Automated desktop client deployment/provisioning

[wojcik91]

Propose a way to support automated client deployments to remote user machines.

Research most commonly used tooling for different platforms (Windows, macOS and Linux) to make this functionality as convenient as possible.

[wojcik91]

Initial proposal for the basic deployment process:

• admin uses Defguard API (and whatever scripting solution they prefer) to generate enrollment tokens for users
• admin deploys the application itself to user machine (by installing the provided package)
• as part of the deployment process a file containing the enrollment URL and an enrollment token is placed in a known location (most likely the application data directory)
• when the client is started it checks if it's been initialized already (if an instance has already been added)
• if it has not yet been initialized, we check if the token file is present
• enrollment token & URL is read from file
• the enrollment process is automatically started in the background
• the user is redirected straight to the enrollment page
• user can now complete the enrollment process (setup password, MFA method, activate desktop client)
• once the enrollment is complete user can use the VPN

While this approach does not allow for deploying a fully pre-configured client it retains our ability to support VPN with MFA without compromising security.

Possible issues:

• we have to enable customizing how long an enrollment token is valid for, because the default 24h could sometimes not be enough
• can we be sure that a user and therefore the app data directory is always present during deployment?

[teon]

• Support enrollment with Microsoft Intune on the Server Side (Core)
• Support enrollment initiation on Defguard Client with Microsoft Intune

[kchudy]

Alternative framework to Microsoft Intune mentioned by one of the clients: https://robopack.com/

[wojcik91]

• add Windows script which fetches data from AD or Entra and stores it as JSON config file
• bundle script with MSI and execute during install
• update client to read provisioning config and redirect user to enrollment page if necessary
• add example PS script for generating enrollment tokens for a given group and putting them in AD
• add example PS script for generating enrollment tokens for a given group and putting them in Entra
• prepare & execute complete enrollment process with AD
  • setup test Defguard instance with AD sync
  • setup test users & group
  • setup test Windows machines to act as admin and domain-joined user
  • execute helper script on admin machine to generate enrollment tokens and put them into a specified AD attribute
  • use GPO to install our MSI + provide properties to MSI to trigger the provisioning process
  • launch client and go through enrollment process on user machine
• prepare & execute complete enrollment process with Entra
• add documentation for the provisioning process architecture
• document general provisioning process
• document specific AD provisioning process
• document specific Entra ID provisioning process

[wojcik91]

Provisioning process documentation: https://docs.defguard.net/1.6/features/desktop-client-auto-provisioning