From 127955dc748c82d4301f02343280631b1bf167a0 Mon Sep 17 00:00:00 2001 From: Victor Vrantchan Date: Sat, 29 Jun 2019 15:36:13 -0700 Subject: [PATCH] Support User Enrollment (#597) In iOS 10.13/macOS 10.15 a new, BYOD specific enrollment type was added, called User Enrollment. This enrollment type replaces the typical UDID field in checkin and acknowledge requests with a EnrollmentID field which is unique per each enrollment. One important aspect of this enrollment type is that no personally identifiable information is available to the MDM (UDID, SerialNumber). The implementation implemented here adds the new EnrollmentID field where appropriate, and ensures that the device tables do not store the enrollment ID. I will follow up this change set with one that allows listing/removing current enrollment IDs in a similar way that mdmctl get devices and mdmctl get users does. --- CHANGELOG.md | 3 + mdm/acknowledge_event.go | 27 +++-- mdm/checkin.go | 2 + mdm/checkin_event.go | 21 ++-- mdm/internal/checkinproto/checkin.pb.go | 147 +++++++++++++----------- mdm/internal/checkinproto/checkin.proto | 1 + mdm/internal/connectproto/connect.pb.go | 74 ++++++------ mdm/internal/connectproto/connect.proto | 2 +- platform/apns/worker.go | 7 +- platform/device/udidauth.go | 9 ++ platform/device/worker.go | 16 ++- platform/queue/queue.go | 9 +- workflow/webhook/acknowledge.go | 14 ++- workflow/webhook/checkin.go | 14 ++- 14 files changed, 209 insertions(+), 137 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ab84b1e1..0b2d22b2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,6 @@ +## [v1.6.0](https://github.com/micromdm/micromdm/compare/v1.4.0...1.5.0) TBD +* Add support for User Enrollment (#597) + ## [v1.5.0](https://github.com/micromdm/micromdm/compare/v1.4.0...1.5.0) June 15 2019 * Fix DEP token update issue (#513, #510) diff --git a/mdm/acknowledge_event.go b/mdm/acknowledge_event.go index e29ab21a..32115598 100644 --- a/mdm/acknowledge_event.go +++ b/mdm/acknowledge_event.go @@ -16,12 +16,13 @@ type AcknowledgeEvent struct { } type Response struct { - RequestType string `json:"request_type,omitempty" plist:",omitempty"` - UDID string - UserID *string `json:"user_id,omitempty" plist:"UserID,omitempty"` - Status string - CommandUUID string - ErrorChain []ErrorChainItem `json:"error_chain" plist:",omitempty"` + RequestType string `json:"request_type,omitempty" plist:",omitempty"` + UDID string + UserID *string `json:"user_id,omitempty" plist:"UserID,omitempty"` + EnrollmentID *string `json:"enrollment_id,omitempty" plist:"EnrollmentID,omitempty"` + Status string + CommandUUID string + ErrorChain []ErrorChainItem `json:"error_chain" plist:",omitempty"` } type ErrorChainItem struct { @@ -41,6 +42,9 @@ func MarshalAcknowledgeEvent(e *AcknowledgeEvent) ([]byte, error) { if e.Response.UserID != nil { response.UserId = *e.Response.UserID } + if e.Response.EnrollmentID != nil { + response.EnrollmentId = *e.Response.EnrollmentID + } return proto.Marshal(&connectproto.Event{ Id: e.ID, @@ -63,11 +67,12 @@ func UnmarshalAcknowledgeEvent(data []byte, e *AcknowledgeEvent) error { } r := pb.GetResponse() e.Response = Response{ - UDID: r.GetUdid(), - UserID: strPtr(r.GetUserId()), - Status: r.GetStatus(), - RequestType: r.GetRequestType(), - CommandUUID: r.GetCommandUuid(), + UDID: r.GetUdid(), + UserID: strPtr(r.GetUserId()), + EnrollmentID: strPtr(r.GetEnrollmentId()), + Status: r.GetStatus(), + RequestType: r.GetRequestType(), + CommandUUID: r.GetCommandUuid(), } e.Raw = pb.GetRaw() e.Params = pb.GetParams() diff --git a/mdm/checkin.go b/mdm/checkin.go index fc9cc3e8..67a30d98 100644 --- a/mdm/checkin.go +++ b/mdm/checkin.go @@ -11,6 +11,8 @@ import ( ) func (svc *MDMService) Checkin(ctx context.Context, event CheckinEvent) error { + // reject user settings at the loginwindow. + // https://github.com/micromdm/micromdm/pull/379 if event.Command.MessageType == "UserAuthenticate" { return &rejectUserAuth{} } diff --git a/mdm/checkin_event.go b/mdm/checkin_event.go index 6322e7b0..ef7c2dc1 100644 --- a/mdm/checkin_event.go +++ b/mdm/checkin_event.go @@ -21,9 +21,10 @@ type CheckinEvent struct { type CheckinCommand struct { // MessageType can be either Authenticate, // TokenUpdate or CheckOut - MessageType string - Topic string - UDID string + MessageType string + Topic string + UDID string + EnrollmentID string auth update } @@ -71,9 +72,10 @@ func (d hexData) String() string { // MarshalCheckinEvent serializes an event to a protocol buffer wire format. func MarshalCheckinEvent(e *CheckinEvent) ([]byte, error) { command := &checkinproto.Command{ - MessageType: e.Command.MessageType, - Topic: e.Command.Topic, - Udid: e.Command.UDID, + MessageType: e.Command.MessageType, + Topic: e.Command.Topic, + Udid: e.Command.UDID, + EnrollmentId: e.Command.EnrollmentID, } switch e.Command.MessageType { case "Authenticate": @@ -123,9 +125,10 @@ func UnmarshalCheckinEvent(data []byte, e *CheckinEvent) error { return nil } e.Command = CheckinCommand{ - MessageType: pb.Command.MessageType, - Topic: pb.Command.Topic, - UDID: pb.Command.Udid, + MessageType: pb.Command.MessageType, + Topic: pb.Command.Topic, + UDID: pb.Command.Udid, + EnrollmentID: pb.Command.EnrollmentId, } switch pb.Command.MessageType { case "Authenticate": diff --git a/mdm/internal/checkinproto/checkin.pb.go b/mdm/internal/checkinproto/checkin.pb.go index 4273c9b7..5ca61046 100644 --- a/mdm/internal/checkinproto/checkin.pb.go +++ b/mdm/internal/checkinproto/checkin.pb.go @@ -19,11 +19,11 @@ var _ = math.Inf const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package type Event struct { - Id string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"` - Time int64 `protobuf:"varint,2,opt,name=time" json:"time,omitempty"` - Command *Command `protobuf:"bytes,3,opt,name=command" json:"command,omitempty"` + Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` + Time int64 `protobuf:"varint,2,opt,name=time,proto3" json:"time,omitempty"` + Command *Command `protobuf:"bytes,3,opt,name=command,proto3" json:"command,omitempty"` Raw []byte `protobuf:"bytes,4,opt,name=raw,proto3" json:"raw,omitempty"` - Params map[string]string `protobuf:"bytes,5,rep,name=params" json:"params,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` + Params map[string]string `protobuf:"bytes,5,rep,name=params,proto3" json:"params,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` @@ -33,7 +33,7 @@ func (m *Event) Reset() { *m = Event{} } func (m *Event) String() string { return proto.CompactTextString(m) } func (*Event) ProtoMessage() {} func (*Event) Descriptor() ([]byte, []int) { - return fileDescriptor_checkin_7e1d11c144d2ce7a, []int{0} + return fileDescriptor_checkin_f106eb4ffaf2f7e3, []int{0} } func (m *Event) XXX_Unmarshal(b []byte) error { return xxx_messageInfo_Event.Unmarshal(m, b) @@ -89,11 +89,12 @@ func (m *Event) GetParams() map[string]string { } type Command struct { - MessageType string `protobuf:"bytes,1,opt,name=message_type,json=messageType" json:"message_type,omitempty"` - Topic string `protobuf:"bytes,2,opt,name=topic" json:"topic,omitempty"` - Udid string `protobuf:"bytes,3,opt,name=udid" json:"udid,omitempty"` - Authenticate *Authenticate `protobuf:"bytes,4,opt,name=authenticate" json:"authenticate,omitempty"` - TokenUpdate *TokenUpdate `protobuf:"bytes,5,opt,name=token_update,json=tokenUpdate" json:"token_update,omitempty"` + MessageType string `protobuf:"bytes,1,opt,name=message_type,json=messageType,proto3" json:"message_type,omitempty"` + Topic string `protobuf:"bytes,2,opt,name=topic,proto3" json:"topic,omitempty"` + Udid string `protobuf:"bytes,3,opt,name=udid,proto3" json:"udid,omitempty"` + Authenticate *Authenticate `protobuf:"bytes,4,opt,name=authenticate,proto3" json:"authenticate,omitempty"` + TokenUpdate *TokenUpdate `protobuf:"bytes,5,opt,name=token_update,json=tokenUpdate,proto3" json:"token_update,omitempty"` + EnrollmentId string `protobuf:"bytes,6,opt,name=enrollment_id,json=enrollmentId,proto3" json:"enrollment_id,omitempty"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` @@ -103,7 +104,7 @@ func (m *Command) Reset() { *m = Command{} } func (m *Command) String() string { return proto.CompactTextString(m) } func (*Command) ProtoMessage() {} func (*Command) Descriptor() ([]byte, []int) { - return fileDescriptor_checkin_7e1d11c144d2ce7a, []int{1} + return fileDescriptor_checkin_f106eb4ffaf2f7e3, []int{1} } func (m *Command) XXX_Unmarshal(b []byte) error { return xxx_messageInfo_Command.Unmarshal(m, b) @@ -158,17 +159,24 @@ func (m *Command) GetTokenUpdate() *TokenUpdate { return nil } +func (m *Command) GetEnrollmentId() string { + if m != nil { + return m.EnrollmentId + } + return "" +} + type Authenticate struct { - OsVersion string `protobuf:"bytes,1,opt,name=os_version,json=osVersion" json:"os_version,omitempty"` - BuildVersion string `protobuf:"bytes,2,opt,name=build_version,json=buildVersion" json:"build_version,omitempty"` - ProductName string `protobuf:"bytes,3,opt,name=product_name,json=productName" json:"product_name,omitempty"` - SerialNumber string `protobuf:"bytes,4,opt,name=serial_number,json=serialNumber" json:"serial_number,omitempty"` - Imei string `protobuf:"bytes,5,opt,name=imei" json:"imei,omitempty"` - Meid string `protobuf:"bytes,6,opt,name=meid" json:"meid,omitempty"` - DeviceName string `protobuf:"bytes,7,opt,name=device_name,json=deviceName" json:"device_name,omitempty"` + OsVersion string `protobuf:"bytes,1,opt,name=os_version,json=osVersion,proto3" json:"os_version,omitempty"` + BuildVersion string `protobuf:"bytes,2,opt,name=build_version,json=buildVersion,proto3" json:"build_version,omitempty"` + ProductName string `protobuf:"bytes,3,opt,name=product_name,json=productName,proto3" json:"product_name,omitempty"` + SerialNumber string `protobuf:"bytes,4,opt,name=serial_number,json=serialNumber,proto3" json:"serial_number,omitempty"` + Imei string `protobuf:"bytes,5,opt,name=imei,proto3" json:"imei,omitempty"` + Meid string `protobuf:"bytes,6,opt,name=meid,proto3" json:"meid,omitempty"` + DeviceName string `protobuf:"bytes,7,opt,name=device_name,json=deviceName,proto3" json:"device_name,omitempty"` Challenge []byte `protobuf:"bytes,8,opt,name=challenge,proto3" json:"challenge,omitempty"` - Model string `protobuf:"bytes,9,opt,name=model" json:"model,omitempty"` - ModelName string `protobuf:"bytes,10,opt,name=model_name,json=modelName" json:"model_name,omitempty"` + Model string `protobuf:"bytes,9,opt,name=model,proto3" json:"model,omitempty"` + ModelName string `protobuf:"bytes,10,opt,name=model_name,json=modelName,proto3" json:"model_name,omitempty"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` @@ -178,7 +186,7 @@ func (m *Authenticate) Reset() { *m = Authenticate{} } func (m *Authenticate) String() string { return proto.CompactTextString(m) } func (*Authenticate) ProtoMessage() {} func (*Authenticate) Descriptor() ([]byte, []int) { - return fileDescriptor_checkin_7e1d11c144d2ce7a, []int{2} + return fileDescriptor_checkin_f106eb4ffaf2f7e3, []int{2} } func (m *Authenticate) XXX_Unmarshal(b []byte) error { return xxx_messageInfo_Authenticate.Unmarshal(m, b) @@ -270,13 +278,13 @@ func (m *Authenticate) GetModelName() string { type TokenUpdate struct { Token []byte `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"` - PushMagic string `protobuf:"bytes,2,opt,name=push_magic,json=pushMagic" json:"push_magic,omitempty"` + PushMagic string `protobuf:"bytes,2,opt,name=push_magic,json=pushMagic,proto3" json:"push_magic,omitempty"` UnlockToken []byte `protobuf:"bytes,3,opt,name=unlock_token,json=unlockToken,proto3" json:"unlock_token,omitempty"` - AwaitingConfiguration bool `protobuf:"varint,4,opt,name=awaiting_configuration,json=awaitingConfiguration" json:"awaiting_configuration,omitempty"` - UserId string `protobuf:"bytes,5,opt,name=user_id,json=userId" json:"user_id,omitempty"` - UserLongName string `protobuf:"bytes,6,opt,name=user_long_name,json=userLongName" json:"user_long_name,omitempty"` - UserShortName string `protobuf:"bytes,7,opt,name=user_short_name,json=userShortName" json:"user_short_name,omitempty"` - NotOnConsole bool `protobuf:"varint,8,opt,name=not_on_console,json=notOnConsole" json:"not_on_console,omitempty"` + AwaitingConfiguration bool `protobuf:"varint,4,opt,name=awaiting_configuration,json=awaitingConfiguration,proto3" json:"awaiting_configuration,omitempty"` + UserId string `protobuf:"bytes,5,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"` + UserLongName string `protobuf:"bytes,6,opt,name=user_long_name,json=userLongName,proto3" json:"user_long_name,omitempty"` + UserShortName string `protobuf:"bytes,7,opt,name=user_short_name,json=userShortName,proto3" json:"user_short_name,omitempty"` + NotOnConsole bool `protobuf:"varint,8,opt,name=not_on_console,json=notOnConsole,proto3" json:"not_on_console,omitempty"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` @@ -286,7 +294,7 @@ func (m *TokenUpdate) Reset() { *m = TokenUpdate{} } func (m *TokenUpdate) String() string { return proto.CompactTextString(m) } func (*TokenUpdate) ProtoMessage() {} func (*TokenUpdate) Descriptor() ([]byte, []int) { - return fileDescriptor_checkin_7e1d11c144d2ce7a, []int{3} + return fileDescriptor_checkin_f106eb4ffaf2f7e3, []int{3} } func (m *TokenUpdate) XXX_Unmarshal(b []byte) error { return xxx_messageInfo_TokenUpdate.Unmarshal(m, b) @@ -370,46 +378,47 @@ func init() { proto.RegisterType((*TokenUpdate)(nil), "checkinproto.TokenUpdate") } -func init() { proto.RegisterFile("checkin.proto", fileDescriptor_checkin_7e1d11c144d2ce7a) } +func init() { proto.RegisterFile("checkin.proto", fileDescriptor_checkin_f106eb4ffaf2f7e3) } -var fileDescriptor_checkin_7e1d11c144d2ce7a = []byte{ - // 602 bytes of a gzipped FileDescriptorProto - 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x54, 0x92, 0xdf, 0x6e, 0xd3, 0x30, - 0x14, 0xc6, 0x95, 0x74, 0x6d, 0x97, 0x93, 0x6c, 0x20, 0x8b, 0x41, 0x98, 0x40, 0xeb, 0xca, 0x84, - 0x7a, 0x55, 0xa4, 0x21, 0xc4, 0x1f, 0x21, 0x24, 0x34, 0xed, 0x02, 0x09, 0x06, 0x32, 0x83, 0xdb, - 0xc8, 0x4d, 0x4c, 0x6a, 0x35, 0xb1, 0xa3, 0xc4, 0xe9, 0xd4, 0x47, 0xe2, 0x05, 0x78, 0x12, 0x9e, - 0x80, 0x27, 0x41, 0xe7, 0x38, 0xdd, 0xd2, 0xbb, 0x73, 0x7e, 0xfe, 0xfc, 0xe5, 0x9c, 0x2f, 0x86, - 0x83, 0x74, 0x29, 0xd3, 0x95, 0xd2, 0xf3, 0xaa, 0x36, 0xd6, 0xb0, 0xa8, 0x6b, 0xa9, 0x9b, 0xfe, - 0xf3, 0x60, 0x78, 0xb9, 0x96, 0xda, 0xb2, 0x43, 0xf0, 0x55, 0x16, 0x7b, 0x13, 0x6f, 0x16, 0x70, - 0x5f, 0x65, 0x8c, 0xc1, 0x9e, 0x55, 0xa5, 0x8c, 0xfd, 0x89, 0x37, 0x1b, 0x70, 0xaa, 0xd9, 0x0b, - 0x18, 0xa7, 0xa6, 0x2c, 0x85, 0xce, 0xe2, 0xc1, 0xc4, 0x9b, 0x85, 0xe7, 0x47, 0xf3, 0xbe, 0xdb, - 0xfc, 0xc2, 0x1d, 0xf2, 0xad, 0x8a, 0xdd, 0x87, 0x41, 0x2d, 0x6e, 0xe2, 0xbd, 0x89, 0x37, 0x8b, - 0x38, 0x96, 0xec, 0x35, 0x8c, 0x2a, 0x51, 0x8b, 0xb2, 0x89, 0x87, 0x93, 0xc1, 0x2c, 0x3c, 0x3f, - 0xd9, 0x75, 0xa0, 0x59, 0xe6, 0xdf, 0x48, 0x71, 0xa9, 0x6d, 0xbd, 0xe1, 0x9d, 0xfc, 0xf8, 0x2d, - 0x84, 0x3d, 0x8c, 0xce, 0x2b, 0xb9, 0xe9, 0xe6, 0xc5, 0x92, 0x3d, 0x80, 0xe1, 0x5a, 0x14, 0xad, - 0x9b, 0x38, 0xe0, 0xae, 0x79, 0xe7, 0xbf, 0xf1, 0xa6, 0x7f, 0x3d, 0x18, 0x77, 0xa3, 0xb1, 0x53, - 0x88, 0x4a, 0xd9, 0x34, 0x22, 0x97, 0x89, 0xdd, 0x54, 0xb2, 0x33, 0x08, 0x3b, 0x76, 0xbd, 0xa9, - 0x24, 0x1a, 0x59, 0x53, 0xa9, 0x74, 0x6b, 0x44, 0x0d, 0xe6, 0xd1, 0x66, 0xca, 0x2d, 0x1e, 0x70, - 0xaa, 0xd9, 0x07, 0x88, 0x44, 0x6b, 0x97, 0x52, 0x5b, 0x95, 0x0a, 0x2b, 0x69, 0xcf, 0xf0, 0xfc, - 0x78, 0x77, 0xa5, 0x8f, 0x3d, 0x05, 0xdf, 0xd1, 0xb3, 0xf7, 0x10, 0x59, 0xb3, 0x92, 0x3a, 0x69, - 0xab, 0x0c, 0xef, 0x0f, 0xe9, 0xfe, 0xe3, 0xdd, 0xfb, 0xd7, 0xa8, 0xf8, 0x41, 0x02, 0x1e, 0xda, - 0xbb, 0x66, 0xfa, 0xc7, 0x87, 0xa8, 0x6f, 0xce, 0x9e, 0x02, 0x98, 0x26, 0x59, 0xcb, 0xba, 0x51, - 0x46, 0x77, 0x9b, 0x05, 0xa6, 0xf9, 0xe9, 0x00, 0x7b, 0x06, 0x07, 0x8b, 0x56, 0x15, 0xd9, 0xad, - 0xc2, 0xed, 0x17, 0x11, 0xdc, 0x8a, 0x4e, 0x21, 0xaa, 0x6a, 0x93, 0xb5, 0xa9, 0x4d, 0xb4, 0x28, - 0x65, 0xb7, 0x6e, 0xd8, 0xb1, 0x2b, 0x51, 0x4a, 0xf4, 0x69, 0x64, 0xad, 0x44, 0x91, 0xe8, 0xb6, - 0x5c, 0xc8, 0x9a, 0xd6, 0x0e, 0x78, 0xe4, 0xe0, 0x15, 0x31, 0x8c, 0x4b, 0x95, 0x52, 0xd1, 0x4a, - 0x01, 0xa7, 0x1a, 0x59, 0x29, 0x55, 0x16, 0x8f, 0x1c, 0xc3, 0x9a, 0x9d, 0x40, 0x98, 0xc9, 0xb5, - 0x4a, 0xa5, 0xfb, 0xdc, 0x98, 0x8e, 0xc0, 0x21, 0xfa, 0xda, 0x13, 0x08, 0xd2, 0xa5, 0x28, 0x0a, - 0xa9, 0x73, 0x19, 0xef, 0xd3, 0x43, 0xba, 0x03, 0xf8, 0xaf, 0x4a, 0x93, 0xc9, 0x22, 0x0e, 0xdc, - 0xbf, 0xa2, 0x06, 0x83, 0xa0, 0xc2, 0x79, 0x82, 0x0b, 0x82, 0x08, 0x5a, 0x4e, 0x7f, 0xfb, 0x10, - 0xf6, 0x52, 0x75, 0x3f, 0x7c, 0x25, 0x5d, 0x64, 0x11, 0x77, 0x0d, 0x9a, 0x54, 0x6d, 0xb3, 0x4c, - 0x4a, 0x91, 0xdf, 0xbe, 0x85, 0x00, 0xc9, 0x17, 0x04, 0x18, 0x54, 0xab, 0x0b, 0x93, 0xae, 0x12, - 0x77, 0x77, 0x40, 0x77, 0x43, 0xc7, 0xc8, 0x9d, 0xbd, 0x82, 0x87, 0xe2, 0x46, 0x28, 0xab, 0x74, - 0x9e, 0xa4, 0x46, 0xff, 0x52, 0x79, 0x5b, 0x0b, 0x8b, 0xc9, 0x63, 0x62, 0xfb, 0xfc, 0x68, 0x7b, - 0x7a, 0xd1, 0x3f, 0x64, 0x8f, 0x60, 0xdc, 0x36, 0xb2, 0x4e, 0x54, 0xd6, 0xa5, 0x37, 0xc2, 0xf6, - 0x53, 0xc6, 0xce, 0xe0, 0x90, 0x0e, 0x0a, 0xa3, 0x73, 0xb7, 0x9a, 0x4b, 0x32, 0x42, 0xfa, 0xd9, - 0xe8, 0x9c, 0x02, 0x7b, 0x0e, 0xf7, 0x48, 0xd5, 0x2c, 0x4d, 0x6d, 0xfb, 0xa9, 0x1e, 0x20, 0xfe, - 0x8e, 0x94, 0x74, 0x67, 0x70, 0xa8, 0x8d, 0x4d, 0x8c, 0xc6, 0xd9, 0x1a, 0x53, 0xb8, 0x74, 0xf7, - 0x79, 0xa4, 0x8d, 0xfd, 0xaa, 0x2f, 0x1c, 0x5b, 0x8c, 0xe8, 0x11, 0xbe, 0xfc, 0x1f, 0x00, 0x00, - 0xff, 0xff, 0x87, 0xd1, 0x6a, 0xe1, 0x46, 0x04, 0x00, 0x00, +var fileDescriptor_checkin_f106eb4ffaf2f7e3 = []byte{ + // 619 bytes of a gzipped FileDescriptorProto + 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x54, 0x52, 0xdd, 0x6a, 0xdb, 0x4a, + 0x10, 0x46, 0x76, 0x6c, 0x47, 0x23, 0x25, 0xe7, 0xb0, 0x9c, 0x9c, 0xa3, 0x13, 0x5a, 0xe2, 0xb8, + 0xa1, 0xf8, 0xca, 0x85, 0x94, 0xd2, 0x1f, 0x4a, 0xa1, 0x84, 0x5c, 0x04, 0xda, 0xb4, 0x6c, 0xd3, + 0xde, 0x8a, 0x8d, 0x34, 0x95, 0x17, 0x6b, 0x77, 0x85, 0xb4, 0x72, 0xf0, 0x23, 0xf5, 0x05, 0xfa, + 0x40, 0x7d, 0x8b, 0xde, 0x95, 0x9d, 0x95, 0x13, 0xf9, 0x6e, 0xe6, 0x9b, 0x6f, 0xbe, 0x9d, 0xf9, + 0x76, 0xe0, 0x20, 0x5b, 0x62, 0xb6, 0x92, 0x7a, 0x51, 0xd5, 0xc6, 0x1a, 0x16, 0x77, 0x29, 0x65, + 0xb3, 0x5f, 0x01, 0x8c, 0x2e, 0xd7, 0xa8, 0x2d, 0x3b, 0x84, 0x81, 0xcc, 0x93, 0x60, 0x1a, 0xcc, + 0x43, 0x3e, 0x90, 0x39, 0x63, 0xb0, 0x67, 0xa5, 0xc2, 0x64, 0x30, 0x0d, 0xe6, 0x43, 0x4e, 0x31, + 0x7b, 0x06, 0x93, 0xcc, 0x28, 0x25, 0x74, 0x9e, 0x0c, 0xa7, 0xc1, 0x3c, 0x3a, 0x3f, 0x5a, 0xf4, + 0xd5, 0x16, 0x17, 0xbe, 0xc8, 0xb7, 0x2c, 0xf6, 0x37, 0x0c, 0x6b, 0x71, 0x97, 0xec, 0x4d, 0x83, + 0x79, 0xcc, 0x5d, 0xc8, 0x5e, 0xc2, 0xb8, 0x12, 0xb5, 0x50, 0x4d, 0x32, 0x9a, 0x0e, 0xe7, 0xd1, + 0xf9, 0xc9, 0xae, 0x02, 0xcd, 0xb2, 0xf8, 0x4c, 0x8c, 0x4b, 0x6d, 0xeb, 0x0d, 0xef, 0xe8, 0xc7, + 0xaf, 0x21, 0xea, 0xc1, 0x4e, 0x79, 0x85, 0x9b, 0x6e, 0x5e, 0x17, 0xb2, 0x7f, 0x60, 0xb4, 0x16, + 0x65, 0xeb, 0x27, 0x0e, 0xb9, 0x4f, 0xde, 0x0c, 0x5e, 0x05, 0xb3, 0xdf, 0x01, 0x4c, 0xba, 0xd1, + 0xd8, 0x29, 0xc4, 0x0a, 0x9b, 0x46, 0x14, 0x98, 0xda, 0x4d, 0x85, 0x9d, 0x40, 0xd4, 0x61, 0x37, + 0x9b, 0x0a, 0x9d, 0x90, 0x35, 0x95, 0xcc, 0xb6, 0x42, 0x94, 0x38, 0x3f, 0xda, 0x5c, 0xfa, 0xc5, + 0x43, 0x4e, 0x31, 0x7b, 0x07, 0xb1, 0x68, 0xed, 0x12, 0xb5, 0x95, 0x99, 0xb0, 0x48, 0x7b, 0x46, + 0xe7, 0xc7, 0xbb, 0x2b, 0xbd, 0xef, 0x31, 0xf8, 0x0e, 0x9f, 0xbd, 0x85, 0xd8, 0x9a, 0x15, 0xea, + 0xb4, 0xad, 0x72, 0xd7, 0x3f, 0xa2, 0xfe, 0xff, 0x77, 0xfb, 0x6f, 0x1c, 0xe3, 0x2b, 0x11, 0x78, + 0x64, 0x1f, 0x12, 0xf6, 0x04, 0x0e, 0x50, 0xd7, 0xa6, 0x2c, 0x15, 0x6a, 0x9b, 0xca, 0x3c, 0x19, + 0xd3, 0x68, 0xf1, 0x03, 0x78, 0x95, 0xcf, 0x7e, 0x0e, 0x20, 0xee, 0x4f, 0xc0, 0x1e, 0x03, 0x98, + 0x26, 0x5d, 0x63, 0xdd, 0x48, 0xa3, 0xbb, 0xf5, 0x43, 0xd3, 0x7c, 0xf3, 0x80, 0x13, 0xbd, 0x6d, + 0x65, 0x99, 0xdf, 0x33, 0xbc, 0x09, 0x31, 0x81, 0x5b, 0xd2, 0x29, 0xc4, 0x55, 0x6d, 0xf2, 0x36, + 0xb3, 0xa9, 0x16, 0x0a, 0x3b, 0x4f, 0xa2, 0x0e, 0xbb, 0x16, 0x8a, 0x86, 0x6b, 0xb0, 0x96, 0xa2, + 0x4c, 0x75, 0xab, 0x6e, 0xb1, 0x26, 0x6f, 0x42, 0x1e, 0x7b, 0xf0, 0x9a, 0x30, 0xe7, 0xa9, 0x54, + 0x28, 0x69, 0xef, 0x90, 0x53, 0xec, 0x30, 0x85, 0xf7, 0xcb, 0x50, 0xcc, 0x4e, 0x20, 0xca, 0x71, + 0x2d, 0x33, 0xf4, 0xcf, 0x4d, 0xa8, 0x04, 0x1e, 0xa2, 0xd7, 0x1e, 0x41, 0x98, 0x2d, 0x45, 0x59, + 0xa2, 0x2e, 0x30, 0xd9, 0xa7, 0x6b, 0x7b, 0x00, 0xdc, 0x87, 0x2a, 0x93, 0x63, 0x99, 0x84, 0xfe, + 0x43, 0x29, 0x71, 0x46, 0x50, 0xe0, 0x35, 0xc1, 0x1b, 0x41, 0x88, 0x93, 0x9c, 0xfd, 0x18, 0x40, + 0xd4, 0xb3, 0xde, 0x5f, 0xc5, 0x0a, 0xbd, 0x65, 0x31, 0xf7, 0x89, 0x13, 0xa9, 0xda, 0x66, 0x99, + 0x2a, 0x51, 0xdc, 0x1f, 0x4c, 0xe8, 0x90, 0x8f, 0x0e, 0x70, 0x46, 0xb5, 0xba, 0x34, 0xd9, 0x2a, + 0xf5, 0xbd, 0x43, 0xea, 0x8d, 0x3c, 0x46, 0xea, 0xec, 0x05, 0xfc, 0x2b, 0xee, 0x84, 0xb4, 0x52, + 0x17, 0x69, 0x66, 0xf4, 0x77, 0x59, 0xb4, 0xb5, 0xb0, 0xce, 0x79, 0xe7, 0xd8, 0x3e, 0x3f, 0xda, + 0x56, 0x2f, 0xfa, 0x45, 0xf6, 0x1f, 0x4c, 0xda, 0x06, 0x6b, 0xf7, 0xed, 0xde, 0xbd, 0xb1, 0x4b, + 0xaf, 0x72, 0x76, 0x06, 0x87, 0x54, 0x28, 0x8d, 0x2e, 0xfc, 0x6a, 0xdd, 0x59, 0x38, 0xf4, 0x83, + 0xd1, 0x05, 0x19, 0xf6, 0x14, 0xfe, 0x22, 0x56, 0xb3, 0x34, 0xb5, 0xed, 0xbb, 0x7a, 0xe0, 0xe0, + 0x2f, 0x0e, 0x25, 0xde, 0x19, 0x1c, 0x6a, 0x63, 0x53, 0xa3, 0xdd, 0x6c, 0x8d, 0x29, 0xbd, 0xbb, + 0xfb, 0x3c, 0xd6, 0xc6, 0x7e, 0xd2, 0x17, 0x1e, 0xbb, 0x1d, 0xd3, 0xa5, 0x3e, 0xff, 0x13, 0x00, + 0x00, 0xff, 0xff, 0x5a, 0x90, 0x46, 0x6c, 0x6b, 0x04, 0x00, 0x00, } diff --git a/mdm/internal/checkinproto/checkin.proto b/mdm/internal/checkinproto/checkin.proto index bd3f4caf..c6cc9179 100644 --- a/mdm/internal/checkinproto/checkin.proto +++ b/mdm/internal/checkinproto/checkin.proto @@ -16,6 +16,7 @@ message Command { string udid = 3; Authenticate authenticate = 4; TokenUpdate token_update = 5; + string enrollment_id = 6; } message Authenticate { diff --git a/mdm/internal/connectproto/connect.pb.go b/mdm/internal/connectproto/connect.pb.go index 09e496c8..164677fc 100644 --- a/mdm/internal/connectproto/connect.pb.go +++ b/mdm/internal/connectproto/connect.pb.go @@ -19,11 +19,11 @@ var _ = math.Inf const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package type Event struct { - Id string `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"` - Time int64 `protobuf:"varint,2,opt,name=time" json:"time,omitempty"` - Response *Response `protobuf:"bytes,3,opt,name=response" json:"response,omitempty"` + Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` + Time int64 `protobuf:"varint,2,opt,name=time,proto3" json:"time,omitempty"` + Response *Response `protobuf:"bytes,3,opt,name=response,proto3" json:"response,omitempty"` Raw []byte `protobuf:"bytes,4,opt,name=raw,proto3" json:"raw,omitempty"` - Params map[string]string `protobuf:"bytes,5,rep,name=params" json:"params,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` + Params map[string]string `protobuf:"bytes,5,rep,name=params,proto3" json:"params,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` @@ -33,7 +33,7 @@ func (m *Event) Reset() { *m = Event{} } func (m *Event) String() string { return proto.CompactTextString(m) } func (*Event) ProtoMessage() {} func (*Event) Descriptor() ([]byte, []int) { - return fileDescriptor_connect_0a9da89ca45acccc, []int{0} + return fileDescriptor_connect_1685d4746e4a2c8b, []int{0} } func (m *Event) XXX_Unmarshal(b []byte) error { return xxx_messageInfo_Event.Unmarshal(m, b) @@ -89,11 +89,12 @@ func (m *Event) GetParams() map[string]string { } type Response struct { - Udid string `protobuf:"bytes,1,opt,name=udid" json:"udid,omitempty"` - UserId string `protobuf:"bytes,2,opt,name=user_id,json=userId" json:"user_id,omitempty"` - Status string `protobuf:"bytes,3,opt,name=status" json:"status,omitempty"` - RequestType string `protobuf:"bytes,4,opt,name=request_type,json=requestType" json:"request_type,omitempty"` - CommandUuid string `protobuf:"bytes,5,opt,name=command_uuid,json=commandUuid" json:"command_uuid,omitempty"` + Udid string `protobuf:"bytes,1,opt,name=udid,proto3" json:"udid,omitempty"` + UserId string `protobuf:"bytes,2,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"` + Status string `protobuf:"bytes,3,opt,name=status,proto3" json:"status,omitempty"` + RequestType string `protobuf:"bytes,4,opt,name=request_type,json=requestType,proto3" json:"request_type,omitempty"` + CommandUuid string `protobuf:"bytes,5,opt,name=command_uuid,json=commandUuid,proto3" json:"command_uuid,omitempty"` + EnrollmentId string `protobuf:"bytes,6,opt,name=enrollment_id,json=enrollmentId,proto3" json:"enrollment_id,omitempty"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` @@ -103,7 +104,7 @@ func (m *Response) Reset() { *m = Response{} } func (m *Response) String() string { return proto.CompactTextString(m) } func (*Response) ProtoMessage() {} func (*Response) Descriptor() ([]byte, []int) { - return fileDescriptor_connect_0a9da89ca45acccc, []int{1} + return fileDescriptor_connect_1685d4746e4a2c8b, []int{1} } func (m *Response) XXX_Unmarshal(b []byte) error { return xxx_messageInfo_Response.Unmarshal(m, b) @@ -158,32 +159,41 @@ func (m *Response) GetCommandUuid() string { return "" } +func (m *Response) GetEnrollmentId() string { + if m != nil { + return m.EnrollmentId + } + return "" +} + func init() { proto.RegisterType((*Event)(nil), "connectproto.Event") proto.RegisterMapType((map[string]string)(nil), "connectproto.Event.ParamsEntry") proto.RegisterType((*Response)(nil), "connectproto.Response") } -func init() { proto.RegisterFile("connect.proto", fileDescriptor_connect_0a9da89ca45acccc) } +func init() { proto.RegisterFile("connect.proto", fileDescriptor_connect_1685d4746e4a2c8b) } -var fileDescriptor_connect_0a9da89ca45acccc = []byte{ - // 285 bytes of a gzipped FileDescriptorProto - 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x54, 0x8f, 0xbd, 0x4e, 0xc3, 0x30, - 0x1c, 0xc4, 0xe5, 0xa4, 0x09, 0xcd, 0x3f, 0x05, 0x21, 0x0b, 0x15, 0x8b, 0x85, 0xd0, 0x29, 0x53, - 0x86, 0x32, 0xf0, 0xb1, 0x77, 0x60, 0x43, 0x16, 0xcc, 0x91, 0x89, 0x3d, 0x58, 0x10, 0x27, 0xf8, - 0xa3, 0x28, 0x0f, 0xc2, 0x23, 0xf2, 0x1e, 0xc8, 0x8e, 0xa9, 0xca, 0x76, 0xf7, 0xf7, 0xf9, 0x74, - 0x3f, 0x38, 0xed, 0x06, 0xa5, 0x44, 0x67, 0x9b, 0x51, 0x0f, 0x76, 0xc0, 0xab, 0x68, 0x83, 0xdb, - 0xfc, 0x20, 0xc8, 0x76, 0x7b, 0xa1, 0x2c, 0x3e, 0x83, 0x44, 0x72, 0x82, 0x2a, 0x54, 0x17, 0x34, - 0x91, 0x1c, 0x63, 0x58, 0x58, 0xd9, 0x0b, 0x92, 0x54, 0xa8, 0x4e, 0x69, 0xd0, 0x78, 0x0b, 0x4b, - 0x2d, 0xcc, 0x38, 0x28, 0x23, 0x48, 0x5a, 0xa1, 0xba, 0xdc, 0xae, 0x9b, 0xe3, 0xba, 0x86, 0xc6, - 0x57, 0x7a, 0xc8, 0xe1, 0x73, 0x48, 0x35, 0xfb, 0x22, 0x8b, 0x0a, 0xd5, 0x2b, 0xea, 0x25, 0xbe, - 0x83, 0x7c, 0x64, 0x9a, 0xf5, 0x86, 0x64, 0x55, 0x5a, 0x97, 0xdb, 0xeb, 0xff, 0x1d, 0x61, 0x4e, - 0xf3, 0x1c, 0x12, 0x3b, 0x65, 0xf5, 0x44, 0x63, 0xfc, 0xea, 0x01, 0xca, 0xa3, 0xb3, 0x6f, 0x7e, - 0x17, 0x53, 0x9c, 0xec, 0x25, 0xbe, 0x80, 0x6c, 0xcf, 0x3e, 0xdc, 0x3c, 0xba, 0xa0, 0xb3, 0x79, - 0x4c, 0xee, 0xd1, 0xe6, 0x1b, 0xc1, 0xf2, 0x6f, 0x9c, 0x47, 0x73, 0xfc, 0x00, 0x1b, 0x34, 0xbe, - 0x84, 0x13, 0x67, 0x84, 0x6e, 0x25, 0x8f, 0x9f, 0x73, 0x6f, 0x9f, 0x38, 0x5e, 0x43, 0x6e, 0x2c, - 0xb3, 0xce, 0x04, 0xe2, 0x82, 0x46, 0x87, 0x6f, 0x60, 0xa5, 0xc5, 0xa7, 0x13, 0xc6, 0xb6, 0x76, - 0x1a, 0x45, 0x00, 0x2c, 0x68, 0x19, 0x6f, 0x2f, 0xd3, 0x28, 0x7c, 0xa4, 0x1b, 0xfa, 0x9e, 0x29, - 0xde, 0x3a, 0x27, 0x39, 0xc9, 0xe6, 0x48, 0xbc, 0xbd, 0x3a, 0xc9, 0xdf, 0xf2, 0xc0, 0x7c, 0xfb, - 0x1b, 0x00, 0x00, 0xff, 0xff, 0x78, 0xb5, 0xce, 0x2a, 0xa5, 0x01, 0x00, 0x00, +var fileDescriptor_connect_1685d4746e4a2c8b = []byte{ + // 306 bytes of a gzipped FileDescriptorProto + 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x54, 0x50, 0x3d, 0x4f, 0xf3, 0x30, + 0x18, 0x94, 0x93, 0x26, 0x6f, 0xf3, 0x24, 0x7d, 0x85, 0x2c, 0x54, 0x22, 0x16, 0x42, 0x59, 0x32, + 0x65, 0x28, 0x03, 0x1f, 0x7b, 0x87, 0x6e, 0xc8, 0x82, 0xb9, 0x0a, 0xf5, 0x33, 0x44, 0x34, 0x76, + 0xf0, 0x47, 0x51, 0xfe, 0x1a, 0xff, 0x87, 0xff, 0x81, 0xec, 0x9a, 0x52, 0xb6, 0xbb, 0xf3, 0xf9, + 0x7c, 0x67, 0x98, 0x6d, 0xa5, 0x10, 0xb8, 0x35, 0xcd, 0xa0, 0xa4, 0x91, 0xb4, 0x08, 0xd4, 0xb3, + 0xc5, 0x17, 0x81, 0x64, 0xb5, 0x47, 0x61, 0xe8, 0x7f, 0x88, 0x3a, 0x5e, 0x92, 0x8a, 0xd4, 0x19, + 0x8b, 0x3a, 0x4e, 0x29, 0x4c, 0x4c, 0xd7, 0x63, 0x19, 0x55, 0xa4, 0x8e, 0x99, 0xc7, 0x74, 0x09, + 0x53, 0x85, 0x7a, 0x90, 0x42, 0x63, 0x19, 0x57, 0xa4, 0xce, 0x97, 0xf3, 0xe6, 0x34, 0xae, 0x61, + 0xe1, 0x94, 0x1d, 0x7d, 0xf4, 0x0c, 0x62, 0xd5, 0x7e, 0x94, 0x93, 0x8a, 0xd4, 0x05, 0x73, 0x90, + 0xde, 0x41, 0x3a, 0xb4, 0xaa, 0xed, 0x75, 0x99, 0x54, 0x71, 0x9d, 0x2f, 0xaf, 0xfe, 0x66, 0xf8, + 0x3a, 0xcd, 0x93, 0x77, 0xac, 0x84, 0x51, 0x23, 0x0b, 0xf6, 0xcb, 0x07, 0xc8, 0x4f, 0x64, 0x97, + 0xfc, 0x86, 0x63, 0xa8, 0xec, 0x20, 0x3d, 0x87, 0x64, 0xdf, 0xee, 0xec, 0xa1, 0x74, 0xc6, 0x0e, + 0xe4, 0x31, 0xba, 0x27, 0x8b, 0x4f, 0x02, 0xd3, 0x9f, 0x72, 0x6e, 0x9a, 0xe5, 0xc7, 0xb1, 0x1e, + 0xd3, 0x0b, 0xf8, 0x67, 0x35, 0xaa, 0x4d, 0xc7, 0xc3, 0xe5, 0xd4, 0xd1, 0x35, 0xa7, 0x73, 0x48, + 0xb5, 0x69, 0x8d, 0xd5, 0x7e, 0x71, 0xc6, 0x02, 0xa3, 0xd7, 0x50, 0x28, 0x7c, 0xb7, 0xa8, 0xcd, + 0xc6, 0x8c, 0x03, 0xfa, 0x81, 0x19, 0xcb, 0x83, 0xf6, 0x3c, 0x0e, 0xe8, 0x2c, 0x5b, 0xd9, 0xf7, + 0xad, 0xe0, 0x1b, 0x6b, 0x3b, 0x5e, 0x26, 0x07, 0x4b, 0xd0, 0x5e, 0x6c, 0xc7, 0xe9, 0x0d, 0xcc, + 0x50, 0x28, 0xb9, 0xdb, 0xf5, 0x28, 0x8c, 0x7b, 0x3c, 0xf5, 0x9e, 0xe2, 0x57, 0x5c, 0xf3, 0xd7, + 0xd4, 0x7f, 0xcc, 0xed, 0x77, 0x00, 0x00, 0x00, 0xff, 0xff, 0xe1, 0x57, 0xaf, 0x0d, 0xca, 0x01, + 0x00, 0x00, } diff --git a/mdm/internal/connectproto/connect.proto b/mdm/internal/connectproto/connect.proto index 5a2eddb5..2faa76bf 100644 --- a/mdm/internal/connectproto/connect.proto +++ b/mdm/internal/connectproto/connect.proto @@ -16,5 +16,5 @@ message Response { string status = 3; string request_type = 4; string command_uuid = 5; + string enrollment_id = 6; } - diff --git a/platform/apns/worker.go b/platform/apns/worker.go index 41b107d2..ba8fc6fd 100644 --- a/platform/apns/worker.go +++ b/platform/apns/worker.go @@ -66,10 +66,15 @@ func (w *Worker) updatePushInfoFromTokenUpdate(ctx context.Context, message []by PushMagic: ev.Command.PushMagic, MDMTopic: ev.Command.Topic, } + // UDID is the primary key for storing the APNS values. + // For MDM managed users, use the UserID instead, + // and for BYOD User Enrollment, use the EnrollmentID. if ev.Command.UserID != "" { - // use the GUID if this is a user TokenUpdate. info.UDID = ev.Command.UserID } + if ev.Command.EnrollmentID != "" { + info.UDID = ev.Command.EnrollmentID + } err := w.db.Save(ctx, &info) return errors.Wrapf(err, "saving pushinfo for udid=%s", info.UDID) } diff --git a/platform/device/udidauth.go b/platform/device/udidauth.go index f7604e23..aa8295ff 100644 --- a/platform/device/udidauth.go +++ b/platform/device/udidauth.go @@ -64,6 +64,11 @@ func (mw *udidCertAuthMiddleware) validateUDIDCertAuth(udid, certHash []byte) (b } func (mw *udidCertAuthMiddleware) Acknowledge(ctx context.Context, req mdm.AcknowledgeEvent) ([]byte, error) { + // only validate device enrollments, user enrollments should be separate. + if req.Response.EnrollmentID != nil { + return mw.next.Acknowledge(ctx, req) + } + devcert, err := mdm.DeviceCertificateFromContext(ctx) if err != nil { return nil, errors.Wrap(err, "error retrieving device certificate") @@ -79,6 +84,10 @@ func (mw *udidCertAuthMiddleware) Acknowledge(ctx context.Context, req mdm.Ackno } func (mw *udidCertAuthMiddleware) Checkin(ctx context.Context, req mdm.CheckinEvent) error { + // only validate device enrollments, user enrollments should be separate. + if req.Command.EnrollmentID != "" { + return mw.next.Checkin(ctx, req) + } devcert, err := mdm.DeviceCertificateFromContext(ctx) if err != nil { return errors.Wrap(err, "error retrieving device certificate") diff --git a/platform/device/worker.go b/platform/device/worker.go index 0c0c635e..48e92e91 100644 --- a/platform/device/worker.go +++ b/platform/device/worker.go @@ -141,6 +141,10 @@ func (w *Worker) updateFromAcknowledge(ctx context.Context, message []byte) erro return errors.Wrap(err, "unmarshal acknowledge event") } + if ev.Response.EnrollmentID != nil { + return nil + } + dev, err := w.db.DeviceByUDID(ctx, ev.Response.UDID) if err != nil { return errors.Wrapf(err, "retrieve device with udid %s", ev.Response.UDID) @@ -158,6 +162,10 @@ func (w *Worker) updateFromCheckout(ctx context.Context, message []byte) error { return errors.Wrap(err, "unmarshal checkin event") } + if ev.Command.EnrollmentID != "" { + return nil + } + dev, err := w.db.DeviceByUDID(ctx, ev.Command.UDID) if err != nil { return errors.Wrapf(err, "retrieve device with udid %s", ev.Command.UDID) @@ -177,8 +185,8 @@ func (w *Worker) updateFromTokenUpdate(ctx context.Context, message []byte) erro return errors.Wrap(err, "unmarshal checkin event") } - if ev.Command.UserID != "" { - // do not process user checkin events while updating device records. + // do not process managed user, or user enrollment checkin events while updating device records. + if ev.Command.UserID != "" || ev.Command.EnrollmentID != "" { return nil } @@ -213,6 +221,10 @@ func (w *Worker) updateFromAuthenticate(ctx context.Context, message []byte) err return errors.Wrap(err, "unmarshal checkin event") } + if ev.Command.EnrollmentID != "" { + return nil + } + device, reenrolling, err := getOrCreateDevice(ctx, w.db, ev.Command.SerialNumber, ev.Command.UDID) if err != nil { return errors.Wrap(err, "get device for authenticate event") diff --git a/platform/queue/queue.go b/platform/queue/queue.go index aad15eff..d83f9904 100644 --- a/platform/queue/queue.go +++ b/platform/queue/queue.go @@ -48,11 +48,18 @@ func (db *Store) Next(ctx context.Context, resp mdm.Response) ([]byte, error) { } func (db *Store) nextCommand(ctx context.Context, resp mdm.Response) (*Command, error) { + // The UDID is the primary key for the queue. + // Depending on the enrollment type, replace the UDID with a different ID type. + // UserID for managed user channel + // EnrollmentID for BYOD User Enrollment. udid := resp.UDID if resp.UserID != nil { - // use the user id for user level commands udid = *resp.UserID } + if resp.EnrollmentID != nil { + udid = *resp.EnrollmentID + } + dc, err := db.DeviceCommand(udid) if err != nil { if isNotFound(err) { diff --git a/workflow/webhook/acknowledge.go b/workflow/webhook/acknowledge.go index 8d5dbf78..b15753b0 100644 --- a/workflow/webhook/acknowledge.go +++ b/workflow/webhook/acknowledge.go @@ -7,11 +7,12 @@ import ( ) type AcknowledgeEvent struct { - UDID string `json:"udid"` - Status string `json:"status"` - CommandUUID string `json:"command_uuid"` - Params map[string]string `json:"url_params"` - RawPayload []byte `json:"raw_payload"` + UDID string `json:"udid,omitempty"` + EnrollmentID string `json:"enrollment_id,omitempty"` + Status string `json:"status"` + CommandUUID string `json:"command_uuid,omitempty"` + Params map[string]string `json:"url_params,omitempty"` + RawPayload []byte `json:"raw_payload"` } func acknowledgeEvent(topic string, data []byte) (*Event, error) { @@ -32,6 +33,9 @@ func acknowledgeEvent(topic string, data []byte) (*Event, error) { RawPayload: ev.Raw, }, } + if ev.Response.EnrollmentID != nil { + webhookEvent.AcknowledgeEvent.EnrollmentID = *ev.Response.EnrollmentID + } return &webhookEvent, nil } diff --git a/workflow/webhook/checkin.go b/workflow/webhook/checkin.go index 63722ec7..b1713317 100644 --- a/workflow/webhook/checkin.go +++ b/workflow/webhook/checkin.go @@ -7,9 +7,10 @@ import ( ) type CheckinEvent struct { - UDID string `json:"udid"` - Params map[string]string `json:"url_params"` - RawPayload []byte `json:"raw_payload"` + UDID string `json:"udid,omitempty"` + EnrollmentID string `json:"enrollment_id,omitempty"` + Params map[string]string `json:"url_params"` + RawPayload []byte `json:"raw_payload"` } func checkinEvent(topic string, data []byte) (*Event, error) { @@ -24,9 +25,10 @@ func checkinEvent(topic string, data []byte) (*Event, error) { CreatedAt: ev.Time, CheckinEvent: &CheckinEvent{ - UDID: ev.Command.UDID, - Params: ev.Params, - RawPayload: ev.Raw, + UDID: ev.Command.UDID, + EnrollmentID: ev.Command.EnrollmentID, + Params: ev.Params, + RawPayload: ev.Raw, }, }