CalvinBackup/apple-device-management-mdm
1
0 Fork 0
mirror of https://github.com/apple/device-management.git synced 2026-09-30 13:19:37 +02:00
Code Issues Packages Projects Releases Wiki Activity

Release-v27.0

Browse Source
This commit is contained in:
Cyrus Daboo committed 2026-09-17 09:59:16 -04:00
1 parent 67045e2fa0
commit 09f249a06e
759 files changed
+22171 -2539
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

declarative/declarations/assets/credentials/acme.yaml
+24 -21
View File
@@ -31,13 +31,13 @@ payloadkeys:
relatively weak indication because of the risk that an attacker may intercept
and duplicate the client identifier.
- key: KeySize
title: Key Size
title: Key size
type: <integer>
presence: required
content: The valid values for `KeySize` depend on the values of `KeyType` and `HardwareBound`.
See those keys for specific requirements.
- key: KeyType
title: Key Type
title: Key type
type: <string>
presence: required
rangelist:
@@ -53,7 +53,7 @@ payloadkeys:
> Note:
> The key size is `521`, not `512`, even though the other key sizes are multiples of `64`.
- key: HardwareBound
title: Hardware Bound
title: Hardware bound
type: <boolean>
presence: required
content: |-
@@ -63,7 +63,7 @@ payloadkeys:
If `true`, `KeyType` needs to be `ECSECPrimeRandom` and `KeySize` needs to be `256` or `384`.
On macOS, this is a required key. Set the value to `false`.
Set this key to `false` on Mac devices that don't have Apple silicon or a T2 chip.
- key: Subject
title: Subject
type: <array>
@@ -78,22 +78,22 @@ payloadkeys:
You can represent OIDs as dotted numbers or use shortcuts for country (`C`), locality (`L`), state (`ST`), organization (`O`), organizational unit (`OU`), and common name (`CN`).
subkeys:
- key: ACMESubjectArrayInnerArray
title: Array Inside ACME Subject Array
title: Array inside ACME subject array
type: <array>
subkeys:
- key: ACMESubjectArrayPair
title: Subject Array Pair
title: Subject array pair
type: <array>
subkeys:
- key: ACMESubjectArrayPairItem
title: ACME Subject Array Pair Item
title: ACME subject array pair item
type: <string>
repetition:
min: 2
max: 2
content: One item in the array representing a pair of OID and value
- key: SubjectAltName
title: Subject Alt Name
title: Subject alt name
type: <dictionary>
presence: optional
content: Specifies the subject's alternative name that the device requests for the
@@ -101,12 +101,12 @@ payloadkeys:
this field in the certificate it issues.
subkeys:
- key: rfc822Name
title: RFC 822 Name
title: RFC 822 name
type: <string>
presence: optional
content: The RFC 822 email address.
- key: dNSName
title: DNS Name
title: DNS name
type: <string>
presence: optional
content: The DNS name.
@@ -116,12 +116,12 @@ payloadkeys:
presence: optional
content: The uniform resource identifier.
- key: ntPrincipalName
title: NT Principal Name
title: NT principal name
type: <string>
presence: optional
content: The NT principal name. Use an other name OID set to `1.3.6.1.4.1.311.20.2.3`.
- key: UsageFlags
title: Key Usage
title: Key usage
type: <integer>
presence: optional
content: |-
@@ -129,7 +129,7 @@ payloadkeys:
The value is a bit field. Bit `0x01` indicates digital signature, and bit `0x04` indicates key encipherment.
- key: ExtendedKeyUsage
title: Extended Key Usage
title: Extended key usage
type: <array>
presence: optional
content: |-
@@ -145,13 +145,12 @@ payloadkeys:
type: <boolean>
presence: optional
default: false
content: If `true`, the device provides attestations that describe the device and
the generated key to the ACME server. The server can use the attestations as strong
evidence that the key is bound to the device, and that the device has properties
listed in the attestation. The server can use that as part of a trust score to
decide whether to issue the requested certificate. When `Attest` is `true`, set
`HardwareBound` to `true`. On macOS, set this key, if present, to `false`. The
hardware requirements for attestation are described below.
content: |-
If `true`, the device provides attestations that describe the device and the generated key to the ACME server. The server can use the attestations as strong evidence that the key is bound to the device, and that the device has properties listed in the attestation. The server can use that as part of a trust score to decide whether to issue the requested certificate.
When `Attest` is `true`, set `HardwareBound` to `true`.
The hardware requirements for attestation are described below.
notes:
- title: ''
content: |-
@@ -168,4 +167,8 @@ notes:
| Attest key support | iPhone, iPad | Mac | Apple TV | Apple Watch | Vision Pro |
|--------------------|--------------------------------------|----------------|-------------------------|----------------|------------|
| Ignored | A10x Fusion and earlier | Intel | A10x Fusion and earlier | S3 and earlier | none |
| Supported | A11 Bionic and later<br>All M series | Apple Silicon | A12 Bionic and later | S4 and later | All |
| Supported | A11 Bionic and later<br>All M series | Apple silicon | A12 Bionic and later | S4 and later | All |
examples:
- title: Credential example
files:
- file: examples/declarative/declarations/assets/credentials/acme/example1.json
declarative/declarations/assets/credentials/identity.yaml
+6
View File
@@ -15,10 +15,16 @@ payload:
introduced: '10.0'
payloadkeys:
- key: Password
title: Password
type: <string>
presence: required
content: 'The password required to decrypt the PKCS #12 identity data.'
- key: Identity
title: Identity
type: <data>
presence: required
content: 'The PKCS #12 identity data.'
examples:
- title: Credential example
files:
- file: examples/declarative/declarations/assets/credentials/identity/example1.json
declarative/declarations/assets/credentials/scep.yaml
+15 -11
View File
@@ -38,15 +38,15 @@ payloadkeys:
You can represent OIDs as dotted numbers or use shortcuts for country (`C`), locality (`L`), state (`ST`), organization (`O`), organizational unit (`OU`), and common name (`CN`).
subkeys:
- key: SCEPSubjectArrayInnerArray
title: Array Inside SCEP Subject Array
title: Array inside SCEP subject array
type: <array>
subkeys:
- key: SCEPSubjectArrayPair
title: Subject Array Pair
title: Subject array pair
type: <array>
subkeys:
- key: SCEPSubjectArrayPairItem
title: SCEP Subject Array Pair Item
title: SCEP subject array pair item
type: <string>
repetition:
min: 2
@@ -58,7 +58,7 @@ payloadkeys:
presence: optional
content: A preshared secret.
- key: Keysize
title: Key Size
title: Key size
type: <integer>
presence: optional
rangelist:
@@ -68,13 +68,13 @@ payloadkeys:
default: 1024
content: The key size in bits, either `1024`, `2048`, or `4096`.
- key: Key Type
title: Key Type
title: Key type
type: <string>
presence: optional
default: RSA
content: The key type, which always has the value `RSA`.
- key: Key Usage
title: Key Usage
title: Key usage
type: <integer>
presence: optional
default: 0
@@ -94,25 +94,25 @@ payloadkeys:
content: The number of times the device should retry if the server sends a `PENDING`
response.
- key: RetryDelay
title: Retry Delay
title: Retry delay
type: <integer>
presence: optional
default: 10
content: The number of seconds to wait between subsequent retries. The system makes
the first retry without this delay.
- key: SubjectAltName
title: Subject Alt Name
title: Subject alt name
type: <dictionary>
presence: optional
content: The subject's alternative name for the certificate.
subkeys:
- key: rfc822Name
title: RFC 822 Name
title: RFC 822 name
type: <string>
presence: optional
content: The RFC 822 email address.
- key: dNSName
title: DNS Name
title: DNS name
type: <string>
presence: optional
content: The DNS name.
@@ -122,7 +122,11 @@ payloadkeys:
presence: optional
content: The uniform resource identifier.
- key: ntPrincipalName
title: NT Principal Name
title: NT principal name
type: <string>
presence: optional
content: The NT principal name. Use an other name OID set to `1.3.6.1.4.1.311.20.2.3`.
examples:
- title: Credential example
files:
- file: examples/declarative/declarations/assets/credentials/scep/example1.json
declarative/declarations/assets/credentials/usernameandpassword.yaml
+6
View File
@@ -15,10 +15,16 @@ payload:
introduced: '10.0'
payloadkeys:
- key: UserName
title: User name
type: <string>
presence: required
content: The user name for this credential.
- key: Password
title: Password
type: <string>
presence: optional
content: The password for this credential.
examples:
- title: Credential example
files:
- file: examples/declarative/declarations/assets/credentials/usernameandpassword/example1.json