Apple Device Enrollment Program Client

This gem allows for easy interaction with the Apple DEP API.

Run gem install apple_dep_client or add gem 'apple_dep_client' to your Gemfile then run bundle install.

This gem also also requires OpenSSL to be installed. You can test it by running require 'openssl' in irb and checking that it works.

It is highly recommended that you use a patched version of the plist gem available at https://github.com/albertyw/plist. To do so, you should add gem 'plist', git: 'https://github.com/albertyw/plist', ref: '3.1.2' to your software's Gemfile.

See Apple's Mobile Device Management Protocol Reference for more information about the high level usage of their DEP Workflow. All commands are under the AppleDEPClient namespace. AppleDEPClient will automatically handle OAuth for DEP endpoints.

In order for you to read the DEP tokens returned by Apple from a DEP account, you must decrypt it using a private key. This will give the individual keys needed for issuing commands to the DEP devices.

AppleDEPClient.configure do |config|
  config.private_key = 'PRIVATE_KEY'
end
# Get S/MIME encrypted Server Token from Apple
token_data = AppleDEPClient::Token.decode_token(smime_data)
token_data[:consumer_key]
token_data[:consumer_secret]
...

The main DEP management commands are issued like this. See Apple's MDM Protocol Reference for information about all the commands.

AppleDEPClient.configure do |config|
  config.consumer_key        = token_data[:consumer_key]        # XXX
  config.consumer_secret     = token_data[:consumer_secret]     # XXX
  config.access_token        = token_data[:access_token]        # XXX
  config.access_secret       = token_data[:access_secret]       # XXX
  config.access_token_expiry = token_data[:access_token_expiry] # XXX
end

data = AppleDEPClient::Account.fetch()
data["server_name"]
data["server_uuid"]
data["org_name"]
...

The full list of commands is

AppleDEPClient::Account.fetch
AppleDEPClient::Device.fetch(cursor: nil)
AppleDEPClient::Device.sync(cursor){|device| pass }
AppleDEPClient::Device.details(devices)
AppleDEPClient::Device.disown(devices)
AppleDEPClient::Profile.define(profile_hash)
AppleDEPClient::Profile.assign(profile_uuid, devices)
AppleDEPClient::Profile.fetch(profile_uuid)
AppleDEPClient::Profile.remove(devices)

After assigning a DEP profile to a device, the device will hit the url in the profile. The returned data will be "encoded as a XML plist and then CMS-signed and DER-encoded" and can be parsed as below:

data = AppleDEPClient::Callback.decode_callback(request_body)
data["UDID"]
data["SERIAL"]
...

There is an example script at example/example.rb which can be run against Apple's DEP simulator. You'll need to download the simulator binary and run it with path/to/depsim start -p 80 example/depsim_config.json. You can then run the script using bundle exec ruby example/example.rb. example.rb can of course be edited to use real DEP keys for manual DEP work (but be careful to keep the keys secret).