Certificate distribution using derived credentials
View Patent ↗Disclosed are approaches for distributing credentials using derived credentials, such as by relaying a simple certificate enrollment protocol (SCEP) payload. A computing device configures a device profile corresponding to a client device. The device profile can include a SCEP payload. The computing device later receives an override for the SCEP payload from a broker service. In response, the computing device creates a copy of the device profile that includes the override for the SCEP payload. The computing device then sends the copy of the device profile to the client device.
1. A system for relaying simple certificate enrollment protocol (SCEP) payloads using derived credentials, comprising:
a computing device comprising a processor and a memory; and
an application stored in the memory that, when executed by the processor, causes the computing device to at least:
configure a device profile corresponding to a client device, the device profile comprising a SCEP payload that comprises a first SCEP challenge;
receive an override for the SCEP payload from a broker service, the override comprising a second SCEP challenge that is based at least in part on a user account credential submitted by the client device to the broker service;
create a modified copy of the device profile comprising the override for the SCEP payload; and
send the modified copy of the device profile to the client device.
2. The system of claim 1 , wherein the override received from the broker service is provided by the broker service in response to authentication of a user account with the broker service.
3. The system of claim 1 , wherein the SCEP payload further comprises a SCEP endpoint.
4. The system of claim 3 , wherein the SCEP endpoint further comprises the broker service.
5. The system of claim 3 , wherein the SCEP endpoint comprises a certificate authority.
6. The system of claim 1 , wherein the SCEP payload further comprises the user account credential.
7. The system of claim 1 , wherein the SCEP payload further comprises user specific data.
8. A method for relaying simple certificate enrollment protocol (SCEP) payloads using derived credentials, comprising:
configuring a device profile corresponding to a client device, the device profile comprising a SCEP payload that comprises a first SCEP challenge;
receiving an override for the SCEP payload from a broker service, the override comprising a second SCEP challenge that is based at least in part on a user account credential submitted by the client device to the broker service;
creating a modified copy of the device profile comprising the override for the SCEP payload; and
sending the modified copy of the device profile to the client device.
9. The method of claim 8 , wherein the override received from the broker service is provided by the broker service in response to authentication of a user account with the broker service.
10. The method of claim 8 , wherein the SCEP payload further comprises a SCEP endpoint.
11. The method of claim 10 , wherein the SCEP endpoint comprises the broker service.
12. The method of claim 10 , wherein the SCEP endpoint comprises a certificate authority.
13. The method of claim 8 , wherein the SCEP payload further comprises the user account credential.
14. A non-transitory computer readable medium comprising machine readable instructions for relaying simple certificate enrollment protocol (SCEP) payloads using derived credentials that, when executed by a processor of a computing device, cause the computing device to at least:
configure a device profile corresponding to a client device, the device profile comprising a SCEP payload that comprises a first SCEP challenge;
receive an override for the SCEP payload from a broker service, the override comprising a second SCEP challenge that is based at least in part on a user account credential submitted by the client device to the broker service;
create a modified copy of the device profile comprising the override for the SCEP payload; and
send the modified copy of the device profile to the client device.
15. The non-transitory computer readable medium of claim 14 , wherein the override received from the broker service is provided by the broker service in response to authentication of a user account with the broker service.
16. The non-transitory computer readable medium of claim 14 , wherein the SCEP payload further comprises a SCEP endpoint.
17. The non-transitory computer readable medium of claim 16 , wherein the SCEP endpoint comprises the broker service.
18. The non-transitory computer readable medium of claim 16 , wherein the SCEP endpoint comprises a certificate authority.
19. The non-transitory computer readable medium of claim 14 , wherein the SCEP payload further comprises the user account credential.
20. The non-transitory computer readable medium of claim 14 , wherein the SCEP payload further comprises user specific data.