Skip to content

Commit 1d2ad85

Browse files
ranbelranbel
committed
add protocol launcher instructions
1 parent a78daff commit 1d2ad85

File tree

1 file changed

+127
-7
lines changed
  • src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment

1 file changed

+127
-7
lines changed

‎src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/protocol-handler.mdx‎

Lines changed: 127 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ sidebar:
66
label: Automated WARP registration
77
---
88

9-
import { Render, GlossaryTooltip } from "~/components";
9+
import { Render, GlossaryTooltip, Tabs, TabItem } from "~/components";
1010

1111
Administrators can automate WARP registration on managed devices and minimize the number of clicks required from an end user.
1212

@@ -23,7 +23,7 @@ This guide covers how to eliminate steps 1, 2 and 4 from your WARP deployment.
2323
If you are looking to eliminate all user interaction, you can [enroll devices using service tokens](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/#check-for-service-token). Because users are not required to log in to an identity provider, identity-based policies and logging will not be available on these devices.
2424
:::
2525

26-
## Turn off onboarding screen
26+
## Turn off onboarding screens
2727

2828
To skip the Terms and Conditions screens that are usually presented to users, set the [`onboarding` parameter](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/) to `false` in your [MDM deployment file](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/). Here is an example `mdm.xml` file:
2929

@@ -42,17 +42,137 @@ If you are only using one identity provider for device enrollment, turn on **Ins
4242

4343
## Allow browser to launch WARP
4444

45-
You can pre-configure your browser to automatically launch the Cloudflare WARP application from your <GlossaryTooltip term="team domain">Zero Trust team domain</GlossaryTooltip>. This will allow the user to skip the **Open Cloudflare WARP.app** popup that is shown after a successful login.
45+
You can configure your browser to automatically launch the Cloudflare WARP application after a successful login and skip the **Open Cloudflare WARP.app** popup.
4646

4747
![Browser popup requesting permission to open WARP](~/assets/images/cloudflare-one/connections/warp-protocol-handler.png)
4848

49-
### Windows
49+
### Chromium-based browsers
50+
51+
Chromium-based browsers such as Google Chrome and Microsoft Edge have a policy setting called [AutoLaunchProtocolsFromOrigins](https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#autolaunchprotocolsfromorigins). This setting takes in two parameters: a protocol for the browser to launch and the origins that are allowed to launch it. For the browser to launch WARP, you need to set the protocol to `com.cloudflare.warp` and the origin to your <GlossaryTooltip term="team domain">Zero Trust team domain</GlossaryTooltip> (`https://<your-team-name>.cloudflareaccess.com`).
52+
53+
<Tabs>
54+
<TabItem label="Windows">
55+
On Windows, you can configure `AutoLaunchProtocolsFromOrigins` by adding a new registry key.
56+
57+
To add the registry key manually:
58+
1. Open Registry Editor as Administrator.
59+
2. Navigate to the policies folder for your browser:
60+
- Google Chrome: `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome`
61+
- Microsoft Edge: `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge`
62+
:::note
63+
You may need to create the `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome` folder if it does not already exist.
64+
:::
65+
3. Create a new string value:
66+
- **Value Name**: `AutoLaunchProtocolsFromOrigins`
67+
- **Value Data**: `[{"allowed_origins": ["https://<your-team-name>.cloudflareaccess.com/"], "protocol": "com.cloudflare.warp"}]`
68+
69+
Be sure to replace `<team-name>` with your actual <GlossaryTooltip term="team name">Zero Trust team name</GlossaryTooltip>.
70+
71+
Instead of using the Registry Editor, the registry key can also be created using a Group Policy Object (GPO), PowerShell script, or with an MDM tool such as [Intune](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/intune/#update-mdm-parameters).
72+
73+
</TabItem>
74+
<TabItem label="macOS">
75+
76+
On macOS, you can configure `AutoLaunchProtocolsFromOrigins` by deploying a property list (plist) file for the browser. The exact instructions will vary depending on your [MDM tool](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/partners/). The general procedure is as follows:
77+
78+
1. Create a new plist file with the following name (case sensitive):
79+
- Google Chrome: `com.google.Chrome.plist`
80+
- Microsoft Edge: `com.microsoft.Edge.plist`
81+
82+
2. Using a text editor, add the following content to your plist:
83+
84+
```xml
85+
<key>AutoLaunchProtocolsFromOrigins</key>
86+
<array>
87+
<dict>
88+
<key>allowed_origins</key>
89+
<array>
90+
<string>https://your-team-name.cloudflareaccess.com</string>
91+
</array>
92+
<key>protocol</key>
93+
<string>com.cloudflare.warp</string>
94+
</dict>
95+
</array>
96+
```
97+
98+
3. Some MDM tools require converting the `.plist` to a `.mobileconfig` before pushing it to a device. You can use a [file converter](https://github.com/timsutton/mcxToProfile) or modify the following example `com.google.Chrome.mobileconfig`:
99+
100+
```xml
101+
<?xml version="1.0" encoding="UTF-8"?>
102+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
103+
<plist version="1.0">
104+
<dict>
105+
<key>PayloadIdentifier</key>
106+
<string>com.google.chrome</string>
107+
<key>PayloadRemovalDisallowed</key>
108+
<true/>
109+
<key>PayloadScope</key>
110+
<string>System</string>
111+
<key>PayloadType</key>
112+
<string>Configuration</string>
113+
<key>PayloadUUID</key>
114+
<string>8FCBDCA7-87B3-4610-A01A-B0FE4C5B57C8</string>
115+
<key>PayloadOrganization</key>
116+
<string></string>
117+
<key>PayloadVersion</key>
118+
<integer>1</integer>
119+
<key>PayloadDisplayName</key>
120+
<string>Google Chrome Policy</string>
121+
<key>PayloadContent</key>
122+
<array>
123+
<dict>
124+
<key>PayloadType</key>
125+
<string>com.apple.ManagedClient.preferences</string>
126+
<key>PayloadVersion</key>
127+
<integer>1</integer>
128+
<key>PayloadIdentifier</key>
129+
<string>com.normandale</string>
130+
<key>PayloadUUID</key>
131+
<string>8FCBDCA7-87B3-4610-A01A-B0FE4C5B57C8</string>
132+
<key>PayloadEnabled</key>
133+
<true/>
134+
<key>PayloadDisplayName</key>
135+
<string>Custom: (com.google.Chrome)</string>
136+
<key>PayloadContent</key>
137+
<dict>
138+
<key>com.google.Chrome</key>
139+
<dict>
140+
<key>Forced</key>
141+
<array>
142+
<dict>
143+
<key>mcx_preference_settings</key>
144+
<dict>
145+
<key>AutoLaunchProtocolsFromOrigins</key>
146+
<array>
147+
<dict>
148+
<key>allowed_origins</key>
149+
<array>
150+
<string>https://your-team-name.cloudflareaccess.com</string>
151+
</array>
152+
<key>protocol</key>
153+
<string>com.cloudflare.warp</string>
154+
</dict>
155+
</array>
156+
</dict>
157+
</dict>
158+
</array>
159+
</dict>
160+
</dict>
161+
</dict>
162+
</array>
163+
</dict>
164+
</plist>
165+
```
166+
4. Upload the `.plist` or `.mobileconfig` file to your preferred MDM tool.
167+
5. Deploy the configuration profile to your devices.
168+
169+
For more information on configuring browser policies on macOS, refer to the [Google Chrome](https://support.google.com/chrome/a/answer/9020077?hl=en&ref_topic=7650028&sjid=15337530832025656704-NA) or [Microsoft Edge]((https://learn.microsoft.com/en-us/deployedge/configure-microsoft-edge-on-mac)) documentation.
170+
171+
</TabItem>
172+
</Tabs>
50173

51174

52175

53-
### macOS
54-
55-
56176

57177

58178

0 commit comments

Comments
 (0)