Remote VPN configuration using dynamically generated configuration profiles
Disclosed are various examples for remote virtual private network (VPN) configuration using dynamically generated configuration profiles. A computing environment having a management service can determine variable names for inclusion in configuration profiles that are capable of configuring VPN settings on various managed device operating systems. The computing environment can dynamically generate configuration profiles using the appropriate variable names such that a client device having a particular operating system installed thereon is capable of interpreting the value and the variable name to configure the VPN setting.
1. A system, comprising:
at least one computing device; and
program instructions executable in the at least one computing device that, when executed by the at least one computing device, cause the at least one computing device to:
identify a value from a field of at least one user interface, the field being associated with a virtual private network (VPN) setting common to a plurality of operating systems;
determine a first variable name for inclusion in a first configuration profile in association with the value to configure the VPN setting on a first one of the plurality of operating systems;
determine a second variable name for inclusion in a second configuration profile in association with the value to configure the VPN setting on a second one of the plurality of operating systems, the second one of the plurality of operating systems being different than the first one of the plurality of operating systems;
generate the first configuration profile such that the value is a parameter of the first variable name for deployment to a first client device having the first one of the plurality of operating systems installed thereon; and
generate the second configuration profile such that the value is a parameter of the second variable name for deployment to a second client device having the second one of the plurality of operating systems installed thereon,
wherein the first configuration profile and the second configuration profile are each configured to, when installed on a respective client device, configure the respective client device and designate a respective agent application as a device administrator, the agent application as the device administrator being configured to control access to at least one software or hardware function of the respective client device.
2. The system of claim 1 , further comprising program instructions that, when executed, cause the at least one computing device to:
instruct a first agent application executable on the first client device to configure the VPN setting on the first client device using the first variable name and the value; and
instruct a second agent application executable on the second client device to configure the VPN setting on the second client device using the second variable name and the value.
3. The system of claim 2 , wherein:
configuring the VPN setting on the first client device using the first variable name and the value further comprises establishing a first VPN for an individual client application of the first client device; and
configuring the VPN setting on the second client device using the second variable name and the value further comprises establishing a VPN for an individual client application of the second client device.
4. The system of claim 2 , wherein the VPN setting is at least one of: a connection name, a connection type, an authentication type, a server address associated with a VPN, or an internet protocol (IP) address associated with the VPN.
5. The system of claim 4 , wherein the authentication type is certificate-based authentication.
6. The system of claim 2 , wherein configuring the VPN setting further comprises establishing a secure socket layer virtual private network (SSL-VPN).
7. The system of claim 1 , wherein:
the first configuration profile comprises a first extensible markup language (XML) document programmatically generated by the at least one computing device using a first predefined format corresponding to the first one of the plurality of operating systems; and
the second configuration profile comprises a second XML document programmatically generated by the at least one computing device using a second predefined format corresponding to the second one of the plurality of operating systems.
8. The system of claim 1 , further comprising program instructions that, when executed, cause the at least one computing device to maintain a database that comprises a mapping of a name attribute for the field associated with the VPN setting to the first variable name corresponding to the first one of the plurality of operating systems and the second variable name corresponding to the second one of the plurality of operating systems.
9. A non-transitory computer-readable medium embodying program instructions executable in at least one computing device that, when executed by the at least one computing device, cause the at least one computing device to:
identify a value from a field of at least one user interface, the field being associated with a virtual private network (VPN) setting common to a plurality of operating systems;
determine a first variable name for inclusion in a first configuration profile in association with the value to configure the VPN setting on a first one of the plurality of operating systems;
determine a second variable name for inclusion in a second configuration profile in association with the value to configure the VPN setting on a second one of the plurality of operating systems, the second one of the plurality of operating systems being different than the first one of the plurality of operating systems;
generate the first configuration profile such that the value is a parameter of the first variable name for deployment to a first client device having the first one of the plurality of operating systems installed thereon; and
generate the second configuration profile such that the value is a parameter of the second variable name for deployment to a second client device having the second one of the plurality of operating systems installed thereon, wherein the first configuration profile and the second configuration profile are each configured to, when installed on a respective client device, configure the respective client device and designate a respective agent application as a device administrator, the agent application as the device administrator being configured to control access to at least one software or hardware function of the respective client device.
10. The non-transitory computer-readable medium of claim 9 , further comprising program instructions that, when executed, cause the at least one computing device to:
instruct a first agent application executable on the first client device to configure the VPN setting on the first client device using the first variable name and the value; and
instruct a second agent application executable on the second client device to configure the VPN setting on the second client device using the second variable name and the value.
11. The non-transitory computer-readable medium of claim 10 , wherein:
configuring the VPN setting on the first client device using the first variable name and the value further comprises establishing a first VPN for an individual client application of the first client device; and
configuring the VPN setting on the second client device using the second variable name and the value further comprises establishing a VPN for an individual client application of the second client device.
12. The non-transitory computer-readable medium of claim 9 , wherein the VPN setting is at least one of: a connection name, a connection type, an authentication type, a server address associated with a VPN, or an internet protocol (IP) address associated with the VPN.
13. The non-transitory computer-readable medium of claim 12 , wherein the authentication type is certificate-based authentication.
14. The non-transitory computer-readable medium of claim 10 , wherein configuring the VPN setting further comprises establishing a secure socket layer virtual private network (SSL-VPN).
15. The non-transitory computer-readable medium of claim 9 , wherein:
the first configuration profile comprises a first extensible markup language (XML) document programmatically generated by the at least one computing device using a first predefined format corresponding to the first one of the plurality of operating systems; and
the second configuration profile comprises a second XML document programmatically generated by the at least one computing device using a second predefined format corresponding to the second one of the plurality of operating systems.
16. The non-transitory computer-readable medium of claim 9 , further comprising program code that, when executed, causes the at least one computing device to maintain a database that comprises a mapping of a name attribute for the field associated with the VPN setting to the first variable name corresponding to the first one of the plurality of operating systems and the second variable name corresponding to the second one of the plurality of operating systems.
17. A computer-implemented method, comprising:
identifying a value from a field of at least one user interface, the field being associated with a virtual private network (VPN) setting common to a plurality of operating systems;
determining a first variable name for inclusion in a first configuration profile in association with the value to configure the VPN setting on a first one of the plurality of operating systems;
determining a second variable name for inclusion in a second configuration profile in association with the value to configure the VPN setting on a second one of the plurality of operating systems, the second one of the plurality of operating systems being different than the first one of the plurality of operating systems;
generating the first configuration profile such that the value is a parameter of the first variable name for deployment to a first client device having the first one of the plurality of operating systems installed thereon; and
generating the second configuration profile such that the value is a parameter of the second variable name for deployment to a second client device having the second one of the plurality of operating systems installed thereon, wherein the first configuration profile and the second configuration profile are each configured to, when installed on a respective client device, configure the respective client device and designate a respective agent application as a device administrator, the agent application as the device administrator being configured to control access to at least one software or hardware function of the respective client device.
18. The computer-implemented method of claim 17 , further comprising:
instructing a first agent application executable on the first client device to configure the VPN setting on the first client device using the first variable name and the value; and
instructing a second agent application executable on the second client device to configure the VPN setting on the second client device using the second variable name and the value.
19. The computer-implemented method of claim 18 , wherein:
configuring the VPN setting on the first client device using the first variable name and the value further comprises establishing a first VPN for an individual client application of the first client device; and
configuring the VPN setting on the second client device using the second variable name and the value further comprises establishing a VPN for an individual client application of the second client device.
20. The computer-implemented method of claim 17 , wherein the VPN setting is at least one of: a connection name, a connection type, an authentication type, a server address associated with a VPN, or an internet protocol (IP) address associated with the VPN.