From cb9bdcae37d064dbf4b790e098e57c35bffb7f34 Mon Sep 17 00:00:00 2001 From: Mosen Date: Tue, 28 Jun 2016 22:03:45 +1000 Subject: [PATCH] Fix error with plist encoding by dereferencing nested payloads. Add correct header for enrollment profile. Enrollment works with micromdm/scep server! --- endpoint.go | 2 +- profile.go | 20 ++++++++++---------- service.go | 35 +++++++++++++++++++++-------------- transport.go | 8 +++----- 4 files changed, 35 insertions(+), 30 deletions(-) diff --git a/endpoint.go b/endpoint.go index ad57b658..4009fa06 100644 --- a/endpoint.go +++ b/endpoint.go @@ -8,7 +8,7 @@ import ( type mdmEnrollRequest struct{} type mdmEnrollResponse struct { - *Profile + Profile } func makeEnrollEndpoint(svc Service) endpoint.Endpoint { diff --git a/profile.go b/profile.go index c949baa7..13b0094e 100644 --- a/profile.go +++ b/profile.go @@ -13,7 +13,7 @@ type Payload struct { PayloadDisplayName string `json:"displayname" db:"displayname"` PayloadDescription string `json:"description,omitempty" db:"description"` PayloadOrganization string `json:"organization,omitempty" db:"organization"` - PayloadContent interface{} `json:"content,omitempty"` + PayloadContent interface{} `json:"content,omitempty" plist:"PayloadContent,omitempty"` } type Profile struct { @@ -43,35 +43,35 @@ func NewProfile() *Profile { } } -func NewPayload(identifier string) *Payload { +func NewPayload(payloadType string) *Payload { payloadUuid := uuid.NewV4() return &Payload{ - PayloadVersion: 1, - PayloadIdentifier: identifier, - PayloadUUID: payloadUuid.String(), + PayloadVersion: 1, + PayloadType: payloadType, + PayloadUUID: payloadUuid.String(), } } type SCEPPayloadContent struct { - CAFingerprint []byte `plist:"omitempty"` // NSData - Challenge string `plist:"omitempty"` + CAFingerprint []byte `plist:"CAFingerprint,omitempty"` // NSData + Challenge string `plist:"Challenge,omitempty"` Keysize int KeyType string `plist:"Key Type"` KeyUsage int `plist:"Key Usage"` Name string - Subject [][][]string `plist:"omitempty"` + Subject [][][]string `plist:"Subject,omitempty"` URL string } // TODO: Actually this is one of those non-nested payloads that doesnt respect the PayloadContent key. type MDMPayloadContent struct { - Payload Payload + Payload AccessRights int CheckInURL string CheckOutWhenRemoved bool IdentityCertificateUUID string - ServerCapabilities []string `plist:"omitempty"` + ServerCapabilities []string `plist:"ServerCapabilities,omitempty"` ServerURL string Topic string } diff --git a/service.go b/service.go index e02164c6..f2a75cdc 100644 --- a/service.go +++ b/service.go @@ -1,7 +1,7 @@ package enroll type Service interface { - Enroll() (*Profile, error) + Enroll() (Profile, error) } func NewService() Service { @@ -13,7 +13,11 @@ func NewService() Service { } return &service{ + Url: "https://micromdm.local:6443", + SCEPUrl: "http://micromdm.local:2019/scep", SCEPSubject: scepSubject, + Topic: "", + CACert: []byte{}, } } @@ -23,9 +27,10 @@ type service struct { SCEPChallenge string SCEPSubject [][][]string Topic string // APNS Topic for MDM notifications + CACert []byte } -func (svc service) Enroll() (*Profile, error) { +func (svc service) Enroll() (Profile, error) { profile := NewProfile() profile.PayloadIdentifier = "com.github.micromdm.micromdm.mdm" profile.PayloadOrganization = "MicroMDM" @@ -45,15 +50,16 @@ func (svc service) Enroll() (*Profile, error) { scepPayload := NewPayload("com.apple.security.scep") scepPayload.PayloadDescription = "Configures SCEP" scepPayload.PayloadDisplayName = "SCEP" + scepPayload.PayloadIdentifier = "com.github.micromdm.scep" scepPayload.PayloadContent = scepContent - mdmPayload := MDMPayloadContent{ - Payload: Payload{ - PayloadVersion: 1, - PayloadType: "com.apple.mdm", - PayloadDescription: "Enrolls with the MDM server", - PayloadOrganization: "MicroMDM", - }, + mdmPayload := NewPayload("com.apple.mdm") + mdmPayload.PayloadDescription = "Enrolls with the MDM server" + mdmPayload.PayloadOrganization = "MicroMDM" + mdmPayload.PayloadIdentifier = "com.github.micromdm.mdm" + + mdmPayloadContent := MDMPayloadContent{ + Payload: *mdmPayload, AccessRights: 8191, CheckInURL: svc.Url + "/mdm/checkin", CheckOutWhenRemoved: true, @@ -62,11 +68,12 @@ func (svc service) Enroll() (*Profile, error) { Topic: svc.Topic, } - caPayload := NewPayload("com.apple.ssl.certificate") - caPayload.PayloadDisplayName = "Root certificate for MicroMDM" - caPayload.PayloadDescription = "Installs the root CA certificate for MicroMDM" + //caPayload := NewPayload("com.apple.ssl.certificate") + //caPayload.PayloadDisplayName = "Root certificate for MicroMDM" + //caPayload.PayloadDescription = "Installs the root CA certificate for MicroMDM" + //caPayload.PayloadContent = []byte{} - profile.PayloadContent = []interface{}{scepPayload, mdmPayload, caPayload} + profile.PayloadContent = []interface{}{*scepPayload, mdmPayloadContent} - return profile, nil + return *profile, nil } diff --git a/transport.go b/transport.go index 783f8ebb..607c7703 100644 --- a/transport.go +++ b/transport.go @@ -37,13 +37,11 @@ func decodeMDMEnrollRequest(_ context.Context, r *http.Request) (interface{}, er func encodeResponse(ctx context.Context, w http.ResponseWriter, response interface{}) error { resp := response.(mdmEnrollResponse) - plistData, err := plist.Marshal(resp.Profile) - if err != nil { + w.Header().Set("Content-Type", "application/x-apple-aspen-config") + + if err := plist.NewEncoder(w).Encode(resp); err != nil { return err } - if len(plistData) != 0 { - w.Write(plistData) - } return nil }