Can we deploy a Chrome extension through local http server through GPO settings?

Question

I have a Windows system that is a part of a domain. I've imported the domain GPO chrome .admx file and then created the Chrome GPO policy for 'ExtensionInstallForceList' property by using http://dev.chromium.org/administrators/policy-list-3#ExtensionInstallForcelist as the reference.

Here I've specified the ID for the extension that gets generated when it was loaded in unpacked format. Also, I used the local HTTP server as the place to download. A pseudo value of the property that I used:

eelojgpfkmaaabbbccneneemcahoehjo;http://<some.ip.address>/crx

See attached snapshot for reference:

I've created an IIS server and enabled Directory browsing and then chose the root path of the server to point to the parent folder of 'crx'. I am able to access an xml file present inside crx using this above URL.

However my extension is still not installed. But I also have the extension in the Chrome Webstore and if I use the Webstore URL, the extension is deployed successfully.

As per comments from Xan below and further trials that I performed, I'll add the snapshots for each of the following: 1. 2. Tried FQDN instead of IP address but still couldn't install 3. Changed the GPO to point to the folder that contains the crx file instead of the update URL. Still not installed 4. I had already packed the extension using the link you mentioned. I dragged-n-dropped this packed crx file and found out the new ID. I then used this ID in my updates.xml file as well as in my Chrome GPO policies. However, extension is still not installed on the domain endpoint.

1. Can someone please help me point out exactly what is missing?
2. Is there some issue in the way I configured my IIS server? or
3. Could it be because I used an IP address instead of an FQDN? or
4. Is it because of some other possible configuration error?

Answer 1

You don't specify this well in your question, but I spot a few problems/omissions:

CRXs and IDs

Here I've specified the ID for the extension that gets generated when it was loaded in unpacked format.

This will not work; that ID is just a temporary one based on the hash of the path to the extension.

Chrome needs to generate a keypair and sign the CRX for it to be useable in enterprise deployment.

1. You need to package it as CRX through chrome://extensions's Developer Mode.

2. It will generate a private key .pem that you need to save for any future updates (otherwise the ID will change again and you won't be able to use it as an update).

3. Then, install the CRX on the same machine by dragging it onto chrome://extensions to get its final, signed ID.

   As an alternative to this step, you can use OpenSSL to generate the key from the .pem obtained from the previous steps.

What are you actually hosting?

The URL that you point to in the GPO policy is the Update URL, not the actual CRX file!

See this documentation on Update manifests. Here's an example:

<?xml version='1.0' encoding='UTF-8'?>
<gupdate xmlns='http://www.google.com/update2/response' protocol='2.0'>
  <app appid='eelojgpfkmaaabbbccneneemcahoehjo'>
    <updatecheck codebase='http://<some.ip.address>/actual_extension.crx' version='1.0' />
  </app>
</gupdate>

Modify the updatecheck.version as needed when updating. Don't touch any of the gupdate properties.

How are you serving files?

There may be a minor issue with content-types your server is sending.

I could not find bulletproof information on what should be the content type for the files, but a good guess is:

• application/xml for the update manifest
• application/octet-stream for the CRX file

Still not working?

Perhaps you're on to something with IP vs FDQN. It should be possible for you to create a local DNS entry for the update server - try and see if it helps.

Answer 2

Here's an Alternative Extension Distribution Options documentation for the possible ways on how to distribute Chrome extensions.

All Chrome extensions must be distributed either directly from the Chrome Web Store, using inline installation, or using the mechanisms described below. Failure to comply with one of these distribution methods constitutes a violation of the Chrome extension policy and may result in the extension and/or the software distributing it to be flagged as unwanted software.

You may also check this support page if you want to force install Chrome extensions on corporate-managed Windows devices via machine and OS-user policies.