macOS setup experience guide: end user authentication (#24990)
- Put "already configured SSO" message at the top b/c this scenario will apply to most users - Add missing permissions for IdP for end user auth and end user migration - Clean up language in docs - Add redirects for the UI in case content moves later --------- Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com>
This commit is contained in:
Noah Talerman
co-authored by
Marko Lisica
Marko Lisica
parent
32c42c301f
commit
3881d0b9d6
@@ -18,24 +18,24 @@ In addition to the customization above, Fleet automatically installs the fleetd
|
||||
|
||||
macOS setup features require connecting Fleet to Apple Business Manager (ABM). Learn how [here](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager-abm).
|
||||
|
||||
## End user authentication and EULA
|
||||
## End user authentication and end user license agreement (EULA)
|
||||
|
||||
Using Fleet, you can require end users to authenticate with your identity provider (IdP) and agree to an end user license agreement (EULA) before they can use their new Mac.
|
||||
|
||||
### End user authentication
|
||||
|
||||
To require end user authentication, first configure your MDM IdP integration by heading to
|
||||
**Settings > Mobile device management (MDM) > End user authentication**. Then, enable end user
|
||||
authentication by heading to to **Controls > Setup experience > End user authentication**.
|
||||
Alternatively, you can use [Fleet's GitOps workflow](https://github.com/fleetdm/fleet-gitops) to configure your MDM IdP integration and enable end user authentication.
|
||||
> If you've already configured [single sign-on (SSO)](https://fleetdm.com/docs/deploy/single-sign-on-sso) in Fleet, create a new SAML app in your IdP. In your new app, use `https://<your_fleet_url>/api/v1/fleet/mdm/sso/callback` for the SSO URL.
|
||||
|
||||
If you've already configured your MDM IdP integration in Fleet, create a new SAML app in your IdP. In your new app, use `https://<your_fleet_url>/api/v1/fleet/mdm/sso/callback` for the SSO URL.
|
||||
To require end user authentication, first configure your IdP by heading to
|
||||
**Settings > Integrations > Mobile device management (MDM) > End user authentication**. Then, enable end user
|
||||
authentication by heading to **Controls > Setup experience > End user authentication**.
|
||||
Alternatively, you can use [Fleet's GitOps workflow](https://github.com/fleetdm/fleet-gitops) to configure your IdP integration and enable end user authentication.
|
||||
|
||||
In your IdP, make sure your end users' full names are set to one of the following attributes (depends on IdP): `name`, `displayname`, `cn`, `urn:oid:2.5.4.3`, or `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name`. Fleet will automatically populate and lock the macOS local account **Full Name** with any of these.
|
||||
|
||||
In your IdP, set **Name ID** to email. Fleet will trim this email and use it to populate and lock the macOS local account **Account Name**. For example, a "johndoe@example.com" email turn into a "johndoe" account name.
|
||||
|
||||
### EULA
|
||||
### End user license agreement (EULA)
|
||||
|
||||
To require a EULA, in Fleet, head to **Settings > Integrations > Automatic enrollment > End user license agreement (EULA)** or use the [Fleet API](https://fleetdm.com/docs/rest-api/rest-api#upload-an-eula-file).
|
||||
|
||||
|
||||
@@ -93,8 +93,8 @@ GitOps is an API-only and write-only role that can be used on CI/CD pipelines.
|
||||
| Edit [MDM settings](https://fleetdm.com/docs/using-fleet/mdm-macos-settings) | | | | ✅ | ✅ |
|
||||
| Edit [MDM settings for teams](https://fleetdm.com/docs/using-fleet/mdm-macos-settings) | | | | ✅ | ✅ |
|
||||
| View all [MDM settings](https://fleetdm.com/docs/using-fleet/mdm-macos-settings) | | | | ✅ | ✅ |
|
||||
| Edit [macOS setup experience]([https://fleetdm.com/docs/](https://fleetdm.com/guides/macos-setup-experience#basic-article))\* | | | ✅ | ✅ | ✅ |
|
||||
| Edit end user license agreement (EULA)\* | | | | ✅ | |
|
||||
| Edit [macOS setup experience]([https://fleetdm.com/docs/](https://fleetdm.com/guides/macos-setup-experience))\* | | | ✅ | ✅ | ✅ |
|
||||
| Add and edit identity provider for end user authentication, end user license agreement (EULA), and end user migration workflow\* | | | | ✅ | |
|
||||
| Add and edit Simple Certificate Enrollment Protocol (SCEP) server\* | | | | ✅ | ✅ |
|
||||
| Run scripts on hosts | | | ✅ | ✅ | |
|
||||
| View saved scripts\* | ✅ | ✅ | ✅ | ✅ | |
|
||||
|
||||
@@ -91,7 +91,7 @@ If you're configuring end user authentication head to **Settings > Integrations
|
||||
issue authorization requests to the IdP.
|
||||
|
||||
- **Metadata** - If the IdP does not provide a metadata URL, the metadata must
|
||||
be obtained from the IdP and entered. Coming soon to end user authentication.
|
||||
be obtained from the IdP and entered.
|
||||
|
||||
|
||||
|
||||
|
||||
+1
-1
@@ -56,7 +56,7 @@ const EulaUploader = ({ onUpload }: IEulaUploaderProps) => {
|
||||
Require end users to agree to a EULA when they first setup their new
|
||||
macOS hosts.{" "}
|
||||
<CustomLink
|
||||
url="https://fleetdm.com/docs/using-fleet/mdm-macos-setup-experience"
|
||||
url="https://fleetdm.com/learn-more-about/end-user-license-agreement"
|
||||
text="Learn more"
|
||||
newTab
|
||||
/>
|
||||
|
||||
+1
-1
@@ -102,7 +102,7 @@ const IdpSection = () => {
|
||||
Connect Fleet to your identity provider to require end users to
|
||||
authenticate when they first setup their new macOS hosts.{" "}
|
||||
<CustomLink
|
||||
url="https://fleetdm.com/docs/using-fleet/mdm-macos-setup-experience##end-user-authentication-and-eula"
|
||||
url="https://fleetdm.com/learn-more-about/end-user-authentication"
|
||||
text="Learn more"
|
||||
newTab
|
||||
/>
|
||||
|
||||
Vendored
+2
@@ -622,6 +622,8 @@ module.exports.routes = {
|
||||
'GET /learn-more-about/mdm-disk-encryption': '/guides/enforce-disk-encryption',
|
||||
'GET /learn-more-about/encrypt-linux-device': '/guides/linux-disk-encryption-end-user',
|
||||
'GET /contribute-to/policies': 'https://github.com/fleetdm/fleet/edit/main/docs/01-Using-Fleet/standard-query-library/standard-query-library.yml',
|
||||
'GET /learn-more-about/end-user-license-agreement': '/guides/macos-setup-experience#end-user-authentication-and-end-user-license-agreement-eula',
|
||||
'GET /learn-more-about/end-user-authentication': '/guides/macos-setup-experience#end-user-authentication-and-end-user-license-agreement-eula',
|
||||
|
||||
// Sitemap
|
||||
// =============================================================================================================
|
||||
|
||||
Reference in New Issue
Block a user