Deploy SCEP certificates from Network Device Enrollment Service (NDES) #21955

Goal

✅ "Grant Wi-Fi access" (Fleet Premium)

Context

• Product designer: @noahtalerman

Notes from call w/ prospect-numa are here (internal).

Original request: #13420

Changes

Product

• UI changes: Figma wireframes here
• Changes to paid features or tiers: Fleet Premium only. Pricing page updates are here: fleetdm.com/pricing: Grant Wi-Fi access (SCEP) #22900
  • @noahtalerman: Still TODO is link to feature guide (once it's shipped) from the pricing page: https://github.com/fleetdm/fleet/pull/22900/files#diff-f109cc3f7421e05eddf317b7c6cc51395977e63a25dd9eed437985060ed796edR1113
    • PR is here: Follows to NDES: pricing page and permissions #23764
• Once shipped, requester has been notified
• Permissions changes: TODO: @noahtalerman: Update the permissions guide
  • PR is here: Follows to NDES: pricing page and permissions #23764
• Once shipped, dogfooding issue has been filed
  • Issue is here: https://github.com/fleetdm/confidential/issues/8812

Engineering

• Reference documentation changes: NDES REST API and config doc changes #22968

• CLI (fleetctl) usage changes: "No changes"

• YAML changes: New variables for populating SCEP challenge and end user email (from mdm_idp_accounts in GET /device_mapping endpoint). NDES REST API and config doc changes #22968

• REST API changes: NDES REST API and config doc changes #22968

• Activity changes

• Feature guide changes: NDES SCEP proxy guide #22966

  • @noahtalerman: I think we want to explain how the IT admin connects their end users to Wi-Fi after the IT admin adds their SCEP server. Something like this:
    • Get your SCEP root cert and add to a configuration profile
    • Add a Wi-Fi profile w/ a SCEP payload

• Database schema migrations

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

Demo

[Demo] Deploy SCEP certificates from Network Device Enrollment Service (NDES) #21955 - Watch Video

[Demo] NDES SCEP proxy gitops #21955 - Watch Video

QA

Risk assessment

• Requires load testing: No, because we don't expect a SCEP profile to be deployed to all hosts. We expect a SCEP profile to be deployed gradually as part of enrolling new devices.
• Risk level: High
• Risk description: Largely new functionality for Fleet (SCEP proxy) interacting with a complex 3rd party Windows Server NDES service.

Manual testing steps

1. Set up NDES server (dev tested using Windows Server 2022, so maybe do Windows Server 2019 for QA)

• Set up Windows AD server
• Set up Enterprise CA with NDES
• Make sure NDES is up and can issue certs

2. Configure NDES

• Test failure scenarios, like password cache full (defaults to 5 passwords)

3. Create a profile using new fleet variables, and upload manually/GitOps. Example profile

• $FLEET_VAR_NDES_SCEP_CHALLENGE
• $FLEET_VAR_HOST_END_USER_EMAIL_IDP
• $FLEET_VAR_NDES_SCEP_PROXY_URL
• Try bad $FLEET_VAR values, such as $FLEET_VAR_BOZO
• Try deploying profile without NDES, or without an IDP email
• Note: dev testing was done by manually adding a mdm_idp_accounts source email to host_emails table in DB
• Try using these Fleet variables in Windows or DDM profiles -- should not work.

4. NDES passwords expire after 60 minutes (this expectation is hard-coded in Fleet). Deploy SCEP profile to an offline host. After 1 hour, when host comes up, Fleet should re-send the profile with updated one time password.
5. Make sure global activity feed shows up when NDES config is added/edited/deleted.
6. Test with multiple devices. Dev testing was done with 2 devices and 10 SCEP profiles each. You will need to increase the password cache in NDES.

Testing notes

• try to use examples/directions from the feature guide as much as possible
• configs can be changed via UI, API, fleetctl apply, and fleetctl gitops -- focus the testing on UI and gitops
• macOS only
• restarting NDES server will cause password cache to clear

Confirmation

1. Engineer (@getvictor): Added comment to user story confirming successful completion of QA.
2. QA (@_____): Added comment to user story confirming successful completion of QA.