Has anyone indeed more details ?
We tried the following:
Build a jwt token, using:
headers as
headers = {
'typ': 'JWT',
'alg': 'RS256'
}
and claim as :
claim = {
'iss': DEP_SERVER_UUID,
'iat': epoch_time_in_ms,
'jti': RANDOM_UUID,
'service_type': 'com.apple.maid'
}
The token is signed with the private key which was used to generate the public key added to the DEP server in Apple Business Manager.
Using python 3, we're using PyJWT package : https://pyjwt.readthedocs.io/en/latest/api.html
This generates jwt token - which seems ok according to https://jwt.io ; token is encoded in utf-8 and then returned in plist as:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>TokenData</key>
<data>
BASE64_ENCODED_VERSION_OF_THE_TOKEN
</data>
</dict>
</plist>
So everything is ok, but I can't log in with a managed Apple ID from the same Business Manager if I enforce "Supervised devices".
Device is sending the GetToken checkin request, receives the response, but does not let user log in.
is there anything missing ? It looks we fulfill documentation requirements, so can't figure out what's wrong.
Thanks for any hint !
