Auto deploying warp configuration with mdm hexnode not executed

[user17930]

Hi All ,

I’m looking for some assistance after 20 hours of banging my head on the desk!

Has anyone had experience deploying Warp Configuration files with MDM products on Mac OS ?

I’m attempting to configure( via XML) the automated setup of WARP via Hexnode MDM and the attachment to a Cloudflare Teams account without the user having to join via the WARP Client preferences panel.

I’m following the Docs here

https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/hexnode

The WARP software deploys as per the MDM and I’ve configured the XML as per the examples above

Does this look correct ? (values substituted)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
   <dict>
      <key>organization</key>
      <string>n****</string>
      <key>auto_connect</key>
      <integer>1</integer>
      <key>switch_locked</key>
      <true />
      <key>onboarding</key>
      <false />
      <key>service_mode</key>
      <string>warp</string>
      <key>auth_client_id</key>
      <string>******************</string>
      <key>auth_client_secret</key>
      <string>************************************</string>
      <key>support_url</key>
      <string>https://support.example.com</string>
   </dict>
</plist>

When I check the PLIST files, they just hold the default values as if none of my configuration values are present.

Any assistance would be greatly appreciated !!

Thanks

Paul

[user17930]

I’ve also seen references to the plist file being ignored by the WARP client

WARP Client Not Using plist File on MacOS

When installing the WARP client on MacOS using a script, it doesn’t use the plist file. The script creates the plist file in /Library/Managed Preferences/ directory, converts it into binary format, and then installs WARP from the pkg file. Since the plist file isn’t being used, the WARP client is deployed like a standalone client, instead of being associated with our Teams organization.

Any experience of this ?

[cscharff]

What is the exact name of the plist file your MDM is creating?

[user17930]

Hi csharff

com.cloudflare.1dot1dot1dot1.macos.warp.daemon.plist

is the only file in the LauchDaemons directory.

its content is

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>KeepAlive</key>
	<true/>
	<key>Label</key>
	<string>com.cloudflare.1dot1dot1dot1.macos.warp.daemon</string>
	<key>ProgramArguments</key>
	<array>
		<string>/Applications/Cloudflare WARP.app/Contents/Resources/CloudflareWARP</string>
	</array>
	<key>RunAtLoad</key>
	<true/>
	<key>SoftResourceLimits</key>
	<dict>
		<key>NumberOfFiles</key>
		<integer>1024</integer>
	</dict>
	<key>UserName</key>
	<string>root</string>
</dict>
</plist>

This is a screen shot of the Profile values as configured in the MDM and pushed to the machine,

[user17930]

OK , so i was directed to this section in the docs

Any script or management tool that can place a com.cloudflare.warp.plist file in /Library/Managed Preferences on a supported macOS device. Additionally this plist can be wrapped in a .mobileconfig.

In the /library/managed preferences I located an encoded version of my XML file with the correct values in the com.cloudflare.1dot1dot1dot1.macos.plist file.

So the XML values are on the machine , but the WARP client doesn’t seem to be using them.

[cscharff]

The plist file name is incorrect. Look at the documentation and the file name you posted. The file name needs to match the documentation exactly. That is what Warp uses to enforce a configuration (same with any other app using a plist)

[user17930]

Hey , Thank you that makes a lot of sense

… One problem, i don’t control the name of the plist file , its part of the MDM package deployed by hexnode and it’s associated with the profile snap shot ( above) .

Any ideas, apart from trying to modify the plist file post deployment ?