mirror of
https://github.com/apple/device-management.git
synced 2026-08-27 10:33:03 +02:00
Release_iOS-17-0_macOS-14-0
This commit is contained in:
Cyrus Daboo
@@ -0,0 +1,68 @@
|
||||
title: Asset:Credential ACME
|
||||
description: A reference to an ACME identity.
|
||||
payload:
|
||||
declarationtype: com.apple.asset.credential.acme
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '17.0'
|
||||
macOS:
|
||||
introduced: '14.0'
|
||||
tvOS:
|
||||
introduced: '17.0'
|
||||
watchOS:
|
||||
introduced: '10.0'
|
||||
payloadkeys:
|
||||
- key: Reference
|
||||
type: <dictionary>
|
||||
presence: required
|
||||
content: |-
|
||||
The external reference. Ensure that the asset data:
|
||||
* Is a JSON document that represents the 'com.apple.credential.acme' credential type
|
||||
* Uses a media type of 'application/json', and if it includes a 'ContentType' sub-key, that sub-key media type is also 'application/json'
|
||||
subkeys:
|
||||
- key: DataURL
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The URL that hosts the credential data. The URL must start with 'https://'.
|
||||
- key: ContentType
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The media type that describes the data.
|
||||
- key: Size
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The size of the data at the 'DataURL'. Use this value to verify that
|
||||
the returned data is the expected data. Use this value to detect when the data
|
||||
changes.
|
||||
- key: Hash-SHA-256
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
A SHA-256 hash of the data at the 'DataURL'. Use this value to verify that the returned data is the expected data. Use this value to detect when the data changes.
|
||||
If 'Size' is '0', clients need to ignore this value or set it to an empty string.
|
||||
- key: Authentication
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The server authentication details.
|
||||
subkeys:
|
||||
- key: Type
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- MDM
|
||||
- None
|
||||
content: |-
|
||||
Type of authentication:
|
||||
* MDM - a request using MDM semantics (includes the device identity certificate, and any user authentication). Equivalent to an MDM request made to the CheckInURL or ServerURL. This option can only be used when using declarative device management.
|
||||
* None - a standard GET request is carried out.
|
||||
- key: Accessible
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- Default
|
||||
- AfterFirstUnlock
|
||||
default: Default
|
||||
content: |-
|
||||
The keychain accessibility that determines when the keychain item is available for use, which has these allowed values:
|
||||
* 'Default': The most restrictive accessibility that still satisfies all uses of the asset by configurations that reference it.
|
||||
* 'AfterFirstUnlock': The keychain item is only available after the first unlock of the device.
|
||||
@@ -0,0 +1,57 @@
|
||||
title: Asset:Credential Certificate
|
||||
description: 'A reference to a PKCS #1 or PEM encoded certificate.'
|
||||
payload:
|
||||
declarationtype: com.apple.asset.credential.certificate
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '17.0'
|
||||
macOS:
|
||||
introduced: '14.0'
|
||||
tvOS:
|
||||
introduced: '17.0'
|
||||
watchOS:
|
||||
introduced: '10.0'
|
||||
payloadkeys:
|
||||
- key: Reference
|
||||
type: <dictionary>
|
||||
presence: required
|
||||
content: The external reference. Ensure that the asset data uses a media type of
|
||||
'application/pkcs1' or 'application/pem' to correctly identify the type of encoded
|
||||
certificate. If the asset data includes a 'ContentType' sub-key, set it to the
|
||||
corresponding media type.
|
||||
subkeys:
|
||||
- key: DataURL
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The URL that hosts the credential data. The URL must start with 'https://'.
|
||||
- key: ContentType
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The media type that describes the data.
|
||||
- key: Size
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The size of the data at the 'DataURL'. Use this value to verify that
|
||||
the returned data is the expected data. Use this value to detect when the data
|
||||
changes.
|
||||
- key: Hash-SHA-256
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
A SHA-256 hash of the data at the 'DataURL'. Use this value to verify that the returned data is the expected data. Use this value to detect when the data changes.
|
||||
If 'Size' is '0', clients need to ignore this value or set it to an empty string.
|
||||
- key: Authentication
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The server authentication details.
|
||||
subkeys:
|
||||
- key: Type
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- MDM
|
||||
- None
|
||||
content: |-
|
||||
Type of authentication:
|
||||
* MDM - a request using MDM semantics (includes the device identity certificate, and any user authentication). Equivalent to an MDM request made to the CheckInURL or ServerURL. This option can only be used when using declarative device management.
|
||||
* None - a standard GET request is carried out.
|
||||
@@ -0,0 +1,68 @@
|
||||
title: Asset:Credential Identity
|
||||
description: 'A reference to a PKCS #12 password-protected identity.'
|
||||
payload:
|
||||
declarationtype: com.apple.asset.credential.identity
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '17.0'
|
||||
macOS:
|
||||
introduced: '14.0'
|
||||
tvOS:
|
||||
introduced: '17.0'
|
||||
watchOS:
|
||||
introduced: '10.0'
|
||||
payloadkeys:
|
||||
- key: Reference
|
||||
type: <dictionary>
|
||||
presence: required
|
||||
content: |-
|
||||
The external reference. Ensure that the asset data:
|
||||
* Is a JSON document that represents the 'com.apple.credential.identity' credential type
|
||||
* Uses a media type of 'application/json', and if it includes a 'ContentType' sub-key, that sub-key media type is also 'application/json'
|
||||
subkeys:
|
||||
- key: DataURL
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The URL that hosts the credential data. The URL must start with 'https://'.
|
||||
- key: ContentType
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The media type that describes the data.
|
||||
- key: Size
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The size of the data at the 'DataURL'. Use this value to verify that
|
||||
the returned data is the expected data. Use this value to detect when the data
|
||||
changes.
|
||||
- key: Hash-SHA-256
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
A SHA-256 hash of the data at the 'DataURL'. Use this value to verify that the returned data is the expected data. Use this value to detect when the data changes.
|
||||
If 'Size' is '0', clients need to ignore this value or set it to an empty string.
|
||||
- key: Authentication
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The server authentication details.
|
||||
subkeys:
|
||||
- key: Type
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- MDM
|
||||
- None
|
||||
content: |-
|
||||
Type of authentication:
|
||||
* MDM - a request using MDM semantics (includes the device identity certificate, and any user authentication). Equivalent to an MDM request made to the CheckInURL or ServerURL. This option can only be used when using declarative device management.
|
||||
* None - a standard GET request is carried out.
|
||||
- key: Accessible
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- Default
|
||||
- AfterFirstUnlock
|
||||
default: Default
|
||||
content: |-
|
||||
The keychain accessibility that determines when the keychain item is available for use, which has these allowed values:
|
||||
* 'Default': The most restrictive accessibility that still satisfies all uses of the asset by configurations that reference it.
|
||||
* 'AfterFirstUnlock': The keychain item is only available after the first unlock of the device.
|
||||
@@ -0,0 +1,68 @@
|
||||
title: Asset:Credential SCEP
|
||||
description: A reference to a SCEP identity.
|
||||
payload:
|
||||
declarationtype: com.apple.asset.credential.scep
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '17.0'
|
||||
macOS:
|
||||
introduced: '14.0'
|
||||
tvOS:
|
||||
introduced: '17.0'
|
||||
watchOS:
|
||||
introduced: '10.0'
|
||||
payloadkeys:
|
||||
- key: Reference
|
||||
type: <dictionary>
|
||||
presence: required
|
||||
content: |-
|
||||
The external reference. Ensure that the asset data:
|
||||
* Is a JSON document that represents the 'com.apple.credential.scep' credential type
|
||||
* Uses a media type of 'application/json', and if it includes a 'ContentType' sub-key, that sub-key media type is also 'application/json'
|
||||
subkeys:
|
||||
- key: DataURL
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The URL that hosts the credential data. The URL must start with 'https://'.
|
||||
- key: ContentType
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The media type that describes the data.
|
||||
- key: Size
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The size of the data at the 'DataURL'. Use this value to verify that
|
||||
the returned data is the expected data. Use this value to detect when the data
|
||||
changes.
|
||||
- key: Hash-SHA-256
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
A SHA-256 hash of the data at the 'DataURL'. Use this value to verify that the returned data is the expected data. Use this value to detect when the data changes.
|
||||
If 'Size' is '0', clients need to ignore this value or set it to an empty string.
|
||||
- key: Authentication
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The server authentication details.
|
||||
subkeys:
|
||||
- key: Type
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- MDM
|
||||
- None
|
||||
content: |-
|
||||
Type of authentication:
|
||||
* MDM - a request using MDM semantics (includes the device identity certificate, and any user authentication). Equivalent to an MDM request made to the CheckInURL or ServerURL. This option can only be used when using declarative device management.
|
||||
* None - a standard GET request is carried out.
|
||||
- key: Accessible
|
||||
type: <string>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- Default
|
||||
- AfterFirstUnlock
|
||||
default: Default
|
||||
content: |-
|
||||
The keychain accessibility that determines when the keychain item is available for use, which has these allowed values:
|
||||
* 'Default': The most restrictive accessibility that still satisfies all uses of the asset by configurations that reference it.
|
||||
* 'AfterFirstUnlock': The keychain item is only available after the first unlock of the device.
|
||||
@@ -1,6 +1,6 @@
|
||||
title: Credential:User Name and Password
|
||||
title: Asset:Credential User Name and Password
|
||||
description: A reference to data describing a credential representing a user name
|
||||
and password. Note that this should always be considered as security sensitive data.
|
||||
and password.
|
||||
payload:
|
||||
declarationtype: com.apple.asset.credential.userpassword
|
||||
supportedOS:
|
||||
@@ -10,11 +10,16 @@ payload:
|
||||
introduced: '13.0'
|
||||
tvOS:
|
||||
introduced: '16.0'
|
||||
watchOS:
|
||||
introduced: '10.0'
|
||||
payloadkeys:
|
||||
- key: Reference
|
||||
type: <dictionary>
|
||||
presence: required
|
||||
content: The reference to the credential.
|
||||
content: |-
|
||||
The external reference. Ensure that the asset data:
|
||||
* Is a JSON document that represents the 'com.apple.credential.usernameandpassword' credential type
|
||||
* Uses a media type of 'application/json', and if it includes a 'ContentType' sub-key, that sub-key media type is also 'application/json'
|
||||
subkeys:
|
||||
- key: DataURL
|
||||
type: <string>
|
||||
@@ -22,17 +27,41 @@ payloadkeys:
|
||||
content: The URL that hosts the credential data. The URL must start with 'https://'.
|
||||
- key: ContentType
|
||||
type: <string>
|
||||
presence: required
|
||||
presence: optional
|
||||
content: The media type that describes the data.
|
||||
- key: Size
|
||||
type: <integer>
|
||||
presence: required
|
||||
presence: optional
|
||||
content: The size of the data at the 'DataURL'. Use this value to verify that
|
||||
the returned data is the expected data. Use this value to detect when the data
|
||||
changes.
|
||||
- key: Hash-SHA-256
|
||||
type: <string>
|
||||
presence: required
|
||||
presence: optional
|
||||
content: |-
|
||||
A SHA-256 hash of the data at the 'DataURL'. Use this value to verify that the returned data is the expected data. Use this value to detect when the data changes.
|
||||
If 'Size' is '0', clients need to ignore this value or set it to an empty string.
|
||||
- key: Authentication
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '17.0'
|
||||
macOS:
|
||||
introduced: '14.0'
|
||||
tvOS:
|
||||
introduced: '17.0'
|
||||
watchOS:
|
||||
introduced: '10.0'
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The server authentication details.
|
||||
subkeys:
|
||||
- key: Type
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- MDM
|
||||
- None
|
||||
content: |-
|
||||
Type of authentication:
|
||||
* MDM - a request using MDM semantics (includes the device identity certificate, and any user authentication). Equivalent to an MDM request made to the CheckInURL or ServerURL. This option can only be used when using declarative device management.
|
||||
* None - a standard GET request is carried out.
|
||||
|
||||
@@ -0,0 +1,138 @@
|
||||
title: ACME Credential
|
||||
description: An ACME identity that should be generated by the device.
|
||||
payload:
|
||||
credentialtype: com.apple.credential.acme
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '17.0'
|
||||
macOS:
|
||||
introduced: '14.0'
|
||||
tvOS:
|
||||
introduced: '17.0'
|
||||
watchOS:
|
||||
introduced: '10.0'
|
||||
payloadkeys:
|
||||
- key: DirectoryURL
|
||||
title: ACME directory URL
|
||||
type: <string>
|
||||
presence: required
|
||||
content: Specifies the directory URL of the ACME server. Use the 'https' scheme
|
||||
for the URL.
|
||||
- key: ClientIdentifier
|
||||
title: Client identifier
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The server can use this as a nonce to prevent issuing multiple certificates.
|
||||
It also indicates to the ACME server that the device has access to a valid client
|
||||
identifier that the enterprise infrastructure issued. This can help the ACME server
|
||||
determine whether to trust the device, however this is a relatively weak indication
|
||||
because of the risk that an attacker may intercept and duplicate the client identifier.
|
||||
- key: KeySize
|
||||
title: Key Size
|
||||
type: <integer>
|
||||
presence: required
|
||||
content: The valid values for 'KeySize' depend on the values of 'KeyType' and 'HardwareBound'.
|
||||
See those keys for specific requirements.
|
||||
- key: KeyType
|
||||
title: Key Type
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- RSA
|
||||
- ECSECPrimeRandom
|
||||
content: |-
|
||||
Specifies the type of key pair to generate.
|
||||
'RSA' specifies an RSA key pair. If you set this value to 'RSA', set 'KeySize' in the range '[1024..4096]' inclusive and a multiple of '8', and set 'HardwareBound' to 'false'.
|
||||
'ECSECPrimeRandom' specifies a key pair on the P-256, P-384 or P-521 curves as defined in FIPS Pub 186-4, and 'KeySize' determines the specific curve. If you set this value to 'ECSECPrimeRandom', set 'KeySize' to '256', '384', or '521'. The system only supports '256' and '384' for hardware bound keys.
|
||||
The key size is '521', not '512', even though the other key sizes are multiples of '64'.
|
||||
- key: HardwareBound
|
||||
title: Hardware Bound
|
||||
type: <boolean>
|
||||
presence: required
|
||||
content: |-
|
||||
If 'false', the private key isn't bound to the device.
|
||||
If 'true', the private key is bound to the device. The Secure Enclave generates the key pair, and the private key is cryptographically entangled with a system key. This protects the private key from being exported.
|
||||
If 'true', 'KeyType' needs to be 'ECSECPrimeRandom' and 'KeySize' needs to be '256' or '384'.
|
||||
On macOS, this is a required key. Set the value to 'false'.
|
||||
- key: Subject
|
||||
title: Subject
|
||||
type: <array>
|
||||
presence: required
|
||||
content: |-
|
||||
The device requests this subject for the certificate that the ACME server issues. The ACME server may override or ignore this field in the certificate it issues.
|
||||
The representation of an X.500 name is an array of OID and value. For example, '/C=US/O=Apple Inc./CN=foo/1.2.5.3=bar' corresponds to:
|
||||
'[ [ [”C”, “US”] ], [ [”O”, “Apple Inc.”] ], [ [ “CN”, “foo”] ], [ [ “1.2.5.3”, “bar” ] ] ]'
|
||||
You can represent OIDs as dotted numbers or use shortcuts for country ('C'), locality ('L'), state ('ST'), organization ('O'), organizational unit ('OU'), and common name ('CN').
|
||||
subkeys:
|
||||
- key: ACMESubjectArrayInnerArray
|
||||
title: Array Inside ACME Subject Array
|
||||
type: <array>
|
||||
subkeys:
|
||||
- key: ACMESubjectArrayPair
|
||||
title: Subject Array Pair
|
||||
type: <array>
|
||||
subkeys:
|
||||
- key: ACMESubjectArrayPairItem
|
||||
title: ACME Subject Array Pair Item
|
||||
type: <string>
|
||||
repetition:
|
||||
min: 2
|
||||
max: 2
|
||||
content: One item in the array representing a pair of OID and value
|
||||
- key: SubjectAltName
|
||||
title: Subject Alt Name
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: Specifies the subject's alternative name that the device requests for the
|
||||
certificate that the ACME server issues. The ACME server may override or ignore
|
||||
this field in the certificate it issues.
|
||||
subkeys:
|
||||
- key: rfc822Name
|
||||
title: RFC 822 Name
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The RFC 822 email address.
|
||||
- key: dNSName
|
||||
title: DNS Name
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The DNS name.
|
||||
- key: uniformResourceIdentifier
|
||||
title: URI
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The uniform resource identifier.
|
||||
- key: ntPrincipalName
|
||||
title: NT Principal Name
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The NT principal name.
|
||||
- key: UsageFlags
|
||||
title: Key Usage
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: |-
|
||||
The device requests this key usage for the certificate that the ACME server issues. The ACME server may override or ignore this field in the certificate it issues.
|
||||
The value is a bit field. Bit '0x01' indicates digital signature, and bit '0x04' indicates key encipherment.
|
||||
- key: ExtendedKeyUsage
|
||||
title: Extended Key Usage
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
The device requests this extended key usage for the certificate that the ACME server issues. The ACME server may override or ignore this field in the certificate it issues.
|
||||
The value is an array of strings. Each string is an OID in dotted notation. For example, '[”1.3.6.1.5.5.7.3.2”, “1.3.6.1.5.5.7.3.4”]' indicates client authentication and email protection.
|
||||
subkeys:
|
||||
- key: OID
|
||||
type: <string>
|
||||
presence: optional
|
||||
- key: Attest
|
||||
title: Attest
|
||||
type: <boolean>
|
||||
presence: optional
|
||||
default: false
|
||||
content: If 'true', the device provides attestations that describe the device and
|
||||
the generated key to the ACME server. The server can use the attestations as strong
|
||||
evidence that the key is bound to the device, and that the device has properties
|
||||
listed in the attestation. The server can use that as part of a trust score to
|
||||
decide whether to issue the requested certificate. When 'Attest' is 'true', set
|
||||
'HardwareBound' to 'true'. On macOS, set this key, if present, to 'false'.
|
||||
@@ -0,0 +1,22 @@
|
||||
title: Identity Credential
|
||||
description: 'Data for a PKCS #12 password-protected identity.'
|
||||
payload:
|
||||
credentialtype: com.apple.credential.identity
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '17.0'
|
||||
macOS:
|
||||
introduced: '14.0'
|
||||
tvOS:
|
||||
introduced: '17.0'
|
||||
watchOS:
|
||||
introduced: '10.0'
|
||||
payloadkeys:
|
||||
- key: Password
|
||||
type: <string>
|
||||
presence: required
|
||||
content: 'The password required to decrypt the PKCS #12 identity data.'
|
||||
- key: Identity
|
||||
type: <data>
|
||||
presence: required
|
||||
content: 'The PKCS #12 identity data.'
|
||||
@@ -0,0 +1,125 @@
|
||||
title: SCEP Credential
|
||||
description: A SCEP identity that should be generated by the device.
|
||||
payload:
|
||||
credentialtype: com.apple.credential.scep
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '17.0'
|
||||
macOS:
|
||||
introduced: '14.0'
|
||||
tvOS:
|
||||
introduced: '17.0'
|
||||
watchOS:
|
||||
introduced: '10.0'
|
||||
payloadkeys:
|
||||
- key: URL
|
||||
title: URL
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The SCEP URL.
|
||||
- key: Name
|
||||
title: Name
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: Any string that the SCEP server recognizes. For example, it could be a
|
||||
domain name such as 'example.org'. If a certificate authority has multiple CA
|
||||
certificates, you can use this field to specify the required certificate.
|
||||
- key: Subject
|
||||
title: Subject
|
||||
type: <array>
|
||||
presence: optional
|
||||
content: |-
|
||||
The representation of an X.500 name is an array of OID and value. For example, '/C=US/O=Apple Inc./CN=foo/1.2.5.3=bar' corresponds to:
|
||||
'[ [ [”C”, “US”] ], [ [”O”, “Apple Inc.”] ], [ [ “CN”, “foo”] ], [ [ “1.2.5.3”, “bar” ] ] ]'
|
||||
You can represent OIDs as dotted numbers or use shortcuts for country ('C'), locality ('L'), state ('ST'), organization ('O'), organizational unit ('OU'), and common name ('CN').
|
||||
subkeys:
|
||||
- key: SCEPSubjectArrayInnerArray
|
||||
title: Array Inside SCEP Subject Array
|
||||
type: <array>
|
||||
subkeys:
|
||||
- key: SCEPSubjectArrayPair
|
||||
title: Subject Array Pair
|
||||
type: <array>
|
||||
subkeys:
|
||||
- key: SCEPSubjectArrayPairItem
|
||||
title: SCEP Subject Array Pair Item
|
||||
type: <string>
|
||||
repetition:
|
||||
min: 2
|
||||
max: 2
|
||||
content: One item in the array representing a pair of OID and value
|
||||
- key: Challenge
|
||||
title: Challenge
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: A preshared secret.
|
||||
- key: Keysize
|
||||
title: Key Size
|
||||
type: <integer>
|
||||
presence: optional
|
||||
rangelist:
|
||||
- 1024
|
||||
- 2048
|
||||
- 4096
|
||||
default: 1024
|
||||
content: The key size in bits, either '1024', '2048', or '4096'.
|
||||
- key: Key Type
|
||||
title: Key Type
|
||||
type: <string>
|
||||
presence: optional
|
||||
default: RSA
|
||||
content: The key type, which always has the value 'RSA'.
|
||||
- key: Key Usage
|
||||
title: Key Usage
|
||||
type: <integer>
|
||||
presence: optional
|
||||
default: 0
|
||||
content: 'A bitmask that specifies the use of the key: ''1'' is signing, ''4'' is
|
||||
encryption, and ''5'' is both signing and encryption. Some certificate authorities,
|
||||
such as Windows CA, support only encryption or signing, but not both at the same
|
||||
time.'
|
||||
- key: CAFingerprint
|
||||
title: Fingerprint
|
||||
type: <data>
|
||||
presence: optional
|
||||
content: The fingerprint of the Certificate Authority certificate.
|
||||
- key: Retries
|
||||
title: Retries
|
||||
type: <integer>
|
||||
presence: optional
|
||||
default: 3
|
||||
content: The number of times the device should retry if the server sends a 'PENDING'
|
||||
response.
|
||||
- key: RetryDelay
|
||||
title: Retry Delay
|
||||
type: <integer>
|
||||
presence: optional
|
||||
default: 10
|
||||
content: The number of seconds to wait between subsequent retries. The system makes
|
||||
the first retry without this delay.
|
||||
- key: SubjectAltName
|
||||
title: Subject Alt Name
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The subject's alternative name for the certificate.
|
||||
subkeys:
|
||||
- key: rfc822Name
|
||||
title: RFC 822 Name
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The RFC 822 email address.
|
||||
- key: dNSName
|
||||
title: DNS Name
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The DNS name.
|
||||
- key: uniformResourceIdentifier
|
||||
title: URI
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The uniform resource identifier.
|
||||
- key: ntPrincipalName
|
||||
title: NT Principal Name
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The NT principal name.
|
||||
@@ -1,4 +1,4 @@
|
||||
title: User Name and Password Credentials
|
||||
title: User Name and Password Credential
|
||||
description: Data describing a credential representing a user name and password.
|
||||
payload:
|
||||
credentialtype: com.apple.credential.usernameandpassword
|
||||
@@ -9,12 +9,14 @@ payload:
|
||||
introduced: '13.0'
|
||||
tvOS:
|
||||
introduced: '16.0'
|
||||
watchOS:
|
||||
introduced: '10.0'
|
||||
payloadkeys:
|
||||
- key: UserName
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The user's user name for the credential.
|
||||
content: The user name for this credential.
|
||||
- key: Password
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user's password for the credential.
|
||||
content: The password for this credential.
|
||||
|
||||
@@ -0,0 +1,54 @@
|
||||
title: Asset:Data
|
||||
description: A reference to arbitrary data with a specific media type.
|
||||
payload:
|
||||
declarationtype: com.apple.asset.data
|
||||
supportedOS:
|
||||
iOS:
|
||||
introduced: '17.0'
|
||||
macOS:
|
||||
introduced: '14.0'
|
||||
tvOS:
|
||||
introduced: '17.0'
|
||||
watchOS:
|
||||
introduced: '10.0'
|
||||
payloadkeys:
|
||||
- key: Reference
|
||||
type: <dictionary>
|
||||
presence: required
|
||||
content: The external reference.
|
||||
subkeys:
|
||||
- key: DataURL
|
||||
type: <string>
|
||||
presence: required
|
||||
content: The URL that hosts the credential data. The URL must start with 'https://'.
|
||||
- key: ContentType
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The media type that describes the data.
|
||||
- key: Size
|
||||
type: <integer>
|
||||
presence: optional
|
||||
content: The size of the data at the 'DataURL'. Use this value to verify that
|
||||
the returned data is the expected data. Use this value to detect when the data
|
||||
changes.
|
||||
- key: Hash-SHA-256
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: |-
|
||||
A SHA-256 hash of the data at the 'DataURL'. Use this value to verify that the returned data is the expected data. Use this value to detect when the data changes.
|
||||
If 'Size' is '0', clients need to ignore this value or set it to an empty string.
|
||||
- key: Authentication
|
||||
type: <dictionary>
|
||||
presence: optional
|
||||
content: The server authentication details.
|
||||
subkeys:
|
||||
- key: Type
|
||||
type: <string>
|
||||
presence: required
|
||||
rangelist:
|
||||
- MDM
|
||||
- None
|
||||
content: |-
|
||||
Type of authentication:
|
||||
* MDM - a request using MDM semantics (includes the device identity certificate, and any user authentication). Equivalent to an MDM request made to the CheckInURL or ServerURL. This option can only be used when using declarative device management.
|
||||
* None - a standard GET request is carried out.
|
||||
@@ -1,4 +1,4 @@
|
||||
title: User Identity
|
||||
title: Asset:User Identity
|
||||
description: User identity data.
|
||||
payload:
|
||||
declarationtype: com.apple.asset.useridentity
|
||||
@@ -9,6 +9,8 @@ payload:
|
||||
introduced: '13.0'
|
||||
tvOS:
|
||||
introduced: '16.0'
|
||||
watchOS:
|
||||
introduced: '10.0'
|
||||
payloadkeys:
|
||||
- key: FullName
|
||||
title: Full Name
|
||||
@@ -19,4 +21,4 @@ payloadkeys:
|
||||
title: Email Address
|
||||
type: <string>
|
||||
presence: optional
|
||||
content: The user's email address.
|
||||
content: The email address of the user.
|
||||
|
||||
Reference in New Issue
Block a user