Skip to content
Identity and Access Management

Device Provisioning

Challenge

When deploying devices to the field, a key challenge is ensuring they are correctly configured to receive their device credentials. A device cannot authenticate with cloud services or perform its core functions without one. Also a device may have a bi-directional communication requirements. This process requires a device to be onboarded into the following systems:

  • IAM (Identity and Access Management) for cloud authentication and access to Trimble products.
  • IoT/MQTT for real-time, bidirectional communication.

Managing siloed provisioning workflows for each of the platform services creates operational friction, increases the risk of manual errors, and slows down the time-to-value for customers. A unified approach is needed to simplify this process and ensure a device is fully operational with all its cloud capabilities from day one.

Solution

The recommendation is to use device-id-cert-tools as a central framework to provide a seamless, end-to-end provisioning experience. This tool handles the entire lifecycle, ensuring a device receives its cloud identity—a critical prerequisite for obtaining its operational certificate.

This solution ensures:

  • A unified and repeatable process for all device types.
  • A single point of entry for provisioning, reducing operational overhead.
  • Reliable synchronization of device identities between IAM and the IoT platform, which is required before the device can be fully authenticated.

Workflow

  1. Administrator uses administrative scripts of device-id-cert-tools and creates device group
  2. Administrator creates yubikey device and store its device credentials
  3. Administrator hands over the group information and yubikey (device credentials) to manufacturer
  4. Manufacturer installs firmware embedded with device-id-cert-tools and device generates a key pair (private and public keys)
  5. Manufacturer extracts the public key and serial number through device-id-cert-tools
  6. Manufacturer uses the yubikey’s credential to register the device’s essential information (serial number, model, manufacturer, SKU and public key) into IAM. This establishes the initial identity of the device in the cloud.
  7. For device flow, please refer device bootstrapping process

Use Case

  • Automated Installation: Allows for devices to be deployed and become fully functional without requiring additional manual configuration steps.