3991374503
* Stub new method for application datastore Handle command failures more gracefully than continuously retrying. Failures are not logged Add table for certificates. (cherry picked from commit9f580a6) * Remove methods with signature NewDatastore() from datastores and injection of the logger instance into each datastore because groob is a doodoo head :) Move NewDatastore methods into unit tests Reinstate NewDB test Create certificates package including a Certificate type and a datastore. Began working on a method ackCertificateList in the connect service. Boilerplate for management service test. Renamed some tables in certificates migration, hopefully nobody notices. Applications response handler should be omitted from this branch. (cherry picked from commit8bc2fc7) * Add device uuid to certificate, as there will never be a normalised form of the certificate data. Change statments to reflect table change from certificates to devices_certificates Add the CertificateList request type to the connect service's Acknowledge method Add certificates datastore to the management service, and add endpoints and request/responses for retrieving certificates by device uuid to the management endpoujnt. Kludge. commits regarding app service will be amended. (cherry picked from commitc723c80) * Don't forget the endpoint definition for certificates! (cherry picked from commit4e5fc1f) * Use byte field for certificate data. (cherry picked from commit66d5036) * Fix empty import in certificates (cherry picked from commitb6d4dca) * Add table for certificates. (cherry picked from commit 06bc231) * Renamed some tables in certificates migration, hopefully nobody notices. Rebase develop onto master (cherry picked from commit 775484d) * Certificate list responses are saved via replacing the entire certificate list on a per device basis. This is because neither the common name nor the data could be used as a unique constraint in the certificates table. Few small changes to imports/style. (cherry picked from commit e0a63e1) * Properly rollback if certificate insert fails for any certificate in a response. (cherry picked from commit 99e1ea1) * Fix several incorrect statements and struct tags which were preventing the certificates management endpoint from listing certs. Certificate listing is working without a base64 encoded representation of each certificate. (cherry picked from commit 685dfef) * Add commands index to command datastore. Add simple test for commands index Add commands index endpoint (cherry picked from commit 4e2a2a2) * Add handler for GET /mdm/commands (cherry picked from commit ae71b8f) * Added Find() method to commands datastore so that the request that matches a response can be retrieved by the connect service. Added Find() method to command service (cherry picked from commit ebceb28) * Fix globally scoped vars in command datastore test suite * groob prefers inline definition of struct members. * Uppercase CommandUuid * Add ackCertificateList to connect service, accidentally omitted from installed_certificate_list PR #14 Make push endpoint conform to Errorer interface. Wrap error return in management service. Add missing certsDB in main.go, should have been part of installed_certificate_list PR #14 * Fix erraneous comma in mdmEnrollResponse * Model is sent with Authenticate message so best to update it there without having to query DeviceInformation. * Incorrect struct tags result in PayloadScope not being included in the mdm enroll profile output.
mircomdm is a Mobile Device Management server for Apple Devices (primarily OS X macs).
While I intend to implement all the commands defined by Apple in the spec, the current focus is on implementing the features necessary to fit Apple's new(er) management tools (MDM, VPP, DEP) into existing enterprise environments.
This project now has a website with updated documentation - https://micromdm.io/
Overview
This repo is under heavy development. The current release is only for developers and expert users
Current status
- Fetch devices from DEP
- Supports
InstallApplicationandInstallProfilecommands - Accepts a variety of other MDM payloads such as
OSUpdateStatusandDeviceInformationbut just dumps the response from the device to standard output. - Push notifications are supported.
- Configuration profiles and applications can be grouped into a "workflow". The workflow can be assigned to a device.
Currently the DEP enrollment step will check for a workflow but ignore it. I'll be adding this feature next. - No SCEP/individual enrollment profiles yet. Need to have an enrollment profile on disk and pass it as a flag.
I set up a public trello board to manage what is currently worked on and make notes.
Getting started
Installation and configuration instructions will be maintained on the website.
Notes on architecture
- micromdm is an open source project written as an http server in Go
- deployed as a single binary.
- almost everything in the project is a separate library/service.
mainjust wraps these together and provides configuration flags - PostgreSQL for long lived data (devices, users, profiles, workflows)
- uses Redis to queue MDM Commands
- API driven - there will be an admin cli and a web ui, but the server itself is build as a RESTful API.
- exposes metrics data in Prometheus format.
Workflows
An administrator can group a DEP enrollment profile, a list of applications and a list of configuration profiles into a workflow and assign the workflow to a device.
If a device has an assigned workflow, micromdm will configure the device according to the workflow.
If you're familiar with Munki's manifest feature, workflows work in a similar way.
Build instructions
If you know Go
go get github.com/micromdm/micromdmcd $GOPATH/src/github.com/micromdm/micromdmglide installinstall the necessary dependencies into /vendor foldergo buildorgo install
If you're new to Go
Go is a bit different from other languages in its requirements for how it expects its programmers to organize Go code on a system.
First, Go expects you to choose a folder, called a workspace (you can name it anything you'd like). The path to this folder must always be set in an environment variable - GOPATH (example: GOPATH=/Users/groob/code/go)
Your GOPATH must have thee subfolders - bin, pkg and src, and any code you create must live inside the src folder. It's also helpful to add $GOPATH/bin to your environment's PATH as that is where go install will place go binaries that you build.
A few helpful resources for getting started with Go.
- Writing, building, installing, and testing Go code
- Resources for new Go programmers
- How I start
- How to write Go code
- GOPATH - go wiki page
To build MicroMDM you will need to:
- Download and install
Go - Install
glide - Set the
GOPATHas explained above. mkdir -p $GOPATH/src/github.com/micromdmgit clonethe project into the above folder.
The repo must always be in the folder$GOPATH/src/github.com/micromdm/micromdmeven if you forked the project. Add a git remote to your fork.glide installThe glide command will download and install all necessary dependencies for the project to compile.go buildorgo install- File an issue or a pull request if the instructions were unclear.
Makefile
The project has a Makefile and will build the project for you assuming you have GOPATH set correctly.
- run
maketo create a new build. make depswill install the necessary dependencies. after that you can usego build,go testetc.- run
make dockerto build a docker container from the local source.
Docker container for Redis and PostgreSQL
If you want to run locally for testing/development, an easy way to run PostgreSQL and Redis is by using docker-compose
docker-compose -f compose-pg.yml up
Dockerfiles for development and release.
-
Dockerfilewill build the latest release (by downloading the binaries). This is equivalent todocker pull micromdm/micromdm:latest -
Dockerfile.devbuilds the latest version from the local source.docker build -f Dockerfile.dev -t micromdm .
docker pull micromdm/micromdm:dev to get the latest version built from master.