mirror of
https://github.com/apple/device-management.git
synced 2026-08-23 08:47:26 +02:00
Seed6
This commit is contained in:
Cyrus Daboo
@@ -1,5 +1,5 @@
|
||||
title: Asset:Credential Certificate
|
||||
description: 'A reference to a PKCS #1 or PEM encoded certificate.'
|
||||
description: 'A reference to one PKCS #1 or PEM encoded certificate.'
|
||||
payload:
|
||||
declarationtype: com.apple.asset.credential.certificate
|
||||
supportedOS:
|
||||
@@ -21,10 +21,12 @@ payloadkeys:
|
||||
- application/pkcs1
|
||||
- application/pem
|
||||
presence: required
|
||||
content: The external reference. Ensure that the asset data uses a media type of
|
||||
`application/pkcs1` or `application/pem` to correctly identify the type of encoded
|
||||
certificate. If the asset data includes a `ContentType` sub-key, set it to the
|
||||
corresponding media type.
|
||||
content: The external reference. Ensure the asset data contains exactly one certificate.
|
||||
If the PEM data contains more than one certificate, the system installs the first
|
||||
certificate and ignores the rest. Ensure that the asset data uses a media type
|
||||
of `application/pkcs1` or `application/pem` to correctly identify the type of
|
||||
encoded certificate. If the asset data includes a `ContentType` sub-key, set it
|
||||
to the corresponding media type.
|
||||
subkeys:
|
||||
- key: DataURL
|
||||
title: Data URL
|
||||
|
||||
@@ -426,15 +426,15 @@ payloadkeys:
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
The policy to apply when using Platform SSO at FileVault unlock on a Mac with Apple silicon. Applies when `AuthenticationMethod` is `Password`.
|
||||
The policy to apply when using Platform SSO at FileVault unlock on a Mac with Apple silicon.
|
||||
|
||||
* `AttemptAuthentication`: The device attempts Platform SSO authentication before proceeding. If offline, unlock continues if the local account password matches. If online and the credential is incorrect, then the device requires a successful Platform SSO authentication is required, even if taken offline.
|
||||
* `RequireAuthentication`: The device requires Platform SSO authentication before proceeding. If the device is offline and `AllowOfflineGracePeriod` is enabled, then the device uses the offline `OfflineGracePeriod` to determine if the user can proceed or not. If online and the credential is incorrect, then the device requires a valid Platform SSO authentication to proceed, regardless of the `OfflineGracePeriod`. If the account isn't registered for Platform SSO and `AllowAuthenticationGracePeriod` is enabled, then the device uses `AuthenticationGracePeriod` to determine if the user can proceed or not.
|
||||
* `AllowOfflineGracePeriod`: The device allows the use of the `OfflineGracePeriod` when `RequireAuthentication` is enabled. If `AllowOfflineGracePeriod` isn't set, then the device denies offline access.
|
||||
* `AllowAuthenticationGracePeriod`: The device allows the use of the `AuthenticationGracePeriod` for other local accounts when `RequireAuthentication` is enabled. The `AuthenticationGracePeriod` starts when any of the policies are updated. If `AllowAuthenticationGracePeriod` isn't set, then the device denies unregistered account access.
|
||||
* `RequireTouchID`: The device requires the use of Touch ID (and not Apple Watch) for File Vault unlock.
|
||||
* `RequireTouchIDOrWatch`: The device requires the use of Touch ID or Apple Watch for File Vault unlock.
|
||||
* `AllowOpenIDForTouchIDFallback`: The device allows web login as a fallback if touchID fails or isn't available.
|
||||
* `AttemptAuthentication`: The device attempts Platform SSO authentication before proceeding. If offline, unlock continues if the local account password matches. If online and the credential is incorrect, then the device requires a successful Platform SSO authentication is required, even if taken offline. Only use when `AuthenticationMethod` is `Password`.
|
||||
* `RequireAuthentication`: The device requires Platform SSO authentication before proceeding. If the device is offline and `AllowOfflineGracePeriod` is enabled, then the device uses the offline `OfflineGracePeriod` to determine if the user can proceed or not. If online and the credential is incorrect, then the device requires a valid Platform SSO authentication to proceed, regardless of the `OfflineGracePeriod`. If the account isn't registered for Platform SSO and `AllowAuthenticationGracePeriod` is enabled, then the device uses `AuthenticationGracePeriod` to determine if the user can proceed or not. Only use when `AuthenticationMethod` is `Password`.
|
||||
* `AllowOfflineGracePeriod`: The device allows the use of the `OfflineGracePeriod`. If `AllowOfflineGracePeriod` isn't set, then the device denies offline access. Only use when `AuthenticationMethod` is `Password` and `RequireAuthentication` is enabled, or `AuthenticationMethod` is `OpenID`.
|
||||
* `AllowAuthenticationGracePeriod`: The device allows the use of the `AuthenticationGracePeriod` for other local accounts when `RequireAuthentication` is enabled. The `AuthenticationGracePeriod` starts when any of the policies are updated. If `AllowAuthenticationGracePeriod` isn't set, then the device denies unregistered account access. Only use when `AuthenticationMethod` is `Password`.
|
||||
* `RequireTouchID`: The device requires the use of Touch ID (and not Apple Watch) for FileVault unlock. Only use when `AuthenticationMethod` is `Password` or `UserSecureEnclaveKey`.
|
||||
* `RequireTouchIDOrWatch`: The device requires the use of Touch ID or Apple Watch for FileVault unlock. Only use when `AuthenticationMethod` is `Password` or `UserSecureEnclaveKey`.
|
||||
* `AllowOpenIDForTouchIDFallback`: The device allows web login as a fallback if Touch ID fails or isn't available. Only use when `AuthenticationMethod` is `Password` or `UserSecureEnclaveKey`.
|
||||
subkeys:
|
||||
- key: policy
|
||||
type: <string>
|
||||
@@ -453,15 +453,15 @@ payloadkeys:
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
The policy to apply when using Platform SSO at the Login Window. Applies when `AuthenticationMethod` is `Password`.
|
||||
The policy to apply when using Platform SSO at the Login Window.
|
||||
|
||||
* `AttemptAuthentication`: The device attempts Platform SSO authentication before proceeding. If offline, login continues if the local account password matches. If online and the credential is incorrect, then the device requires a successful Platform SSO authentication to proceed, even if taken offline.
|
||||
* `RequireAuthentication`: The device requires Platform SSO authentication before proceeding. If the device is offline and `AllowOfflineGracePeriod` is enabled, then the device uses the offline `OfflineGracePeriod` to determine if the user can proceed or not. If online and the credential is incorrect, then the device requires a valid Platform SSO authentication to proceed, regardless of the `OfflineGracePeriod`. If the account isn't registered for Platform SSO and `AllowAuthenticationGracePeriod` is enabled, then the device uses the `AuthenticationGracePeriod` to determine if the user can proceed or not.
|
||||
* `AllowOfflineGracePeriod`: The device allows the use of the `OfflineGracePeriod` when `RequireAuthentication` is enabled. If `AllowOfflineGracePeriod` isn't set, then the device denies offline access. Applies to web login and all offline passwords.
|
||||
* `AllowAuthenticationGracePeriod`: The device allows the use of the `AuthenticationGracePeriod` for other local accounts when `RequireAuthentication` is enabled. The `AuthenticationGracePeriod` starts when any of the policies have been updated. If `AllowAuthenticationGracePeriod` isn't set, then the device denies unregistered account access.
|
||||
* `RequireTouchID`: The device requires the use of Touch ID (and not Apple Watch) for login.
|
||||
* `RequireTouchIDOrWatch`: The device requires the use of Touch ID or Apple Watch for login.
|
||||
* `AllowOpenIDForTouchIDFallback`: The device allows web login as fallback if touchID fails or isn't available.
|
||||
* `AttemptAuthentication`: The device attempts Platform SSO authentication before proceeding. If offline, login continues if the local account password matches. If online and the credential is incorrect, then the device requires a successful Platform SSO authentication to proceed, even if taken offline. Only use when `AuthenticationMethod` is `Password`.
|
||||
* `RequireAuthentication`: The device requires Platform SSO authentication before proceeding. If the device is offline and `AllowOfflineGracePeriod` is enabled, then the device uses the offline `OfflineGracePeriod` to determine if the user can proceed or not. If online and the credential is incorrect, then the device requires a valid Platform SSO authentication to proceed, regardless of the `OfflineGracePeriod`. If the account isn't registered for Platform SSO and `AllowAuthenticationGracePeriod` is enabled, then the device uses the `AuthenticationGracePeriod` to determine if the user can proceed or not. Only use when `AuthenticationMethod` is `Password`.
|
||||
* `AllowOfflineGracePeriod`: The device allows the use of the `OfflineGracePeriod`. If `AllowOfflineGracePeriod` isn't set, then the device denies offline access. Only use when `AuthenticationMethod` is `Password` and `RequireAuthentication` is enabled, or `AuthenticationMethod` is `OpenID`.
|
||||
* `AllowAuthenticationGracePeriod`: The device allows the use of the `AuthenticationGracePeriod` for other local accounts when `RequireAuthentication` is enabled. The `AuthenticationGracePeriod` starts when any of the policies have been updated. If `AllowAuthenticationGracePeriod` isn't set, then the device denies unregistered account access. Only use when `AuthenticationMethod` is `Password`.
|
||||
* `RequireTouchID`: The device requires the use of Touch ID (and not Apple Watch) for login. Only use when `AuthenticationMethod` is `Password` or `UserSecureEnclaveKey`.
|
||||
* `RequireTouchIDOrWatch`: The device requires the use of Touch ID or Apple Watch for login. Only use when `AuthenticationMethod` is `Password` or `UserSecureEnclaveKey`.
|
||||
* `AllowOpenIDForTouchIDFallback`: The device allows web login as fallback if Touch ID fails or isn't available. Only use when `AuthenticationMethod` is `Password` or `UserSecureEnclaveKey`.
|
||||
subkeys:
|
||||
- key: policy
|
||||
type: <string>
|
||||
@@ -480,16 +480,16 @@ payloadkeys:
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
The policy to apply when using Platform SSO at screensaver unlock. Applies when `AuthenticationMethod` is `Password`. later.
|
||||
The policy to apply when using Platform SSO at screensaver unlock.
|
||||
|
||||
* `AttemptAuthentication`: The device attempts Platform SSO authentication before proceeding. If offline, unlock will continue if the local account password matches. If online and the credential is incorrect, then the device requires a successful Platform SSO authentication to proceed, even if taken offline.
|
||||
* `RequireAuthentication`: The device requires Platform SSO authentication before proceeding. If the device is offline and `AllowOfflineGracePeriod` is enabled, then the offline `OfflineGracePeriod` is used to determine if the user can proceed or not. If online and the credential is incorrect, then the device requires a valid Platform SSO authentication to proceed regardless of the `OfflineGracePeriod`. If the account isn't registered for Platform SSO and `AllowAuthenticationGracePeriod` is enabled, then the device uses `AuthenticationGracePeriod` to determine if the user can proceed or not.
|
||||
* `AllowOfflineGracePeriod`: The device allows the use of the `OfflineGracePeriod` when `RequireAuthentication` is enabled. If `AllowOfflineGracePeriod` isn't set, then the device denies offline access.
|
||||
* `AllowAuthenticationGracePeriod`: The device allows the use of the `AuthenticationGracePeriod` for other local accounts when `RequireAuthentication` is enabled. The `AuthenticationGracePeriod` starts when any of the policies have been updated. If `AllowAuthenticationGracePeriod` isn't set, then the device denies the unregistered account access.
|
||||
* `AllowTouchIDOrWatchForUnlock`: The device allows TouchID or Watch to unlock the screensaver instead of Platform SSO authentication when `RequireAuthentication` is enabled.
|
||||
* `RequireTouchID`: The device requires the use of Touch ID (and not Apple Watch) for unlock.
|
||||
* `RequireTouchIDOrWatch`: RThe device requires the use of Touch ID or Apple Watch for unlock.
|
||||
* `AllowOpenIDForTouchIDFallback`: The device allows web login as fallback if touchID fails or isn't available.
|
||||
* `AttemptAuthentication`: The device attempts Platform SSO authentication before proceeding. If offline, unlock will continue if the local account password matches. If online and the credential is incorrect, then the device requires a successful Platform SSO authentication to proceed, even if taken offline. Only use when `AuthenticationMethod` is `Password`.
|
||||
* `RequireAuthentication`: The device requires Platform SSO authentication before proceeding. If the device is offline and `AllowOfflineGracePeriod` is enabled, then the offline `OfflineGracePeriod` is used to determine if the user can proceed or not. If online and the credential is incorrect, then the device requires a valid Platform SSO authentication to proceed regardless of the `OfflineGracePeriod`. If the account isn't registered for Platform SSO and `AllowAuthenticationGracePeriod` is enabled, then the device uses `AuthenticationGracePeriod` to determine if the user can proceed or not. Only use when `AuthenticationMethod` is `Password`.
|
||||
* `AllowOfflineGracePeriod`: The device allows the use of the `OfflineGracePeriod`. If `AllowOfflineGracePeriod` isn't set, then the device denies offline access. Only use when `AuthenticationMethod` is `Password` and `RequireAuthentication` is enabled, or `AuthenticationMethod` is `OpenID`.
|
||||
* `AllowAuthenticationGracePeriod`: The device allows the use of the `AuthenticationGracePeriod` for other local accounts when `RequireAuthentication` is enabled. The `AuthenticationGracePeriod` starts when any of the policies have been updated. If `AllowAuthenticationGracePeriod` isn't set, then the device denies the unregistered account access. Only use when `AuthenticationMethod` is `Password`.
|
||||
* `AllowTouchIDOrWatchForUnlock`: The device allows Touch ID or Apple Watch to unlock the screensaver instead of Platform SSO authentication when `RequireAuthentication` is enabled. Only use when `AuthenticationMethod` is `Password`.
|
||||
* `RequireTouchID`: The device requires the use of Touch ID (and not Apple Watch) for unlock. Only use when `AuthenticationMethod` is `Password` or `UserSecureEnclaveKey`.
|
||||
* `RequireTouchIDOrWatch`: The device requires the use of Touch ID or Apple Watch for unlock. Only use when `AuthenticationMethod` is `Password` or `UserSecureEnclaveKey`.
|
||||
* `AllowOpenIDForTouchIDFallback`: The device allows web login as fallback if Touch ID fails or isn't available. Only use when `AuthenticationMethod` is `Password` or `UserSecureEnclaveKey`.
|
||||
subkeys:
|
||||
- key: policy
|
||||
type: <string>
|
||||
@@ -508,13 +508,14 @@ payloadkeys:
|
||||
title: Offline grace period
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The amount of time after the last successful Platform SSO login for
|
||||
using a local account password offline. Required when setting `AllowOfflineGracePeriod`.
|
||||
content: The amount of time (in seconds) after the last successful Platform
|
||||
SSO login for using a local account password offline. Required when setting
|
||||
`AllowOfflineGracePeriod`.
|
||||
- key: AuthenticationGracePeriod
|
||||
title: Authentication grace period
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The amount of time after receiving or updating a `Policies.FileVault`,
|
||||
content: The amount of time (in seconds) after receiving or updating a `Policies.FileVault`,
|
||||
`Policies.Login`, or `Policies.Unlock` that the system can use unregistered
|
||||
local accounts. Required when `AllowAuthenticationGracePeriod` is set.
|
||||
- key: NonPlatformSSOAccounts
|
||||
|
||||
@@ -121,7 +121,7 @@ payloadkeys:
|
||||
tvOS:
|
||||
introduced: n/a
|
||||
visionOS:
|
||||
introduced: n/a
|
||||
introduced: '27.0'
|
||||
watchOS:
|
||||
introduced: n/a
|
||||
type: <boolean>
|
||||
|
||||
Reference in New Issue
Block a user