+ Enroll your device to Fleet
+
+ Follow the instructions below to download and install the Fleet profile
+ on your device.
+
+
+ -
+
+ 1.
+
+ Download the Fleet profile and select Allow in the
+ pop-up.
+
+
+ Download
+
+ -
+
+ 2.
+
+ Navigate to Settings and select Profile Downloaded.
+
+
+
+
![select profile downloaded in settings]()
+
+ -
+
+ 3.
+ Select Install.
+
+
+
![select install]()
+
+
+
+
+
+
diff --git a/server/service/frontend.go b/server/service/frontend.go
index f5d884ec1f..a2a6058b54 100644
--- a/server/service/frontend.go
+++ b/server/service/frontend.go
@@ -1,9 +1,11 @@
package service
import (
+ "fmt"
"html/template"
"io"
"net/http"
+ "net/url"
assetfs "github.com/elazarl/go-bindata-assetfs"
"github.com/fleetdm/fleet/v4/server/bindata"
@@ -68,6 +70,69 @@ func ServeFrontend(urlPrefix string, sandbox bool, logger log.Logger) http.Handl
})
}
+func ServeEndUserEnrollOTA(urlPrefix string, logger log.Logger) http.Handler {
+ herr := func(w http.ResponseWriter, err string) {
+ logger.Log("err", err)
+ http.Error(w, err, http.StatusInternalServerError)
+ }
+
+ return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ writeBrowserSecurityHeaders(w)
+
+ fs := newBinaryFileSystem("/frontend")
+ file, err := fs.Open("templates/enroll-ota.html")
+ if err != nil {
+ herr(w, "load enroll ota template: "+err.Error())
+ return
+ }
+
+ data, err := io.ReadAll(file)
+ if err != nil {
+ herr(w, "read bindata file: "+err.Error())
+ return
+ }
+
+ t, err := template.New("enroll-ota").Parse(string(data))
+ if err != nil {
+ herr(w, "create react template: "+err.Error())
+ return
+ }
+
+ enrollURL, err := generateEnrollOTAURL(urlPrefix, r.URL.Query().Get("enroll_secret"))
+ if err != nil {
+ herr(w, "generate enroll ota url: "+err.Error())
+ return
+ }
+ if err := t.Execute(w, struct {
+ EnrollURL string
+ URLPrefix string
+ }{
+ URLPrefix: urlPrefix,
+ EnrollURL: enrollURL,
+ }); err != nil {
+ herr(w, "execute react template: "+err.Error())
+ return
+ }
+ })
+}
+
+func generateEnrollOTAURL(fleetURL string, enrollSecret string) (string, error) {
+ path, err := url.JoinPath(fleetURL, "/api/v1/fleet/enrollment_profiles/ota")
+ if err != nil {
+ return "", fmt.Errorf("creating path for end user ota enrollment url: %w", err)
+ }
+
+ enrollURL, err := url.Parse(path)
+ if err != nil {
+ return "", fmt.Errorf("parsing end user ota enrollment url: %w", err)
+ }
+
+ q := enrollURL.Query()
+ q.Set("enroll_secret", enrollSecret)
+ enrollURL.RawQuery = q.Encode()
+ return enrollURL.String(), nil
+}
+
func ServeStaticAssets(path string) http.Handler {
return http.StripPrefix(path, http.FileServer(newBinaryFileSystem("/assets")))
}
diff --git a/server/service/frontend_test.go b/server/service/frontend_test.go
index 32363d6dd8..2710b69e9d 100644
--- a/server/service/frontend_test.go
+++ b/server/service/frontend_test.go
@@ -2,6 +2,7 @@ package service
import (
"bytes"
+ "io"
"net/http"
"net/http/httptest"
"os"
@@ -40,3 +41,29 @@ func TestServeFrontend(t *testing.T) {
require.NoError(t, err)
require.Equal(t, http.StatusMethodNotAllowed, response.StatusCode)
}
+
+func TestServeEndUserEnrollOTA(t *testing.T) {
+ if !hasBuildTag("full") {
+ t.Skip("This test requires running with -tags full")
+ }
+ logger := log.NewLogfmtLogger(os.Stdout)
+ h := ServeEndUserEnrollOTA("", logger)
+ ts := httptest.NewServer(h)
+ t.Cleanup(func() {
+ ts.Close()
+ })
+
+ // assert html is returned
+ response, err := http.DefaultClient.Get(ts.URL + "?enroll_secret=foo")
+ require.NoError(t, err)
+ require.Equal(t, http.StatusOK, response.StatusCode)
+ require.Equal(t, response.Header.Get("Content-Type"), "text/html; charset=utf-8")
+
+ // assert it contains the content we expect
+ defer response.Body.Close()
+ bodyBytes, err := io.ReadAll(response.Body)
+ require.NoError(t, err)
+ bodyString := string(bodyBytes)
+ require.Contains(t, bodyString, "Enroll your device to Fleet")
+ require.Contains(t, bodyString, "?enroll_secret=foo")
+}
diff --git a/server/service/handler.go b/server/service/handler.go
index 497fd8955f..23b30a3461 100644
--- a/server/service/handler.go
+++ b/server/service/handler.go
@@ -567,9 +567,6 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC
mdmAppleMW.GET("/api/_version_/fleet/mdm/manual_enrollment_profile", getManualEnrollmentProfileEndpoint, getManualEnrollmentProfileRequest{})
mdmAppleMW.GET("/api/_version_/fleet/enrollment_profiles/manual", getManualEnrollmentProfileEndpoint, getManualEnrollmentProfileRequest{})
- // Get OTA profile
- mdmAppleMW.GET("/api/_version_/fleet/enrollment_profiles/ota", getOTAProfileEndpoint, getOTAProfileRequest{})
-
// bootstrap-package routes
// Deprecated: POST /mdm/bootstrap is now deprecated, replaced by the
@@ -890,6 +887,9 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC
// Deprecated: GET /mdm/apple/setup/eula/:token is now deprecated, replaced by the platform agnostic /mdm/setup/eula/:token
neAppleMDM.GET("/api/_version_/fleet/mdm/apple/setup/eula/{token}", getMDMEULAEndpoint, getMDMEULARequest{})
+ // Get OTA profile
+ neAppleMDM.GET("/api/_version_/fleet/enrollment_profiles/ota", getOTAProfileEndpoint, getOTAProfileRequest{})
+
// These endpoint are used by Microsoft devices during MDM device enrollment phase
neWindowsMDM := ne.WithCustomMiddleware(mdmConfiguredMiddleware.VerifyWindowsMDM())
+