Install Okta Verify on Windows workstations via Fleet-maintained app (#48952)
**Related issue:** N/A (dogfood GitOps change) # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] QA'd all new/changed functionality manually (YAML validated; will verify install + patch policy on a Windows workstation after the GitOps run applies) ## Details Adds Okta Verify to Windows devices on the Workstations team following the same pattern used for it on macOS, including the patch policy: - Replaces the custom-package Okta Verify install (`$DOGFOOD_OKTA_VERIFY_WINDOWS_URL` + custom install/uninstall scripts) with the `okta-verify/windows` Fleet-maintained app — `self_service: true`, `setup_experience: true`, category Security, scoped to "x86-based Windows hosts" (the FMA installer is x86-only). - Adds a "Windows - Okta Verify up to date" patch policy with `install_software: true` for automatic remediation, mirroring the macOS policy. - Adds the "x86 Windows hosts with Okta Verify installed" label that scopes the patch policy to hosts that already have the app. - Cleanup: deletes the now-orphaned custom package YAML and `okta_verify_*.ps1` scripts. Follow-up (not in this PR — requires `workflow` scope): remove the now-unused `DOGFOOD_OKTA_VERIFY_WINDOWS_URL` env line from `.github/workflows/dogfood-gitops.yml` and delete the GitHub secret. Harmless in the meantime — the env var is exported but nothing consumes it. Hosts that installed Okta Verify from the old custom package are picked up by the new label, and the patch policy will auto-update them to the FMA version (currently 6.10.2.0) if they fall behind.
This commit is contained in:
Allen Houchins
@@ -299,13 +299,6 @@ software:
|
||||
# - Browsers
|
||||
# labels_include_any:
|
||||
# - "ARM-based Windows hosts"
|
||||
- path: ../lib/windows/software/okta-verify.yml # Okta Verify for Windows (x86)
|
||||
self_service: true
|
||||
setup_experience: true
|
||||
categories:
|
||||
- Security
|
||||
labels_include_any:
|
||||
- "x86-based Windows hosts"
|
||||
app_store_apps:
|
||||
- app_store_id: "361285480" # Keynote
|
||||
display_name: "Keynote"
|
||||
@@ -552,6 +545,13 @@ software:
|
||||
- Communication
|
||||
labels_include_any:
|
||||
- "x86-based Windows hosts"
|
||||
- slug: okta-verify/windows # Okta Verify for Windows (x86)
|
||||
self_service: true
|
||||
setup_experience: true
|
||||
categories:
|
||||
- Security
|
||||
labels_include_any:
|
||||
- "x86-based Windows hosts"
|
||||
- slug: visual-studio-code/windows # Microsoft Visual Studio for Windows
|
||||
self_service: true
|
||||
labels_include_any:
|
||||
|
||||
@@ -33,6 +33,11 @@
|
||||
query: SELECT 1 FROM programs WHERE name LIKE 'Microsoft Visual Studio Code%' AND EXISTS (SELECT 1 FROM os_version WHERE arch NOT LIKE 'ARM%');
|
||||
label_membership_type: dynamic
|
||||
platform: windows
|
||||
- name: x86 Windows hosts with Okta Verify installed
|
||||
description: x86 Windows hosts with Okta Verify installed
|
||||
query: SELECT 1 FROM programs WHERE name = 'Okta Verify' AND EXISTS (SELECT 1 FROM os_version WHERE arch NOT LIKE 'ARM%');
|
||||
label_membership_type: dynamic
|
||||
platform: windows
|
||||
- name: x86 Windows hosts with Adobe Acrobat Reader installed
|
||||
description: x86 Windows hosts with Adobe Acrobat Reader installed (excludes Adobe Acrobat Pro, which shares the 'Adobe Acrobat (64-bit)' program name on Windows; differentiated by the Reader install_location).
|
||||
query: SELECT 1 FROM programs WHERE ((name = 'Adobe Acrobat (64-bit)' AND publisher LIKE 'Adobe%' AND install_location LIKE '%\Reader\%') OR (name LIKE 'Adobe Acrobat Reader%' AND publisher LIKE 'Adobe%')) AND EXISTS (SELECT 1 FROM os_version WHERE arch NOT LIKE 'ARM%');
|
||||
|
||||
@@ -55,6 +55,14 @@
|
||||
install_software: false
|
||||
labels_include_any:
|
||||
- x86 Windows hosts with Visual Studio Code installed
|
||||
- name: Windows - Okta Verify up to date
|
||||
description: The host may have an outdated version of Okta Verify, potentially risking security vulnerabilities or compatibility issues.
|
||||
resolution: "Okta Verify is an app managed by IT and should be kept up to date automatically. If you are failing this policy, install the latest version from Self-service, then click Refetch. If you are still failing after Refetch completes, drop a note in #help-it."
|
||||
type: patch
|
||||
fleet_maintained_app_slug: okta-verify/windows
|
||||
install_software: true
|
||||
labels_include_any:
|
||||
- x86 Windows hosts with Okta Verify installed
|
||||
- name: Windows - Adobe Acrobat Reader up to date
|
||||
description: This device may have an outdated version of Adobe Acrobat Reader, posing a critical security risk. Adobe Reader is a frequent target for exploits and must be kept up to date at all times.
|
||||
resolution: "Adobe Acrobat Reader is managed by IT and should be updated automatically. If you are failing this policy, install the latest version from Self-service. If you are still failing after Refetch completes, drop a note in #help-it."
|
||||
|
||||
@@ -1,27 +0,0 @@
|
||||
# Learn more about .exe install scripts:
|
||||
# http://fleetdm.com/learn-more-about/exe-install-scripts
|
||||
|
||||
$exeFilePath = "${env:INSTALLER_PATH}"
|
||||
|
||||
try {
|
||||
|
||||
# WiX Burn bootstrapper uses /quiet for silent installation
|
||||
$processOptions = @{
|
||||
FilePath = "$exeFilePath"
|
||||
ArgumentList = "/quiet /norestart"
|
||||
PassThru = $true
|
||||
Wait = $true
|
||||
}
|
||||
|
||||
# Start process and track exit code
|
||||
$process = Start-Process @processOptions
|
||||
$exitCode = $process.ExitCode
|
||||
|
||||
# Prints the exit code
|
||||
Write-Host "Install exit code: $exitCode"
|
||||
Exit $exitCode
|
||||
|
||||
} catch {
|
||||
Write-Host "Error: $_"
|
||||
Exit 1
|
||||
}
|
||||
@@ -1,96 +0,0 @@
|
||||
# Fleet extracts name from installer (EXE) and saves it to PACKAGE_ID
|
||||
# variable
|
||||
$softwareName = $PACKAGE_ID
|
||||
|
||||
# It is recommended to use exact software name here if possible to avoid
|
||||
# uninstalling unintended software.
|
||||
$softwareNameLike = "*Okta Verify*"
|
||||
|
||||
# WiX Burn bootstrapper uses /quiet for silent uninstall
|
||||
$uninstallArgs = "/quiet /norestart"
|
||||
|
||||
$paths = @(
|
||||
'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall',
|
||||
'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall'
|
||||
)
|
||||
|
||||
$exitCode = 0
|
||||
|
||||
try {
|
||||
|
||||
[array]$uninstallKeys = Get-ChildItem `
|
||||
-Path $paths `
|
||||
-ErrorAction SilentlyContinue |
|
||||
ForEach-Object { Get-ItemProperty $_.PSPath }
|
||||
|
||||
$foundUninstaller = $false
|
||||
foreach ($key in $uninstallKeys) {
|
||||
# If needed, add -notlike to the comparison to exclude certain similar
|
||||
# software
|
||||
if ($key.DisplayName -like $softwareNameLike) {
|
||||
$foundUninstaller = $true
|
||||
# Get the uninstall command. Some uninstallers do not include
|
||||
# 'QuietUninstallString' and require a flag to run silently.
|
||||
$uninstallCommand = if ($key.QuietUninstallString) {
|
||||
$key.QuietUninstallString
|
||||
} else {
|
||||
$key.UninstallString
|
||||
}
|
||||
|
||||
# The uninstall command may contain command and args, like:
|
||||
# "C:\Program Files\Software\uninstall.exe" /quiet
|
||||
# Split the command and args
|
||||
$splitArgs = $uninstallCommand.Split('"')
|
||||
if ($splitArgs.Length -gt 1) {
|
||||
if ($splitArgs.Length -eq 3) {
|
||||
$existingArgs = $splitArgs[2].Trim()
|
||||
if ($existingArgs -notmatch '/quiet') {
|
||||
$uninstallArgs = "$existingArgs /quiet /norestart".Trim()
|
||||
} else {
|
||||
$uninstallArgs = $existingArgs
|
||||
}
|
||||
} elseif ($splitArgs.Length -gt 3) {
|
||||
Throw `
|
||||
"Uninstall command contains multiple quoted strings. " +
|
||||
"Please update the uninstall script.`n" +
|
||||
"Uninstall command: $uninstallCommand"
|
||||
}
|
||||
$uninstallCommand = $splitArgs[1]
|
||||
} else {
|
||||
if ($uninstallCommand -notmatch '/quiet') {
|
||||
$uninstallArgs = "/quiet /norestart"
|
||||
} else {
|
||||
$uninstallArgs = ""
|
||||
}
|
||||
}
|
||||
Write-Host "Uninstall command: $uninstallCommand"
|
||||
Write-Host "Uninstall args: $uninstallArgs"
|
||||
|
||||
$processOptions = @{
|
||||
FilePath = $uninstallCommand
|
||||
PassThru = $true
|
||||
Wait = $true
|
||||
}
|
||||
|
||||
if ($uninstallArgs -ne '') {
|
||||
$processOptions.ArgumentList = $uninstallArgs
|
||||
}
|
||||
|
||||
$process = Start-Process @processOptions
|
||||
$exitCode = $process.ExitCode
|
||||
Write-Host "Uninstall exit code: $exitCode"
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
if (-not $foundUninstaller) {
|
||||
Write-Host "Uninstall entry not found for $softwareNameLike"
|
||||
Exit 0
|
||||
}
|
||||
|
||||
Exit $exitCode
|
||||
|
||||
} catch {
|
||||
Write-Host "Error: $_"
|
||||
Exit 1
|
||||
}
|
||||
@@ -1,5 +0,0 @@
|
||||
url: $DOGFOOD_OKTA_VERIFY_WINDOWS_URL
|
||||
install_script:
|
||||
path: ../scripts/okta_verify_install.ps1
|
||||
uninstall_script:
|
||||
path: ../scripts/okta_verify_uninstall.ps1
|
||||
Reference in New Issue
Block a user