vfuse: How to solve “Error: VMware Fusion.app is not running”

I have been recently building some new VMs for Catalina for testing, and I was having the below error:


Error: VMware Fusion.app is not running

This was frustrating the hell out of me, as Fusion was 100% running, so I uninstalled vfuse, reinstalled it from homebrew so I knew I had the right version (2.2.6). I’m running Fusion Pro 11.5.6, I could not work out WTF was going on.

I then went to the vfuse source code (as you do) to see how the script determines the Fusion application path.

The lines we need start at 342 https://github.com/chilcote/vfuse/blob/master/pkgroot/usr/local/vfuse/bin/vfuse#L342 and end at 362.

I extracted the, note that “subprocess” is used so we need to import that.

I ran it with python3, and we see whats going on!

[[FACEPALM]]. I have the VMware Fusion Tech Preview installed!! I don’t run the tech preview day to day, and I had forgotten I even had it installed.

SO… close Fusion and launch Fusion Tech Preview (can’t use both together) and re-run the command (S/N redacted).

$ sudo vfuse -i osx_custom_200908-10.15.6-19G2021.apfs.dmg -n "Catalina 10.15.6" -s <<XXXXXXXXXX>> --hw-model "MacBookPro8,2" --snapshot --snapshot-name "Pre-Boot"

SUCCESS!!

One good exercise here is vfuse 2.2.6, with AutoDMG v1.10b587 and VMware Fusion version “e.x.p” as of 8th September 2020, all work great!

Many thanks to all the contributors of vfuse https://github.com/chilcote/vfuse for making our lives easier!

P.S – if you’re looking to create VMs for Fusion, you can look at the following links:

Quick tip with AutoDMG on Catalina, once you’ve grabbed the installer from the App Store/Software Updates on macOS, copy it over to some external media before you drag it into AutoDMG, and save yourself some time! https://github.com/MagerValp/AutoDMG/wiki/FAQ

macOS Custom Enrolment with Workspace ONE, Okta and more

Post first appeared on the EUCSE.com blog at https://blog.eucse.com/macos-custom-enrolment-workspace-one-okta/

WWDC 2019 brought with it a whole host of new enterprise features for Apple’s OS’s, including macOS 10.15 Catalina. One of the most importnat in my opinion is called ‘Enrolment Customisation’. This is essentially a page during the DEP process where an MDM can present any web content. In our case, this was a perfect place to put a SAML authentication page.

We released our support for this feature in Workspace ONE UEM 1909 (our Sept 2019 release). All Workspace ONE UEM release notes can be found here. 

Personally, this is something which I’ve seen holding up a more broad rollout of DEP across enterprise customers. Mainly for one, MFA is leveraged in many organisations today and the existing DEP authentication relied on an LDAP connection, meaning Username / Password only.

Also, any organisation who are leveraging Smart Cards or certificates for authentication require the use of a Single Factor Token which can be generated from the UEM Self Service Portal. The UX downside to this was the Token needed to be input in the username AND password box, a slightly confusing process for many colleagues.

So, now Apple has delivered us this feature and VMware has released the to code to on-premise and SaaS customers, let’s have a look at how to deploy it.

1) SAML AuthN via UEM

The first step is to configure SAML authentication within Settings / Enterprise Integration / Directory Services. You can choose how users can be authenticated, whether this is for Admins, Enrolment or the SSP or all at once.

In this example, we have integrated our UEM with Workspace ONE Access as the identity broker for our device enrolments.

Next step, we go into Access and configure the ‘default_access_policy’ for macOS. I wont go into detail in this blog, but you can follow:

In our case here, we are performing Certificate auth with Access (Seamless SSO), and if we don’t have a cert yet (unenrolled), then we are sending our authentication to Okta.

As you can see, we can do more than just Okta with Access, we can hook into any SAML compliant Identity provider. We have other Access tenants, and AzureAD, we could also add Ping, JumpCloud and more into one tenant. This means IT has total flexibility over the ecosystem, and end users have a one stop catalog for ALL applications regardless of where they are federated.

The best way to validate your config is to authenticate to your SSP from a Mac. Head to https://yourds.awmdm.com/MyDevice/?gid=OGID

2) Configure DEP Profile in UEM

Once we have our UEM SAML authentication working, we can configure our DEP profile. Head to Settings / Devices & Users / Apple / Device Enrolment Program. If you dont have DEP setup yet, follow the steps to get started. If you have an existing DEP profile, there are only 2 amends to make for 10.15.

Switch this on. Done

OPTIONAL: We can now pre-fill the Computer Account Full Name and Username based on account fields within UEM, based on lookups. You can also then prevent users from changing these details using ‘Allow Editing’.

Once this is complete, any new devices assigned to this DEP profile which are switched on after this change will be presented with the new experience.

See the following video for an example of the experience with Workspace ONE Access and with Okta Verify.

Web SSO for Chrome with Workspace ONE

Web SSO Workspace ONE

So, you’ve enabled Workspace ONE for your organisation, you’re on your way to End User Nirvana. Theres just one thing in your way, the Username and Password field! 

Workspace ONE is great at becoming a one stop shop for all Web, Native and Virtual Applications, leaving your users with just one password to remember. But… what if that could be a thing of the past! 

On a Workspace ONE Managed Device (macOS or Windows 10), your users can simply open their Browser of Choice (except Firefox, we’ll cover that later), et voilà . Logged in without a second thought.