Windows MDM enrollment: MS-MDE2 protocol implementation

[lukeheath]

Goal

As a developer, I aim to support Windows Devices enrollment by implementing the MS-MDE2 protocol specification in the Fleet server. Initially, only the 'On-Premise' auth type should be supported. A sample proof of concept (PoC) with an MS-MDE2 implementation is available here. Example protocol exchange here and here.

• Example IDiscoveryService endpoint here.
• Example Certificate Enrollment Policy endpoint here
• Example RequestSecurityToken endpoint here.

Tasks

• [ ] Implement the IDiscoveryService endpoint interface details as described in section 3.1 of the MS-MDE2 spec here.
• [ ] The service endpoints are hardcoded and don't need to be configured through configuration.
• [ ] The IDiscoveryService should handle any errors during the discovery process and return appropriate error messages.
• [ ] Implement the endpoint interface to handle X.509 Certificate Enrollment Policy (MS-XCEP) requests for certificate enrollment policies as described in section 3.3 of the MS-MDE2 spec here
• [ ] The server should return a collection of certificate enrollment policy objects in response to valid requests.
• [ ] Implement the RequestSecurityToken operation as part of the interaction with WS-Trust X.509v3 Token Enrollment (MS-WSTEP) as described in section 3.4 of the MS-MDE2 spec here
• [ ] The server should correctly parse incoming MS-WSTEP RequestSecurityToken messages.
• [ ] The server should return a RequestSecurityTokenResponseCollection message containing the identity and provisioning information for the device management client in response to valid requests.
• [ ] The server should validate the incoming requests using the wsse:BinarySecurityToken field
• [ ] The server should return appropriate error messages for invalid requests.

Context

• Requestor(s): Marcos Oviedo

There is no NanoMDM equivalent for Windows, so there is some technical foundation work required to begin implementing Windows MDM features.

QA

Risk assessment

• [ ] Requires load testing TODO

Risk level: Low / High TODO

Risk description: TODO

Automated:

• Fleet: Cover / Will not cover
• QAWolf: Cover / Will not cover

Manual testing steps

1. Step 1
2. Step 2
3. Step 3

Testing notes

Confirmation

1. [ ] Engineer (@____): Added comment to user story confirming succesful completion of QA.
2. [ ] QA (@____): Added comment to user story confirming succesful completion of QA.

[zhumo]

@georgekarrv I removed the product label to take it off the board. We're gonna make a subtask of #11952.

[noahtalerman]

@georgekarrv do we still need this for programmatic enrollment to work? My guess is no if programmatic enrollment works as expected.

[georgekarrv]

Closing this as it's mostly a duplicate of #11952

[fleet-release]

Windows MDM enrolled, Secure in the cloud city, Fleet stands strong, controlled.