From defacdff1583e8246f0c288e4261b25ef625c39a Mon Sep 17 00:00:00 2001 From: Jesse Peterson Date: Fri, 20 Mar 2020 13:48:48 -0700 Subject: [PATCH] Fixes and typo corrections for SCEP dynamic challenges (#656) * Fixes and typo corrections for SCEP dynamic challenges * Guard against not being configured --- CHANGELOG.md | 2 +- cmd/micromdm/serve.go | 10 ++++++---- platform/challenge/service.go | 5 +++++ 3 files changed, 12 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e3f60482..a535db5c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,7 +9,7 @@ * Workaround issue where a newly added DEP token would not be used after a restart (#546, #633) * Fix bug with applying an empty blueprint (#615, #634) * Add `-no-command-history` flag to disable saving of command history (#640). This works around a race-condition/scalability issue with device records (#556). -* Add dynamic SCEP challenges (#642). Require dynamic SCEP challenges for certificate issuance with `-use-dynamic-challege` and (only recommended for testing) generate them in enrollment profiles with `-gen-dynamic-challege`. +* Add dynamic SCEP challenges (#642). Require dynamic SCEP challenges for certificate issuance with `-use-dynamic-challenge` and (only recommended for testing) generate them in enrollment profiles with `-gen-dynamic-challenge`. * Add MDM commands to enable and disable remote desktop (#651) * SCEP payload key names were corrected (#652) diff --git a/cmd/micromdm/serve.go b/cmd/micromdm/serve.go index 251749ee..7ffc9e64 100644 --- a/cmd/micromdm/serve.go +++ b/cmd/micromdm/serve.go @@ -85,8 +85,8 @@ func serve(args []string) error { flHomePage = flagset.Bool("homepage", env.Bool("MICROMDM_HTTP_HOMEPAGE", true), "Hosts a simple built-in webpage at the / address") flSCEPClientValidity = flagset.Int("scep-client-validity", env.Int("MICROMDM_SCEP_CLIENT_VALIDITY", 365), "Sets the scep certificate validity in days") flNoCmdHistory = flagset.Bool("no-command-history", env.Bool("MICROMDM_NO_COMMAND_HISTORY", false), "disables saving of command history") - flUseDynChallenge = flagset.Bool("use-dynamic-challege", env.Bool("MICROMDM_USE_DYNAMIC_CHALLENGE", false), "require dynamic SCEP challenges") - flGenDynChalEnroll = flagset.Bool("gen-dynamic-challege", env.Bool("MICROMDM_GEN_DYNAMIC_CHALLENGE", false), "generate dynamic SCEP challenges in enrollment profile (built-in only)") + flUseDynChallenge = flagset.Bool("use-dynamic-challenge", env.Bool("MICROMDM_USE_DYNAMIC_CHALLENGE", false), "require dynamic SCEP challenges") + flGenDynChalEnroll = flagset.Bool("gen-dynamic-challenge", env.Bool("MICROMDM_GEN_DYNAMIC_CHALLENGE", false), "generate dynamic SCEP challenges in enrollment profile (built-in only)") flPrintArgs = flagset.Bool("print-flags", false, "Print all flags and their values") ) flagset.Usage = usageFor(flagset, "micromdm serve [flags]") @@ -267,8 +267,10 @@ func serve(args []string) error { depsyncEndpoints := sync.MakeServerEndpoints(sync.NewService(syncer, sm.SyncDB), basicAuthEndpointMiddleware) sync.RegisterHTTPHandlers(r, depsyncEndpoints, options...) - challengeEndpoints := challenge.MakeServerEndpoints(challenge.NewService(sm.SCEPChallengeDepot), basicAuthEndpointMiddleware) - challenge.RegisterHTTPHandlers(r, challengeEndpoints, options...) + if sm.SCEPChallengeDepot != nil { + challengeEndpoints := challenge.MakeServerEndpoints(challenge.NewService(sm.SCEPChallengeDepot), basicAuthEndpointMiddleware) + challenge.RegisterHTTPHandlers(r, challengeEndpoints, options...) + } r.HandleFunc("/boltbackup", httputil2.RequireBasicAuth(boltBackup(sm.DB), "micromdm", *flAPIKey, "micromdm")) } else { diff --git a/platform/challenge/service.go b/platform/challenge/service.go index 28d2a610..50098af8 100644 --- a/platform/challenge/service.go +++ b/platform/challenge/service.go @@ -2,6 +2,8 @@ package challenge import ( "context" + "errors" + challengestore "github.com/micromdm/scep/challenge/bolt" ) @@ -14,6 +16,9 @@ type ChallengeService struct { } func (c *ChallengeService) SCEPChallenge(ctx context.Context) (string, error) { + if c.scepChallengeStore == nil { + return "", errors.New("SCEP challenge store missing") + } return c.scepChallengeStore.SCEPChallenge() }