Profile enforcer. This is an example, no warranty expressed or implied. Use at your own risk.

profileenforcer.py

import sal.plugin
import requests
from django.conf import settings

SETTINGS = settings.PROFILE_SETTINGS


class Profileenforcer(sal.plugin.Widget):

    description = 'Enforces profiles via MDM'
    title = 'Profile enforcer'

    supported_os_families = [sal.plugin.OSFamilies.darwin]

    def _get_setting(self, setting):
        return SETTINGS.get(setting, None)

    def get_context(self, queryset, **kwargs):
        context = self.super_get_context(queryset, **kwargs)
        context['optout'] = self._filter(queryset, 'profiles').count()
        return context

    def filter(self, machines, data):
        return self._filter(machines, data), 'Walkme Opt-out'

    def _filter(self, machines, data):
        machines = machines.filter(os_family='Darwin')
        return machines

    def _get_device(self, serial):
        device = {"filter_serial": [serial]}
        request = requests.get(
            '{}/v1/devices'.format(self._get_setting('micromdm_url')),
            auth=('micromdm', self._get_setting('micromdm_key')),
            json=device,
            verify=settings.ROOT_CA
        )

        output = None
        if request.status_code == requests.codes.ok:
            try:
                response = request.json()
                output = response.get('devices')[0].get('udid')
            except Exception:
                pass

        return output

    def _post_profile(self, uuid, profile):
        payload = {
            'udid': uuid,
            'payload': profile,
            'request_type': 'InstallProfile'
        }

        requests.post(
            '{}/v1/commands'.format(self._get_setting('micromdm_url')),
            auth=('micromdm', self._get_setting('micromdm_key')),
            json=payload,
            verify=settings.ROOT_CA
        )

    def profiles_processor(self, machine, profiles_list):
        serial = machine.serial
        our_profiles = self._get_setting('profiles')
        profiles_to_push = []
        for our_profile in our_profiles:
            profile_found = False
            for profile in profiles_list:
                if profile['ProfileIdentifier'] == our_profile['identifier']:
                    if profile['ProfileUUID'] == our_profile['uuid']:
                        profile_found = True
            if not profile_found:
                profiles_to_push.append(our_profile['base64'])

        if profiles_to_push != []:
            try:
                uuid = self._get_device(serial)
                if uuid:
                    for profile in profiles_to_push:
                        self._post_profile(uuid, profile)
            except Exception:
                pass
        return profiles_list

settings.py

PROFILE_SETTINGS = {
    'micromdm_url': 'https://mdm.company.com',
    'micromdm_key': '<%= @micromdm_key %>',
    'profiles': [
        {
            'identifier': 'com.company.profiles.PasswordPolicy',
            'uuid': '0A2182C3-9336-48FC-8593-B043FCDDF2B61',
            'base64': """base64encodedprofile"""
        },
        {
            'identifier': 'com.company.profiles.kextpolicy',
            'uuid': '03211085-D036-43E8-9113-E0091F9F14C9',
            'base64': """otherbase64encodedprofile"""
        }
    ]
}