PUT: /checkin
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC
"-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>MessageType</key>
<string>Authenticate</string>
<key>Topic</key>
<string>com.example.mdm.pushcert</string>
<key>UDID</key>
<string> [ redacted ] </string>
</dict>
</plist>
The enrollment profile can be installed through IPCU directly, or through
an IPCU-created profile pulled off a web link, or by another process
hosted on the MDM server.
Once the profile is installed, the device sends the Authenticate
message, then in a separate connection, the TokenUpdate message.
The first step is the device authenticating itself to the server. It’s not so
much a secure authentication as it is a simple identification, but it
provides the server a chance, based on the Topic and UDID provided, to
accept or reject the enrollment request. This can be used to prevent just
anyone from enrolling with the corporate MDM server. (additional steps
at a more user-friendly level, such as web-based authentication panels
with real usernames/passwords, are also possible, and can be used
prior to creating an enrollment profile).
The data is presented to the server over HTTP (perhaps SSL-
encryped), using PUT, to the URL specified in the enrollment profile’s
“Check In” field. The data itself is an Apple Property List (.plist) file,
XML formatted. [key elements of the data are highlighted here in red]
Comentarios a estos manuales