From 8072ae8c9d142da29b0b95eb832d45cb8906bbcf Mon Sep 17 00:00:00 2001
From: mosen <mosen@users.noreply.github.com>
Date: Tue, 25 Oct 2016 14:08:45 +1100
Subject: [PATCH] Empty consent text in enroll profile was generating an
 invalid plist key. (#39)

Enrollment service now takes the TLS certificate path and provides a PKCS1 payload with the servers TLS certificate in order to trust it at enroll time.
---
 profile.go |  2 +-
 service.go | 33 ++++++++++++++++++++++++++++-----
 2 files changed, 29 insertions(+), 6 deletions(-)

diff --git a/profile.go b/profile.go
index 84b2150d..2740b4bf 100644
--- a/profile.go
+++ b/profile.go
@@ -31,7 +31,7 @@ type Profile struct {
 	PayloadScope             string            `json:"scope" db:"scope" plist:",omitempty"`
 	RemovalDate              *time.Time        `json:"removal_date" db:"removal_date" plist:"-" plist:",omitempty"`
 	DurationUntilRemoval     float32           `json:"duration_until_removal" db:"duration_until_removal" plist:",omitempty"`
-	ConsentText              map[string]string `json:"consent_text" db:"consent_text" plist:"omitempty"`
+	ConsentText              map[string]string `json:"consent_text" db:"consent_text" plist:",omitempty"`
 }
 
 func NewProfile() *Profile {
diff --git a/service.go b/service.go
index 1a9792c1..fae47003 100644
--- a/service.go
+++ b/service.go
@@ -9,13 +9,13 @@ type Service interface {
 	Enroll(ctx context.Context) (Profile, error)
 }
 
-func NewService(pushCertPath string, pushCertPass string, caCertPath string, scepURL string, scepChallenge string, url string) (Service, error) {
+func NewService(pushCertPath string, pushCertPass string, caCertPath string, scepURL string, scepChallenge string, url string, tlsCertPath string) (Service, error) {
 	pushTopic, err := GetPushTopicFromPKCS12(pushCertPath, pushCertPass)
 	if err != nil {
 		return nil, err
 	}
 
-	var caCert []byte
+	var caCert, tlsCert []byte
 
 	if caCertPath != "" {
 		caCert, err = ioutil.ReadFile(caCertPath)
@@ -25,6 +25,14 @@ func NewService(pushCertPath string, pushCertPass string, caCertPath string, sce
 		}
 	}
 
+	if tlsCertPath != "" {
+		tlsCert, err = ioutil.ReadFile(tlsCertPath)
+
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	scepSubject := [][][]string{
 		[][]string{
 			[]string{"O", "MicroMDM"},
@@ -39,6 +47,7 @@ func NewService(pushCertPath string, pushCertPass string, caCertPath string, sce
 		SCEPChallenge: scepChallenge,
 		Topic:         pushTopic,
 		CACert:        caCert,
+		TLSCert:       tlsCert,
 	}, nil
 }
 
@@ -49,6 +58,7 @@ type service struct {
 	SCEPSubject   [][][]string
 	Topic         string // APNS Topic for MDM notifications
 	CACert        []byte
+	TLSCert       []byte
 }
 
 func (svc service) Enroll(ctx context.Context) (Profile, error) {
@@ -93,6 +103,8 @@ func (svc service) Enroll(ctx context.Context) (Profile, error) {
 		Topic: svc.Topic,
 	}
 
+	payloadContent := []interface{}{*scepPayload, mdmPayloadContent}
+
 	if len(svc.CACert) > 0 {
 		caPayload := NewPayload("com.apple.ssl.certificate")
 		caPayload.PayloadDisplayName = "Root certificate for MicroMDM"
@@ -100,10 +112,21 @@ func (svc service) Enroll(ctx context.Context) (Profile, error) {
 		caPayload.PayloadIdentifier = "com.github.micromdm.ssl.ca"
 		caPayload.PayloadContent = svc.CACert
 
-		profile.PayloadContent = []interface{}{*scepPayload, mdmPayloadContent, *caPayload}
-	} else {
-		profile.PayloadContent = []interface{}{*scepPayload, mdmPayloadContent}
+		payloadContent = append(payloadContent, *caPayload)
 	}
 
+	// Client needs to trust us at this point if we are using a self signed certificate.
+	if len(svc.TLSCert) > 0 {
+		tlsPayload := NewPayload("com.apple.security.pkcs1")
+		tlsPayload.PayloadDisplayName = "Self-signed TLS certificate for MicroMDM"
+		tlsPayload.PayloadDescription = "Installs the TLS certificate for MicroMDM"
+		tlsPayload.PayloadIdentifier = "com.github.micromdm.tls"
+		tlsPayload.PayloadContent = svc.TLSCert
+
+		payloadContent = append(payloadContent, *tlsPayload)
+	}
+
+	profile.PayloadContent = payloadContent
+
 	return *profile, nil
 }