Before
An administrator likely had to inspect the submitted URLs, identify the corresponding extension names and IDs, and manually confirm the requested change. They then had to locate the correct Jamf configuration profile, preserve and reformat the existing blocklist, apply the update, and notify the requester of the result.
How it works
- Receive the web extension request, verify the requester, extract extension names and IDs, and present the proposed change for approval.
- After approval, authenticate to Jamf Pro, find the target OS X configuration profile, and combine the existing blocklist with the new escaped extension entries.
- Apply the profile update and replace the original Slack request with either a success message or an aborted-status message.
Workflow details
- Trigger and authorization: The workflow starts when a communication tool sends a webhook containing a web extension URL or URLs and the requesting user's identity. It checks the user against the configured authorization condition before allowing the request to continue.
- Extension identification and approval: The submitted URLs are processed to extract each extension's name and ID. The workflow then posts these details to Slack and asks the user to confirm whether the blacklist update should proceed.
- Jamf profile discovery: After approval, the workflow obtains a Jamf Pro access token, retrieves the available OS X configuration profiles, selects the targeted profile, and loads its current configuration so the existing web-extension blocklist can be preserved.
- Payload preparation and update: The current ExtensionInstallBlocklist values are extracted and transformed into the required XML format. The new extension values and existing entries are escaped and combined before the selected configuration profile is updated.
- Outcome communication: The original Slack message is updated with a success notice identifying the extension values added to the profile. If the user cancels, the message is replaced with an aborted-status notice and the process is closed without applying the update.
What changed
The request now moves from a webhook command to an approval-controlled profile update without requiring an administrator to perform the intermediate lookups, formatting, authentication, or message handoffs. The existing blocklist is retrieved and preserved automatically, the new entries are added to the selected profile, and the original Slack message records the final success or cancellation state.
Work removed
Manually parsing extension URLs, looking up extension names and IDs, sending approval requests, generating Jamf authentication, searching configuration profiles, opening the target profile, extracting and reformatting the existing blocklist, escaping XML values, submitting the profile update, and rewriting the Slack status message.
Expected outcome
Each approved request removes at least 7 distinct recurring manual actions and delivers a documented Jamf profile update with a Slack confirmation, while cancellation prevents the configuration change.
