From 0dc53ec2c3df54ea09fe13e8dde9652b9f3dd482 Mon Sep 17 00:00:00 2001
From: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
Date: Tue, 17 Mar 2026 21:27:33 -0500
Subject: [PATCH] Switch dogfood SSO to Okta and add metadata URL (#41900)

Add DOGFOOD_OKTA_METADATA_URL to the dogfood GitOps workflow environment
and update SSO configuration to use Okta. it-and-security/default.yml:
change end_user_authentication.entity_id to fleet-end-users and org SSO
entity_id to fleet-admins, set idp_name to Okta for both, remove inline
metadata values, and point metadata_url to $DOGFOOD_OKTA_METADATA_URL.
This centralizes IdP metadata retrieval via a secret URL.
---
 .github/workflows/dogfood-gitops.yml |  1 +
 it-and-security/default.yml          | 16 ++++++----------
 2 files changed, 7 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/dogfood-gitops.yml b/.github/workflows/dogfood-gitops.yml
index b71999a971..5112741232 100644
--- a/.github/workflows/dogfood-gitops.yml
+++ b/.github/workflows/dogfood-gitops.yml
@@ -84,6 +84,7 @@ jobs:
           DOGFOOD_OKTA_CA_CERTIFICATE: ${{ secrets.DOGFOOD_OKTA_CA_CERTIFICATE }}
           DOGFOOD_OKTA_VERIFY_WINDOWS_URL: ${{ secrets.DOGFOOD_OKTA_VERIFY_WINDOWS_URL }}
           DOGFOOD_ENTRA_TENANT_ID: ${{ secrets.DOGFOOD_ENTRA_TENANT_ID }}
+          DOGFOOD_OKTA_METADATA_URL: ${{ secrets.DOGFOOD_OKTA_METADATA_URL }}
 
       - name: Notify on Gitops failure
         if: failure() && github.ref_name == 'main'
diff --git a/it-and-security/default.yml b/it-and-security/default.yml
index 442761b6f4..18af2c0e1a 100644
--- a/it-and-security/default.yml
+++ b/it-and-security/default.yml
@@ -18,11 +18,9 @@ org_settings:
     zendesk: []
   mdm:
     end_user_authentication:
-      entity_id: dogfood-eula.fleetdm.com
-      idp_name: Google Workspace
-      metadata: |-
-        $DOGFOOD_END_USER_SSO_METADATA
-      metadata_url: ""
+      entity_id: fleet-end-users
+      idp_name: Okta
+      metadata_url: "$DOGFOOD_OKTA_METADATA_URL"
     end_user_license_agreement: ../it-and-security/lib/macos/misc/eula.pdf
     apple_business_manager:
       - organization_name: Fleet Device Management Inc.
@@ -58,12 +56,10 @@ org_settings:
     enable_jit_provisioning: true
     enable_sso: true
     enable_sso_idp_login: true
-    entity_id: dogfood.fleetdm.com
+    entity_id: fleet-admins
     idp_image_url: ""
-    idp_name: Google Workspace
-    metadata: |-
-      $DOGFOOD_SSO_METADATA
-    metadata_url: ""
+    idp_name: Okta
+    metadata_url: "$DOGFOOD_OKTA_METADATA_URL"
   webhook_settings:
     failing_policies_webhook:
       destination_url: $DOGFOOD_FAILING_POLICIES_WEBHOOK_URL