mirror of
https://github.com/apple/device-management.git
synced 2026-08-13 12:00:21 +02:00
53 lines
2.3 KiB
YAML
53 lines
2.3 KiB
YAML
title: FDE Recovery Key Redirection
|
|
description: The payload that configures FileVault recovery key redirection.
|
|
payload:
|
|
payloadtype: com.apple.security.FDERecoveryRedirect
|
|
supportedOS:
|
|
iOS:
|
|
introduced: n/a
|
|
macOS:
|
|
introduced: '10.9'
|
|
deprecated: '10.13'
|
|
multiple: false
|
|
devicechannel: true
|
|
userchannel: false
|
|
requiresdep: false
|
|
userapprovedmdm: false
|
|
allowmanualinstall: true
|
|
userenrollment:
|
|
mode: forbidden
|
|
tvOS:
|
|
introduced: n/a
|
|
visionOS:
|
|
introduced: n/a
|
|
watchOS:
|
|
introduced: n/a
|
|
content: |-
|
|
This payload will be ignored on macOS 10.13 and later. See "com.apple.security.FDERecoveryKeyEscrow" payload.
|
|
Old notes:
|
|
Once installed, this payload will cause any FDE (Full Disk Encryption) recovery keys to be redirected to the specified URL instead of being sent to Apple. This will require sites to implement their own HTTPS server that will receive the recovery keys via a POST request. Details of the data sent to the server will be provided in a different document.
|
|
Notes:
|
|
* The payload must exist in a "system" scoped profile.
|
|
* It will be an error to install more than one payload of this type per machine.
|
|
payloadkeys:
|
|
- key: RedirectURL
|
|
type: <string>
|
|
presence: required
|
|
content: The URL to which the device sends FDE recovery keys instead of to Apple.
|
|
The URL must begin with https://.
|
|
- key: EncryptCertPayloadUUID
|
|
type: <string>
|
|
presence: required
|
|
content: The UUID of a payload within the same profile that contains a certificate
|
|
used to encrypt the recovery key when the device sends it to the redirected URL.
|
|
The referenced payload must be of type \`com.apple.security.pkcs1\`.
|
|
notes:
|
|
- title: ''
|
|
content: |-
|
|
Although the previous FDE Recovery payload is no longer supported in macOS 10.13 and later, it's still supported in macOS 10.9 through 10.12. When installed, this payload causes any FDE recovery keys to be redirected to the specified URL instead of being sent to Apple. This requires sites to implement their own HTTPS server to receive the recovery keys through a POST request.
|
|
|
|
Note these cautions:
|
|
|
|
- The payload must exist in a system-scoped profile.
|
|
- Installing more than one payload of this type per machine results in an error.
|