Repository navigation
Conversation
CN=OTTER1X passed for OTTER1, and OU=CN=OTTER1,CN=ADMIN passed while the cert the CA issued said ADMIN. Now compares parsed CN attributes, and checks the signature so an unverifiable request never reaches the CA.
An admin marks a callsign with init mdm=true; the agent completes it with the device CSR, authorised by its CN in RM_MDM_AGENT_CNS, empty by default. Approving such a row by hand is refused: it would spend the callsign on a keypair generated here.
Revert "chore: remove useless comments" This reverts commit d7448d0c270a418e7add8ace1c3465c1f879efed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
See the MDM/SCEP support plan at https://github.com/pvarki/python-odmdmkit-poc/blob/main/docs/mvp-plan.md
Lets a named service identity complete a device enrolment an admin already planned, so an MDM can
enrol phones over SCEP without anyone holding an admin certificate.
POST /enrollment/inittakesmdm=trueto plan a callsign, and issues no JWT for one. The devicenever uses it, and issuing it would overwrite the planning admin's session.
POST /enrollment/acceptnow serves two callers: an admin approving by hand, unchanged, or theagent supplying the CSR the device generated.
The agent is
mdm_agent_cns, empty by default, so the path does not exist until a deployment namesa CN. Not a product CN: those skip role checks and can have any subject signed. The CN is also
reserved as a callsign, or an invited user could have been issued one and then completed every
planned enrolment.
A callsign is spent forever once used, so: hand-approving an MDM-planned row is refused, the claim
is one conditional UPDATE so two devices cannot both win, and a repeat returns the same certificate
matched on the CSR's public key.
Anything Else You'd Like to Mention
Base is
fix/verify-csr-exact-subject, which this relies on for the subject check.