New issue
Advanced search Search tips

Issue 601749 link

Starred by 11 users

Issue metadata

Status: Assigned
Owner:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 2
Type: Bug



Sign in to add a comment

FR - Managed users on Unmanaged devices

Reported by arnauhe...@gmail.com, Apr 8 2016

Issue description

UserAgent: Mozilla/5.0 (X11; CrOS x86_64 7834.66.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.111 Safari/537.36
Platform: 7834.66.0 (Official Build) stable-channel swanky

Steps to reproduce the problem:
Use case:
A network policy could be implemented to restrict managed users to access corporate network from a un-enrolled corporate devices. For example, a managed user can't access to some network interfaces (Ethernet or Wi-Fi) if its device has not been enrolled before.

What is the expected behavior?
Motivation:
May be a risk here since unmanaged device could run into Developer mode then connect to a corporate network. In case of compromised managed accounts, anybody are able to access internal resources.
Second reason is because BYOD is not entirely approved in most french companies (more than for technical reasons).

What went wrong?
Existing workarounds:
no workarounds

Did this work before? N/A 

Chrome version: 49.0.2623.111  Channel: stable
OS Version: 7834.66.0
Flash Version: Shockwave Flash 21.0 r0
 
Owner: dskaram@chromium.org
Sounds like the right way to do this would be to require a VA-backed certificate to connect to the sensitive network - that way the enterprise can enforce that the device is not in dev mode via the VA check.

David, do we have public docs for how enterprises can set this up yet?

Comment 2 by dskaram@google.com, Apr 11 2016

Status: Assigned (was: Unconfirmed)
We are in the design phase of a verified access solution that would come on top of the existing certificate enrollment extension. The current design would put the CES endpoint behind a proxy that first does VA and then calls back to get the certificate. That way, no Chromebook can get a cert without passing through a verified access check.

This would require that all sensitive company resources be guarded by such a certificate though.


We'll use this bug to track this work.
Owner: marcuskoehler@chromium.org

Sign in to add a comment