micromdm/mdm

common library for mdm command payloads and responses.

The mdm package holds structs and helper methods for payloads in Apple's Mobile Device Management protocol.
This package embeds the various payloads and responses in two structs - Payload and Response.

How an MDM server executes commands on a device.

To communicate with a device, an MDM server must create a Payload property list with a specific RequestType and additional data for each request type. Let's use the DeviceInformation request as an example:

    // create a request
	request := &CommandRequest{
		RequestType: "DeviceInformation",
		Queries:     []string{"IsCloudBackupEnabled", "BatteryLevel"},
	}

    // NewPayload will create a proper Payload based on the CommandRequest struct
	payload, err := NewPayload(request)
	if err != nil {
		log.Fatal(err)
	}

	// Encode in a plist and print to stdout
    // uses the github.com/groob/plist package
	encoder := plist.NewEncoder(os.Stdout)
	encoder.Indent("  ")
	if err := encoder.Encode(payload); err != nil {
		log.Fatal(err)
	}

Resulting command payload:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>Command</key>
    <dict>
      <key>Queries</key>
      <array>
        <string>IsCloudBackupEnabled</string>
        <string>BatteryLevel</string>
      </array>
      <key>RequestType</key>
      <string>DeviceInformation</string>
    </dict>
    <key>CommandUUID</key>
    <string>fa34b4b7-0553-4b3a-9c4b-76b8b357a622</string>
  </dict>
</plist>

An MDM server will queue this request and send a push notification to a device. When device checks in, the server will reply with the queued plist.

Once the device receives and processes the payload plist, it will reply back to the server. The response will be another plist, which can be unmarshalled into the Response struct. Below is the response to our DeviceInformation request.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>CommandUUID</key>
    <string>fa34b4b7-0553-4b3a-9c4b-76b8b357a622</string>
	<key>QueryResponses</key>
	<dict>
		<key>BatteryLevel</key>
		<real>1</real>
		<key>IsCloudBackupEnabled</key>
		<false/>
	</dict>
	<key>Status</key>
	<string>Acknowledged</string>
	<key>UDID</key>
	<string>1111111111111111111111111111111111111111</string>
</dict>
</plist>

mdm's Issues

Lack of a License

Hello,

Would you consider adding a license to this repo? I'm sure it's just an oversight, seeing how many of the related repos do have one.

(I'd submit a PR but that seems problematic for a license 😁 )

Thanks!

Response struct missing fields for ProfileList and ProvisioningProfileList

If it matters, this is via iOS 9.3.5

The ResponseStruct has a field for InstalledApplicationList:

mdm/response.go

Line 16 in 6e0586c

InstalledApplicationList InstalledApplicationListResponse `json:"installed_application_list,omitempty" plist:",omitempty"`

However it does not have any fields for ProfileList or ProvisioningProfileList

A quick (but less than ideal) solution in testing so far was to update response.go with following edits:

Response struct

// Response is an MDM Command Response
type Response struct {
	UDID                     string
	UserID                   *string `json:"user_id,omitempty" plist:"UserID,omitempty"`
	Status                   string
	CommandUUID              string
	RequestType              string                           `json:"request_type,omitempty" plist:",omitempty"`
	ErrorChain               []ErrorChainItem                 `json:"error_chain" plist:",omitempty"`
	QueryResponses           QueryResponses                   `json:"query_responses,omitempty" plist:",omitempty"`
	SecurityInfo             SecurityInfo                     `json:"security_info,omitempty" plist:",omitempty"`
	CertificateList          CertificateList                  `json:"certificate_list,omitempty" plist:",omitempty"`
	InstalledApplicationList InstalledApplicationListResponse `json:"installed_application_list,omitempty" plist:",omitempty"`
	ProvisioningProfileList  []ProvisioningProfileListItem
	ProfileList              []ProfileListItem
}

additional structs

type ProfileListItem struct {
	HasRemovalPasscode bool
	IsEncrypted        bool
	PayloadContent     []PayloadData
	PayloadData
}

type PayloadData struct {
	PayloadDescription       string
	PayloadDisplayName       string
	PayloadIdentifier        string
	PayloadType              string
	PayloadVersion           uint32
	PayloadUUID              string
	PayloadRemovalDisallowed bool
}

Any suggestions on how to do this better are more than welcome. Will update this issue as I make any changes/improvements.

API CORS JavaScript

Please implement the possibility to enter external files to the server micromdm server.

I am calling .../v1/commands from JavaScript and if I run it from localhost I get error like
"Failed to load https://mdm01.kidgonet.de/v1/commands: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost' is therefore not allowed access. The response had HTTP status code 404."

Please help.

DEP & OTA share field names on enrollment/checkin

Perhaps merge datatypes at some point. I.e. potentially merge this struct with this struct and use interchangeably.