Automated desktop client deployment/provisioning

[wojcik91]

Propose a way to support automated client deployments to remote user machines.

Research most commonly used tooling for different platforms (Windows, macOS and Linux) to make this functionality as convenient as possible.

[wojcik91]

Initial proposal for the basic deployment process:

• admin uses Defguard API (and whatever scripting solution they prefer) to generate enrollment tokens for users
• admin deploys the application itself to user machine (by installing the provided package)
• as part of the deployment process a file containing the enrollment URL and an enrollment token is placed in a known location (most likely the application data directory)
• when the client is started it checks if it's been initialized already (if an instance has already been added)
• if it has not yet been initialized, we check if the token file is present
• enrollment token & URL is read from file
• the enrollment process is automatically started in the background
• the user is redirected straight to the enrollment page
• user can now complete the enrollment process (setup password, MFA method, activate desktop client)
• once the enrollment is complete user can use the VPN

While this approach does not allow for deploying a fully pre-configured client it retains our ability to support VPN with MFA without compromising security.

Possible issues:

• we have to enable customizing how long an enrollment token is valid for, because the default 24h could sometimes not be enough
• can we be sure that a user and therefore the app data directory is always present during deployment?

[teon]

• Support enrollment with Microsoft Intune on the Server Side (Core)
• Support enrollment initiation on Defguard Client with Microsoft Intune

[kchudy]

Alternative framework to Microsoft Intune mentioned by one of the clients: https://robopack.com/

[wojcik91]

• add Windows script which fetches data from AD or Entra and stores it as JSON config file
• bundle script with MSI
• update client to read provisioning config and redirect user to enrollment page if necessary
• add example PS script for generating enrollment tokens for a given group and putting them in AD
• test process on test VM with AD connection
• test process on test VM with Entra connection
• add documentation for the provisioning process architecture