Device provisioning using dedicated credential storage
A disclosed method for provisioning a computing device includes receiving, by provisioning software that executes on the computing device to provision the computing device for access to an enterprise infrastructure from a device orchestration service through which computing devices are provisioned to access the enterprise infrastructure, a digital certificate representing a credential for accessing, by a user via the computing device, the enterprise infrastructure. The method also includes storing, by the provisioning software, the digital certificate in dedicated secure credential storage on the computing device, receiving, by the provisioning software, a one-time-usable nonce value generated by the device orchestration service and usable by the provisioning software to unlock the digital certificate stored in the dedicated secure credential storage, unlocking the digital certificate, and presenting the digital certificate to the enterprise infrastructure to authorize access to the enterprise infrastructure by the user via the computing device.
1. A method for provisioning a computing device, comprising:
receiving an order for the computing device, the order including a first identifier and a second identifier, the first identifier indicating a configuration of the computing device and the second identifier indicating end-user deployment services associated with a user;
in response to the order including the second identifier, generating, by a device orchestration service, a digital certificate based on the first identifier and the second identifier;
receiving, by provisioning software that executes on the computing device to provision the computing device for access to an enterprise infrastructure from a device orchestration service through which computing devices are provisioned to access the enterprise infrastructure, the digital certificate representing a credential for accessing, by the user associated with the second identifier via the computing device, the enterprise infrastructure;
storing, by the provisioning software, the digital certificate in a secure credential storage location on the computing device;
receiving, by the provisioning software via a user interface, a one-time-usable nonce value generated by the device orchestration service and usable to unlock the digital certificate;
unlocking, by the provisioning software and using the nonce value, the digital certificate stored in the secure credential storage location; and
presenting the digital certificate to the enterprise infrastructure to authorize access to the enterprise infrastructure by the user via the computing device.
2. The method of claim 1 , wherein generating the digital certificate further comprises, generating, by the orchestration service, the digital certification based on infrastructure access information associated with the user.
3. The method of claim 1 , wherein the infrastructure access information associated with the user comprises at least one of:
account information associated with the user;
information identifying an access portal of the enterprise infrastructure; and
an enterprise login credential for the user.
4. The method of claim 1 , further comprising accessing, by an application executing on the computing device, the enterprise infrastructure.
5. The method of claim 1 , wherein:
the method further comprises receiving, by the device orchestration service, an indication that end-user deployment has been requested on behalf of the user; and
said receiving the digital certificate, said storing the digital certificate, said receiving the nonce value, and said unlocking the digital certificate are performed in response to determining that end-user deployment has been requested.
6. The method of claim 1 , further comprising providing, to the user by the device orchestration service via a text message or an email message, the nonce value.
7. The method of claim 1 , wherein presenting the digital certificate to the enterprise infrastructure comprises communicating, by the provisioning software, the digital certificate to the enterprise infrastructure in conjunction with a first login to the enterprise infrastructure by the user via the computing device.
8. A system for provisioning an information handling system, comprising:
a device ordering system that receives an order for an information handling system, the order including a first identifier and a second identifier, the first identifier indicating a configuration of the information handling system and the second identifier indicating end-user deployment services associated with a user;
a device orchestration service through which information handling systems are provisioned to access an enterprise infrastructure, the device orchestration service configured to generate, in response to the order including the second identifier, a digital certificate for the information handling system based on the first identifier and the second identifier, the digital certificate representing a credential for accessing, by the user, the enterprise infrastructure;
the information handling system, including:
a secure credential storage medium;
a processor;
a memory storing program instructions that when executed by the processor cause the processor to:
receive the digital certificate from the device orchestration service;
store the digital certificate in the secure credential storage medium;
receive, via a user interface of the information handling system, a one-time-usable nonce value generated by the device orchestration service and usable to unlock the digital certificate;
unlock, using the nonce value, the digital certificate stored in the secure credential storage medium; and
present the digital certificate to the enterprise infrastructure to authorize access to the enterprise infrastructure by the user via the computing device.
9. The system of claim 8 , wherein:
the information handling system further comprises an embedded controller; and
the first identifier of the information handling system comprises an identifier of the embedded controller.
10. The system of claim 8 , wherein the digital certificate is further based on infrastructure access information associated with the user, the infrastructure access information comprising at least one of:
account information associated with the user;
information identifying an access portal of the enterprise infrastructure; and
an enterprise login credential for the user.
11. The system of claim 8 , wherein presenting the digital certificate to the enterprise infrastructure comprises communicating the digital certificate to the enterprise infrastructure in conjunction with a first login to the enterprise infrastructure by the user via the information handling system.
12. The system of claim 8 , wherein:
the digital certificate is valid for a predetermined period of time; and
when executed by the processor, the program instructions further cause the processor to disable the digital certificate stored in the secure credential storage medium in response to the predetermined period of time expiring.
13. Non-transitory computer readable memory media storing instructions executable by a processor for:
receiving an order for a computing device, the order including a first identifier and a second identifier, the first identifier indicating a configuration of the computing device and the second identifier indicating end-user deployment services associated with a user;
in response to the order including the second identifier, generating, by a device orchestration service, a digital certificate based on the first identifier and the second identifier;
receiving, on a computing device from a device orchestration service through which computing devices are provisioned to access an enterprise infrastructure, the digital certificate representing a credential for accessing, by the user associated with the second identifier via the computing device, the enterprise infrastructure;
storing the digital certificate in a secure credential storage location on the computing device;
receiving, via a user interface, a one-time-usable nonce value generated by the device orchestration service and usable to unlock the digital certificate;
unlocking, using the nonce value, the digital certificate stored in the secure credential storage location; and
presenting the digital certificate to the enterprise infrastructure to authorize access to the enterprise infrastructure by the user via the computing device.
14. The non-transitory computer readable memory media of claim 13 , wherein the digital certificate is further dependent on infrastructure access information associated with the user.
15. The non-transitory computer readable memory media of claim 14 , wherein:
the infrastructure access information associated with the user comprises at least one of:
account information associated with the user;
information identifying an access portal of the enterprise infrastructure; and
an enterprise login credential for the user.
16. The non-transitory computer readable memory media of claim 13 , wherein said receiving the digital certificate, said storing the digital certificate, said receiving the nonce value, and said unlocking the digital certificate are performed in response to determining that an end-user deployment service has been requested for the computing device.
17. The non-transitory computer readable memory media of claim 13 , wherein presenting the digital certificate to the enterprise infrastructure comprises communicating the digital certificate to the enterprise infrastructure in conjunction with a first login to the enterprise infrastructure by the user via the computing device.
18. The non-transitory computer readable memory media of claim 13 , wherein:
the digital certificate is valid for a predetermined period of time; and
the instructions are further executable by the processor for disabling the digital certificate stored in the secure credential storage medium in response to the predetermined period of time expiring.