging PackagingConfig MDM MDMConfig - MDMApple MDMAppleConfig `yaml:"mdm_apple"` } type MDMConfig struct { @@ -471,6 +436,20 @@ type MDMConfig struct { OktaClientSecret string `yaml:"okta_client_secret"` OktaServerURL string `yaml:"okta_server_url"` EndUserAgreementURL string `yaml:"eula_url"` + + // AppleEnable enables Apple MDM functionality on Fleet. + AppleEnable bool `yaml:"apple_enable"` + // AppleDEPSyncPeriodicity is the duration between DEP device syncing + // (fetching and setting of DEP profiles). + AppleDEPSyncPeriodicity time.Duration `yaml:"apple_dep_sync_periodicity"` + // AppleSCEPChallenge is the SCEP challenge for SCEP enrollment requests. + AppleSCEPChallenge string `yaml:"apple_scep_challenge"` + // AppleSCEPSignerValidityDays are the days signed client certificates will + // be valid. + AppleSCEPSignerValidityDays int `yaml:"apple_scep_signer_validity_days"` + // AppleSCEPSignerAllowRenewalDays are the allowable renewal days for + // certificates. + AppleSCEPSignerAllowRenewalDays int `yaml:"apple_scep_signer_allow_renewal_days"` } type x509KeyPairConfig struct { @@ -1019,13 +998,6 @@ func (man Manager) addConfigs() { man.addConfigBool("packaging.s3.disable_ssl", false, "Disable SSL (typically for local testing)") man.addConfigBool("packaging.s3.force_s3_path_style", false, "Set this to true to force path-style addressing, i.e., `http://s3.amazonaws.com/BUCKET/KEY`") - // MDM Apple config (prototype) - man.addConfigBool("mdm_apple.enable", false, "Enable MDM Apple functionality") - man.addConfigInt("mdm_apple.scep.signer.validity_days", 365, "Days signed client certificates will be valid") - man.addConfigInt("mdm_apple.scep.signer.allow_renewal_days", 14, "Allowable renewal days for client certificates") - man.addConfigString("mdm_apple.scep.challenge", "", "SCEP static challenge for enrollment") - man.addConfigDuration("mdm_apple.dep.sync_periodicity", 1*time.Minute, "How much time to wait for DEP profile assignment") - // MDM config man.addConfigString("mdm.apple_apns_cert", "", "Apple APNs PEM-encoded certificate path") man.addConfigString("mdm.apple_apns_cert_bytes", "", "Apple APNs PEM-encoded certificate bytes") @@ -1045,33 +1017,11 @@ func (man Manager) addConfigs() { man.addConfigString("mdm.okta_client_secret", "", "Private client secret of the Okta application") man.addConfigString("mdm.okta_server_url", "The Okta server URL, eg: https://my-subdomain.okta.com", "") man.addConfigString("mdm.eula_url", "", "A link to a PDF document containing an EULA document") - - // Hide the official MDM flags as we don't want it to be discoverable for users for now - mdmFlags := []string{ - "mdm.apple_apns_cert", - "mdm.apple_apns_cert_bytes", - "mdm.apple_apns_key", - "mdm.apple_apns_key_bytes", - "mdm.apple_scep_cert", - "mdm.apple_scep_cert_bytes", - "mdm.apple_scep_key", - "mdm.apple_scep_key_bytes", - "mdm.apple_bm_server_token", - "mdm.apple_bm_server_token_bytes", - "mdm.apple_bm_cert", - "mdm.apple_bm_cert_bytes", - "mdm.apple_bm_key", - "mdm.apple_bm_key_bytes", - "mdm.okta_client_id", - "mdm.okta_client_secret", - "mdm.okta_server_url", - "mdm.eula_url", - } - for _, mdmFlag := range mdmFlags { - if flag := man.command.PersistentFlags().Lookup(flagNameFromConfigKey(mdmFlag)); flag != nil { - flag.Hidden = true - } - } + man.addConfigBool("mdm.apple_enable", false, "Enable MDM Apple functionality") + man.addConfigInt("mdm.apple_scep_signer_validity_days", 365, "Days signed client certificates will be valid") + man.addConfigInt("mdm.apple_scep_signer_allow_renewal_days", 14, "Allowable renewal days for client certificates") + man.addConfigString("mdm.apple_scep_challenge", "", "SCEP static challenge for enrollment") + man.addConfigDuration("mdm.apple_dep_sync_periodicity", 1*time.Minute, "How much time to wait for DEP profile assignment") } // LoadConfig will load the config variables into a fully initialized @@ -1299,38 +1249,30 @@ func (man Manager) LoadConfig() FleetConfig { ForceS3PathStyle: man.getConfigBool("packaging.s3.force_s3_path_style"), }, }, - MDMApple: MDMAppleConfig{ - Enable: man.getConfigBool("mdm_apple.enable"), - SCEP: MDMAppleSCEPConfig{ - Signer: SCEPSignerConfig{ - ValidityDays: man.getConfigInt("mdm_apple.scep.signer.validity_days"), - AllowRenewalDays: man.getConfigInt("mdm_apple.scep.signer.allow_renewal_days"), - }, - Challenge: man.getConfigString("mdm_apple.scep.challenge"), - }, - DEP: MDMAppleDEP{ - SyncPeriodicity: man.getConfigDuration("mdm_apple.dep.sync_periodicity"), - }, - }, MDM: MDMConfig{ - AppleAPNsCert: man.getConfigString("mdm.apple_apns_cert"), - AppleAPNsCertBytes: man.getConfigString("mdm.apple_apns_cert_bytes"), - AppleAPNsKey: man.getConfigString("mdm.apple_apns_key"), - AppleAPNsKeyBytes: man.getConfigString("mdm.apple_apns_key_bytes"), - AppleSCEPCert: man.getConfigString("mdm.apple_scep_cert"), - AppleSCEPCertBytes: man.getConfigString("mdm.apple_scep_cert_bytes"), - AppleSCEPKey: man.getConfigString("mdm.apple_scep_key"), - AppleSCEPKeyBytes: man.getConfigString("mdm.apple_scep_key_bytes"), - AppleBMServerToken: man.getConfigString("mdm.apple_bm_server_token"), - AppleBMServerTokenBytes: man.getConfigString("mdm.apple_bm_server_token_bytes"), - AppleBMCert: man.getConfigString("mdm.apple_bm_cert"), - AppleBMCertBytes: man.getConfigString("mdm.apple_bm_cert_bytes"), - AppleBMKey: man.getConfigString("mdm.apple_bm_key"), - AppleBMKeyBytes: man.getConfigString("mdm.apple_bm_key_bytes"), - OktaClientID: man.getConfigString("mdm.okta_client_id"), - OktaClientSecret: man.getConfigString("mdm.okta_client_secret"), - OktaServerURL: man.getConfigString("mdm.okta_server_url"), - EndUserAgreementURL: man.getConfigString("mdm.eula_url"), + AppleAPNsCert: man.getConfigString("mdm.apple_apns_cert"), + AppleAPNsCertBytes: man.getConfigString("mdm.apple_apns_cert_bytes"), + AppleAPNsKey: man.getConfigString("mdm.apple_apns_key"), + AppleAPNsKeyBytes: man.getConfigString("mdm.apple_apns_key_bytes"), + AppleSCEPCert: man.getConfigString("mdm.apple_scep_cert"), + AppleSCEPCertBytes: man.getConfigString("mdm.apple_scep_cert_bytes"), + AppleSCEPKey: man.getConfigString("mdm.apple_scep_key"), + AppleSCEPKeyBytes: man.getConfigString("mdm.apple_scep_key_bytes"), + AppleBMServerToken: man.getConfigString("mdm.apple_bm_server_token"), + AppleBMServerTokenBytes: man.getConfigString("mdm.apple_bm_server_token_bytes"), + AppleBMCert: man.getConfigString("mdm.apple_bm_cert"), + AppleBMCertBytes: man.getConfigString("mdm.apple_bm_cert_bytes"), + AppleBMKey: man.getConfigString("mdm.apple_bm_key"), + AppleBMKeyBytes: man.getConfigString("mdm.apple_bm_key_bytes"), + OktaClientID: man.getConfigString("mdm.okta_client_id"), + OktaClientSecret: man.getConfigString("mdm.okta_client_secret"), + OktaServerURL: man.getConfigString("mdm.okta_server_url"), + EndUserAgreementURL: man.getConfigString("mdm.eula_url"), + AppleEnable: man.getConfigBool("mdm.apple_enable"), + AppleSCEPSignerValidityDays: man.getConfigInt("mdm.apple_scep_signer_validity_days"), + AppleSCEPSignerAllowRenewalDays: man.getConfigInt("mdm.apple_scep_signer_allow_renewal_days"), + AppleSCEPChallenge: man.getConfigString("mdm.apple_scep_challenge"), + AppleDEPSyncPeriodicity: man.getConfigDuration("mdm.apple_dep_sync_periodicity"), }, } @@ -1682,12 +1624,7 @@ func SetTestMDMConfig(t testing.TB, cfg *FleetConfig, cert, key []byte, appleBMT cfg.MDM.appleSCEPPEMCert = cert cfg.MDM.appleSCEPPEMKey = key cfg.MDM.appleBMToken = appleBMToken - cfg.MDMApple.Enable = true - - cfg.MDMApple.SCEP = MDMAppleSCEPConfig{ - Signer: SCEPSignerConfig{ - ValidityDays: 365, - }, - Challenge: "testchallenge", - } + cfg.MDM.AppleEnable = true + cfg.MDM.AppleSCEPSignerValidityDays = 365 + cfg.MDM.AppleSCEPChallenge = "testchallenge" } diff --git a/server/service/appconfig.go b/server/service/appconfig.go index 8ceb7d6560..6ad843be1a 100644 --- a/server/service/appconfig.go +++ b/server/service/appconfig.go @@ -483,7 +483,7 @@ func (svc *Service) validateMDM( invalid.Append("macos_settings.enable_disk_encryption", ErrMissingLicense.Error()) } - if !svc.config.MDMApple.Enable { + if !svc.config.MDM.AppleEnable { // TODO(mna): eventually we should detect the minimum config required for // this to be allowed, probably just SCEP/APNs? diff --git a/server/service/apple_mdm.go b/server/service/apple_mdm.go index 5d210b31a1..5bda04b06b 100644 --- a/server/service/apple_mdm.go +++ b/server/service/apple_mdm.go @@ -1048,7 +1048,7 @@ func (svc *Service) GetMDMAppleEnrollmentProfileByToken(ctx context.Context, tok mobileconfig, err := apple_mdm.GenerateEnrollmentProfileMobileconfig( appConfig.OrgInfo.OrgName, appConfig.ServerSettings.ServerURL, - svc.config.MDMApple.SCEP.Challenge, + svc.config.MDM.AppleSCEPChallenge, svc.mdmPushCertTopic, ) if err != nil { @@ -1424,7 +1424,7 @@ func (svc *Service) BatchSetMDMAppleProfiles(ctx context.Context, tmID *uint, tm return ctxerr.Wrap(ctx, err) } - if !svc.config.MDMApple.Enable { + if !svc.config.MDM.AppleEnable { // NOTE: in order to prevent an error when Fleet MDM is not enabled but no // profile is provided, which can happen if a user runs `fleetctl get // config` and tries to apply that YAML, as it will contain an empty/null diff --git a/server/service/apple_mdm_test.go b/server/service/apple_mdm_test.go index f24f8d028c..b696a299f9 100644 --- a/server/service/apple_mdm_test.go +++ b/server/service/apple_mdm_test.go @@ -36,7 +36,7 @@ import ( func setupAppleMDMService(t *testing.T) (fleet.Service, context.Context, *mock.Store) { ds := new(mock.Store) cfg := config.TestConfig() - cfg.MDMApple.Enable = true + cfg.MDM.AppleEnable = true ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { switch { case strings.Contains(r.URL.Path, "/server/devices"): diff --git a/server/service/devices.go b/server/service/devices.go index 219b690df6..abb6747af6 100644 --- a/server/service/devices.go +++ b/server/service/devices.go @@ -414,7 +414,7 @@ func (svc *Service) GetDeviceMDMAppleEnrollmentProfile(ctx context.Context) ([]b mobileConfig, err := apple_mdm.GenerateEnrollmentProfileMobileconfig( appConfig.OrgInfo.OrgName, appConfig.ServerSettings.ServerURL, - svc.config.MDMApple.SCEP.Challenge, + svc.config.MDM.AppleSCEPChallenge, svc.mdmPushCertTopic, ) if err != nil { diff --git a/server/service/handler.go b/server/service/handler.go index fc8945c428..a4fef7d626 100644 --- a/server/service/handler.go +++ b/server/service/handler.go @@ -431,7 +431,7 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC ue.GET("/api/_version_/fleet/status/live_query", statusLiveQueryEndpoint, nil) // Only Fleet MDM specific endpoints should be within the root /mdm/ path. - if config.MDMApple.Enable { + if config.MDM.AppleEnable { ue.POST("/api/_version_/fleet/mdm/apple/enrollmentprofiles", createMDMAppleEnrollmentProfilesEndpoint, createMDMAppleEnrollmentProfileRequest{}) ue.GET("/api/_version_/fleet/mdm/apple/enrollmentprofiles", listMDMAppleEnrollmentsEndpoint, listMDMAppleEnrollmentProfilesRequest{}) ue.POST("/api/_version_/fleet/mdm/apple/enqueue", enqueueMDMAppleCommandEndpoint, enqueueMDMAppleCommandRequest{}) @@ -495,7 +495,7 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC errorLimiter.Limit("get_device_transparency", desktopQuota), ).GET("/api/_version_/fleet/device/{token}/transparency", transparencyURL, transparencyURLRequest{}) - if config.MDMApple.Enable { + if config.MDM.AppleEnable { // mdm-related endpoints available via device authentication de.WithCustomMiddleware( errorLimiter.Limit("get_device_mdm", desktopQuota), @@ -540,7 +540,7 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC ne.WithAltPaths("/api/v1/osquery/enroll"). POST("/api/osquery/enroll", enrollAgentEndpoint, enrollAgentRequest{}) - if config.MDMApple.Enable { + if config.MDM.AppleEnable { // These endpoint are token authenticated. ne.GET(apple_mdm.EnrollPath, mdmAppleEnrollEndpoint, mdmAppleEnrollRequest{}) ne.GET(apple_mdm.InstallerPath, mdmAppleGetInstallerEndpoint, mdmAppleGetInstallerRequest{}) @@ -588,7 +588,7 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC ne.WithCustomMiddleware(limiter.Limit("login", throttled.RateQuota{MaxRate: loginRateLimit, MaxBurst: 9})). POST("/api/_version_/fleet/demologin", makeDemologinEndpoint(config.Server.URLPrefix), demologinRequest{}) - if config.MDMApple.Enable { + if config.MDM.AppleEnable { ne.WithCustomMiddleware(limiter.Limit("login", throttled.RateQuota{MaxRate: loginRateLimit, MaxBurst: 9})). POST("/api/_version_/fleet/mdm/apple/dep_login", mdmAppleDEPLoginEndpoint, mdmAppleDEPLoginRequest{}) } @@ -693,7 +693,7 @@ func RedirectSetupToLogin(svc fleet.Service, logger kitlog.Logger, next http.Han // the MDM services to Apple devices. func RegisterAppleMDMProtocolServices( mux *http.ServeMux, - scepConfig config.MDMAppleSCEPConfig, + scepConfig config.MDMConfig, mdmStorage nanomdm_storage.AllStorage, scepStorage scep_depot.Depot, logger kitlog.Logger, @@ -716,7 +716,7 @@ func RegisterAppleMDMProtocolServices( // Returns the SCEP CA certificate that can be used by verifiers. func registerSCEP( mux *http.ServeMux, - scepConfig config.MDMAppleSCEPConfig, + scepConfig config.MDMConfig, scepCert *x509.Certificate, scepKey *rsa.PrivateKey, scepStorage scep_depot.Depot, @@ -724,10 +724,10 @@ func registerSCEP( ) error { var signer scepserver.CSRSigner = scep_depot.NewSigner( scepStorage, - scep_depot.WithValidityDays(scepConfig.Signer.ValidityDays), - scep_depot.WithAllowRenewalDays(scepConfig.Signer.AllowRenewalDays), + scep_depot.WithValidityDays(scepConfig.AppleSCEPSignerValidityDays), + scep_depot.WithAllowRenewalDays(scepConfig.AppleSCEPSignerAllowRenewalDays), ) - scepChallenge := scepConfig.Challenge + scepChallenge := scepConfig.AppleSCEPChallenge if scepChallenge == "" { return errors.New("missing SCEP challenge") } diff --git a/server/service/handler_test.go b/server/service/handler_test.go index 9d33e76b76..f90062f34a 100644 --- a/server/service/handler_test.go +++ b/server/service/handler_test.go @@ -26,7 +26,7 @@ func TestAPIRoutesConflicts(t *testing.T) { svc, _ := newTestService(t, ds, nil, nil) limitStore, _ := memstore.New(0) cfg := config.TestConfig() - cfg.MDMApple.Enable = true // ensure we test with optional mdm-specific routes + cfg.MDM.AppleEnable = true // ensure we test with optional mdm-specific routes h := MakeHandler(svc, cfg, kitlog.NewNopLogger(), limitStore) router := h.(*mux.Router) diff --git a/server/service/integration_mdm_test.go b/server/service/integration_mdm_test.go index 2787cc7b35..bc47eca0e0 100644 --- a/server/service/integration_mdm_test.go +++ b/server/service/integration_mdm_test.go @@ -2014,7 +2014,7 @@ func (d *device) scepEnroll() { }, SignatureAlgorithm: x509.SHA256WithRSA, }, - ChallengePassword: d.s.fleetCfg.MDMApple.SCEP.Challenge, + ChallengePassword: d.s.fleetCfg.MDM.AppleSCEPChallenge, } csrDerBytes, err := x509util.CreateCertificateRequest(rand.Reader, &csrTemplate, key) require.NoError(t, err) @@ -2048,7 +2048,7 @@ func (d *device) scepEnroll() { SignerKey: key, SignerCert: cert, CSRReqMessage: &scep.CSRReqMessage{ - ChallengePassword: d.s.fleetCfg.MDMApple.SCEP.Challenge, + ChallengePassword: d.s.fleetCfg.MDM.AppleSCEPChallenge, }, } diff --git a/server/service/testing_utils.go b/server/service/testing_utils.go index 668d212195..1c606b4a93 100644 --- a/server/service/testing_utils.go +++ b/server/service/testing_utils.go @@ -285,7 +285,7 @@ func RunServerForTestsWithDS(t *testing.T, ds fleet.Datastore, opts ...*TestServ if mdmStorage != nil && scepStorage != nil { err := RegisterAppleMDMProtocolServices( rootMux, - cfg.MDMApple.SCEP, + cfg.MDM, mdmStorage, scepStorage, logger,