Deploy browser extension to managed devices

Download the Chrome Enterprise Bundle for Windows and extract its contents.

From the extracted folder:

Launch the Windows Group Policy management console and add a new Group Policy Object for installation of the Bravura Safe browser extension.

Right-click on the created GPO, click Edit... , then access Computer Configuration > Policies > Administrative Templates > Google Chrome > Extensions.

On the right, click Configure the list of force-installed apps and extensions and switch the setting to Enabled.

Click the Show... button and enter the following line:

cjidmfgdjckibjdfnglfdgohkaballnn;https://clients2.google.com/service/update2/crx

Confirm by clicking OK.

While still within the Computer Configuration > Policies > Administrative Templates > Google Chrome section, click on Password manager.

Right-click on Enable saving passwords to the password manager on the right, click Edit , change the setting to Disabled and then click OK.

In the same area of Administrative Templates > Google Chrome, repeat the previous step (8) for Enable Autofill for addresses and Enable Autofill for credit cards.

Apply this new GPO to the appropriate organizational units or groups.

Download the ADMX Template for Firefox file and extract its contents.

In the extracted folder:

1. Copy the \policy_templates_<version>\windows\firefox.admx file to the directory C:\Windows\PolicyDefinitions.

2. Copy the \policy_templates_<version>\windows\en-US\firefox.adml file to the directory C:\Windows\PolicyDefinitions\en-US.

Launch the Windows Group Policy Editor and generate a new Group Policy Object (GPO) for setting up the Bravura Safe browser extension.

Right-click the created GPO, click the Edit... option, and go to: Computer Configuration > Policies > Administrative Templates > Firefox > Extensions.

In the right panel, click Extensions to Install. Turn on the Enabled option in the window that appears.

Click Show... and input the Bravura Security URL:

https://github.com/Hitachi-ID/bravura-safe_browser/releases/latest

Confirm by clicking OK.

In the navigation pane, click Firefox. On the right, click Edit... and deactivate the Offer to save logins and Offer to save logins (default) settings.

Finish by assigning the configured GPO to the intended targets.

Obtain and extract the Windows Policy Files for Microsoft Edge .

Within the extracted directory:

Launch the Windows Group Policy Editor and establish a new Group Policy Object (GPO) dedicated to installing the Bravura Safe browser extension.

Right-click the created GPO, click Edit... , then go to: Computer Configuration > Policies > Administrative Templates > Microsoft Edge > Extensions.

On the right, click Control which extensions are installed silently. Then, switch the Enabled setting to active.

Click Show... and enter the details below:

lgjgabmkhcjfpcmflkhmhjgmnnpfgmnc;https://edge.microsoft.com/extensionwebstorebase/v1/crx

Confirm your entry by clicking OK.

Continuing in Administrative Templates > Microsoft Edge , open Password manager and protection.

On the right, find and right-click Enable saving passwords to the password manager, and select Edit. Then, change the setting to Disabled and click OK.

Follow the same process in Step 8 for both the Enable Autofill for addresses and Enable Autofill for credit cards settings located in the Administrative Templates > Microsoft Edge section.

Assign the configured GPO to the appropriate group of users or computers.

Get the macOS version of Google Chrome by downloading the .dmg or .pkg file.

Obtain the Chrome Enterprise Bundle for Mac.

Extract the Enterprise Bundle (either GoogleChromeEnterpriseBundle64.zip or GoogleChromeEnterpriseBundle32.zip).

Edit the /Configuration/com.Google.Chrome.plist file using a text editor of your choice.

Incorporate the following configurations into the .plist file:

<key>ExtensionSettings</key>
 <dict>
  <key>cjidmfgdjckibjdfnglfdgohkaballnn</key>
  <dict>
   <key>installation_mode</key>
   <string>force_installed</string>
   <key>update_url</key>
   <string>https://clients2.google.com/service/update2/crx</string>
  </dict>
 </dict>

In this snippet, cjidmfgdjckibjdfnglfdgohkaballnn refers to the ID for the Bravura Safe browser extension, while the URL https://clients2.google.com/service/update2/crx directs Chrome to fetch the specified extension from the Chrome Web Store.

To further enhance security, it is advised to turn off Chrome's integrated password manager by adding the following entry to the com.Google.Chrome.plist:

<key>PasswordManagerEnabled</key>
<false />

Transform the com.Google.Chrome.plist into a configuration profile using a utility such as mcxToProfile.

Distribute both the Chrome installation file ( .dmg or .pkg) and the configuration profile to all the applicable machines through your chosen software deployment or Mobile Device Management (MDM) solution.

First, ensure that you have Firefox for Enterprise installed on your macOS device.

Navigate to Firefox.app/Contents/Resources/ and establish a new directory named distribution.

In the above new directory, make this file: org.mozilla.firefox.plist.

Edit the org.mozilla.firefox.plist file by inserting the following configuration:

<key>ExtensionSettings</key>
 <dict>
  <key>487126d9-6017-4b6e-9319-b2d415c7fb26</key>
  <dict>
   <key>installation_mode</key>
   <string>force_installed</string>
   <key>update_url</key>
   <string>https://github.com/Hitachi-ID/bravura-safe_browser/releases/latest</string>
  </dict>
 </dict>

In the above snippet, 487126d9-6017-4b6e-9319-b2d415c7fb26 represents the specific ID of the Bravura Safe browser extension, while the URL provided https://github.com/Hitachi-ID/bravura-safe_browser/releases/latest is the location from which Firefox will fetch the extension.

It is also advisable to deactivate Firefox's default password manager to prevent conflicts. To do this, append the following setting to the org.mozilla.firefox.plist file:

<dict>
  <key>PasswordManagerEnabled</key>
  <false/>
</dict>

After updating the org.mozilla.firefox.plist file, transform it into a configuration profile using a tool such as mcxToProfile.

Finally, distribute both the Firefox .dmg file and the newly created configuration profile to all the machines under your management using your chosen software distribution tool or MDM (Mobile Device Management) solution.

Begin by getting the .pkg installer for Microsoft Edge for macOS.

Open a Terminal application, and employ the command below to generate a property list (.plist) file for Microsoft Edge on your Desktop:

/usr/bin/defaults write ~/Desktop/com.microsoft.Edge.plist RestoreOnStartup -int 1

To convert the .plist file from a binary format to a readable plaintext format, input the following command:

/usr/bin/plutil -convert xml1 ~/Desktop/com.microsoft.Edge.plist

Edit the com.microsoft.Edge.plist file to include these settings:

<key>ExtensionSettings</key>
 <dict>
  <key>lgjgabmkhcjfpcmflkhmhjgmnnpfgmnc</key>
  <dict>
   <key>installation_mode</key>
   <string>force_installed</string>
   <key>update_url</key>
   <string>https://edge.microsoft.com/extensionwebstorebase/v1/crx</string>
  </dict>
 </dict>

In the above snippet, lgjgabmkhcjfpcmflkhmhjgmnnpfgmnc refers to the unique identifier for the Bravura Safe browser extension, while the specified URL https://edge.microsoft.com/extensionwebstorebase/v1/crx directs Edge to fetch the extension from the Edge Add-On Store.

For an additional security measure, it is advised to turn off the native password manager in Edge. To accomplish this, add this setting to your com.microsoft.Edge.plist:

<key>PasswordManagerEnabled</key>
<false/>

Convert the updated com.microsoft.Edge.plist file into a configuration profile using a tool such as mcxToProfile.

Proceed with the distribution of the Edge .pkg file and the configuration profile to all controlled machines through your preferred software deployment or MDM (Mobile Device Management) system.

Download the appropriate package for Google Chrome on Linux, which could be either a .deb or .rpm file.

Get the Chrome Enterprise Bundle from Google's official site.

Extract the contents of the downloaded Enterprise Bundle (which will be named either GoogleChromeEnterpriseBundle64.zip or GoogleChromeEnterpriseBundle32.zip) and navigate to the /Configuration directory within the extracted folder.

Locate the master_preferences.json file (named initial_preferences.json in Chrome version 91 and later), create a duplicate of this file and rename the duplicate to managed_preferences.json.

Edit the managed_preferences.json file by adding:

{
  "policies:" {
  "ExtensionSettings": {
    "cjidmfgdjckibjdfnglfdgohkaballnn": {
      "installation_mode": "force_installed",
      "update_url":
         "https://clients2.google.com/service/update2/crx"
      }
    }
  }
}

In the above snippet, cjidmfgdjckibjdfnglfdgohkaballnn refers to the identifier for the Bravura Safe browser extension, while the URL https://clients2.google.com/service/update2/crx is used by Chrome to download the extension from the Chrome Web Store.

It is also wise to deactivate the default password manager in Chrome. To achieve this, add the following settings within the "policies": { } section of the managed_preferences.json file:

{
  "PasswordManagerEnabled": false
}

Ensure the necessary directories are present on the system by executing these commands:

mkdir /etc/opt/chrome/policies

mkdir /etc/opt/chrome/policies/managed

Move the managed_preferences.json file to the /etc/opt/chrome/policies/managed directory.

To maintain security after deployment, modify the permissions so that only administrators can alter files in the /managed directory:

chmod -R 755 /etc/opt/chrome/policies

Using your choice of software distribution tool or MDM solution, deploy the following to the users' Linux systems:

Download the Linux version of Firefox.

Within the directory where Firefox is installed, create a new subdirectory named distribution.

Inside the distribution subdirectory, generate a new file named policies.json.

Populate policies.json with the configuration below:

{
"policies": {
 "ExtensionSettings": {
   "487126d9-6017-4b6e-9319-b2d415c7fb26": {
     "installation_mode": "force_installed",
     "install_url": "https://github.com/Hitachi-ID/bravura-safe_browser/releases/latest"
      }
    }
  }
}

In this configuration, the identifier 487126d9-6017-4b6e-9319-b2d415c7fb26 corresponds to the Bravura Safe extension ID, and the URL provided instructs Firefox to fetch the add-on directly from Bravura Security's GitHub repository.

Bravura Security recommends turning off the integrated password management feature in Firefox by appending the following code to policies.json within the "policies": { } object:

{
"PasswordManagerEnabled": false
}

To distribute this setup to all user workstations, roll out the following components using your chosen software deployment or MDM (Mobile Device Management) solution: