[PRE-91] Use downloadable config profile for Jamf/Fleet#526
Open
JoeWagstaff wants to merge 3 commits into
Open
[PRE-91] Use downloadable config profile for Jamf/Fleet#526JoeWagstaff wants to merge 3 commits into
JoeWagstaff wants to merge 3 commits into
Conversation
|
|
tashian
requested changes
Jun 25, 2026
| ``` | ||
| ## Step 4. Download the configuration profile | ||
|
|
||
| Fleet deploys certificates to devices using a configuration profile. Smallstep generates this profile for your Fleet connection, so you can download it from the Smallstep dashboard and upload it to Fleet. There's no need to build the payloads or paste certificate data by hand. |
Member
There was a problem hiding this comment.
Suggested change
| Fleet deploys certificates to devices using a configuration profile. Smallstep generates this profile for your Fleet connection, so you can download it from the Smallstep dashboard and upload it to Fleet. There's no need to build the payloads or paste certificate data by hand. | |
| Fleet deploys certificates to devices using a configuration profile. You can download this from the Smallstep dashboard and upload it to Fleet. No need to build the payloads or paste certificate data by hand. |
| 2. Open your Fleet connection, then choose the **Settings** tab | ||
| 3. Under **Configuration Profile (macOS only)**, click **Download** to save the profile. The downloaded file is named `fleet-<connection-id>.mobileconfig`. | ||
|
|
||
| The downloaded profile bundles everything required to enroll a device: the SCEP payload, the root and intermediate CA trust certificates (pre-filled), the agent's managed settings (including your Smallstep team slug), and the Managed Login Items entry for the agent. Its SCEP URL and challenge are embedded as Fleet's `$FLEET_VAR_*` placeholders; Fleet substitutes them per host at deploy time using the certificate authority you added in Step 3, so that CA must be in place and named `SMALLSTEP_AGENT`. |
Member
There was a problem hiding this comment.
Suggested change
| The downloaded profile bundles everything required to enroll a device: the SCEP payload, the root and intermediate CA trust certificates (pre-filled), the agent's managed settings (including your Smallstep team slug), and the Managed Login Items entry for the agent. Its SCEP URL and challenge are embedded as Fleet's `$FLEET_VAR_*` placeholders; Fleet substitutes them per host at deploy time using the certificate authority you added in Step 3, so that CA must be in place and named `SMALLSTEP_AGENT`. | |
| The downloaded profile bundles everything required to enroll a device: the SCEP payload, your root and intermediate CA certificates, the Smallstep agent settings, and the Login Items entry for the agent. Its SCEP URL and challenge are embedded as Fleet's `$FLEET_VAR_*` placeholders; Fleet substitutes them per host at deploy time using the certificate authority you added in Step 3. That CA must be in place and named `SMALLSTEP_AGENT`. |
| - Replace the `<team-slug>` value with your Smallstep team slug | ||
| <Alert severity="info"> | ||
| <div> | ||
| The dashboard labels this **macOS only** because the agent-specific payloads (managed settings and Managed Login Items) apply only to macOS. The SCEP and CA trust payloads still apply to iOS and iPadOS, so you can scope this same profile to your iOS and iPadOS hosts — the macOS-only payloads are simply ignored there. On iOS and iPadOS, the SCEP certificate issued by this profile is the end of the flow, since those platforms do not run the Smallstep agent. |
Member
There was a problem hiding this comment.
Because the agent doesn't run on iOS or iPadOS, SCEP certificates don't make sense there for most use cases. I'd remove this entire alert block.
| ``` | ||
| In this step, we’ll tie everything together by deploying a configuration profile that enrolls devices using the Smallstep Agent. Smallstep generates this profile for your Jamf connection, so you can download it from the Smallstep dashboard and upload it directly to Jamf Pro. There’s no need to build the payloads by hand. | ||
|
|
||
| The downloaded profile bundles everything required to enroll a device: the SCEP payload (with your provisioner URL pre-filled), the root and intermediate CA certificates, the agent’s managed settings (including your Team Slug), and the Managed Login Items entry for the agent. The SCEP payload relies on the dynamic challenge served by the SCEP enrollment webhook you configured earlier, so that webhook must be in place for enrollment to succeed. |
Member
There was a problem hiding this comment.
Suggested change
| The downloaded profile bundles everything required to enroll a device: the SCEP payload (with your provisioner URL pre-filled), the root and intermediate CA certificates, the agent’s managed settings (including your Team Slug), and the Managed Login Items entry for the agent. The SCEP payload relies on the dynamic challenge served by the SCEP enrollment webhook you configured earlier, so that webhook must be in place for enrollment to succeed. | |
| The downloaded profile bundles everything required to enroll a device: the SCEP payload, your root and intermediate CA certificates, the Smallstep agent settings, and the Login Items entry for the agent. The SCEP payload relies on the dynamic challenge served by the SCEP enrollment webhook you configured earlier, so that webhook must be in place for enrollment to succeed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Describe your changes:
Jamf: Replace the manual "Configure an agent enrollment profile" steps (hand-built Managed Login Items / Certificate / SCEP / External Applications payloads) with downloading the pre-built profile from the dashboard (Device Management → connection → Settings → Configuration Profile (macOS only)) and uploading it to Jamf; scope it to the agent install policy.
Fleet: Replace the hand-authored smallstep-agent.mobileconfig (Step 4 XML template + base64 CA paste) with the downloaded fleet-.mobileconfig; update the upload step and the GitOps section to reference it.
Fleet: Tighten Step 3 to require naming the CA SMALLSTEP_AGENT (the generated profile hardcodes that suffix); drop the stray $FLEET_VAR_HOST_END_USER_EMAIL_IDP variable (not used by the profile).
Add notes clarifying the profiles rely on Fleet/Jamf substituting their dynamic SCEP values at deploy time, and that the macOS-only profile's SCEP payload still serves iOS/iPadOS.
Keep the API-client/connection/webhook setup steps (the download depends on them).
Related links/other PRs/issues:
Thank you!