Distributed profile and key management

A non-transitory computer-readable medium for distributed profile and key management embodying program code executable in a client device that, when executed by the client device, causes the client device to:

• receive, by a first client application of the client device, a partially populated device profile, the partially populated device profile generated by a management service remotely located from the client device to configure atleast one setting on the client device, the partially populated device profile as generated comprising a credential payload portion having a temporary string or an empty portion;
• authenticate, by a second client application, the client device through communication with a third-party security service;
• in response to the client device being authenticated, generate, by the second client application, a credential, wherein the credential is a derived credential, the derived credential being generated using at least one personal identity verification (PIV) card credential;
• provide, by the second client application, the credential to the first client application;
• modify, by the first client application, the partially populated device profile to include the credential to create a fully populated device profile by replacing the temporary string or inserting the credential to generate the fully populated device profile;
• and
• cause, by the first client application, the client device to be configured in accordance with the fully populated device profile.

A computer-implemented method for distributed profile and key management, comprising:

• receiving, by a first client application of the client device, a partially populated device profile, the partially populated device profile generated by a management service remotely located from the client device to configure at least one setting on the client device, the partially populated device profile as generated comprising a credential payload portion having a temporary string or an empty portion;
• authenticating, by a second client application, the client device through communication with a third-party security service;
• in response to the client device being authenticated, generating, by the second client application, a credential, wherein the credential is a derived credential, the derived credential being generated using at least one personal identity verification (PIV) card credential;
• providing, by the second client application, the credential to the first client application;
• modifying, by the first client application, the partially populated device profile to include the credential to create a fully populated device profile by replacing the temporary string or inserting the credential to generate the fully populated device profile;
• and
• configuring, by the first client application, the client device in accordance with the fully populated device profile.