mirror of
https://github.com/fleetdm/fleet
synced 2026-04-21 21:47:20 +00:00
aff7baf3f6
This pull request introduces new configuration profiles to support Okta conditional access for macOS devices, specifically targeting the Information Technology department. It also updates the GitHub Actions workflow to include a new secret for the Okta CA certificate. Additionally, it removes the `workstations-canary` team configuration, likely as part of a cleanup or migration. The most important changes are: **Conditional Access and Okta Integration:** * Added a new configuration profile, `fleet-okta-conditional-access.mobileconfig`, to manage trusted CA certificates, SCEP enrollment, mTLS identity preferences, and Chrome mTLS auto-selection for Okta conditional access on macOS. This profile is applied to devices labeled with "Department: Information Technology". [[1]](diffhunk://#diff-904aba5588b0d2c8dc325414aa1e8f2cd8a324602ac8e0c1cd2a5dff28db357bR1-R157) [[2]](diffhunk://#diff-96f80858f5a487334ae6014cddaa65d1bb79d7e85fa0ea596d1e49063f5b99bdR72-R77) * Added a new configuration profile, `okta-verify-settings.mobileconfig`, to configure privacy preferences, managed login items, notification settings, and Okta Verify app settings for macOS devices in the Information Technology department. [[1]](diffhunk://#diff-b321656e070ad9cb0727fe7ced60565d88bf31d236ac2642d3192fcb375fa4b2R1-R129) [[2]](diffhunk://#diff-96f80858f5a487334ae6014cddaa65d1bb79d7e85fa0ea596d1e49063f5b99bdR72-R77) **Workflow and Secrets Management:** * Updated the GitHub Actions workflow (`dogfood-gitops.yml`) to include the `DOGFOOD_OKTA_CA_CERTIFICATE` secret, supporting the new Okta conditional access configuration. **Configuration Cleanup:** * Removed the `workstations-canary.yml` team configuration, eliminating its policies, software, scripts, and settings. --------- Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com> Co-authored-by: Allen Houchins <allenhouchins@mac.com>
129 lines
4.2 KiB
XML
129 lines
4.2 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<plist version="1.0">
|
|
<dict>
|
|
<key>PayloadContent</key>
|
|
<array>
|
|
<dict>
|
|
<key>PayloadDisplayName</key>
|
|
<string>Privacy Preferences Policy Control</string>
|
|
<key>PayloadIdentifier</key>
|
|
<string>com.apple.TCC.configuration-profile-policy.DFBB4921-A766-42FE-AC3E-47150B51991F</string>
|
|
<key>PayloadType</key>
|
|
<string>com.apple.TCC.configuration-profile-policy</string>
|
|
<key>PayloadUUID</key>
|
|
<string>DFBB4921-A766-42FE-AC3E-47150B51991F</string>
|
|
<key>PayloadVersion</key>
|
|
<integer>1</integer>
|
|
<key>Services</key>
|
|
<dict>
|
|
<key>BluetoothAlways</key>
|
|
<array>
|
|
<dict>
|
|
<key>Authorization</key>
|
|
<string>Allow</string>
|
|
<key>CodeRequirement</key>
|
|
<string>anchor apple generic and identifier "com.okta.mobile" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = B7F62B65BN)</string>
|
|
<key>Identifier</key>
|
|
<string>com.okta.mobile</string>
|
|
<key>IdentifierType</key>
|
|
<string>bundleID</string>
|
|
<key>StaticCode</key>
|
|
<false/>
|
|
</dict>
|
|
</array>
|
|
</dict>
|
|
</dict>
|
|
<dict>
|
|
<key>PayloadDisplayName</key>
|
|
<string>Service Management - Managed Login Items</string>
|
|
<key>PayloadIdentifier</key>
|
|
<string>com.apple.servicemanagement.C06873D1-CEE5-4CBD-8C3B-EE96BAF487D1</string>
|
|
<key>PayloadType</key>
|
|
<string>com.apple.servicemanagement</string>
|
|
<key>PayloadUUID</key>
|
|
<string>C06873D1-CEE5-4CBD-8C3B-EE96BAF487D1</string>
|
|
<key>PayloadVersion</key>
|
|
<integer>1</integer>
|
|
<key>Rules</key>
|
|
<array>
|
|
<dict>
|
|
<key>RuleType</key>
|
|
<string>BundleIdentifier</string>
|
|
<key>RuleValue</key>
|
|
<string>com.okta.mobile</string>
|
|
<key>TeamIdentifier</key>
|
|
<string>B7F62B65BN</string>
|
|
</dict>
|
|
</array>
|
|
</dict>
|
|
<dict>
|
|
<key>NotificationSettings</key>
|
|
<array>
|
|
<dict>
|
|
<key>BadgesEnabled</key>
|
|
<true/>
|
|
<key>BundleIdentifier</key>
|
|
<string>com.okta.mobile</string>
|
|
<key>ShowInNotificationCenter</key>
|
|
<true/>
|
|
</dict>
|
|
</array>
|
|
<key>PayloadDisplayName</key>
|
|
<string>Notifications</string>
|
|
<key>PayloadIdentifier</key>
|
|
<string>com.apple.notificationsettings.C2C42EC8-D883-4102-AD50-C7B03FDD6E01</string>
|
|
<key>PayloadType</key>
|
|
<string>com.apple.notificationsettings</string>
|
|
<key>PayloadUUID</key>
|
|
<string>C2C42EC8-D883-4102-AD50-C7B03FDD6E01</string>
|
|
<key>PayloadVersion</key>
|
|
<integer>1</integer>
|
|
</dict>
|
|
<dict>
|
|
<key>PayloadDisplayName</key>
|
|
<string>Okta Verify</string>
|
|
<key>PayloadIdentifier</key>
|
|
<string>com.okta.mobile.025AA0BB-1D39-456C-BA51-7274DFD0C4F5</string>
|
|
<key>PayloadType</key>
|
|
<string>com.okta.mobile</string>
|
|
<key>PayloadUUID</key>
|
|
<string>025AA0BB-1D39-456C-BA51-7274DFD0C4F5</string>
|
|
<key>PayloadVersion</key>
|
|
<integer>1</integer>
|
|
<key>OktaVerify.OrgUrl</key>
|
|
<string>fleetdm.okta.com</string>
|
|
<key>OktaVerify.LaunchOptions</key>
|
|
<string>HideMainWindow</string>
|
|
</dict>
|
|
<dict>
|
|
<key>PayloadDisplayName</key>
|
|
<string>Okta Verify Auth Service Extension</string>
|
|
<key>PayloadIdentifier</key>
|
|
<string>com.okta.mobile.auth-service-extension.F8A21C44-3E9B-4D5C-9F2A-1B8E7D4A9C3F</string>
|
|
<key>PayloadType</key>
|
|
<string>com.okta.mobile.auth-service-extension</string>
|
|
<key>PayloadUUID</key>
|
|
<string>F8A21C44-3E9B-4D5C-9F2A-1B8E7D4A9C3F</string>
|
|
<key>PayloadVersion</key>
|
|
<integer>1</integer>
|
|
<key>OktaVerify.OrgUrl</key>
|
|
<string>fleetdm.okta.com</string>
|
|
<key>OktaVerify.LaunchOptions</key>
|
|
<string>HideMainWindow</string>
|
|
</dict>
|
|
</array>
|
|
<key>PayloadDisplayName</key>
|
|
<string>Okta Verify settings</string>
|
|
<key>PayloadIdentifier</key>
|
|
<string>com.fleetdm.okta-verify.settings</string>
|
|
<key>PayloadScope</key>
|
|
<string>System</string>
|
|
<key>PayloadType</key>
|
|
<string>Configuration</string>
|
|
<key>PayloadUUID</key>
|
|
<string>078FDE56-2002-4189-AFE6-019167F0F9F9</string>
|
|
<key>PayloadVersion</key>
|
|
<integer>1</integer>
|
|
</dict>
|
|
</plist>
|