Support SCEP automatic profile redistribution in Iru tutorial#532
Open
tashian wants to merge 2 commits into
Open
Support SCEP automatic profile redistribution in Iru tutorial#532tashian wants to merge 2 commits into
tashian wants to merge 2 commits into
Conversation
With Iru's automatic profile redistribution enabled, the SCEP library item's UUID is appended to the certificate Subject, so the agent's keychain lookup label must include it. Without this, the agent's exact-match certificate lookup fails after the first renewal and the agent cannot start. - Enable automatic profile redistribution in the SCEP profile steps - Add a step to copy the SCEP library item's UUID from its URL - Include the UUID in the agent's mackms: certificate label - Require creating the SCEP profile before the agent Custom Profile - Warn against $PROFILE_UUID in the agent profile and against recreating the SCEP library item Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Describe your changes:
The Iru (Kandji) tutorial's agent configuration only works while SCEP certificate renewal is off. When Automatic profile redistribution is enabled on the SCEP library item, Iru appends the SCEP library item's UUID to the certificate Subject, the keychain label changes, and the agent's exact-match certificate lookup fails — the agent can never start after the first renewal.
This updates the tutorial so the documented configuration works with renewal enabled:
step-agent-bootstrap <uuid>, single space before the UUID)mackms:certificate label, with the exact-match caveat$PROFILE_UUIDin the agent's Custom Profile (it renders that profile's own UUID, not the SCEP item's) and against deleting/recreating the SCEP library item (new UUID breaks enrolled devices)Verified with vale and markdown-link-check, and rendered locally via
pnpm dev.Related links/other PRs/issues:
EFF-433
Thank you!
🤖 Generated with Claude Code