From 4742bb7bb3467ea9eaae0cbda66581a9c3c9a7ed Mon Sep 17 00:00:00 2001
From: mosen <mosen@users.noreply.github.com>
Date: Tue, 25 Oct 2016 17:21:32 +1100
Subject: [PATCH] SCEP Subject had incorrect nesting of arrays, which allowed
 macOS to ignore it, but iOS would refuse enrolment. (#40)

SCEP payload is optional in /mdm/enroll
SCEP challenge is optional in /mdm/enroll (warning about prompt)
Change CA cert to payload type com.apple.security.root

(cherry picked from commit 0d8d092)
---
 enroll/service.go | 67 +++++++++++++++++++++++++++--------------------
 main.go           |  2 +-
 2 files changed, 40 insertions(+), 29 deletions(-)

diff --git a/enroll/service.go b/enroll/service.go
index fae47003..10c00f18 100644
--- a/enroll/service.go
+++ b/enroll/service.go
@@ -36,7 +36,9 @@ func NewService(pushCertPath string, pushCertPass string, caCertPath string, sce
 	scepSubject := [][][]string{
 		[][]string{
 			[]string{"O", "MicroMDM"},
-			[]string{"CN", "MDM Identity Certificate:UDID"},
+		},
+		[][]string{
+			[]string{"CN", "MDM Identity Certificate UDID"},
 		},
 	}
 
@@ -69,24 +71,6 @@ func (svc service) Enroll(ctx context.Context) (Profile, error) {
 	profile.PayloadDescription = "The server may alter your settings"
 	profile.PayloadScope = "System"
 
-	scepContent := SCEPPayloadContent{
-		Challenge: svc.SCEPChallenge,
-		URL:       svc.SCEPURL,
-		Keysize:   1024,
-		KeyType:   "RSA",
-		KeyUsage:  0,
-		Name:      "Device Management Identity Certificate",
-		Subject:   svc.SCEPSubject,
-	}
-
-	scepPayload := NewPayload("com.apple.security.scep")
-	scepPayload.PayloadDescription = "Configures SCEP"
-	scepPayload.PayloadDisplayName = "SCEP"
-	scepPayload.PayloadIdentifier = "com.github.micromdm.scep"
-	scepPayload.PayloadOrganization = "MicroMDM"
-	scepPayload.PayloadContent = scepContent
-	scepPayload.PayloadScope = "System"
-
 	mdmPayload := NewPayload("com.apple.mdm")
 	mdmPayload.PayloadDescription = "Enrolls with the MDM server"
 	mdmPayload.PayloadOrganization = "MicroMDM"
@@ -94,19 +78,46 @@ func (svc service) Enroll(ctx context.Context) (Profile, error) {
 	mdmPayload.PayloadScope = "System"
 
 	mdmPayloadContent := MDMPayloadContent{
-		Payload:                 *mdmPayload,
-		AccessRights:            8191,
-		CheckInURL:              svc.URL + "/mdm/checkin",
-		CheckOutWhenRemoved:     true,
-		ServerURL:               svc.URL + "/mdm/connect",
-		IdentityCertificateUUID: scepPayload.PayloadUUID,
-		Topic: svc.Topic,
+		Payload:             *mdmPayload,
+		AccessRights:        8191,
+		CheckInURL:          svc.URL + "/mdm/checkin",
+		CheckOutWhenRemoved: true,
+		ServerURL:           svc.URL + "/mdm/connect",
+		Topic:               svc.Topic,
 	}
 
-	payloadContent := []interface{}{*scepPayload, mdmPayloadContent}
+	payloadContent := []interface{}{}
+
+	if svc.SCEPURL != "" {
+		scepContent := SCEPPayloadContent{
+			URL:      svc.SCEPURL,
+			Keysize:  1024,
+			KeyType:  "RSA",
+			KeyUsage: 0,
+			Name:     "Device Management Identity Certificate",
+			Subject:  svc.SCEPSubject,
+		}
+
+		if svc.SCEPChallenge != "" {
+			scepContent.Challenge = svc.SCEPChallenge
+		}
+
+		scepPayload := NewPayload("com.apple.security.scep")
+		scepPayload.PayloadDescription = "Configures SCEP"
+		scepPayload.PayloadDisplayName = "SCEP"
+		scepPayload.PayloadIdentifier = "com.github.micromdm.scep"
+		scepPayload.PayloadOrganization = "MicroMDM"
+		scepPayload.PayloadContent = scepContent
+		scepPayload.PayloadScope = "System"
+
+		payloadContent = append(payloadContent, *scepPayload)
+		mdmPayloadContent.IdentityCertificateUUID = scepPayload.PayloadUUID
+	}
+
+	payloadContent = append(payloadContent, mdmPayloadContent)
 
 	if len(svc.CACert) > 0 {
-		caPayload := NewPayload("com.apple.ssl.certificate")
+		caPayload := NewPayload("com.apple.security.root")
 		caPayload.PayloadDisplayName = "Root certificate for MicroMDM"
 		caPayload.PayloadDescription = "Installs the root CA certificate for MicroMDM"
 		caPayload.PayloadIdentifier = "com.github.micromdm.ssl.ca"
diff --git a/main.go b/main.go
index a7eaf560..5d25e406 100644
--- a/main.go
+++ b/main.go
@@ -235,7 +235,7 @@ func main() {
 		logger.Log("warn", "Enrollment endpoint /mdm/enroll will be disabled because you did not specify flags/environment vars for the external URL (--url MICROMDM_URL) or SCEP URL (--scep-url/MICROMDM_SCEP_URL)")
 	} else {
 		if *flSCEPChallenge == "" {
-			logger.Log("warn", "You did not specify a SCEP challenge via --scep-challenge or MICROMDM_SCEP_CHALLENGE (this may not be what you intended).")
+			logger.Log("warn", "You did not specify a SCEP challenge via --scep-challenge or MICROMDM_SCEP_CHALLENGE (this may not be what you intended, the user will be prompted for a challenge).")
 		}
 
 		if *flTLSCACert == "" {