From 3881d0b9d6770e79fbb94d2d5bc790c178d10ddd Mon Sep 17 00:00:00 2001 From: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Date: Fri, 27 Dec 2024 10:33:00 -0500 Subject: [PATCH] macOS setup experience guide: end user authentication (#24990) - Put "already configured SSO" message at the top b/c this scenario will apply to most users - Add missing permissions for IdP for end user auth and end user migration - Clean up language in docs - Add redirects for the UI in case content moves later --------- Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com> --- articles/macos-setup-experience.md | 14 +++++++------- articles/role-based-access.md | 4 ++-- docs/Deploy/single-sign-on-sso.md | 2 +- .../components/EulaUploader/EulaUploader.tsx | 2 +- .../components/IdpSection/IdpSection.tsx | 2 +- website/config/routes.js | 2 ++ 6 files changed, 14 insertions(+), 12 deletions(-) diff --git a/articles/macos-setup-experience.md b/articles/macos-setup-experience.md index b72370bac6..0e287879cb 100644 --- a/articles/macos-setup-experience.md +++ b/articles/macos-setup-experience.md @@ -18,24 +18,24 @@ In addition to the customization above, Fleet automatically installs the fleetd macOS setup features require connecting Fleet to Apple Business Manager (ABM). Learn how [here](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager-abm). -## End user authentication and EULA +## End user authentication and end user license agreement (EULA) Using Fleet, you can require end users to authenticate with your identity provider (IdP) and agree to an end user license agreement (EULA) before they can use their new Mac. ### End user authentication -To require end user authentication, first configure your MDM IdP integration by heading to -**Settings > Mobile device management (MDM) > End user authentication**. Then, enable end user -authentication by heading to to **Controls > Setup experience > End user authentication**. -Alternatively, you can use [Fleet's GitOps workflow](https://github.com/fleetdm/fleet-gitops) to configure your MDM IdP integration and enable end user authentication. +> If you've already configured [single sign-on (SSO)](https://fleetdm.com/docs/deploy/single-sign-on-sso) in Fleet, create a new SAML app in your IdP. In your new app, use `https:///api/v1/fleet/mdm/sso/callback` for the SSO URL. -If you've already configured your MDM IdP integration in Fleet, create a new SAML app in your IdP. In your new app, use `https:///api/v1/fleet/mdm/sso/callback` for the SSO URL. +To require end user authentication, first configure your IdP by heading to +**Settings > Integrations > Mobile device management (MDM) > End user authentication**. Then, enable end user +authentication by heading to **Controls > Setup experience > End user authentication**. +Alternatively, you can use [Fleet's GitOps workflow](https://github.com/fleetdm/fleet-gitops) to configure your IdP integration and enable end user authentication. In your IdP, make sure your end users' full names are set to one of the following attributes (depends on IdP): `name`, `displayname`, `cn`, `urn:oid:2.5.4.3`, or `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name`. Fleet will automatically populate and lock the macOS local account **Full Name** with any of these. In your IdP, set **Name ID** to email. Fleet will trim this email and use it to populate and lock the macOS local account **Account Name**. For example, a "johndoe@example.com" email turn into a "johndoe" account name. -### EULA +### End user license agreement (EULA) To require a EULA, in Fleet, head to **Settings > Integrations > Automatic enrollment > End user license agreement (EULA)** or use the [Fleet API](https://fleetdm.com/docs/rest-api/rest-api#upload-an-eula-file). diff --git a/articles/role-based-access.md b/articles/role-based-access.md index 5b89ff26a0..125bbffaed 100644 --- a/articles/role-based-access.md +++ b/articles/role-based-access.md @@ -93,8 +93,8 @@ GitOps is an API-only and write-only role that can be used on CI/CD pipelines. | Edit [MDM settings](https://fleetdm.com/docs/using-fleet/mdm-macos-settings) | | | | ✅ | ✅ | | Edit [MDM settings for teams](https://fleetdm.com/docs/using-fleet/mdm-macos-settings) | | | | ✅ | ✅ | | View all [MDM settings](https://fleetdm.com/docs/using-fleet/mdm-macos-settings) | | | | ✅ | ✅ | -| Edit [macOS setup experience]([https://fleetdm.com/docs/](https://fleetdm.com/guides/macos-setup-experience#basic-article))\* | | | ✅ | ✅ | ✅ | -| Edit end user license agreement (EULA)\* | | | | ✅ | | +| Edit [macOS setup experience]([https://fleetdm.com/docs/](https://fleetdm.com/guides/macos-setup-experience))\* | | | ✅ | ✅ | ✅ | +| Add and edit identity provider for end user authentication, end user license agreement (EULA), and end user migration workflow\* | | | | ✅ | | | Add and edit Simple Certificate Enrollment Protocol (SCEP) server\* | | | | ✅ | ✅ | | Run scripts on hosts | | | ✅ | ✅ | | | View saved scripts\* | ✅ | ✅ | ✅ | ✅ | | diff --git a/docs/Deploy/single-sign-on-sso.md b/docs/Deploy/single-sign-on-sso.md index 5f60ac4647..51d30f1674 100644 --- a/docs/Deploy/single-sign-on-sso.md +++ b/docs/Deploy/single-sign-on-sso.md @@ -91,7 +91,7 @@ If you're configuring end user authentication head to **Settings > Integrations issue authorization requests to the IdP. - **Metadata** - If the IdP does not provide a metadata URL, the metadata must - be obtained from the IdP and entered. Coming soon to end user authentication. + be obtained from the IdP and entered. ![Example SSO Configuration](https://raw.githubusercontent.com/fleetdm/fleet/main/docs/images/sso-setup.png) diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaUploader/EulaUploader.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaUploader/EulaUploader.tsx index 89933f4f11..a35f41e2b6 100644 --- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaUploader/EulaUploader.tsx +++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaUploader/EulaUploader.tsx @@ -56,7 +56,7 @@ const EulaUploader = ({ onUpload }: IEulaUploaderProps) => { Require end users to agree to a EULA when they first setup their new macOS hosts.{" "} diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/IdpSection/IdpSection.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/IdpSection/IdpSection.tsx index 798161c6d0..24c79e3a29 100644 --- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/IdpSection/IdpSection.tsx +++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/IdpSection/IdpSection.tsx @@ -102,7 +102,7 @@ const IdpSection = () => { Connect Fleet to your identity provider to require end users to authenticate when they first setup their new macOS hosts.{" "} diff --git a/website/config/routes.js b/website/config/routes.js index 506c8e19af..4005ddc36a 100644 --- a/website/config/routes.js +++ b/website/config/routes.js @@ -622,6 +622,8 @@ module.exports.routes = { 'GET /learn-more-about/mdm-disk-encryption': '/guides/enforce-disk-encryption', 'GET /learn-more-about/encrypt-linux-device': '/guides/linux-disk-encryption-end-user', 'GET /contribute-to/policies': 'https://github.com/fleetdm/fleet/edit/main/docs/01-Using-Fleet/standard-query-library/standard-query-library.yml', + 'GET /learn-more-about/end-user-license-agreement': '/guides/macos-setup-experience#end-user-authentication-and-end-user-license-agreement-eula', + 'GET /learn-more-about/end-user-authentication': '/guides/macos-setup-experience#end-user-authentication-and-end-user-license-agreement-eula', // Sitemap // =============================================================================================================