Systems and methods to orchestrate trusted enrollment
Systems and methods are provided that may be implemented to orchestrate trusted enrollment of an endpoint client information handling system by deploying a signed payload of an enrollment package to the endpoint client system, and by using a client software agent executing on the endpoint client system to first verify the distribution chain and/or signature of the deployed enrollment package before proceeding to use other information contained in the enrollment package to contact a registration server to enroll the endpoint client system.
1 . A method, comprising:
receiving an enrollment request in a server from across one or more networks coupled to the server, the enrollment request including enrollment information including an identity of an endpoint client system, a designated network location of a remote registration server, an email domain of an originator of the enrollment request and an email domain of the endpoint client system; and in response to the enrollment request:
authenticating the email domain of the originator of the enrollment request;
comparing the email domain of the endpoint client system to the authenticated email domain of the originator of the enrollment request; and
then only performing the following if the email domain of the endpoint client system is the same as the authenticated email domain of the originator of the enrollment request:
provisioning an enrollment package having a payload comprising at least a portion of the enrollment information that comprises the identity of the endpoint client system and the designated network location of the remote registration server,
signing the enrollment package, and
deploying the signed enrollment package across at least one of the one or more networks directly or through an intermediary system to the endpoint client system.
2 . The method of claim 1 , further comprising attempting to verify one or more credentials presented by the originator of the enrollment request; and then only performing the provisioning, signing and deploying if the one or more credentials presented by the originator of the enrollment request are verified.
3 . The method of claim 1 , further comprising provisioning a private key that is unique to the originator of the enrollment request; where the provisioning further comprises including a public key in the enrollment package that corresponds to the private key that is unique to the originator of the enrollment request; and where the signing of the enrollment package further comprises signing the enrollment package with the private key that is unique to the originator of the enrollment request.
4 . The method of claim 1 , where the provisioning further comprises including a public key in the enrollment package that is unique to a software provider that deploys the signed enrollment package from the server.
5 . The method of claim 1 , where the provisioning comprises provisioning an enrollment package having a payload comprising at least a portion of the enrollment information that further comprises at least one of a uniform resource locator (URL) of the registration server, a tenant name for the endpoint client system, or a secure sockets layer (SSL) certificate of the registration server.
6 . The method of claim 1 , where an originator of the enrollment request is an enterprise software customer; and where a software vendor receives the enrollment request in the server and performs the provisioning, signing and deploying of the signed enrollment package from the server.
7 . A system, comprising:
a server information handling system comprising at least one programmable integrated circuit programmed to:
receive an enrollment request from across one or more networks, the enrollment request including enrollment information including an identity of an endpoint client system, a designated network location of a remote registration server, an email domain of an originator of the enrollment request and an email domain of the endpoint client system, and in response to the enrollment request:
authenticate the email domain of the originator of the enrollment request;
compare the email domain of the endpoint client system to the authenticated email domain of the originator of the enrollment request; and
then only perform the following if the email domain of the endpoint client system is the same as the authenticated email domain of the originator of the enrollment request:
provision an enrollment package having a payload comprising at least a portion of the enrollment information that comprises the identity of the endpoint client system and the designated network location of the remote registration server,
sign the enrollment package, and
deploy the signed enrollment package across at least one of the one or more networks directly or through an intermediary system to the endpoint client system.
8 . The system of claim 7 , where the at least one programmable integrated circuit is programmed to attempt to verify one or more credentials presented by an originator of the enrollment request; and then only provision, sign and deploy the enrollment package if the one or more credentials presented by the originator of the enrollment request are verified.
9 . The system of claim 7 , where the at least one programmable integrated circuit is programmed to:
provision a private key that is unique to the originator of the enrollment request by including a public key in the enrollment package that corresponds to the private key that is unique to the originator of the enrollment request; and
sign the enrollment package with the private key that is unique to the originator of the enrollment request.
10 . The system of claim 7 , where the at least one programmable integrated circuit is programmed to include a public key in the enrollment package that is unique to a software provider that deploys the signed enrollment package from the server information handling system.
11 . The system of claim 7 , where the at least one programmable integrated circuit is programmed to provision the enrollment package to have a payload comprising at least a portion of the enrollment information that further comprises at least one of a uniform resource locator (URL) of the registration server, a tenant name for the endpoint client system, or a secure sockets layer (SSL) certificate of the registration server.
12 . The system of claim 7 , where the at least one programmable integrated circuit is programmed to receive the enrollment request from an enterprise software customer.
13 . The system of claim 7 , further comprising the endpoint client system, the endpoint client system being an information handling system communicatively coupled to the server information handling system by at least one of the one or more networks.
14 . The system of claim 13 , further comprising the remote registration server, the remote registration server being an information handling system communicatively coupled to the server information handling system by at least one of the one or more networks.
15 . The system of claim 14 , further comprising an additional information handling system coupled to the server information handling system by at least one of the one or more networks, the additional information handling system originating and providing the enrollment request to the server information handling system across at least one of the one or more networks.