Kandji

Kandji is purpose built MDM application used to deploy apps and services remotely to macOS devices. To learn more about Kandji and their MDM platform, visit: Kandji Support website.

This article illustrates the procedure to deploy Netskope Client on macOS devices running Big Sur or later using the Kandji MDM as the IdP. This process ensures reduced user interaction while deploying tenant certificates, system and network extensions.

Before you begin deployment, perform the following steps to upload the required certificates and configuration files in Kandji to successfully install and activate Client:

1. Download Netskope Certificates

2. Upload Netskope Certificates to Kandji.

3. Upload VPN Configuration to Kandji.

4. Add System Extension Profile.

5. Prevent disabling Netskope background items.

6. Allow Privacy Settings in Kandji

1. Login to Netskope WebUI with admin access and go to Settings > Manage > Certificates.

2. Click the Signing CA tab and download both Netskope Root and Netskope Intermediate certificates.

   

3. Convert the downloaded certificates to .cer format by renaming the .pem files to .cer.

To upload the certificates to Kandji:

Allow Privacy Settings in Kandji

1. Go to Library > Add New  (you can also add Netskope settings to a pre-existing Privacy library item).

2. Select Profiles from the drop-down > Privacy > Add & Configure

3. Under APP ACCESS, create the following:

   Privacy setting #1

   • Identifier Type: Bundle ID

   • Identifier: com.netskope.client.Netskope-Client

   • Code Requirement:

     anchor apple generic and identifier "com.netskope.client.Netskope-Client" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "24W52P9M7W")

   • App or Service: Allow Accessibility and SystemPolicyAllFiles.

     

   Privacy setting #2

   • Identifier Type: Bundle ID

   • Identifier: com.netskope.epdlp.client

   • Code Requirement:

     anchor apple generic and identifier "com.netskope.epdlp.client" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "24W52P9M7W")

   • App or Service: Allow SystemPolicyAllFiles

     

   To learn more: Enabling Endpoint DLP on the Netskope Client for macOS.

   Privacy setting #3

   • Identifier Type: Bundle ID

   • Identifier: com.netskope.client.Netskope-Client.NetskopeClientMacAppProxy

   • Code Requirement:

     anchor apple generic and identifier "com.netskope.client.Netskope-Client.NetskopeClientMacAppProxy" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "24W52P9M7W")

   • App or Service: Allow SystemPolicyAllFiles

   

After you complete adding the required certificates and files, you are ready to start with the deployment scripts using the pre-built scripts using the instructions provided in this section.

Kandji supports the following types of deployment methods:

Netskope provides documentation for three deployment methods. Choose the best method for your organization and follow the instructions in that section. If neither of these deployment methods are applicable to your organization, contact Netskope for additional assistance.

After you complete the steps to upload the required certificates and files, you can start adding the deployment scripts in Kandji. You can use the Netskope pre-built deployment scripts.

Deployment scripts are a combination of audit and remediation scripts that are required to deploy Netskope Client to the end user devices.

The audit scripts are the same for each deployment method. You can start by creating the Kandji Library item and adding the audit script.

1. Go to Library > Add New.

   

2. Select Custom Script and click Add &Configure.

   

3. Create custom script with the following parameters:

   • Name: Enter any name. For example, Netskope Client Install.

   • Execution Frequency : Set this to value that suits your environment. Netskope recommends setting this value to Daily or 15 minutes.

4. Enter the following script in the Audit Script text box:

   #!/bin/bash
   #script for installing NSAgent on OSX machines
   #will check to see if Netskope is Installed
   function Test_NSClient(){
   xz=$(/usr/bin/mdfind kMDItemFSName == Netskope Client.app -onlyin /Library/Application\ Support/)
    if [ -e "$xz" ]; then
        echo "$xz found netskope client is installed"
    exit 0
    else
        echo "client does not exist"
    exit 1
    fi
   }
   Test_NSClient
   #end script

   

5. Click +Add Remediation script and add the following script:

   The remediation script varies according to your choice of the enrollment method.

   • Remediation Script for IdP enrollment

     • Replace the values marked XXXXX with your tenant domain name and YYYYY with the tenant name.

       • spDomain= <tenant-domain> Example: skope.com.

       • spTenant = <tenant-name> Example: If your tenant URL is example.skope.com, then enter only example.

       • If you prefer normal installation with single-user mode no other changes are needed.

       • If you prefer to install in multi-user mode, change “perusermode=0” to  “perusermode=1”

     #!/bin/bash
     #Script for installing Netskope Client on OSX machines
     #function will install Netskope Client
     function Ins_NSClient(){
     ag="NSClient.pkg"
     spDomain="XXXXX"
     spTenant="YYYYY"
     perusermode=0 # put 0 for normal installation, put 1 for per user config
     echo "Downloading NsAgent..."
     curl -o /tmp/$ag  https://download.goskope.com/dlr/mac/get
     echo "will now add config file..."
     mkdir -p "/Library/Application Support/Netskope/STAgent"
     NSIDPCONFIG_FILE_PATH="/Library/Application Support/Netskope/STAgent/nsidpconfig.json"
     echo "{ \"serviceProvider\": { \"domain\": \"$spDomain\", \"tenant\": \"$spTenant\" } }" > "${NSIDPCONFIG_FILE_PATH}"
     if [ $perusermode -eq 1 ]
     then
     NSUSERCONFIG_JSON_FILE="/Library/Application Support/Netskope/STAgent/nsuserconfig.json"
     echo "{\"nsUserConfig\":{\"enablePerUserConfig\": \"true\", \"configLocation\": \"~/Library/Application Support/Netskope/STAgent\", \"token\": \"\", \"host\": \"\",\"autoupdate\": \"true\"$fail_close_option}}" > "${NSUSERCONFIG_JSON_FILE}"
     fi
     echo "Installing Agent..."
     installer -dumplog -pkg /tmp/$ag -target / && rm /tmp/$ag
     }
     Ins_NSClient
     #end script

   • Remediation script for Kandji assigned user

     • Replace the values marked XXXXX with your tenantUrl and YYYYY with your Organization ID.

       • tenantUrl= addon-<tenant url>Example: If your tenant URL is example.skope.com, then it would be addon-example.skope.com

       • orgKey = <Organization ID> This is found in your Netskope tenant at this location: Settings > Security Cloud Platform > MDM Distribution > Deployment Resources for iOS > Create VPN Configuration > Organization ID: YYYYY

       #!/bin/bash
       #Script for installing Netskope Client on OSX machines by the Kandji assigned user
       #function will install Netskope Client
       function Ins_NSClient(){
       ag="NSClient.pkg"
       tenantUrl="addon-XXXXX"
       emailAddress="$(/usr/libexec/PlistBuddy -c 'print :EMAIL' /Library/Managed\ Preferences/io.kandji.globalvariables.plist)"
       orgKey="YYYYY"
       echo "will now add config file..."
       mkdir -p "/tmp/nsbranding"
       NSINSTPARAM_JSON_FILE="/tmp/nsbranding/nsinstparams.json"
       echo "{\"TenantHostName\":\"$tenantUrl\", \"Email\":\"$emailAddress\", \"OrgKey\":\"$orgKey\"}" > "${NSINSTPARAM_JSON_FILE}"
       echo "Downloading NsAgent..."
       curl -o /tmp/$ag  https://download.goskope.com/dlr/mac/get
       echo "Installing Agent..."
       installer -dumplog -pkg /tmp/$ag -target / && rm /tmp/$ag
       echo "Cleaning up..."
       }
       Ins_NSClient

6. Click Save.

Primarily, you need to deploy a .plist file to the local devices to run the remediation script. The script uses the .plist file during installation to identify the the user of any device.

To add a custom profile:

Netskope recommends creating a test blueprint to ensure Netskope Client deploys as expected.