Deprovision and recover Mac hosts with Jamf Pro

#!/bin/bash

###############################################################################
# enable_remote_access.sh
#
# Triggered by Jamf Pro enrollment complete policy.
# - Creates a standard local temporary user account
# - Forces password change on first login
# - Enables SSH (Remote Login) directly via systemsetup
# - Calls the Jamf Pro API to send the Enable Remote Desktop MDM command
#   to this device using its own serial number for lookup
#
# Parameters:
#   $4 - Jamf Pro API Client ID
#   $5 - Jamf Pro API Client Secret
#   $6 - Jamf Pro URL (e.g. https://yourinstance.jamfcloud.com)
#   $7 - Temporary local username (e.g. tempuser)
#   $8 - Temporary local password
###############################################################################

CLIENT_ID="$4"
CLIENT_SECRET="$5"
JAMF_URL="$6"
TEMP_USER="$7"
TEMP_PASS="$8"

if [[ -z "$CLIENT_ID" || -z "$CLIENT_SECRET" || -z "$JAMF_URL" ]]; then
    echo "ERROR: Missing required parameters. Check Parameter 4 (Client ID), 5 (Client Secret), 6 (Jamf URL)."
    exit 1
fi

if [[ -z "$TEMP_USER" || -z "$TEMP_PASS" ]]; then
    echo "ERROR: Missing temp user parameters. Check Parameter 7 (username) and 8 (password)."
    exit 1
fi

JAMF_URL="${JAMF_URL%/}"

# Create temporary standard local user
echo "Creating temporary local user: $TEMP_USER..."
/usr/sbin/sysadminctl -addUser "$TEMP_USER" -fullName "Temporary User" -password "$TEMP_PASS"
if [[ $? -eq 0 ]]; then
    echo "User $TEMP_USER created."
else
    echo "WARNING: sysadminctl returned an error. User may not have been created."
fi

# Force password change on first login
/usr/bin/pwpolicy -u "$TEMP_USER" -setpolicy "newPasswordRequired=1"
if [[ $? -eq 0 ]]; then
    echo "Password change required on first login."
else
    echo "WARNING: Could not set newPasswordRequired policy for $TEMP_USER."
fi

# Enable SSH (Remote Login) locally -- no MDM command required
echo "Enabling SSH (Remote Login)..."
/usr/sbin/systemsetup -setremotelogin on
if [[ $? -eq 0 ]]; then
    echo "SSH enabled."
else
    echo "WARNING: systemsetup -setremotelogin returned an error. SSH may not be enabled."
fi

# Get bearer token
echo "Requesting API token..."
TOKEN_RESPONSE=$(curl -s -X POST "$JAMF_URL/api/oauth/token" -H "Content-Type: application/x-www-form-urlencoded" -d "client_id=${CLIENT_ID}&client_secret=${CLIENT_SECRET}&grant_type=client_credentials")

TOKEN=$(echo "$TOKEN_RESPONSE" | grep -o '"access_token":"[^"]*"' | cut -d'"' -f4)

if [[ -z "$TOKEN" ]]; then
    echo "ERROR: Failed to obtain API token. Check Client ID and Secret."
    echo "Response: $TOKEN_RESPONSE"
    exit 1
fi

echo "Token obtained."

# Get this device's serial number
SERIAL=$(system_profiler SPHardwareDataType | awk '/Serial Number/{print $4}')

if [[ -z "$SERIAL" ]]; then
    echo "ERROR: Could not determine serial number."
    exit 1
fi

echo "Serial number: $SERIAL"

# Brief pause for Jamf DB write lag after enrollment
sleep 20

# Look up Jamf device ID by serial number
echo "Looking up Jamf ID for serial $SERIAL..."
COMPUTER_XML=$(curl -s -H "Authorization: Bearer $TOKEN" -H "Accept: application/xml" "$JAMF_URL/JSSResource/computers/serialnumber/$SERIAL")

COMPUTER_ID=$(echo "$COMPUTER_XML" | xpath -q -e "//computer/general/id/text()" 2>/dev/null)

if [[ -z "$COMPUTER_ID" ]]; then
    echo "ERROR: Could not find Jamf ID for serial $SERIAL."
    echo "Response: $COMPUTER_XML"
    exit 1
fi

echo "Jamf ID: $COMPUTER_ID"

# Send Enable Remote Desktop MDM command via Jamf API
echo "Sending Enable Remote Desktop command..."
COMMAND_RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" -X POST -H "Authorization: Bearer $TOKEN" "$JAMF_URL/JSSResource/computercommands/command/EnableRemoteDesktop/id/$COMPUTER_ID")

if [[ "$COMMAND_RESPONSE" == "201" ]]; then
    echo "SUCCESS: Enable Remote Desktop command queued for device ID $COMPUTER_ID."
    exit 0
else
    echo "ERROR: API returned HTTP $COMMAND_RESPONSE when sending remote desktop command."
    exit 1
fi