Skip to content

Support SCEP automatic profile redistribution in Iru tutorial #532

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
tashian wants to merge 6 commits into
base: main
Choose a base branch
from
Draft

Support SCEP automatic profile redistribution in Iru tutorial #532

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
b6281e9
Support SCEP automatic profile redistribution in Iru tutorial
tashian Jul 15, 2026
f49025f
Clarify that recreating the SCEP library item breaks the agent
tashian Jul 15, 2026
b06b242
Use DN component search instead of SCEP item UUID in agent config
tashian Jul 16, 2026
dcb7455
Update tutorials/connect-iru-to-smallstep.mdx
tashian Jul 16, 2026
8859bca
Update tutorials/connect-iru-to-smallstep.mdx
tashian Jul 16, 2026
9ddd5d4
Update tutorials/connect-iru-to-smallstep.mdx
tashian Jul 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 8 additions & 5 deletions tutorials/connect-iru-to-smallstep.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
---
updated_at: March 24, 2026
updated_at: July 16, 2026
title: Connect Iru (Kandji) to Smallstep
html_title: Integrate Iru (Kandji) with Smallstep Tutorial
description: Integrate Iru (Kandji) with Smallstep for Apple device security. Complete guide for enforcing device trust in macOS environments.
Expand Down Expand Up @@ -95,15 +95,18 @@ Keep this page open or save these values temporarily — you'll need them for th
- **URL**: Paste the SCEP URL from the previous step
- **Challenge**: Paste the SCEP Challenge from the previous step
- **Fingerprint**: Paste the Root Certificate Fingerprint from the previous step
- **Subject**: `CN=step-agent-bootstrap`
- **Subject**: `CN=$PROFILE_UUID,OU=$BLUEPRINT_ID,L=step-agent-bootstrap`
- Enable **Subject Alternative Names (SAN)**:
- Key: `Uniform Resource Identifier`
- Value: `deviceid:$DEVICE_ID`
- **Key Size**: `2048`
- **Key Usage**: `Both signing and encryption`
6. In the **Additional Options** section, enable **Allow all apps to access the private key**
6. In the **Additional Options** section, configure the following:
- Enable **Allow all apps to access the private key**
- Enable **Automatic profile redistribution**, and set the number of days before certificate expiration when Iru should redistribute the profile (Iru defaults to 30 days). This is what lets the agent's enrollment certificate renew before it expires.
7. Choose **Save**

A note on the Subject: Iru replaces `$BLUEPRINT_ID` with the ID of the assigned Blueprint, and `L=step-agent-bootstrap` is a fixed marker value. In the agent configuration below, the agent uses these fields to look up the certificate on the device.
## Install the Smallstep Agent

There are two ways to install the agent:
Expand Down Expand Up @@ -131,7 +134,7 @@ The Smallstep Agent requires configuration settings to connect to your Smallstep
2. In the Iru sidebar, choose **Library**
3. Choose **Add Library Item**, then select **Custom Profile**, and click **Add and Configure**
4. Set a title (e.g., `Smallstep Agent Configuration`)
5. Under **Assignment**, choose your desired Blueprint (should match the agent installation scope)
5. Under **Assignment**, choose the same Blueprint you assigned to the SCEP profile. This is required for the agent to find the certificate.
6. In the **Settings** section, create a `.mobileconfig` file with the following content and upload it:

```xml
Expand All @@ -153,7 +156,7 @@ The Smallstep Agent requires configuration settings to connect to your Smallstep
<key>TeamSlug</key>
<string>YOUR-TEAM-SLUG</string>
<key>Certificate</key>
<string>mackms:label=step-agent-bootstrap;se=false;tag=</string>
<string>mackms:ou=$BLUEPRINT_ID;l=step-agent-bootstrap;se=false;tag=</string>
</dict>
</array>
<key>PayloadDisplayName</key>
Expand Down
Loading