Support SCEP automatic profile redistribution in Iru tutorial#532
Draft
tashian wants to merge 6 commits into
Draft
Support SCEP automatic profile redistribution in Iru tutorial#532tashian wants to merge 6 commits into
tashian wants to merge 6 commits into
Conversation
With Iru's automatic profile redistribution enabled, the SCEP library item's UUID is appended to the certificate Subject, so the agent's keychain lookup label must include it. Without this, the agent's exact-match certificate lookup fails after the first renewal and the agent cannot start. - Enable automatic profile redistribution in the SCEP profile steps - Add a step to copy the SCEP library item's UUID from its URL - Include the UUID in the agent's mackms: certificate label - Require creating the SCEP profile before the agent Custom Profile - Warn against $PROFILE_UUID in the agent profile and against recreating the SCEP library item Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
tashian
enabled auto-merge (squash)
July 15, 2026 15:47
Iru requires the profile identifier in the CN, so the CN is not a stable lookup key. Instead of copying the SCEP library item's UUID into the agent profile, set stable OU/L components in the SCEP Subject and have the agent search by those via mackms ou= and l=. Requires the SCEP profile and the agent Custom Profile to be assigned to the same Blueprint so $BLUEPRINT_ID renders identically in both. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
tashian
marked this pull request as draft
July 16, 2026 22:35
auto-merge was automatically disabled
July 16, 2026 22:35
Pull request was converted to draft
tashian
commented
Jul 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Describe your changes:
The Iru (Kandji) tutorial's agent configuration only works while SCEP certificate renewal is off. When Automatic profile redistribution is enabled on the SCEP library item, Iru puts the SCEP profile's UUID in the certificate Subject's CN, the keychain label changes, and the agent's exact-match certificate lookup fails — the agent can never start after the first renewal.
Since Iru requires the CN to carry the profile identifier, the CN isn't a stable lookup key. This updates the tutorial to identify the certificate by stable DN components instead:
CN=$PROFILE_UUID,OU=$BLUEPRINT_ID,L=step-agent-bootstrapCertificatevalue becomesmackms:ou=$BLUEPRINT_ID;l=step-agent-bootstrap;se=false;tag=$BLUEPRINT_IDrenders identically in bothmackms:lookup byou/lSubject components (today it only supportslabel/serial/keychain). Merge once the agent change is released.Verified with vale and markdown-link-check, and rendered locally via
pnpm dev.Related links/other PRs/issues:
EFF-433
Thank you!
🤖 Generated with Claude Code