CalvinBackup/apple_device-management
1
0
Fork 0
mirror of https://github.com/apple/device-management.git synced 2026-07-11 13:26:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

Release_iOS-17-0_macOS-14-0

Browse Source
This commit is contained in:
Cyrus Daboo
2023-09-14 17:37:05 -04:00
parent 5a8fb0deb2
commit 72c2a0a69f
254 changed files with 6787 additions and 969 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/errata.md
+33
View File
@@ -0,0 +1,33 @@
# Schema Errata
This document lists errata for the YAML schema. This is used when older versions of the schema are incorrect, and a fix was made in later schema to correct the problem.
## iOS 17 / macOS 14
### profiles/com.apple.vpn.managed.yaml
The `CertificateType` key in the `com.apple.vpn.managed` profile payload incorrectly listed `Ed25519` as a supported certificate type. That type was never supported and has now been removed.
The `PPTP` VPNType has not been supported since iOS 10 and macOS 10.12, see https://support.apple.com/en-us/HT206844. The `PPTP` VPNType has been removed.
### mdmprotocol/commands passcode.firmware.set.yaml passcode.firmware.verify.yaml
The response keys were incorrectly listed as being top-level keys in the response dictionary when in fact they were nested one-level deep.
### profiles/com.apple.vpn.managed.applayer.yaml
The `OnDemandMatchAppEnabled` key in the `com.apple.vpn.managed.applayer` profile payload incorrectly listed its type as `integer`. The correct type is `boolean`.
### profiles/com.apple.wifi.managed.yaml
The EAPClientConfiguration dictionary listed both OneTimePassword and OneTimeUserPassword as valid keys. The erroneous OneTimePassword key has been removed.
### profiles/com.apple.security.scep.yaml
The documentation indicated that all the keys in the SubjectAltName value could be either string or array types. The ntPrincipalName cannot be an array and must be a
string. This has been clarified in the description. Note that the type field for the rfc822Name, dNSName, and uniformResourceIdentifier still indicates these are
strings. This has not been corrected as the schema does not support polymorphic types.
### profiles/com.apple.universalaccess.yaml
The `contrast` key in the `com.apple.universalaccess` profile payload incorrectly listed its type as `integer`. The correct type is `real`.
docs/schema.md
+28 -20
View File
@@ -13,6 +13,7 @@ The definition of the schema used here is in the `schema.yaml` file. That file c
| payload | object | Information about the object as a whole |
| payloadkeys | array | A list of YAML objects representing the command request |
| responsekeys | array | A list of YAML objects representing the command response |
| reasons | array | A list of YAML objects representing declarative device management status reason codes |
### Payload Object
@@ -24,6 +25,7 @@ The definition of the schema used here is in the `schema.yaml` file. That file c
| statusitemtype | string | Type of the status payload |
| credentialtype | string | Type of the credential asset data |
| supportedOS | object | Identifies the range of supported OS versions that support the entire payload |
| apply | string | Indicates how multiple configurations of the same type are applied |
| content | string | Description of the payload |
### supportedOS Object
@@ -41,29 +43,33 @@ The `supportedOS` object is used in the `payload` object to indicate overall sup
### iOS, macOS, tvOS, watchOS Objects
| Name | Type | Description |
|--------------------|---------|-------------|
| introduced | string | OS version where feature was introduced |
| deprecated | string | OS version where feature was deprecated |
| removed | string | OS version where feature was removed |
| accessrights | string | The MDM protocol access rights required on the device to execute the command |
| devicechannel | boolean | Indicates whether the command is supported on the device channel |
| userchannel | boolean | indicates whether the command is supported on the user channel |
| supervised | boolean | Indicates whether the command can only be executed on supervised devices |
| requiresdep | boolean | If True, the command can only be executed on devices provisioned in DEP |
| userapprovedmdm | boolean | If True, the command can only be executed on devices with user approved MDM enrollment |
| allowmanualinstall | boolean | If True, the profile can be installed manually by a user on the device |
| sharedipad | object | Additional behavior specific to shared iPad devices |
| userenrollment | object | Additional behavior when user enrollment is in effect |
| always-skippable | boolean | If True, indicates that the skip key's corresponding Setup pane is always skipped. If False, indicates that the skip key's corresponding Setup pane may be shown, depending on exactly when during the setup flow it occurs. This is only used in skipkeys.yaml. |
| Name | Type | Description |
|---------------------|---------|-------------|
| introduced | string | OS version where feature was introduced |
| deprecated | string | OS version where feature was deprecated |
| removed | string | OS version where feature was removed |
| accessrights | string | The MDM protocol access rights required on the device to execute the command |
| multiple | boolean | Indicates whether multiple copies of the payload can be installed |
| devicechannel | boolean | Indicates whether the command or profile is supported on the device channel |
| userchannel | boolean | indicates whether the command or profile is supported on the user channel |
| supervised | boolean | Indicates whether the command or profile can only be executed on supervised devices |
| requiresdep | boolean | If True, the command can only be executed on devices provisioned in DEP |
| userapprovedmdm | boolean | If True, the command can only be executed on devices with user-approved MDM enrollment |
| allowmanualinstall | boolean | If True, the profile can be installed manually by a user on the device |
| sharedipad | object | Additional behavior specific to shared iPad devices |
| userenrollment | object | Additional behavior when user enrollment is in effect |
| always-skippable | boolean | If True, indicates that the skip key's corresponding Setup pane is always skipped. If False, indicates that the skip key's corresponding Setup pane may be shown, depending on exactly when during the setup flow it occurs. This is only used in skipkeys.yaml. |
| allowed-enrollments | string | Array of allowed enrollment types for declarative device management |
| allowed-scopes | string | Array of allowed enrollment scopes for declarative device management |
### Shared iPad Object
| Name | Type | Description |
|---------------|---------|-------------|
| mode | string | Indicates whether a payload or payload key can used with shared iPad |
| devicechannel | boolean | Defines if the payload can be installed on the device MDM channel |
| userchannel | boolean | Defines if the payload can be installed on the user MDM channel |
| Name | Type | Description |
|----------------|---------|-------------|
| mode | string | Indicates whether a payload or payload key can used with shared iPad |
| devicechannel | boolean | Defines if the payload can be installed on the device MDM channel |
| userchannel | boolean | Defines if the payload can be installed on the user MDM channel |
| allowed-scopes | string | Array of allowed enrollment scopes for declarative device management |
__Notes__
@@ -89,12 +95,14 @@ The `mode` can have one of four values: `allowed`, `required`, `forbidden`, and
| supportedOS | object | Identifies the range of supported OS versions that support the key |
| type | string | The type of key |
| subtype | string | Indicates the expected format of the string value of the key |
| assettypes | string | Indicates the set of allowed asset types |
| presence | string | Whether the key is required or optional |
| rangelist | array | List of allowed values for this key |
| range | object | Bounds for the value of this key |
| default | scalar | The default value for the key |
| format | string | The format for the value expressed as a regular expression |
| repetition | object | Cardinality for this value |
| combinetype | string | Indicates how this key is combined with ones from other configurations |
| content | string | Description of the payload key |
| subkeytype | string | A name that uniquely represents the structured subkey object |
| subkeys | array | An array of payload keys |
docs/schema.yaml
+116 -4
View File
@@ -52,24 +52,44 @@ properties:
accessrights:
type: string
description: The MDM protocol access rights required on the device to execute the command.
multiple:
type: boolean
description: Indicates whether multiple copies of the payload can be installed
devicechannel:
type: boolean
description: Indicates whether the command is supported on the device channel. If this key is present it overrides the the `devicechannel` key in the top-level payload !!(payload) key.
description: Indicates whether the command or profile is supported on the device channel. If this key is present it overrides the the `devicechannel` key in the top-level payload !!(payload) key.
userchannel:
type: boolean
description: indicates whether the command is supported on the user channel. If this key is present it overrides the the `userchannel` key in the top-level payload !!(payload) key.
description: indicates whether the command or profile is supported on the user channel. If this key is present it overrides the the `userchannel` key in the top-level payload !!(payload) key.
supervised:
type: boolean
description: Indicates whether the command can only be executed on supervised devices. If this key is present it overrides the the `supervised` key in the top-level payload !!(payload) key.
description: Indicates whether the command or profile can only be executed on supervised devices. If this key is present it overrides the the `supervised` key in the top-level payload !!(payload) key.
requiresdep:
type: boolean
description: If True, the command can only be executed on devices provisioned in DEP.
userapprovedmdm:
type: boolean
description: If True, the command can only be executed on devices with user approved MDM enrollment.
description: If True, the command can only be executed on devices with user-approved MDM enrollment.
allowmanualinstall:
type: boolean
description: If True, the profile can be installed manually by a user on the device.
allowed-enrollments:
type: array
description: Array of allowed enrollment types.
items:
type: string
enum:
- device
- user
- local
allowed-scopes:
type: array
description: Array of allowed scopes.
items:
type: string
enum:
- system
- user
sharedipad:
type: object
description: Additional behavior specific to shared iPad devices.
@@ -94,6 +114,15 @@ properties:
userchannel:
type: boolean
description: Defines if the payload can be installed on the user MDM channel.
allowed-scopes:
type: array
description: Array of allowed scopes.
items:
type: string
enum:
- system
- user
- local
userenrollment:
type: object
description: Additional behavior when user enrollment is in effect.
@@ -124,6 +153,16 @@ properties:
macOS: *supportedOSItem
tvOS: *supportedOSItem
watchOS: *supportedOSItem
apply:
type: string
description: Indicates how multiple configurations of the same type are applied.
If set to 'single', then only one configuration will be applied.
If set to 'multiple', then each configuration is applied separately.
If set to 'combined', then all configurations are combined into a single effective configuration.
enum:
- single
- multiple
- combined
content:
type: string
description: Description of the payload.
@@ -168,6 +207,11 @@ properties:
- <url>
- <hostname>
- <email>
assettypes:
type: array
description: Indicates the set of allowed asset types.
items:
type: string
presence:
type: string
description: Whether the key is required or optional.
@@ -202,6 +246,7 @@ properties:
- string
- integer
- number
- boolean
description: The default value (if any) for the key.
format:
type: string
@@ -220,6 +265,31 @@ properties:
max:
type: integer
description: Upper bound.
combinetype:
type: string
description: |-
For a configuration that will be combined, indicates how this key is combined with ones from other configurations.
* boolean-or - multiple <boolean> values are combined using a logical OR operation
* boolean-and - multiple <boolean> values are combined using a logical AND operation
* number-min - multiple <integer> or <real> values are combined by using the smallest value
* number-max - multiple <integer> or <real> values are combined by using the largest value
* enum-lowest - multiple <string> values with a rangelist are combined by using the value whose position is lowest in the range list
* enum-highest - multiple <string> values with a rangelist are combined by using the value whose position is highest in the range list
* first - multiple values are combined by using the first value that is processed
* array-append - multiple <array> values are combined by concatenating the values in each array into a new array
* set-union - multiple <array> values are combined by returning the unique union of all values in each array
* set-intersection - multiple <array> values are combined by returning the unique intersection of all values in each array
enum:
- boolean-or
- boolean-and
- number-min
- number-max
- enum-lowest
- enum-highest
- first
- array-append
- set-union
- set-intersection
content:
type: string
description: Description of the payload key.
@@ -229,3 +299,45 @@ properties:
subkeys: *payloadKeys
responsekeys: *payloadKeys
reasons:
type: array
description: An array of Remote Management status reason codes.
items:
type: object
description: An Remote Management reason code.
additionalProperties: false
properties:
value:
type: string
description: The Remote Management reason code.
description:
type: string
description: Description of the Remote Management reason code.
details:
type: array
description: Keys defined in the Details dictionary
items:
type: object
description: Details dictionary keys
additionalProperties: false
properties:
key:
type: string
description: The name of the dictionary key.
description:
type: string
description: Description of the dictionary item.
type:
type: string
description: The type of the dictionary value.
enum:
- <string>
- <integer>
- <real>
- <boolean>
- <date>
- <data>
- <array>
- <dictionary>
- <any>