Guide: Enable Okta Verify on my macOS hosts using variables in configuration profiles

noahtalerman commented 1 month ago

Goal

User story
As a Client Platform Engineer,
I want to know how to deploying a profile (SCEP payload) in Fleet w/ computer name, serial number, and UUID as variables
so that Fleet, for each host, populates this variable with host specific information. This way, I can install a unique SCEP certificate to enable Okta Verify on my macOS hosts.

Context

We learned that the necessary variables are already supported natively in macOS and we don't need to make changes to Fleet to support this workflow: https://github.com/fleetdm/fleet/issues/16958#issuecomment-2225840359

Changes

Product

[ ] Reference documentation changes: None.
[ ] UI changes: None.
[ ] CLI usage changes: None.
[ ] REST API changes: None.
[ ] Fleet's agent (fleetd) changes: None.
[ ] Permissions changes: None.
[ ] Changes to paid features or tiers: None.

Engineering

[ ] Feature guide changes: Sign up for an Okta trial, test this workflow, and write a guide that walks the IT admin through how to connect a macOS host to Okta verify using variables in config profiles in Fleet.
[ ] Database schema migrations: None.
[ ] Load testing: None.

noahtalerman commented 1 month ago

Hey @georgekarrv, I can't remember...do we treat missing guides as bugs?

If so, can you please update this to a bug and pull it onto the release board?

cc @lukeheath

lukeheath commented 3 weeks ago

@noahtalerman Yes, we track any missing documentation as bugs. @georgekarrv please reformat and bring into the board when you have the chance. Thanks!

georgekarrv commented 3 weeks ago

Hey team! Please add your planning poker estimate with Zenhub @dantecatalfamo @ghernandez345 @gillespi314 @jahzielv @mna @roperzh

roperzh commented 6 days ago

note: it already happened in the past that we wanted a feature like this for both mac and windows, however since the issue description explicitly calls out macOS, I'll move forward with macOS only.

roperzh commented 6 days ago

note II: looking at the Okta Verify flow, it's a multi step setup, where issuing a SCEP certificate is just one step of many. I won't note all of that in the guide, because we would be documenting the Okta product.

The guide will be about how to configure and distribute a SCEP profile in Fleet that uses Okta as the CA. Something very similar to this page only https://help.okta.com/oie/en-us/content/topics/identity-engine/devices/configure-ca-main.htm

fleetdm / fleet