Deploying Google Chrome Extensions

[jhuls]

Has anyone deployed extensions to Google Chrome users? Is there a best practices for doing this?

[DanR1974]

Trying to do this as well. So far even putting in UserTemplate doesn't seem to work.

[#3]

Bump. Anyone have a working solution for this?

[CasperSally]

Check this out
http://www.chromium.org/administrators/policy-list-3#ExtensionInstallForcelist

[Matt]

I'm not sure how its done here but I know we have a Chrome policy with paths to extension that we set as a default. I made the plist based off our Windows GPO list however it seems our extensions are stored somewhere and there is a key which we can call that on in the plist.

<key>ExtensionInstallForcelist</key>
    <array>
        <string>gcbommkclmclpchllfjekcdonpmejbdp;https://clients2.google.com/service/update2/crx</string>
        <string>gighmmpiobklfepjocnamgkkbiglidom;https://clients2.google.com/service/update2/crx</string>
        <string>hcghfieafojgpngcjbkbbjfecjbahhif;https://clients2.google.com/service/update2/crx</string>
        <string>heildphpnddilhkemkielfhnkaagiabh;https://clients2.google.com/service/update2/crx</string>
    </array>
    <key>ExtensionInstallWhitelist</key>
    <array>
        <string>gcbommkclmclpchllfjekcdonpmejbdp</string>
        <string>gighmmpiobklfepjocnamgkkbiglidom</string>
        <string>hcghfieafojgpngcjbkbbjfecjbahhif</string>
        <string>heildphpnddilhkemkielfhnkaagiabh</string>
    </array>

[jennifer]

How about just tracking them? Or blocking?

[geekyink]

Was anyone able to successfully push Chrome extensions? I have a need to distribute and activate an extension to my multiple users. Also, Safari too if anyone has info on that as well.

[bentoms]

For Safari I do this: http://macmule.com/2012/08/01/deploying-installing-safari-toolbars/

We don't use Chrome, so not sure.

[jennifer]

I was able to determine that the Chrome extensions are in this folder :

/Users/$loggedInUser/Library/Application Support/Google/Chrome/Default/Extensions/

they are named by odd strings, tweet deck for example is

.../Extensions/hbdpomandigafcibbmofojjchbcdagbl

You could look at packaging that folder and deploying it.

[seanbalsiger]

I have had some success with this. We have an extension developed by one of our developers (@Cycododge on Twitter, without whom this would not have been possible) for an internal site. So far, the only way we have been able to successfully do this on 10.8 and 10.9 is through MCX. Here is how I did it.

We are hosting our extension on our internal network which took a couple extra steps. Follow the instructions outlined here to do so: https://developer.chrome.com/extensions/hosting
. The one thing we discovered while doing this that doesn’t seem to be explicitly mentioned in the documentation is that your policy needs to point at the update_manifest.xml file URL, not the .crx file URL.

Next, a couple pieces of critical information need to be gathered. You will need to find out the extension ID and the update URL of the extensions you are trying to install before continuing on. You can find the extension ID by entering chrome://extensions into your omnibar, then checking the developer mode box. You will now see the ID under each extension, it will be a string of 32 characters. Chrome Extensions are stored in ~/Library/Application Support/Google/Chrome/Default/Extensions and are each in a folder with the extension ID as the name. Somewhere in that folder is a file called manifest.json which is where you will find the update URL. Just open it up using a text editor and find the field called update_url.

Now that you’ve got your extension hosted and you have the ID and update URL, you need to create a managed preference in the JSS. To do so:

1) Copy the Chrome manifest file out of its default location. It can be found at: ```
/Applications/Google Chrome.app/Contents/Resources/com.google.Chrome.manifest/Contents/Resources/com.google.Chrome.manifest
```
2) Log into your JSS and go to Managed Preferences, click New. Scroll down to the bottom of the list in the sidebar and select Custom. This gives you an option to upload a manifest file. This is the annoying/confusing part because once you upload that file you will see a bunch of empty lines with a plus icon button on the right hand side. Each of those lines represents a different key that you can set (they are alphabetical). Unfortunately, Apple doesn’t want JAMF to be awesome so they don’t let them list the key that each line controls so you basically just have to click on them until you find the two that are needed for this which are: ExtensionInstallForcelist and ExtensionInstallWhitelist.

3) Now that you show ExtensionInstallForcelist and ExtensionInstallWhitelist, you can add the values. ExtensionInstallForcelist is expecting it in the format of extensionid;update url and ExtensionInstallWhitelist is just looking for the extension id.

4) Now just set your scope and let it go. I have noticed that it seems like you often have to reboot your computer for these settings to take effect and have been having some other issues but this definitely works and appears to be the way that Google intends for you to do this.

It’s a little irritating that it’s so difficult and requires a reboot when installing an extension while browsing is cake.

Below is a list of links that I found to be useful while researching this:

http://dev.chromium.org/administrators/policy-templates
http://www.chromium.org/administrators/policy-list-3#ExtensionInstallWhitelist
http://dev.chromium.org/administrators/mac-quick-start
https://support.google.com/a/answer/187202?hl=en&ref_topic=2936229

[alex_drinkwater]

Hi seanbalsiger, thanks for the info. Is it possible simply to edit this manifest file and deploy it to an existing Google Chrome installation?

I tried editing the plist as you outline, but it didn't seem to work, unfortunately.

I'm assuming that the specified extensions should be deployed to all users in the background. This didn't seem to be happening.

Alex

[seanbalsiger]

Is it possible simply to edit this manifest file and deploy it to an existing Google Chrome installation?

As far as I can tell, no. I think that the manifest file is supposed to be a template for all possible settings that can be controlled via managed preferences and had no luck with my attempts to edit it.

I tried editing the plist as you outline, but it didn't seem to work, unfortunately.

Which plist were you trying to edit?

I did find that I was able to make this work in 10.8 by using Workgroup Manager to create a Managed Preference which put a file called com.google.Chrome.plist into /Library/Managed Preferences/Username/ (I can outline exactly how I did this if you're interested in pursuing it). Copying that file and replacing a user's com.google.Chrome.plist in ~/Library/Preferences/ with the new one does seem to work but I don't like deleting a plist as a solution. I tried messing around with defaults write to accomplish this but was never successful with that method on 10.8 or 10.9.

The nice thing about using the managed preference method is that it will apply it to all users (except hidden ones) automagically and you only have to manage that one managed preference through the JSS. I'm still new to managed preferences but it seems like they could be very powerful if Apple would make them work right.

[alex_drinkwater]

Thanks for getting back to me.
When I said 'editing the plist file' I meant the manifest. I added the ID and update URL for the keys you mentioned, then restarted. Nothing obvious happened.

I'm actually going to give up on this for the moment. I wanted to pre-install a particular Chrome extension (Awesome Screenshot) for all users, but I've since found an alternative for FireFox that seems to do the job just as well (and doesn't harvest data from your browsing and filter your search results behind your back to earn money for its developer, as apparently Awesome Screenshot does).

Thanks very much for sharing these tips. I may well find it useful in the future, as I'm sure will others.

Cheers,

Alex

[seanbalsiger]

You're welcome.

Okay, I see now. As far as I can tell, this is pretty much the only way to get it to work and you pretty much have to do everything exactly as I explained.

If you decide to pursue this again, I'd be happy to help with any clarification you may need.

[Chriskmpruitt]

Has anyone came up with a way to deploy extensions in 10.9.5?

[jperkins01]

BUMP 10.9.5 Assistance needed for Deploying Chrome Extensions as well. Also, Is there a way to create a way for Groups to have the Install via Self Service??

[elliotjordan]

@alex_drinkwater You may want to reconsider using Awesome Screenshot. I've read suspicious things about it. I use Paparazzi myself, which has similar features.

[mm2270]

Yeah. apparently Awesome Screenshot is in cahoots with some adware company and may be injecting ads into your browser experience without telling you, in addition to possible URL tracking. All around shady tactics.
More details at the TheSafeMac site:
http://www.thesafemac.com/screenshot-extension-injects-ads/

[Chris_Hafner]

Just to add my own recent experience with this, I've found that Google's Chrome management console is a far easier way to manage than managing the manifests directly.

https://support.google.com/chrome/a/answer/6177431?hl=en

[Chris_Hafner]

That is, assuming that you do manage your domain through Google apps that is. For the rest of you... carry on!

[MadPossum]

OK, Having been very successful using @seanbalsiger 's excellent instructions (They work like a charm by the way) How the heck to I remove the extension on a computer that no longer needs it?I don't want to deploy until I know I can "un-deploy"

So far:
I have removed the machine from the scope cleared all the local MCX using dscl and trashed /Library/Managed Preferences. And I've trashed the google extension itself rebooting all along the way (I've wrangled MCX before) when all is said and done a sort of ghost of the Extension keeps showing up in chrome and in the supporting directories. Help?

[Look]

If your using managed preferences you can add them using that.
I am not sure on the official method but I got one working by basically taking the settings for a specific extension out of working profile and adding it to the extensions section of the Managed Preferences file.
When you do this if you 0.0 any version numbers it auto update to the newest version as soon as it is loaded.
Looking @Matt 's post though I wonder if I could then do it with just the data he has used. The particular extension I am loading though (zotero) requires special permissions as well so I suspect it needs a least some additional info.

[jackrum]

When I try to upload the manifest file JSS says No Settings Found and won't let me upload it. Also do you have to host it internally?

[jonmyron]

@seanbalsiger Thanks a million for the instructions above. They worked like a charm. I copied the manifest from the installed Chrome app and uploaded it to managed preferences. I will concur, it was a PITA to search out the whitelist and blacklist. I had to do this 2 times because Jamf (cloud) hung on me and I had to start over. Piece of advice to all those needing to do this, once you find and add the desired settings, Save! Once that was done, I set up the blacklist to deny everything by entering "*", then modified the whitelist to include the extensions that we are allowing. Once I added the scope, it didn't take right away. I opened up terminal on the Mac I was testing and ran "sudo jamf mcx -username {myusername} -verbose" and watched the policy particulars scroll by. I confirmed this worked because I couldn't install anything other than those entries on my list. So many different solutions out there and this was the only one that worked.

[cjames]

@jonmyron If you copy the chrome .manifest on your machine to your desktop. Textedit it & leave only the <dict> entries for ExtensionInstallForcelist and ExtensionInstallWhitelist & save that file. Once you upload the manifest to your new managed preference you'll only have those two custom entries to add. Instead of searching through all the default entries.

@seanbalsiger Thanks for the answer!

[cjames]

@jonmyron If you copy the chrome .manifest on your machine to your desktop. Textedit it & leave only the <dict> entries for ExtensionInstallForcelist and ExtensionInstallWhitelist & save that file. Once you upload the manifest to your new managed preference you'll only have those two custom entries to add. Instead of searching through all the default entries.

@seanbalsiger Thanks for the answer!