search

fleetdm / fleet

Open-source platform for IT, security, and infrastructure teams. (Linux, macOS, Chrome, Windows, cloud, data center)
https://fleetdm.com
Other
3.09k stars 427 forks source link

Deploy Configuration Profiles that automatically inject host-specific attributes into the profile payload #20690

Open Patagonia121 opened 3 months ago

Patagonia121 commented 3 months ago
noahtalerman commented 2 months ago

We proved we could use %SerialNumber% (and other values) in a payload per https://support.apple.com/guide/deployment/variables-settings-for-mdm-payloads-dep04666af94/1/web/1.0 that would be substituted on host. FYI to Fleet for documentation updates.

Hey @Patagonia121 and @ambrusps assuming this is about connecting a host to Okta Verify (or a similar tool) I think this request already works but we don't have a guide for it.

Here's the issue tracking the guide here:

I'm fairly confident we already cover customer-reedtimmer's use case. They use Okta Verify.

I'm not sure about customer-pingali

@ambrusps and @Patagonia121 can you please help me confirm this?

Closing this issue for now in favor of the guide. We can always reopen.

fleet-release commented 2 months ago

Profiles auto-fill, Host data in cloud weave. Admins find relief.

Patagonia121 commented 1 month ago

@noahtalerman we heard from customer-reedtimmer today that unfortunately this doesn't solve their use case. They do not use Okta Verify and they have flows outside that specific use case where they still need to inject custom attributes from the host into configuration profiles. They mentioned that this https://github.com/fleetdm/fleet/issues/21294 starts to cover it, but the use case is not only Okta Verify.

As an example, they use Cyberhaven and need to send a profile for a specific domain where mdm_username must be mapped to the assigned user. In Fleet, they'd associate the custom human device-mapping to an email and need to inject its value to a profile.

I'm reopening this issue given their feedback today and we can decide how to move forward from here. Thanks!

noahtalerman commented 1 month ago

Thanks for following up @Patagonia121!

need to inject custom attributes from the host into configuration profiles. They mentioned that this https://github.com/fleetdm/fleet/issues/21294 starts to cover it, but the use case is not only Okta Verify.

Makes sense 👍

they use Cyberhaven and need to send a profile for a specific domain where mdm_username must be mapped to the assigned user. In Fleet, they'd associate the custom human device-mapping to an email and need to inject its value to a profile.

Great example!

I think we want to track a separate request for this: "Deploy configuration profiles w/ end user's email as a variable"

Can you please help track that and confirm that that would solve their use case?

JoStableford commented 1 month ago

Linked to Unthread ticket:

Conversation #3129)

noahtalerman commented 3 weeks ago

Moved the original issue here for safekeeping:

User story: As an admin, I want to deploy Configuration Profiles that automatically inject host-specific attributes into the profile payload, facilitating the delivery of host-specific configurations so that Munki can read this information and deploy different apps based on user's group membership in IdP.

Customer feedback:

Added as a blocker due to Smallstep certification deployment requiring including host’s serial in generated SCEP payload. We proved we could use %SerialNumber% (and other values) in a payload per https://support.apple.com/guide/deployment/variables-settings-for-mdm-payloads-dep04666af94/1/web/1.0 that would be substituted on host. FYI to Fleet for documentation updates.

noahtalerman commented 3 weeks ago

@Patagonia121 @pintomi1989 when you get the chance, can you please add Gong snippets for pingali and deebradel? Thanks!

Patagonia121 commented 3 weeks ago

@ambrusps since you added the tag for customer-pingali, can you grab the gong snippet and add to the issue description above?

noahtalerman commented 2 weeks ago

Hey @ambrusps and @pintomi1989 just giving you another ping! Can you please add the Gong snippets for pingali and deebradel?

pintomi1989 commented 2 weeks ago

Hey @ddribeiro,

Tagging you here since you added the tag for customer-deebradel here a few weeks ago. I looked around and I'm not turning up any recordings or notes around this ask

noahtalerman commented 2 weeks ago

Hey @ambrusps just giving you another ping! Can you please add the Gong snippet for pingali?

allenhouchins commented 2 weeks ago

@Patagonia121 - Can you help add the snippet from today's call with customer-sarahwu? Specifically the segment where the conversation starts talking about Okta and ends with SCEP would be great.

@noahtalerman This is a blocker for customer-sarahwu to adopt Fleet MDM. The snippet that @Patagonia121 will help get added will be very insightful as to why.

Patagonia121 commented 2 weeks ago

I dropped customer-sarahwu's snippet into the issue @allenhouchins @noahtalerman. Let me know if you need anything else!

noahtalerman commented 2 weeks ago

Hey @ambrusps and @ddribeiro can you please add the Gong snippet for pingali and deebradel?

ambrusps commented 1 week ago

@noahtalerman sorry for the long wait on this, it wasn't a direct request from customer-pingali but more so a feature that will help their overall objective of human to device mapping. I added a snippet above that most closely mentions this for now. Let me know if further clarification is needed

noahtalerman commented 1 week ago

@ambrusps I don't see the pingali clip in the issue description. Can you please share it again?

noahtalerman commented 1 week ago

Hey @ambrusps, just following up w/ another ping! I can't find the pingali clip you mentioned in your comment here.

ambrusps commented 6 days ago

@noahtalerman added above