Credentails from configuration profile in Content Filter

Question

Created Dec ’20

Replies 4

Boosts 0

Participants 2

Hi,
We are developing a Network Extension Content Filter plugin, we are using the Apple Configurator 2 to create profiles that are installed on supervised devices.

I the project has entitlements setup for Network Extensions and App Groups

I have created a Content Filter payload with the appropriate data, ServerAddress, UserName and Password

My goal here is to use credentials found in configuration profile to create credentials used in URLSession requests

Now here is where I have gotten confused.
I've read this post
https://developer.apple.com/forums/thread/70806

this pointed me to use the keychain access groups.

"I suspect you’re being bitten by keychain access groups. Security items installed via a configuration profile typically go into the com.apple.managed.vpn.shared access group"

Then I have found the following:
https://developer.apple.com/forums/thread/67613

but I am still confused.

"This entitlement is only necessary if your VPN supports configuration via a configuration profile and needs to access credentials from that profile (as discussed in the Profile Configuration section of the NETunnelProviderManager Reference)."

"Access to this keychain access group requires a special entitlement. If you need that entitlement, please open a DTS tech support incident and we will take things from there"

Questions:

Is it the same keychain for credentials for a Content Filter configured via configuration profile?
Do I need to create a DTS tech support ticket to get keychain access?

/Cheers
Kristofer Linnestjerna

Boost

Answer 1

Systems Engineer OP

Apple

Dec ’20

Is it the same keychain for credentials for a Content Filter configured via configuration profile?
This entitlement is only necessary if your VPN supports configuration via a configuration profile

The reason this could be a supported workflow via VPN is because there are certain cases where a client needs to authentication with a VPN server to establish the tunnel. This is not typically the case for a Content Filter. What is the use case here?

Do I need to create a DTS tech support ticket to get keychain access?

If you want to discuss the use-case on a DTS incident, then yes, open an incident and we can discuss this further offline. However, I cannot guarantee that opening an DTS incident will make you a fit for this entitlement.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

0

Answer 2

klinnestjerna OP

Dec ’20

This is not typically the case for a Content Filter. What is the use case here?

My use case is that I would like to use the supplied credentials from the configuration profile (Content Filter payload)
to be used in the authentication process when calling external services.

The external service needs authentication to be provided.

When I use the filterConfiguration: NEFilterProviderConfiguration in my NEFilterControlProvider class, it the contains a passwordReference and from what I understand this reference just points to a value of a password stored in a keychain.

Now I would like to know which keychain it is, and if I need special entitlements to read from it.

Or have I misunderstood the documentation?

My goal is to create URLCredentials to be used in URLSession calls. My NEFilterControlProvider
should be able to call services with the supplied credentials from the configuration profile.

So I don't want to use the VPN stuff, I just can't find any documentation with where the credential payload is stored in the context of a Content Filter profile payload.

/Cheers

Kristofer

0

Answer 3

klinnestjerna OP

Dec ’20

Sorry I think I need to clarify what content filter I was referring to. We use the com.apple.webcontent-filter on a supervised device and the we have the FilterType set to Plugin

So how do I go about and retrive the password I have set in the payload of this profile on the device?

/Cheers
Kristofer

0

Answer 4

Systems Engineer OP

Apple

Dec ’20

This is not typically the case for a Content Filter. What is the use case here?

A Packet Tunnel VPN.

We use the com.apple.webcontent-filter on a supervised device and the we have the FilterType set to Plugin

This does not change my previous response about the usage of com.apple.managed.vpn.shared.

So how do I go about and retrive the password I have set in the payload of this profile on the device?

There may be an out of band way to do with with the configuration profile and not the Keychain. For example, if you look at the Filter Type of Plugin in Apple Configurator there should be a field that shows up as Custom Data and this then maps to a VendorConfig dictionary in the profile where you can add custom data. However if your profile is not encrypted then I would advise against this from a Security standpoint.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

0