Guide: Enable Okta Verify on my macOS hosts using variables in configuration profiles

[noahtalerman]

Goal

User story
As a Client Platform Engineer,
I want to know how to deploying a profile (SCEP payload) in Fleet w/ computer name, serial number, and UUID as variables
so that Fleet, for each host, populates this variable with host specific information. This way, I can install a unique SCEP certificate to enable Okta Verify on my macOS hosts.

Context

We learned that the necessary variables are already supported natively in macOS and we don't need to make changes to Fleet to support this workflow: #16958 (comment)

Changes

Product

• Reference documentation changes: None.
• UI changes: None.
• CLI usage changes: None.
• REST API changes: None.
• Fleet's agent (fleetd) changes: None.
• Permissions changes: None.
• Changes to paid features or tiers: None.

Engineering

• Feature guide changes: Sign up for an Okta trial, test this workflow, and write a guide that walks the IT admin through how to connect a macOS host to Okta verify using variables in config profiles in Fleet.
• Database schema migrations: None.
• Load testing: None.

[noahtalerman]

Hey @georgekarrv, I can't remember...do we treat missing guides as bugs?

If so, can you please update this to a bug and pull it onto the release board?

cc @lukeheath

[lukeheath]

@noahtalerman Yes, we track any missing documentation as bugs. @georgekarrv please reformat and bring into the board when you have the chance. Thanks!

[georgekarrv]

Hey team! Please add your planning poker estimate with Zenhub @dantecatalfamo @ghernandez345 @gillespi314 @jahzielv @mna @roperzh

[roperzh]

note: it already happened in the past that we wanted a feature like this for both mac and windows, however since the issue description explicitly calls out macOS, I'll move forward with macOS only.

[roperzh]

note II: looking at the Okta Verify flow, it's a multi step setup, where issuing a SCEP certificate is just one step of many. I won't note all of that in the guide, because we would be documenting the Okta product.

The guide will be about how to configure and distribute a SCEP profile in Fleet that uses Okta as the CA. Something very similar to this page only https://help.okta.com/oie/en-us/content/topics/identity-engine/devices/configure-ca-main.htm

[roperzh]

#22108

[fleet-release]

Fleet links Mac to Okta,
Each host unique, secure.
A cloud city's lock.