mirror of
https://github.com/fleetdm/fleet
synced 2026-05-24 09:28:54 +00:00
3451ec6454
## Summary - Adds Fleet's dynamic SCEP challenge (Okta CA with a dynamic challenge, available since Fleet 4.81.0) as the recommended path for Device Access certificates on macOS 14+ - Preserves static SCEP as a documented legacy option, each with its own downloadable example profile - Adds `okta-device-access-scep-dynamic-example.mobileconfig` using `$FLEET_VAR_NDES_SCEP_PROXY_URL` and `$FLEET_VAR_NDES_SCEP_CHALLENGE`; existing static example profile unchanged - Corrects renewal claim: neither static nor dynamic SCEP supports automatic certificate renewal per Okta's own documentation — both require profile redeployment before expiration - Adds Okta documentation links throughout for proper SEO and cross-reference: - [Use Okta as a CA for Device Access](https://help.okta.com/oie/en-us/content/topics/oda/oda-as-scep-okta-ca.htm) - [Configure Okta as a CA with a dynamic SCEP challenge](https://help.okta.com/oie/en-us/content/topics/identity-engine/devices/okta-ca-dynamic-scep-macos-jamf.htm) - [Configure Okta as a CA with a static SCEP challenge](https://help.okta.com/oie/en-us/content/topics/identity-engine/devices/okta-ca-static-scep-macos-jamf.htm) - Uses correct Fleet UI path and CA type name verified against `helpers.tsx` and the 4.81.0 release article - Uses Okta's exact field names (SCEP URL, Challenge URL, Username, Password) verified from Okta's documentation - Updates `publishedOn` to reflect the revision date ## Files changed - `articles/deploying-okta-platform-sso-with-fleet.md` — article update - `docs/solutions/macos/configuration-profiles/okta-device-access-scep-dynamic-example.mobileconfig` — new dynamic SCEP example profile - `docs/solutions/macos/configuration-profiles/okta-device-access-scep-example.mobileconfig` — unchanged (static example) ## Test plan - [ ] Article renders correctly on fleetdm.com preview - [ ] Dynamic example profile link resolves: `okta-device-access-scep-dynamic-example.mobileconfig` - [ ] Static example profile link resolves: `okta-device-access-scep-example.mobileconfig` - [ ] All Okta documentation links resolve - [ ] Fleet UI path verified: **Settings → Integrations → Certificate authorities → Add CA → Okta CA or Microsoft Device Enrollment service (NDES)** - [ ] Fleet variables `$FLEET_VAR_NDES_SCEP_PROXY_URL` and `$FLEET_VAR_NDES_SCEP_CHALLENGE` confirmed in Fleet docs - [ ] Meta tags present with updated `publishedOn` date - [ ] Style guide compliance verified (active voice, bold UI elements, no marketing fluff) |
||
|---|---|---|
| .. | ||
| all | ||
| android/configuration-profiles | ||
| api-scripts | ||
| docker-compose | ||
| ios-ipados | ||
| linux | ||
| macos | ||
| tines | ||
| windows | ||
| README.md | ||
Solutions
Best Practices
General
- Name the file what the profile does.
- For example, instead of
googlePlayProtectVerifyApps.json(the name of the Android policy for this control), describe what it does:enforce-google-play-protect.json.
- For example, instead of
- Use kebab case in file names, with all letters in lowercase.
- Instead of
passwordPolicy.json, usepassword-policy.json.
- Instead of
- Be sure to end files with an empty newline.
symlinks
If a solution is applicable to multiple platforms, keep the original in the main platform directory and symlink it to the other platforms. For example, if an Apple configuration profile can be used on both macOS and iOS, use macOS as the source, and create a symlink in the iOS directory.
cd docs/solutions/ios-ipados/configuration-profiles/- Note that this is the destination that we want the symlink to be in.
ln -s ../../macos/configuration-profiles/my-profile.mobileconfig .- The
.here at the end means the current directory, and will use the same file name as the original (which is what we want).
- The
git add profile.mobileconfiggit commit