Andrew Mellor
d06a4c222c
**Related issue:** Resolves #47700 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. - [ ] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually. **_Not able to do for all code paths yet_** <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added `token_invalid` for Apple Business Manager tokens, automatically tracked based on Apple responses. * Enhanced host DEP assignment API responses with a structured `dep_device_error` field to classify why device details couldn’t be retrieved. * **Bug Fixes** * Improved error handling for DEP device lookup, distinguishing invalid/rejected tokens, expired terms, not-found devices, server/API errors, and unavailable/unspecified failures. * Added regression and unit test coverage for ABM token invalidation and DEP device error classification. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
NanoDEP
The contents of this directory were copied (on February 2024) from https://github.com/fleetdm/nanomdm (the
apple-mdmbranch) which was forked from https://github.com/micromdm/nanodep. Check UPSTREAM_COMMIT for the commit hash of the original repository the current code in this repository is on.
NanoDEP is a set of tools and a Go library powering them for communicating with Apple's Device Enrollment Program (DEP) API servers.
Getting started & Documentation
-
Quickstart A guide to get NanoDEP up and running quickly.
-
Operations Guide A brief overview of the various tools and utilities for working with NanoDEP.
Tools and utilities
NanoDEP contains a few tools and utilities. At a high level:
- DEP configuration & reverse proxy server. The primary server component, called
depserveris used for configuring NanoDEP and talking with Apple's DEP servers. It hosts its own API for configuring MDM server instances used with Apple's servers (called DEP names) and also hosts a transparently authenticating reverse proxy for talking 'directly' to Apple's DEP API endpoints. - Device sync & assigner. The
depsyncertool handles the device fetch/sync cursor logic to continually retrieve the assigned devices from one or more Apple DEP MDM server instance(s). - Scripts, tools, and helpers.
- A set of tools and utilities for talking to the Apple DEP API services — mostly implemented as shell scripts that communicate to the
depserver. - A stand-alone
deptokenstool for locally working with certificate generation for DEP token decryption.
- A set of tools and utilities for talking to the Apple DEP API services — mostly implemented as shell scripts that communicate to the
See the Operations Guide for more details and usage documentation.
Go library
NanoDEP is also a Go library for accessing the Apple DEP APIs. There are two components to the Go library:
- The higher-level godep package implements Go methods and structures for talking to the individual DEP API endpoints.
- The lower-level client package implements primitives, helpers, and middleware for authenticating to the DEP API and managing sessions tokens.
See the Go Reference documentation (or the Go source itself, of course) for details on these packages.