Distributed profile and key management

1. A system for distributed profile and key management, comprising:

at least one computing device; and

program instructions executable in the at least one computing device that, when executed by the at least one computing device, cause the at least one computing device to:

generate, by a management service remotely located from a client device, a partially populated device profile, the partially populated device profile comprising a data structure or a document that directs a client application of the client device to configure at least one setting of the client device, the partially populated device profile as generated comprising a credential payload portion that has a temporary string or an empty portion; and

provide the partially populated device profile to a client application executable on the client device over a network, wherein the client application executable on the client device is configured to:

generate a credential comprising at least one cryptographic key locally on the client device, wherein the credential is a derived credential generated using credentials of a personal identity verification (PIV) card;

insert the credential into the partially populated device profile in the credential payload portion by replacing the temporary string or inserting the credential into the empty portion to generate a fully populated device profile that configures the client device in an enrollment process with the management service;

provide, by the client device, the fully populated device profile to the at least one computing device; and

share the credential with at least one other client application on the client device.

2. The system of claim 1 , wherein the client application executable in the client device is further configured to encrypt the fully populated device profile prior to the fully populated device profile being provided to the at least one computing device.

3. The system of claim 2 , wherein the fully populated device profile is encrypted by the client application using a private key, wherein the management service does not have access to the private key.

4. The system of claim 2 , wherein the at least one other client application on the client device to whom the credential is shared comprises an agent application configured to decrypt the fully populate device profile and direct an operating system of the client device to install the fully populated device profile on the client device.

5. The system of claim 1 , wherein the partially populated device profile is generated in response to a specification of a derived credential setting made by an administrator.

6. The system of claim 5 , wherein the partially populated device profile is further generated in response to an enrollment request being received from the client device over a network, wherein the enrollment request is generated to enroll the client device with the management service.

7. The system of claim 1 , wherein the derived credential is an X.509 public key certificate.

8. A non-transitory computer-readable medium for distributed profile and key management embodying program code executable in a client device that, when executed by the client device, causes the client device to:

receive, by a client application executable on the client device, a partially populated device profile from a management service over a network, wherein the management service is located remotely from the client device, the partially populated device profile comprising a data structure or a document that directs a client application of the client device to configure at least one setting of the client device, the partially populated device profile as generated comprising a credential payload portion that has a temporary string or an empty portion;

generate a credential locally on the client device, wherein the credential is a derived credential generated using credentials of a personal identity verification (PIV) card;

insert the credential into the credential payload portion of the partially populated device profile by replacing the temporary string or inserting the credential into the empty portion to generate a fully populated device profile that configures the client device in an enrollment process with the management service;

send the fully populated device profile to the management service; and

share the credential with at least one other client application on the client device.

9. The non-transitory computer-readable medium of claim 8 , further comprising program code executable in the client device that, when executed, causes the client device to encrypt the fully populated device profile prior to the fully populated device profile being sent to the management service.

10. The non-transitory computer-readable medium of claim 9 , wherein the fully populated device profile is encrypted by the client application using a private key, wherein the management service does not have access to the private key.

11. The non-transitory computer-readable medium of claim 8 , wherein the partially populated device profile is generated in response to a specification of a derived credential setting made by an administrator.

12. The non-transitory computer-readable medium of claim 11 , wherein the partially populated device profile is further generated in response to an enrollment request being received from the client device over a network, wherein the enrollment request is generated to enroll the client device with the management service.

13. The non-transitory computer-readable medium of claim 8 , wherein the derived credential is an X.509 public key certificate.

14. A computer-implemented method for distributed profile and key management, comprising:

generating, by a management service remotely located from a client device, a partially populated device profile, the partially populated device profile comprising a data structure or a document that directs a client application of the client device to configure at least one setting of the client device, the partially populated device profile as generated comprising a credential payload portion that has a temporary string or an empty portion; and

providing the partially populated device profile to a client application executable on the client device over a network, wherein the client application executable on the client device is configured to:

generate a credential locally on the client device, wherein the credential is a derived credential generated using credentials of a personal identity verification (PIV) card;

insert the credential into the credential payload portion of the partially populated device profile by replacing the temporary string or inserting the credential into the empty portion to generate a fully populated device profile that configures the client device in an enrollment process with the management service;

provide, from the client device, the fully populated device profile to the at least one computing device; and

share the credential with at least one other client application on the client device.

15. The computer-implemented method of claim 14 , wherein the client application executable in the client device is further configured to encrypt the fully populated device profile prior to the fully populated device profile being provided to the at least one computing device.

16. The computer-implemented method of claim 15 , wherein the fully populated device profile is encrypted by the client application using a private key, wherein the management service does not have access to the private key.

17. The computer-implemented method of claim 15 , wherein the at least one other client application on the client device to whom the credential is shared comprises an agent application configured to decrypt the fully populate device profile and direct an operating system of the client device to install the fully populated device profile on the client device.

18. The computer-implemented method of claim 14 , wherein the partially populated device profile is generated in response to a specification of a derived credential setting made by an administrator.

19. The computer-implemented method of claim 18 , wherein the partially populated device profile is further generated in response to an enrollment request being received from the client device over a network, wherein the enrollment request is generated to enroll the client device with the management service.

20. The computer-implemented method of claim 14 , wherein the derived credential is an X.509 public key certificate.