NDES REST API and config doc changes

docs/Configuration/fleet-server-configuration.md

@@ -631,7 +631,7 @@ Setting to true will disable the origin check.
 
 ##### server_private_key
 
-This key is required for enabling macOS MDM features in Fleet. If you are using the `FLEET_APPLE_APNS_*` and `FLEET_APPLE_SCEP_*` variables, Fleet will automatically encrypt the values of those variables using `FLEET_SERVER_PRIVATE_KEY` and save them in the database when you restart after updating.
+This key is required for enabling macOS MDM features and/or storing sensitive configs (passwords, API keys, etc.) in Fleet. If you are using the `FLEET_APPLE_APNS_*` and `FLEET_APPLE_SCEP_*` variables, Fleet will automatically encrypt the values of those variables using `FLEET_SERVER_PRIVATE_KEY` and save them in the database when you restart after updating.
 
 The key must be at least 32 bytes long. Run `openssl rand -base64 32` in the Terminal app to generate one on macOS.
 

docs/Configuration/yaml-files.md

@@ -267,7 +267,7 @@ controls:
 - `macos_settings.custom_settings` is a list of paths to macOS configuration profiles (.mobileconfig) or declaration profiles (.json).
 - `windows_settings.custom_settings` is a list of paths to Windows configuration profiles (.xml).
 
-Fleet supports adding [GitHub environment variables](https://docs.github.com/en/actions/learn-github-actions/variables#defining-environment-variables-for-a-single-workflow) in your configuration profiles. Use `$ENV_VARIABLE` format.
+Fleet supports adding [GitHub environment variables](https://docs.github.com/en/actions/learn-github-actions/variables#defining-environment-variables-for-a-single-workflow) in your configuration profiles. Use `$ENV_VARIABLE` format. Variables beginning with `$FLEET_VAR_` are reserved for Fleet server. The server will replace these variables with the actual values when profiles are sent to hosts. See supported variables in the guide [here](https://fleetdm.com/guides/ndes-scep-proxy).
 
 Use `labels_include_all` to only apply (scope) profiles to hosts that have all those labels or `labels_exclude_any` to apply profiles to hosts that don't have any of those labels.
 
@@ -473,7 +473,8 @@ org_settings:
 
 ### integrations
 
-The `integrations` section lets you define calendar events and ticket settings for failing policy and vulnerablity automations. Learn more about automations in Fleet [here](https://fleetdm.com/docs/using-fleet/automations).
+The `integrations` section lets you define calendar events and ticket settings for failing policy and vulnerability automations. Learn more about automations in Fleet [here](https://fleetdm.com/docs/using-fleet/automations).
+In addition, you can define the SCEP proxy settings for Network Device Enrollment Service (NDES). Learn more about SCEP and NDES in Fleet [here](https://fleetdm.com/guides/ndes-scep-proxy).
 
 #### Example
 
@@ -493,6 +494,11 @@ org_settings:
         email: user1@example.com
         api_token: $ZENDESK_API_TOKEN
         group_id: 1234
+    ndes_scep_proxy:
+      url: https://example.com/certsrv/mscep/mscep.dll
+      admin_url: https://example.com/certsrv/mscep_admin/
+      username: Administrator@example.com
+      password: 'myPassword'
 ```
 
 For secrets, you can add [GitHub environment variables](https://docs.github.com/en/actions/learn-github-actions/variables#defining-environment-variables-for-a-single-workflow)
@@ -511,11 +517,17 @@ For secrets, you can add [GitHub environment variables](https://docs.github.com/
 
 #### zendesk
 
-  - `url` is the URL of your Zendesk (default: `""`)
+- `url` is the URL of your Zendesk (default: `""`)
 - `username` is the username of your Zendesk account (default: `""`).
 - `api_token` is the Zendesk API token (default: `""`).
 - `group_id`is found by selecting **Admin > People > Groups** in Zendesk. Find your group and select it. The group ID will appear in the search field.
 
+#### ndes_scep_proxy
+- `url` is the URL of the NDES SCEP endpoint (default: `""`).
+- `admin_url` is the URL of the NDES admin endpoint (default: `""`).
+- `username` is the username of the NDES admin endpoint (default: `""`).
+- `password` is the password of the NDES admin endpoint (default: `""`).
+
 ### webhook_settings
 
 The `webhook_settings` section lets you define webhook settings for failing policy, vulnerability, and host status automations. Learn more about automations in Fleet [here](https://fleetdm.com/docs/using-fleet/automations).

docs/Contributing/API-for-contributors.md

@@ -553,6 +553,7 @@ The MDM endpoints exist to support the related command-line interface sub-comman
 - [Get FileVault statistics](#get-filevault-statistics)
 - [Upload VPP content token](#upload-vpp-content-token)
 - [Disable VPP](#disable-vpp)
+- [SCEP proxy](#scep-proxy)
 
 
 ### Generate Apple Business Manager public key (ADE)
@@ -1229,6 +1230,11 @@ Content-Type: application/octet-stream
 
 `Status: 204`
 
+### SCEP proxy
+
+`/mdm/scep/proxy/{identifier}`
+
+This endpoint is used to proxy SCEP requests to the configured SCEP server. It uses the [SCEP protocol](https://datatracker.ietf.org/doc/html/rfc8894). The `identifier` is in the format `hostUUID,profileUUID`.
 
 ## Get or apply configuration files
 

docs/REST API/rest-api.md

@@ -1023,7 +1023,6 @@ None.
     }
   },
   "integrations": {
-    "jira": null,
     "google_calendar": [
       {
         "domain": "example.com",
@@ -1041,7 +1040,15 @@ None.
            "universe_domain": "googleapis.com"
          }
       }
-    ]
+    ],
+    "jira": [],
+    "ndes_scep_proxy": {
+      "admin_url": "https://example.com/certsrv/mscep_admin/",
+      "password": "********",
+      "url": "https://example.com/certsrv/mscep/mscep.dll",
+      "username": "Administrator@example.com"
+    },
+    "zendesk": []
   },
   "logging": {
     "debug": false,
@@ -1100,7 +1107,7 @@ Modifies the Fleet's configuration with the supplied information.
 | agent_options            | objects | body  | The agent_options spec that is applied to all hosts. In Fleet 4.0.0 the `api/v1/fleet/spec/osquery_options` endpoints were removed.  |
 | fleet_desktop            | object  | body  | See [fleet_desktop](#fleet-desktop).                                                                                                 |
 | webhook_settings         | object  | body  | See [webhook_settings](#webhook-settings).                                                                                           |
-| integrations             | object  | body  | Includes `jira`, `zendesk`, and `google_calendar` arrays. See [integrations](#integrations) for details.                             |
+| integrations             | object  | body  | Includes `ndes_scep_proxy` object and `jira`, `zendesk`, and `google_calendar` arrays. See [integrations](#integrations) for details.                             |
 | mdm                      | object  | body  | See [mdm](#mdm).                                                                                                                     |
 | features                 | object  | body  | See [features](#features).                                                                                                           |
 | scripts                  | array   | body  | A list of script files to add so they can be executed at a later time.                                                               |
@@ -1291,6 +1298,12 @@ Modifies the Fleet's configuration with the supplied information.
     }
   },
   "integrations": {
+    "google_calendar": [
+      {
+        "domain": "",
+        "api_key_json": null
+      }
+    ],
     "jira": [
       {
         "url": "https://jiraserver.com",
@@ -1300,12 +1313,8 @@ Modifies the Fleet's configuration with the supplied information.
         "enable_software_vulnerabilities": false
       }
     ],
-    "google_calendar": [
-      {
-        "domain": "",
-        "api_key_json": null
-      }
-    ]
+    "ndes_scep_proxy": null,
+    "zendesk": []
   },
   "logging": {
       "debug": false,
@@ -1620,16 +1629,15 @@ _Available in Fleet Premium._
 + [`integrations.jira`](#integrations-jira)
 + [`integrations.zendesk`](#integrations-zendesk)
 + [`integrations.google_calendar`](#integrations-google-calendar)
++ [`integrations.ndes_scep_proxy`](#integrations-ndes_scep_proxy)
 -->
 
-| Name                  | Type  | Description   |
-| --------------------- | ----- | -------------------------------------------------------------------- |
-| jira                  | array | See [`integrations.jira`](#integrations-jira).                       |
-| zendesk               | array | See [`integrations.zendesk`](#integrations-zendesk).                 |
-| google_calendar       | array | See [`integrations.google_calendar`](#integrations-google-calendar). |
-
-
-> Note that when making changes to the `integrations` object, all integrations must be provided (not just the one being modified). This is because the endpoint will consider missing integrations as deleted.
+| Name            | Type   | Description                                                          |
+|-----------------|--------|----------------------------------------------------------------------|
+| jira            | array  | See [`integrations.jira`](#integrations-jira).                       |
+| zendesk         | array  | See [`integrations.zendesk`](#integrations-zendesk).                 |
+| google_calendar | array  | See [`integrations.google_calendar`](#integrations-google-calendar). |
+| ndes_scep_proxy | object | See [`integrations.ndes_scep_proxy`](#integrations-ndes-scep-proxy). |
 
 <br/>
 
@@ -1648,6 +1656,8 @@ _Available in Fleet Premium._
 
 <br/>
 
+> Note that when making changes to the `integrations.jira` array, all integrations must be provided (not just the one being modified). This is because the endpoint will consider missing integrations as deleted.
+
 ##### integrations.zendesk
 
 `integrations.zendesk` is an array of objects with the following structure:
@@ -1663,6 +1673,8 @@ _Available in Fleet Premium._
 
 <br/>
 
+> Note that when making changes to the `integrations.zendesk` array, all integrations must be provided (not just the one being modified). This is because the endpoint will consider missing integrations as deleted.
+
 ##### integrations.google_calendar
 
 `integrations.google_calendar` is an array of objects with the following structure:
@@ -1674,6 +1686,22 @@ _Available in Fleet Premium._
 
 <br/>
 
+##### integrations.ndes_scep_proxy
+
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+`integrations.ndes_scep_proxy` is an object with the following structure:
+
+| Name      | Type   | Description                                             |
+|-----------|--------|---------------------------------------------------------|
+| url       | string | **Required**. The URL of the NDES SCEP endpoint.        |
+| admin_url | string | **Required**. The URL of the NDES admin endpoint.       |
+| password  | string | **Required**. The password for the NDES admin endpoint. |
+| username  | string | **Required**. The username for the NDES admin endpoint. |
+
+Setting `integrations.ndes_scep_proxy` to `null` will clear existing settings. Not specifying `integrations.ndes_scep_proxy` in the payload will not change the existing settings.
+
+
+
 ##### Example request body
 
 ```json
@@ -1695,7 +1723,13 @@ _Available in Fleet Premium._
         "domain": "https://domain.com",
         "api_key_json": "<API KEY JSON>"
       }
-    ]
+    ],
+    "ndes_scep_proxy": {
+      "admin_url": "https://example.com/certsrv/mscep_admin/",
+      "password": "abc123",
+      "url": "https://example.com/certsrv/mscep/mscep.dll",
+      "username": "Administrator@example.com"
+    }
   }
 }
 ```