Deploy Client on macOS Using Iru

Iru is formerly known as Kandji.

This article illustrates the procedure to deploy Netskope Client on macOS devices running Big Sur or later using the Kandji MDM as the IdP. This process ensures reduced user interaction while deploying tenant certificates, system and network extensions.

Before you begin deployment, perform the following steps to upload the required certificates and configuration files in Kandji to successfully install and activate Client:

1. Download Netskope Certificates

2. Upload Netskope Certificates to Kandji.

3. Upload VPN Configuration to Kandji.

4. Add System Extension Profile.

5. Prevent disabling Netskope background items.

6. Allow Privacy Settings in Kandji

1. Login to Netskope WebUI with admin access and go to Settings > Manage > Certificates.

2. Click the Signing CA tab and download both Netskope Root and Netskope Intermediate certificates.

   

3. Convert the downloaded certificates to .cer format by renaming the .pem files to .cer.

To upload the certificates to Kandji:

Allow Privacy Settings in Kandji

1. Go to Library > Add New  (you can also add Netskope settings to a pre-existing Privacy library item).

2. Select Profiles from the drop-down > Privacy > Add & Configure

3. Under APP ACCESS, create the following:

   Privacy setting #1

   • Identifier Type: Bundle ID

   • Identifier: com.netskope.client.Netskope-Client

   • Code Requirement:

     anchor apple generic and identifier "com.netskope.client.Netskope-Client" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "24W52P9M7W")

   • App or Service: Allow Accessibility and SystemPolicyAllFiles.

     

   Privacy setting #2

   • Identifier Type: Bundle ID

   • Identifier: com.netskope.epdlp.client

   • Code Requirement:

     anchor apple generic and identifier "com.netskope.epdlp.client" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "24W52P9M7W")

   • App or Service: Allow SystemPolicyAllFiles

     

   To learn more: Enabling Endpoint DLP on the Netskope Client for macOS.

   Privacy setting #3

   • Identifier Type: Bundle ID

   • Identifier: com.netskope.client.Netskope-Client.NetskopeClientMacAppProxy

   • Code Requirement:

     anchor apple generic and identifier "com.netskope.client.Netskope-Client.NetskopeClientMacAppProxy" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "24W52P9M7W")

   • App or Service: Allow SystemPolicyAllFiles

   

After you complete adding the required certificates and files, you are ready to start with the deployment scripts using the pre-built scripts using the instructions provided in this section.

Kandji supports the following types of deployment methods:

Netskope provides documentation for three deployment methods. Choose the best method for your organization and follow the instructions in that section. If neither of these deployment methods are applicable to your organization, contact Netskope for additional assistance.

After you complete the steps to upload the required certificates and files, you can start adding the deployment scripts in Kandji. You can use the Netskope pre-built deployment scripts.

Deployment scripts are a combination of audit and remediation scripts that are required to deploy Netskope Client to the end user devices.

The audit scripts are the same for each deployment method. You can start by creating the Kandji Library item and adding the audit script.

1. Go to Library > Add New.

   

2. Select Custom Script and click Add &Configure.

   

3. Create custom script with the following parameters:

   • Name: Enter any name. For example, Netskope Client Install.

   • Execution Frequency : Set this to value that suits your environment. Netskope recommends setting this value to Daily or 15 minutes.

4. Enter the following script in the Audit Script text box:

   #!/bin/bash
   #script for installing NSAgent on OSX machines
   #will check to see if Netskope is Installed
   function Test_NSClient(){
   xz=$(/usr/bin/mdfind kMDItemFSName == Netskope Client.app -onlyin /Library/Application\ Support/)
    if [ -e "$xz" ]; then
        echo "$xz found netskope client is installed"
    exit 0
    else
        echo "client does not exist"
    exit 1
    fi
   }
   Test_NSClient
   #end script

   

5. Click +Add Remediation script and add the following script:

   The remediation script varies according to your choice of the enrollment method.

   • Remediation Script for IdP enrollment

     • Replace the values marked XXXXX with your tenant domain name and YYYYY with the tenant name.

       • spDomain= <tenant-domain> Example: goskope.com.

       • spTenant = <tenant-name> Example: If your tenant URL is example.goskope.com, then enter only example.

       • If you prefer normal installation with single-user mode no other changes are needed.

       • If you prefer to install in multi-user mode, change “perusermode=0” to  “perusermode=1”

     • If Secure Enrollment is enabled, replace the authentication and encryption enrollment tokens with the tokens generated on the tenant webUI:

       • enrollencryptiontoken=<encryption token>

       • enrollauthtoken=<authentication token>

       If secure enrollment is not enabled, the following values are displayed in the script:

       • enrollencryptiontoken=0

       • enrollauthtoken=0

     #!/bin/bash
     #Script for installing Netskope Client on OSX machines
     #function will install Netskope Client
     
     function Ins_NSClient(){
     ag="NSClient.pkg"
     spDomain="XXXXX"
     spTenant="YYYYY"
     perusermode=0 # put 0 for normal installation, put 1 for per user config
     
     # Initialize variables for the mandate failclose
     enforceFailClose=0 # put 1 for enabling enforce enrollemnt 
     steeringProfileID_val=""
     frequency_val="5" # Set default value
     host_val=""   #addon url
     token_val=""  #org id
     # end for mandate failclose variables
     echo "Downloading NsAgent..."
     curl -o /tmp/$ag  https://download.goskope.com/dlr/mac/get
     echo "will now add config file..."
     mkdir -p "/Library/Application Support/Netskope/STAgent"
     NSIDPCONFIG_FILE_PATH="/Library/Application Support/Netskope/STAgent/nsidpconfig.json"
     NSUSERCONFIG_JSON_FILE="/Library/Application Support/Netskope/STAgent/nsuserconfig.json"
     echo "{ \"serviceProvider\": { \"domain\": \"$spDomain\", \"tenant\": \"$spTenant\" } }" > "${NSIDPCONFIG_FILE_PATH}"
     
     # Determine the string value for enablePerUserConfig based on the perusermode flag.
         per_user_enabled="false"
         if [ $perusermode -eq 1 ]; then
             per_user_enabled="true"
         fi
        if [[ $perusermode -eq 1 || $enforceFailClose -eq 1 ]]; then
             json_config="{\"nsUserConfig\":{\"enablePerUserConfig\": ${per_user_enabled}, \"configLocation\": \"~/Library/Application Support/Netskope/STAgent\""
             mkdir -p "/Library/Application Support/Netskope/STAgent"
             # Conditionally add host and token directly under nsUserConfig
             json_config="$json_config, \"host\": \"$host_val\""
             json_config="$json_config, \"token\": \"$token_val\""
             if [ $enforceFailClose -eq 1 ]; then
                 echo "Enforce fail close option is provided"
                 json_config="$json_config, \"enforceEnrollment\": {"
                 json_config="$json_config \"steeringProfileID\": \"$steeringProfileID_val\""
                 json_config="$json_config, \"frequency\": \"$frequency_val\""
                 json_config="$json_config }" # Close the nested object
             fi
             # Add the remaining static parts and close the main JSON object
             json_config="$json_config, \"autoupdate\": \"true\"$fail_close_option}}"
             # Write the final, valid JSON to the file
             echo "$json_config" > "${NSUSERCONFIG_JSON_FILE}"
         fi
     
     echo "Installing Agent..."
     installer -dumplog -pkg /tmp/$ag -target / && rm /tmp/$ag
     }
     # Function to create JSON file with provided tokens
     Create_Json() {
         # Create directory if it doesn't exist
         mkdir -p $TEMP_BRANDING_DIR
         # Delete previous enroll.conf if it exists
         if [[ -f "$TEMP_ENROLLMENT_TOKEN_FILE" ]]; then
             rm "$TEMP_ENROLLMENT_TOKEN_FILE"
         fi 
         local a=$1 #auth token
         local b=$2 #encryption token
         # Check if parameters are 32 characters hexadecimal
         if ! [[ "$a" =~ ^[a-fA-F0-9]{32}$ ]] && [[ "$a" != "0" ]]; then
             echo "Invalid auth token: must be 32 hexadecimal characters"
             return 1
         fi
         if ! [[ "$b" =~ ^[a-fA-F0-9]{32}$ ]] && [[ "$b" != "0" ]]; then
             echo "Invalid encryption token: must be 32 hexadecimal characters"
             return 1
         fi
         # Start the JSON structure
         echo "{" > $TEMP_ENROLLMENT_TOKEN_FILE
         #if both token is present
         if [[ "$a" != "0" && "$b" != "0" ]]; then
             echo "\"enrollauthtoken\": \"$a\"," >> $TEMP_ENROLLMENT_TOKEN_FILE
             echo "\"enrollencryptiontoken\": \"$b\"" >> $TEMP_ENROLLMENT_TOKEN_FILE
         # only encryption token present
         elif [[ "$a" == "0" && "$b" != "0" ]]; then
             echo "\"enrollencryptiontoken\": \"$b\"" >> $TEMP_ENROLLMENT_TOKEN_FILE
         #only authtoken present
         elif [[ "$b" == "0" && "$a" != "0" ]]; then
               echo "\"enrollauthtoken\": \"$a\"" >> $TEMP_ENROLLMENT_TOKEN_FILE
         else
              echo "Unsupported use case"
         fi
         # End the JSON structure
         echo "}" >> $TEMP_ENROLLMENT_TOKEN_FILE
         chmod 700 "$TEMP_ENROLLMENT_TOKEN_FILE"
         echo "enroll.conf created with provided tokens."
     }
     
     # Main script execution
     
     #update these tokens to valid tokens
     enrollencryptiontoken=0
     enrollauthtoken=0
     TEMP_BRANDING_DIR="/tmp/nsbranding"
     TEMP_ENROLLMENT_TOKEN_FILE="$TEMP_BRANDING_DIR/enroll.conf"
     
     # Check if atleast one of the token is present, then create enroll.conf
     if [[ "$enrollencryptiontoken" != "0" || "$enrollauthtoken" != "0" ]]; then
         echo "Using secure enrollment"
         Create_Json "$enrollauthtoken" "$enrollencryptiontoken"
     else
         echo "Not using secure enrollment"
         # Delete previous enroll.conf if it exists
         if [[ -f "$TEMP_ENROLLMENT_TOKEN_FILE" ]]; then
             rm "$TEMP_ENROLLMENT_TOKEN_FILE"
         fi
     fi
     Ins_NSClient
     #end script

   • Remediation script for Kandji assigned user

     • If Secure Enrollment is enabled, replace the authentication and encryption enrollment tokens with the tokens generated on the tenant webUI:

       • enrollencryptiontoken=<encryption token>

       • enrollauthtoken=<authentication token>

       If secure enrollment is not enabled, the following values are displayed in the script:

       • enrollencryptiontoken=0

       • enrollauthtoken=0

     • Replace the values marked XXXXX with your tenantUrl and YYYYY with your Organization ID.

       • tenantUrl= addon-<tenant url>Example: If your tenant URL is example.goskope.com, then it would be addon-example.goskope.com

       • orgKey = <Organization ID> This is found in your Netskope tenant at this location: Settings > Security Cloud Platform > MDM Distribution > Deployment Resources for iOS > Create VPN Configuration > Organization ID: YYYYY

       #!/bin/bash
       #Script for installing Netskope Client on OSX machines by the Kandji assigned user
       #function will install Netskope Client
       
       
       function Ins_NSClient(){
       ag="NSClient.pkg"
       tenantUrl="addon-XXXXX"                                                                                                                                                                                                                              
       emailAddress="$(/usr/libexec/PlistBuddy -c 'print :EMAIL' /Library/Managed\ Preferences/io.kandji.globalvariables.plist)"
       orgKey="YYYYY"
       echo "will now add config file..."
       mkdir -p "/tmp/nsbranding"
       NSINSTPARAM_JSON_FILE="/tmp/nsbranding/nsinstparams.json"
       echo "{\"TenantHostName\":\"$tenantUrl\", \"Email\":\"$emailAddress\", \"OrgKey\":\"$orgKey\"}" > "${NSINSTPARAM_JSON_FILE}"
       echo "Downloading NsAgent..."
       curl -o /tmp/$ag  https://download.goskope.com/dlr/mac/get
       echo "Installing Agent..."
       installer -dumplog -pkg /tmp/$ag -target / && rm /tmp/$ag
       echo "Cleaning up..."
       }
       
       
       # Function to create JSON file with provided tokens
       Create_Json() {
           # Create directory if it doesn't exist
           mkdir -p $TEMP_BRANDING_DIR
           # Delete previous enroll.conf if it exists
           if [[ -f "$TEMP_ENROLLMENT_TOKEN_FILE" ]]; then
               rm "$TEMP_ENROLLMENT_TOKEN_FILE"
           fi  
           local a=$1 #auth token
           local b=$2 #encryption token
           # Check if parameters are 32 characters hexadecimal
           if ! [[ "$a" =~ ^[a-fA-F0-9]{32}$ ]] && [[ "$a" != "0" ]]; then
               echo "Invalid auth token: must be 32 hexadecimal characters"
               return 1
           fi  
           if ! [[ "$b" =~ ^[a-fA-F0-9]{32}$ ]] && [[ "$b" != "0" ]]; then
               echo "Invalid encryption token: must be 32 hexadecimal characters"
               return 1
           fi  
           # Start the JSON structure
           echo "{" > $TEMP_ENROLLMENT_TOKEN_FILE
           #if both token is present
           if [[ "$a" != "0" && "$b" != "0" ]]; then
               echo "\"enrollauthtoken\": \"$a\"," >> $TEMP_ENROLLMENT_TOKEN_FILE
               echo "\"enrollencryptiontoken\": \"$b\"" >> $TEMP_ENROLLMENT_TOKEN_FILE
           # only encryption token present
           elif [[ "$a" == "0" && "$b" != "0" ]]; then
               echo "\"enrollencryptiontoken\": \"$b\"" >> $TEMP_ENROLLMENT_TOKEN_FILE
           #only authtoken present
           elif [[ "$b" == "0" && "$a" != "0" ]]; then
                 echo "\"enrollauthtoken\": \"$a\"" >> $TEMP_ENROLLMENT_TOKEN_FILE
           else
                echo "Unsupported use case"
           fi  
           # End the JSON structure
           echo "}" >> $TEMP_ENROLLMENT_TOKEN_FILE
           chmod 700 "$TEMP_ENROLLMENT_TOKEN_FILE"
           echo "enroll.conf created with provided tokens."
       }
       # Main script execution
       
       #update these tokens to valid tokens
       enrollencryptiontoken=0
       enrollauthtoken=0
       TEMP_BRANDING_DIR="/tmp/nsbranding"
       TEMP_ENROLLMENT_TOKEN_FILE="$TEMP_BRANDING_DIR/enroll.conf"
       
       # Check if atleast one of the token is present, then create enroll.conf
       if [[ "$enrollencryptiontoken" != "0" || "$enrollauthtoken" != "0" ]]; then
           echo "Using secure enrollment"
           Create_Json "$enrollauthtoken" "$enrollencryptiontoken"
       else
           echo "Not using secure enrollment"
           # Delete previous enroll.conf if it exists
           if [[ -f "$TEMP_ENROLLMENT_TOKEN_FILE" ]]; then
               rm "$TEMP_ENROLLMENT_TOKEN_FILE"
           fi
       fi
       Ins_NSClient
       #end script

6. Click Save.

Primarily, you need to deploy a .plist file to the local devices to run the remediation script. The script uses the .plist file during installation to identify the the user of any device.

To add a custom profile:

Netskope recommends creating a test blueprint to ensure Netskope Client deploys as expected.