mirror of
https://github.com/fleetdm/fleet
synced 2026-05-23 00:49:03 +00:00
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #34528 # Details This PR implements the agent changes for allowing Fleet admins to require that users authenticate with an IdP prior to having their devices set up. I'll comment on changes inline but the high-level is: 1. Orbit calls the enroll endpoint as usual. This is triggered lazily by any one of a number of subsystems like device token rotation or requesting Fleet config 2. If the enroll endpoint returns the new `ErrEndUserAuthRequired` response, then it opens a window to the `/mdm/sso` Fleet page and retries the enroll endpoint every 30 seconds indefinitely. 3. Any other non-200 response to the enroll request is treated as before (limited # of retries, with backoff) # Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing- changes.md#changes-files) for more information. Will add changelog when story is one. ## Testing - [X] Added/updated automated tests Added test for new retry logic - [X] QA'd all new/changed functionality manually This is kinda hard to test without the associated backend PR: https://github.com/fleetdm/fleet/pull/34835 ## fleetd/orbit/Fleet Desktop - [X] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) This is compatible with all Fleet versions, since older ones won't send the new error. - [X] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes This is compatible with all platforms, although it currently should only ever run on Windows and Linux since macOS devices will have end-user auth taken care of before they even download Orbit. - [ ] Verified that fleetd runs on macOS, Linux and Windows Testing this now. - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added SSO (Single Sign-On) enrollment support for end-user authentication * Enhanced error messaging for authentication-required scenarios * **Bug Fixes** * Improved error handling and retry logic for enrollment failures <!-- end of auto-generated comment: release notes by coderabbit.ai -->
146 lines
3.4 KiB
Go
146 lines
3.4 KiB
Go
package retry
|
|
|
|
import (
|
|
"errors"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
var errTest = errors.New("test error")
|
|
|
|
func TestRetryDo(t *testing.T) {
|
|
t.Run("WithMaxAttempts only performs the operation the configured number of times", func(t *testing.T) {
|
|
count := 0
|
|
maxAttempts := 3
|
|
|
|
err := Do(func() error {
|
|
count++
|
|
return errTest
|
|
}, WithMaxAttempts(maxAttempts), WithInterval(1*time.Millisecond))
|
|
|
|
require.ErrorIs(t, errTest, err)
|
|
require.Equal(t, maxAttempts, count)
|
|
})
|
|
|
|
t.Run("operations are run an unlimited number of times by default", func(t *testing.T) {
|
|
count := 0
|
|
maxAttempts := 10
|
|
|
|
err := Do(func() error {
|
|
if count++; count != maxAttempts {
|
|
return errTest
|
|
}
|
|
return nil
|
|
}, WithInterval(1*time.Millisecond))
|
|
|
|
require.NoError(t, err)
|
|
require.Equal(t, maxAttempts, count)
|
|
})
|
|
|
|
t.Run("with backoff", func(t *testing.T) {
|
|
count := 0
|
|
maxAttempts := 4
|
|
start := time.Now()
|
|
err := Do(func() error {
|
|
switch count {
|
|
case 0:
|
|
require.WithinDuration(t, start, time.Now(), 1*time.Millisecond)
|
|
case 1:
|
|
require.WithinDuration(t, start.Add(50*time.Millisecond), time.Now(), 10*time.Millisecond)
|
|
case 2:
|
|
require.WithinDuration(t, start.Add((50+100)*time.Millisecond), time.Now(), 10*time.Millisecond)
|
|
case 3:
|
|
require.WithinDuration(t, start.Add((50+100+200)*time.Millisecond), time.Now(), 10*time.Millisecond)
|
|
}
|
|
count++
|
|
if count != maxAttempts {
|
|
return errTest
|
|
}
|
|
return nil
|
|
},
|
|
WithInterval(50*time.Millisecond),
|
|
WithBackoffMultiplier(2),
|
|
WithMaxAttempts(4),
|
|
)
|
|
|
|
require.NoError(t, err)
|
|
require.Equal(t, maxAttempts, count)
|
|
})
|
|
|
|
t.Run("with error filter (test ignore)", func(t *testing.T) {
|
|
count := 0
|
|
err := Do(func() error {
|
|
count++
|
|
if count == 1 {
|
|
return errors.New("normal")
|
|
}
|
|
if count == 2 {
|
|
return errors.New("reset")
|
|
}
|
|
if count == 3 {
|
|
return errors.New("ignore")
|
|
}
|
|
return nil
|
|
},
|
|
WithInterval(50*time.Millisecond),
|
|
// We should actually run 3 times, but since one
|
|
// of the errors causes a reset, we set max attempts to 2
|
|
// to ensure that the reset logic is exercised.
|
|
WithMaxAttempts(2),
|
|
WithErrorFilter(func(err error) ErrorOutcome {
|
|
if err.Error() == "normal" {
|
|
return ErrorOutcomeNormalRetry
|
|
}
|
|
if err.Error() == "reset" {
|
|
return ErrorOutcomeResetAttempts
|
|
}
|
|
if err.Error() == "ignore" {
|
|
return ErrorOutcomeIgnore
|
|
}
|
|
return ErrorOutcomeDoNotRetry
|
|
}),
|
|
)
|
|
|
|
require.NoError(t, err)
|
|
require.Equal(t, 3, count)
|
|
})
|
|
|
|
t.Run("with error filter (test noretry)", func(t *testing.T) {
|
|
count := 0
|
|
err := Do(func() error {
|
|
count++
|
|
if count == 1 {
|
|
return errors.New("normal")
|
|
}
|
|
if count == 2 {
|
|
return errors.New("reset")
|
|
}
|
|
if count == 3 {
|
|
return errors.New("stop")
|
|
}
|
|
return nil
|
|
},
|
|
WithInterval(50*time.Millisecond),
|
|
// We should only actually run 3 times, setting this to 10
|
|
// tests that the DoNotRetry logic is exercised.
|
|
WithMaxAttempts(10),
|
|
WithErrorFilter(func(err error) ErrorOutcome {
|
|
if err.Error() == "normal" {
|
|
return ErrorOutcomeNormalRetry
|
|
}
|
|
if err.Error() == "reset" {
|
|
return ErrorOutcomeResetAttempts
|
|
}
|
|
if err.Error() == "stop" {
|
|
return ErrorOutcomeDoNotRetry
|
|
}
|
|
return ErrorOutcomeNormalRetry
|
|
}),
|
|
)
|
|
|
|
require.ErrorContains(t, err, "stop")
|
|
require.Equal(t, 3, count)
|
|
})
|
|
}
|