ogb912/micromdm
1
0
Fork 0
mirror of https://github.com/micromdm/micromdm/ synced 2026-08-12 04:55:39 +08:00
Code Issues Packages Projects Releases Wiki Activity

SCEP Subject had incorrect nesting of arrays, which allowed macOS to ignore it, but iOS would refuse enrolment. (#40)

Browse Source 
SCEP payload is optional in /mdm/enroll
SCEP challenge is optional in /mdm/enroll (warning about prompt)
Change CA cert to payload type com.apple.security.root

(cherry picked from commit 0d8d092)
This commit is contained in:
mosen
2016-10-25 17:21:32 +11:00
committed by GitHub
parent d56e06f992
commit 4742bb7bb3
2 changed files with 40 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

67
enroll/service.go
View File

@@ -36,7 +36,9 @@ func NewService(pushCertPath string, pushCertPass string, caCertPath string, sce
scepSubject := [][][]string{
[][]string{
[]string{"O", "MicroMDM"},
[]string{"CN", "MDM Identity Certificate:UDID"},
},
[][]string{
[]string{"CN", "MDM Identity Certificate UDID"},
},
}
@@ -69,24 +71,6 @@ func (svc service) Enroll(ctx context.Context) (Profile, error) {
profile.PayloadDescription = "The server may alter your settings"
profile.PayloadScope = "System"
scepContent := SCEPPayloadContent{
Challenge: svc.SCEPChallenge,
URL: svc.SCEPURL,
Keysize: 1024,
KeyType: "RSA",
KeyUsage: 0,
Name: "Device Management Identity Certificate",
Subject: svc.SCEPSubject,
}
scepPayload := NewPayload("com.apple.security.scep")
scepPayload.PayloadDescription = "Configures SCEP"
scepPayload.PayloadDisplayName = "SCEP"
scepPayload.PayloadIdentifier = "com.github.micromdm.scep"
scepPayload.PayloadOrganization = "MicroMDM"
scepPayload.PayloadContent = scepContent
scepPayload.PayloadScope = "System"
mdmPayload := NewPayload("com.apple.mdm")
mdmPayload.PayloadDescription = "Enrolls with the MDM server"
mdmPayload.PayloadOrganization = "MicroMDM"
@@ -94,19 +78,46 @@ func (svc service) Enroll(ctx context.Context) (Profile, error) {
mdmPayload.PayloadScope = "System"
mdmPayloadContent := MDMPayloadContent{
Payload: *mdmPayload,
AccessRights: 8191,
CheckInURL: svc.URL + "/mdm/checkin",
CheckOutWhenRemoved: true,
ServerURL: svc.URL + "/mdm/connect",
IdentityCertificateUUID: scepPayload.PayloadUUID,
Topic: svc.Topic,
Payload: *mdmPayload,
AccessRights: 8191,
CheckInURL: svc.URL + "/mdm/checkin",
CheckOutWhenRemoved: true,
ServerURL: svc.URL + "/mdm/connect",
Topic: svc.Topic,
}
payloadContent := []interface{}{*scepPayload, mdmPayloadContent}
payloadContent := []interface{}{}
if svc.SCEPURL != "" {
scepContent := SCEPPayloadContent{
URL: svc.SCEPURL,
Keysize: 1024,
KeyType: "RSA",
KeyUsage: 0,
Name: "Device Management Identity Certificate",
Subject: svc.SCEPSubject,
}
if svc.SCEPChallenge != "" {
scepContent.Challenge = svc.SCEPChallenge
}
scepPayload := NewPayload("com.apple.security.scep")
scepPayload.PayloadDescription = "Configures SCEP"
scepPayload.PayloadDisplayName = "SCEP"
scepPayload.PayloadIdentifier = "com.github.micromdm.scep"
scepPayload.PayloadOrganization = "MicroMDM"
scepPayload.PayloadContent = scepContent
scepPayload.PayloadScope = "System"
payloadContent = append(payloadContent, *scepPayload)
mdmPayloadContent.IdentityCertificateUUID = scepPayload.PayloadUUID
}
payloadContent = append(payloadContent, mdmPayloadContent)
if len(svc.CACert) > 0 {
caPayload := NewPayload("com.apple.ssl.certificate")
caPayload := NewPayload("com.apple.security.root")
caPayload.PayloadDisplayName = "Root certificate for MicroMDM"
caPayload.PayloadDescription = "Installs the root CA certificate for MicroMDM"
caPayload.PayloadIdentifier = "com.github.micromdm.ssl.ca"

2
main.go
View File

@@ -235,7 +235,7 @@ func main() {
logger.Log("warn", "Enrollment endpoint /mdm/enroll will be disabled because you did not specify flags/environment vars for the external URL (--url MICROMDM_URL) or SCEP URL (--scep-url/MICROMDM_SCEP_URL)")
} else {
if *flSCEPChallenge == "" {
logger.Log("warn", "You did not specify a SCEP challenge via --scep-challenge or MICROMDM_SCEP_CHALLENGE (this may not be what you intended).")
logger.Log("warn", "You did not specify a SCEP challenge via --scep-challenge or MICROMDM_SCEP_CHALLENGE (this may not be what you intended, the user will be prompted for a challenge).")
}
if *flTLSCACert == "" {