PENDING response from the server about scep HOT 6 OPEN

@ripienaar The client actually implements PENDING. I added it there because MS SCEP server server supports manual approval.

As far as server side, the reason it's not implemented is because the initial purpose of the SCEP server is for macOS enrollments, with device provisioning at the loginwindow. Sending a PENDING response there would break the desired UX for the user.
I wouldn't be opposed to implementing it server side. Can you explain the use-case better? Are you looking for a manual approval workflow? Would defaulting to a Pending state and adding an /approve endpoint on the server work?

from scep.

Yeah I saw it in the client and went looking for the server side equivalent feature with no luck

I wish to do mass enrolment of 100s of thousands of nodes. Most nodes I can auto approve based on let’s say a pattern match of cname (any fqdn in our domain). Some though are users and not machines and those I need to hand approve

So I imagine something that I can run like the verifier that returns 0 for APPROVE, 1 for PENDING and 2 for REJECT is easy way and if it’s a nice interface then for my use case I can implement a Go class to do this while using your server code as a library. Perhaps even extend the current verifier in this way?

The /approve end point is also a good idea though obviously would require auth. I think it’s key that there is a hook to programmatically decide if a incoming request is auto approve or not.

from scep.

@ripienaar is this still interesting to you? Sorry the issue has been idle for so long. I'm looking at a batch of things I can pick up to improve over the holidays.

from scep.

@groob in theory - but I have another solution, so like I have not been holding my breath :P

from scep.

@groob if you still plan on having a look at it I'm interested as well with a PENDING response from the server

from scep.

We would be interested in this too. We're interested in a downstream project, called step-ca. I've put an issue about manual approvals there too.

from scep.