ChromeBook DOH Enrollment (MV3 ChromeOS)

This guide provides the steps to deploy the Infoblox Chromebook Client with DNS-over-HTTPS (DoH) for your organization’s Chromebook devices. After completing this process, devices will register in the Infoblox Portal (http://csp.infoblox.com) and DNS activities will be visible for registered devices.

To Deploy the Infoblox Chromebook Client with DOH to your organization’s Chromebook devices, complete the following process. 

Prerequisites

Ensure the following prerequisites are met before starting the deployment:

• You must have a Google Workspace (formerly G Suite) admin account to log in to admin.google.com.

• You must have valid Infoblox Portal login credentials.

• Chromebook devices must be running Chrome OS version 88 or later.

Deployment Steps

The deployment process includes the following main steps:

1. Download the Chrome Config File from the Infoblox Portal.

2. Configure and Install the Infoblox Chromebook Extension App.

3. Configure the DoH URL in Google Admin Console.

Step 1: Download the Chrome Config File from the Infoblox Portal

1. Log in to the Infoblox Portal: http://csp.infoblox.com

2. Navigate to Configure > Security > Endpoints > Endpoint Groups.

3. Click Download MDM Configuration > Chrome Config File.

4. Save the file: Save the Chrome-config.json file to your local machine or a local location where it can be easily accessed during installation.

To assign an endpoint to a specific endpoint group:

1. Go to Configure > Security > Endpoints > Endpoint Groups.

2. Click the three horizontal bars icon next to the endpoint group’s name.

3. Select Download MDM Configuration > Chrome Config File.

4. Save the file: Save the file to a location from which it can be easily retrieved during the installation of the client app. You will copy the configuration from this file during the installation of the client app.

 Step 2: Configure and install the Infoblox Chromebook Extension App 

1. Log in to https://admin.google.com. 

2. Go to devices > Chrome > Apps and extensions. 

3. Under Users and Browsers, select the user groups on Organization Unit. 

4. Click + Search or add a filter to add the Chrome app or extension by ID. 

5. Enter the Extension ID:

   • gllkkgmieokcbgbpfobmdlfkijcodbcm

6. Click Save.

Installation Policy:

7. Under the Installation policy, select Force install + pin to browser toolbar. 

7. Add the Downloaded Chrome Config Data:

   • Copy the content from the Chrome-config.json file into Policy for Extensions.

   • Use the following JSON configuration (example):
     

 {
    "allowServiceControl": { 
        "Value": true 
    }, 
    "customerId": { 
        "Value": "" 
    }, 
    "groupName": { 
        "Value": "All BloxOne Endpoints (Default)" 
    }, 
    "cspUrl": { 
        "Value": "http://csp.infoblox.com" 
    }, 
    "jointToken": { 
        "Value": "<JoinToken>" 
    }, 
    "salt": { 
        "Value": "<32-bit-charters>" 
    } 
} 

8. After adding the above configurations. Click SAVE to apply the configuration. 

Step 3: Configuring the DOH URL in Google Admin Console

1. Use the following DoH URL in the Google Admin Console:

   • URL: https://doh.threatdefense.infoblox.com/{variable_name}/dns-query

2. Replace {variable_name} with one of the following attributes based on the user's Chrome admin plan. 

• USER_EMAIL

  • Example: https://doh.threatdefense.infoblox.com/hash/${USER_EMAIL}/dns-query 

• DEVICE_SERIAL_NUMBER 

  • Example: https://doh.threatdefense.infoblox.com//hash/${DEVICE_SERIAL_NUMBER}/dns-query

3. Navigate to Devices > Chrome > Settings.

4. Under User and Browser Settings, select respective User Groups.

5. Scroll down to Network Tab for DNS-over-HTTPS, DNS-over-HTTPS with identifiers, and DNS-over-HTTPS with exclude domains settings. 

• DNS-over-HTTPS:

  • Select Require DNS-over-HTTPS.

  • Add the DoH URL in the DNS-over-HTTPS templates field.

  • Click Save.

• DNS-over-HTTPS without fallback:

  • Select Require DNS-over-HTTPS.

  • Add the DoH URL in the DNS-over-HTTPS templates field.

  • Click Save.

• DNS-over-HTTPS with identifiers:

  • Add the same DoH URL as in the previous step.

  • Enter the same 32-bit hexadecimal character as the Salt for hashing identifiers in URI Templates and the Extensions field.

  • Click Save.

These settings ensure that the configuration is synchronized with Google APIs and Infoblox Server. when it is saved.

URL Blocking

To prevent users from accessing chrome://policy/ (which displays configuration and policies assigned by Google Admin Console):

1. Navigate to Devices > Chrome > Settings > Users and Browsers > URL Blocking.

2. Block the following URL:

   • chrome://policy/

Completing the Deployment

After completing the above configurations:

• Chromebook devices will register in the Infoblox Portal.

• Configurations and assigned policies will apply according to their endpoint groups.

• You will be able to monitor DNS activities for registered Chrome devices in the Infoblox Portal.