Empty consent text in enroll profile was generating an invalid plist key. (#39)

Enrollment service now takes the TLS certificate path and provides a PKCS1 payload with the servers TLS certificate in order to trust it at enroll time.

enroll/profile.go

@@ -31,7 +31,7 @@ type Profile struct {
 	PayloadScope             string            `json:"scope" db:"scope" plist:",omitempty"`
 	RemovalDate              *time.Time        `json:"removal_date" db:"removal_date" plist:"-" plist:",omitempty"`
 	DurationUntilRemoval     float32           `json:"duration_until_removal" db:"duration_until_removal" plist:",omitempty"`
-	ConsentText              map[string]string `json:"consent_text" db:"consent_text" plist:"omitempty"`
+	ConsentText              map[string]string `json:"consent_text" db:"consent_text" plist:",omitempty"`
 }
 
 func NewProfile() *Profile {

enroll/service.go

@@ -9,13 +9,13 @@ type Service interface {
 	Enroll(ctx context.Context) (Profile, error)
 }
 
-func NewService(pushCertPath string, pushCertPass string, caCertPath string, scepURL string, scepChallenge string, url string) (Service, error) {
+func NewService(pushCertPath string, pushCertPass string, caCertPath string, scepURL string, scepChallenge string, url string, tlsCertPath string) (Service, error) {
 	pushTopic, err := GetPushTopicFromPKCS12(pushCertPath, pushCertPass)
 	if err != nil {
 		return nil, err
 	}
 
-	var caCert []byte
+	var caCert, tlsCert []byte
 
 	if caCertPath != "" {
 		caCert, err = ioutil.ReadFile(caCertPath)
@@ -25,6 +25,14 @@ func NewService(pushCertPath string, pushCertPass string, caCertPath string, sce
 		}
 	}
 
+	if tlsCertPath != "" {
+		tlsCert, err = ioutil.ReadFile(tlsCertPath)
+
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	scepSubject := [][][]string{
 		[][]string{
 			[]string{"O", "MicroMDM"},
@@ -39,6 +47,7 @@ func NewService(pushCertPath string, pushCertPass string, caCertPath string, sce
 		SCEPChallenge: scepChallenge,
 		Topic:         pushTopic,
 		CACert:        caCert,
+		TLSCert:       tlsCert,
 	}, nil
 }
 
@@ -49,6 +58,7 @@ type service struct {
 	SCEPSubject   [][][]string
 	Topic         string // APNS Topic for MDM notifications
 	CACert        []byte
+	TLSCert       []byte
 }
 
 func (svc service) Enroll(ctx context.Context) (Profile, error) {
@@ -93,6 +103,8 @@ func (svc service) Enroll(ctx context.Context) (Profile, error) {
 		Topic: svc.Topic,
 	}
 
+	payloadContent := []interface{}{*scepPayload, mdmPayloadContent}
+
 	if len(svc.CACert) > 0 {
 		caPayload := NewPayload("com.apple.ssl.certificate")
 		caPayload.PayloadDisplayName = "Root certificate for MicroMDM"
@@ -100,10 +112,21 @@ func (svc service) Enroll(ctx context.Context) (Profile, error) {
 		caPayload.PayloadIdentifier = "com.github.micromdm.ssl.ca"
 		caPayload.PayloadContent = svc.CACert
 
-		profile.PayloadContent = []interface{}{*scepPayload, mdmPayloadContent, *caPayload}
-	} else {
-		profile.PayloadContent = []interface{}{*scepPayload, mdmPayloadContent}
+		payloadContent = append(payloadContent, *caPayload)
 	}
 
+	// Client needs to trust us at this point if we are using a self signed certificate.
+	if len(svc.TLSCert) > 0 {
+		tlsPayload := NewPayload("com.apple.security.pkcs1")
+		tlsPayload.PayloadDisplayName = "Self-signed TLS certificate for MicroMDM"
+		tlsPayload.PayloadDescription = "Installs the TLS certificate for MicroMDM"
+		tlsPayload.PayloadIdentifier = "com.github.micromdm.tls"
+		tlsPayload.PayloadContent = svc.TLSCert
+
+		payloadContent = append(payloadContent, *tlsPayload)
+	}
+
+	profile.PayloadContent = payloadContent
+
 	return *profile, nil
 }

main.go

@@ -241,7 +241,7 @@ func main() {
 		if *flTLSCACert == "" {
 			logger.Log("warn", "You did not specify a CA Certificate to trust via --tls-ca-cert or MICROMDM_TLS_CA_CERT. If your certificates are self signed, devices may not be able to enroll.")
 		}
-		enrollSvc, _ := enroll.NewService(*flPushCert, *flPushPass, *flTLSCACert, *flSCEPURL, *flSCEPChallenge, *flURL)
+		enrollSvc, _ := enroll.NewService(*flPushCert, *flPushPass, *flTLSCACert, *flSCEPURL, *flSCEPChallenge, *flURL, *flTLSCert)
 		enrollHandler := enroll.MakeHTTPHandler(ctx, enrollSvc, httpLogger)
 		mux.Handle("/mdm/enroll", enrollHandler)
 	}