Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-02 19:07:38 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 96
fleet/it-and-security/lib/macos/configuration-profiles/okta-verify-settings.mobileconfig

130 lines
4.2 KiB
Text
Raw Normal View History

Pilot deployment of Okta Verify (#38646) This pull request introduces new configuration profiles to support Okta conditional access for macOS devices, specifically targeting the Information Technology department. It also updates the GitHub Actions workflow to include a new secret for the Okta CA certificate. Additionally, it removes the `workstations-canary` team configuration, likely as part of a cleanup or migration. The most important changes are: **Conditional Access and Okta Integration:** * Added a new configuration profile, `fleet-okta-conditional-access.mobileconfig`, to manage trusted CA certificates, SCEP enrollment, mTLS identity preferences, and Chrome mTLS auto-selection for Okta conditional access on macOS. This profile is applied to devices labeled with "Department: Information Technology". [[1]](diffhunk://#diff-904aba5588b0d2c8dc325414aa1e8f2cd8a324602ac8e0c1cd2a5dff28db357bR1-R157) [[2]](diffhunk://#diff-96f80858f5a487334ae6014cddaa65d1bb79d7e85fa0ea596d1e49063f5b99bdR72-R77) * Added a new configuration profile, `okta-verify-settings.mobileconfig`, to configure privacy preferences, managed login items, notification settings, and Okta Verify app settings for macOS devices in the Information Technology department. [[1]](diffhunk://#diff-b321656e070ad9cb0727fe7ced60565d88bf31d236ac2642d3192fcb375fa4b2R1-R129) [[2]](diffhunk://#diff-96f80858f5a487334ae6014cddaa65d1bb79d7e85fa0ea596d1e49063f5b99bdR72-R77) **Workflow and Secrets Management:** * Updated the GitHub Actions workflow (`dogfood-gitops.yml`) to include the `DOGFOOD_OKTA_CA_CERTIFICATE` secret, supporting the new Okta conditional access configuration. **Configuration Cleanup:** * Removed the `workstations-canary.yml` team configuration, eliminating its policies, software, scripts, and settings. --------- Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com> Co-authored-by: Allen Houchins <allenhouchins@mac.com>
2026-01-28 22:24:21 +00:00
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>PayloadDisplayName</key>
<string>Privacy Preferences Policy Control</string>
<key>PayloadIdentifier</key>
<string>com.apple.TCC.configuration-profile-policy.DFBB4921-A766-42FE-AC3E-47150B51991F</string>
<key>PayloadType</key>
<string>com.apple.TCC.configuration-profile-policy</string>
<key>PayloadUUID</key>
<string>DFBB4921-A766-42FE-AC3E-47150B51991F</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>Services</key>
<dict>
<key>BluetoothAlways</key>
<array>
<dict>
<key>Authorization</key>
<string>Allow</string>
<key>CodeRequirement</key>
<string>anchor apple generic and identifier "com.okta.mobile" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = B7F62B65BN)</string>
<key>Identifier</key>
<string>com.okta.mobile</string>
<key>IdentifierType</key>
<string>bundleID</string>
<key>StaticCode</key>
<false/>
</dict>
</array>
</dict>
</dict>
<dict>
<key>PayloadDisplayName</key>
<string>Service Management - Managed Login Items</string>
<key>PayloadIdentifier</key>
<string>com.apple.servicemanagement.C06873D1-CEE5-4CBD-8C3B-EE96BAF487D1</string>
<key>PayloadType</key>
<string>com.apple.servicemanagement</string>
<key>PayloadUUID</key>
<string>C06873D1-CEE5-4CBD-8C3B-EE96BAF487D1</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>Rules</key>
<array>
<dict>
<key>RuleType</key>
<string>BundleIdentifier</string>
<key>RuleValue</key>
<string>com.okta.mobile</string>
<key>TeamIdentifier</key>
<string>B7F62B65BN</string>
</dict>
</array>
</dict>
<dict>
<key>NotificationSettings</key>
<array>
<dict>
<key>BadgesEnabled</key>
<true/>
<key>BundleIdentifier</key>
<string>com.okta.mobile</string>
<key>ShowInNotificationCenter</key>
<true/>
</dict>
</array>
<key>PayloadDisplayName</key>
<string>Notifications</string>
<key>PayloadIdentifier</key>
<string>com.apple.notificationsettings.C2C42EC8-D883-4102-AD50-C7B03FDD6E01</string>
<key>PayloadType</key>
<string>com.apple.notificationsettings</string>
<key>PayloadUUID</key>
<string>C2C42EC8-D883-4102-AD50-C7B03FDD6E01</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
<dict>
<key>PayloadDisplayName</key>
<string>Okta Verify</string>
<key>PayloadIdentifier</key>
<string>com.okta.mobile.025AA0BB-1D39-456C-BA51-7274DFD0C4F5</string>
<key>PayloadType</key>
<string>com.okta.mobile</string>
<key>PayloadUUID</key>
<string>025AA0BB-1D39-456C-BA51-7274DFD0C4F5</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>OktaVerify.OrgUrl</key>
<string>fleetdm.okta.com</string>
<key>OktaVerify.LaunchOptions</key>
<string>HideMainWindow</string>
</dict>
<dict>
<key>PayloadDisplayName</key>
<string>Okta Verify Auth Service Extension</string>
<key>PayloadIdentifier</key>
<string>com.okta.mobile.auth-service-extension.F8A21C44-3E9B-4D5C-9F2A-1B8E7D4A9C3F</string>
<key>PayloadType</key>
<string>com.okta.mobile.auth-service-extension</string>
<key>PayloadUUID</key>
<string>F8A21C44-3E9B-4D5C-9F2A-1B8E7D4A9C3F</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>OktaVerify.OrgUrl</key>
<string>fleetdm.okta.com</string>
<key>OktaVerify.LaunchOptions</key>
<string>HideMainWindow</string>
</dict>
</array>
<key>PayloadDisplayName</key>
<string>Okta Verify settings</string>
<key>PayloadIdentifier</key>
<string>com.fleetdm.okta-verify.settings</string>
<key>PayloadScope</key>
<string>System</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>078FDE56-2002-4189-AFE6-019167F0F9F9</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>
Reference in a new issue Copy permalink