ogb912/micromdm
1
0
Fork 0
mirror of https://github.com/micromdm/micromdm/ synced 2026-08-05 08:55:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

blueprint: do not send DeviceConfigured when there are no user configured blueprints (#586)

Browse Source 
Instead of defaulting to sending a DeviceConfigured command on all enrollments, only do that if the user has configured a blueprint.
Not sending DeviceConfigured by default will allow a workflow service to make decisions about enrollment.
This commit is contained in:
Victor Vrantchan
2019-05-03 11:21:52 -04:00
committed by GitHub
parent 1988c308e9
commit 438fdfa990
2 changed files with 31 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
docs/architecture/2019-05-03_no_device_configured_without_blueprint.md Normal file
View File

@@ -0,0 +1,17 @@
# Do not send DeviceConfigured when there are no user configured blueprints.
## Context
DEP enrolled devices use an `AwaitDeviceConfigured` mode, which can be optionally enabled in a DEP profile. If enabled, the device will wait at the Remote Management screen, and not proceed until the MDM issues a `DeviceConfigured` command.
MicroMDM introduced the concept of a `Blueprint`, which an administrator can configure to apply `InstallProfile` and `InstallApplication` payloads. At the end of the list of pre-configured commands the MDM would default to sending the `DeviceConfigured` command.
It would be useful to allow a separate service to make a decision about whether it is ok to proceed with device provisioning past enrollment.
## Decision
When there are no blueprints configured, the MicroMDM server will not send _any_ commands to the device.
That means, if `AwaitDeviceConfigured` is enabled on the device, upon enrollment the device will remain at the Remote Management screen until an API request queues the DeviceConfigured command.
## Status
Accepted

14
platform/blueprint/worker.go
View File

@@ -93,6 +93,11 @@ func (w *Worker) handleTokenUpdateEvent(ctx context.Context, message []byte) err
return errors.Wrap(err, "unmarshal checkin event")
}
if ev.Command.UserID != "" {
level.Debug(w.logger).Log(
"msg", "skipping user token update in blueprint worker.",
"device_udid", ev.Command.UDID,
"user_id", ev.Command.UserID,
)
// skip UserID token updates
return nil
}
@@ -102,6 +107,15 @@ func (w *Worker) handleTokenUpdateEvent(ctx context.Context, message []byte) err
return errors.Wrap(err, "get blueprints by ApplyAtEnroll")
}
// if there are no blueprints exit early. This will ensure that DeviceConfigured is not sent.
if len(bps) == 0 {
level.Debug(w.logger).Log(
"msg", "no blueprints to apply",
"device_udid", ev.Command.UDID,
)
return nil
}
for _, bp := range bps {
level.Debug(w.logger).Log(
"msg", "applying blueprint",