mirror of
https://github.com/fleetdm/fleet
synced 2026-04-21 13:37:30 +00:00
b482e07605
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #34528 # Details This PR implements the agent changes for allowing Fleet admins to require that users authenticate with an IdP prior to having their devices set up. I'll comment on changes inline but the high-level is: 1. Orbit calls the enroll endpoint as usual. This is triggered lazily by any one of a number of subsystems like device token rotation or requesting Fleet config 2. If the enroll endpoint returns the new `ErrEndUserAuthRequired` response, then it opens a window to the `/mdm/sso` Fleet page and retries the enroll endpoint every 30 seconds indefinitely. 3. Any other non-200 response to the enroll request is treated as before (limited # of retries, with backoff) # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing- changes.md#changes-files) for more information. Will add changelog when story is one. ## Testing - [X] Added/updated automated tests Added test for new retry logic - [X] QA'd all new/changed functionality manually This is kinda hard to test without the associated backend PR: https://github.com/fleetdm/fleet/pull/34835 ## fleetd/orbit/Fleet Desktop - [X] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) This is compatible with all Fleet versions, since older ones won't send the new error. - [X] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes This is compatible with all platforms, although it currently should only ever run on Windows and Linux since macOS devices will have end-user auth taken care of before they even download Orbit. - [ ] Verified that fleetd runs on macOS, Linux and Windows Testing this now. - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added SSO (Single Sign-On) enrollment support for end-user authentication * Enhanced error messaging for authentication-required scenarios * **Bug Fixes** * Improved error handling and retry logic for enrollment failures <!-- end of auto-generated comment: release notes by coderabbit.ai -->
49 lines
1.8 KiB
PHP
49 lines
1.8 KiB
PHP
<?php
|
|
|
|
$metadata['https://localhost:8080'] = array(
|
|
'AssertionConsumerService' => [
|
|
'https://localhost:8080/api/v1/fleet/sso/callback',
|
|
],
|
|
'NameIDFormat' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddres',
|
|
'simplesaml.nameidattribute' => 'email',
|
|
);
|
|
|
|
# Used in integration tests and to validate SSO flows that use a
|
|
# separate application for MDM SSO (with a single
|
|
# AssertionConsumerService)
|
|
$metadata['mdm.test.com'] = array(
|
|
'AssertionConsumerService' => [
|
|
'https://localhost:8080/api/v1/fleet/mdm/sso/callback',
|
|
],
|
|
'NameIDFormat' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddres',
|
|
'simplesaml.nameidattribute' => 'email',
|
|
);
|
|
|
|
# Use for local testing of devices on the same network.
|
|
$metadata['mdm.host.docker.internal'] = array(
|
|
'AssertionConsumerService' => [
|
|
'https://host.docker.internal:8080/api/v1/fleet/mdm/sso/callback',
|
|
],
|
|
'NameIDFormat' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddres',
|
|
'simplesaml.nameidattribute' => 'email',
|
|
);
|
|
|
|
|
|
# Used for testing when sso_settings.entity_id ("sso.test.com") is different than
|
|
# server_settings.server_url (usually "https://localhost:8080").
|
|
$metadata['sso.test.com'] = array(
|
|
'AssertionConsumerService' => [
|
|
'https://localhost:8080/api/v1/fleet/sso/callback',
|
|
],
|
|
'NameIDFormat' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddres',
|
|
'simplesaml.nameidattribute' => 'email',
|
|
);
|
|
|
|
# Used for testing when entity_id is not set, so that it matches the hostname (localhost).
|
|
$metadata['localhost'] = array(
|
|
'AssertionConsumerService' => [
|
|
'https://localhost:8080/api/v1/fleet/sso/callback',
|
|
],
|
|
'NameIDFormat' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddres',
|
|
'simplesaml.nameidattribute' => 'email',
|
|
);
|