Deploying the Endpoint Controller on macOS with Jamf Pro

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>tenant</key>
    <string>[Insert Tenant ID]</string>

    <key>macuser</key>
    <string>$USERNAME</string>

    <key>privuser</key>
    <string>$USERNAME</string>

    <key>expiryHours</key>
    <string>$EXTENSIONATTRIBUTE_4</string>

    <key>privateKeyBase64</key>
    <string>$EXTENSIONATTRIBUTE_2</string>

    <key>controllerURL</key>
    <string>[Insert Controller URL]</string>
</dict>
</plist>

#!/bin/sh
# PingOne Privilege config-creation policy
# Triggers the agent install policy, then runs until config.json is created.

LOG=/var/log/pingone-privilege-postinstall.log
log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> "$LOG"; }

APP="/Applications/PingOne Privilege.app"
APP_BIN="/usr/local/bin/cyononboard"
PREFS="/Library/Managed Preferences/com.pingidentity.privilege.onboard.plist"

# Trigger the installation policy
log "config-policy: calling custom event procyon-agent-install..."
/usr/local/bin/jamf policy -event procyon-agent-install

if [ ! -d "$APP" ]; then
    log "config-policy: agent app not installed yet - exiting 1, will retry"
    exit 1
fi

CONSOLE_USER=$(/usr/bin/stat -f%Su /dev/console 2>/dev/null)
if [ -z "$CONSOLE_USER" ]; then
    TARGET_USER=$(/usr/libexec/PlistBuddy -c 'Print :macuser' "$PREFS" 2>/dev/null)
else
    TARGET_USER=$CONSOLE_USER
fi

if [ -z "$TARGET_USER" ]; then
    log "config-policy: no console user and no macuser in profile - exiting 1, will retry"
    exit 1
fi

CONFIG="/Users/$TARGET_USER/.config/procyon/config.json"

if [ -s "$CONFIG" ]; then
    log "config-policy: $CONFIG exists - nothing to do"
    exit 0
fi

ATTEMPTS=0
until "$APP_BIN" >> "$LOG" 2>&1; do
    ATTEMPTS=$((ATTEMPTS + 1))
    log "config-policy: attempt $ATTEMPTS failed (MDM profile may not be installed yet)"
    if [ "$ATTEMPTS" -ge 20 ]; then
        log "config-policy: profile still missing after 20 attempts - exiting 1, Jamf will retry"
        exit 1
    fi
    sleep 30
done

if [ -s "$CONFIG" ]; then
    log "config-policy: created $CONFIG for $TARGET_USER"
    exit 0
fi

log "config-policy: cyononboard exited 0 but $CONFIG missing - exiting 1, will retry"
exit 1