From 744087d2c7201f9028dda708fcb18ed18f64456d Mon Sep 17 00:00:00 2001 From: Gabriel Hernandez Date: Wed, 4 Mar 2026 12:02:35 +0000 Subject: [PATCH] add option to lock end user info during setup experience to UI (#40802) **Related issue:** Resolves #38669 Added the ability to lock end user info on the end use auth section of the setup experience page image # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] QA'd all new/changed functionality manually --- frontend/__mocks__/configMock.ts | 1 + frontend/interfaces/config.ts | 1 + frontend/interfaces/team.ts | 1 + .../EndUserAuthentication.tsx | 24 +++++++++ .../EndUserAuthForm/EndUserAuthForm.tsx | 53 +++++++++++++++++-- frontend/services/entities/mdm.ts | 7 ++- 6 files changed, 82 insertions(+), 5 deletions(-) diff --git a/frontend/__mocks__/configMock.ts b/frontend/__mocks__/configMock.ts index 03e934e186..b0e6a97101 100644 --- a/frontend/__mocks__/configMock.ts +++ b/frontend/__mocks__/configMock.ts @@ -35,6 +35,7 @@ const DEFAULT_CONFIG_MDM_MOCK: IMdmConfig = { macos_setup_assistant: null, enable_release_device_manually: false, require_all_software_macos: false, + lock_end_user_info: false, }, macos_migration: { enable: false, diff --git a/frontend/interfaces/config.ts b/frontend/interfaces/config.ts index 1deb6d17fe..99b6c26b8d 100644 --- a/frontend/interfaces/config.ts +++ b/frontend/interfaces/config.ts @@ -80,6 +80,7 @@ export interface IMdmConfig { enable_release_device_manually: boolean | null; manual_agent_install: boolean | null; require_all_software_macos: boolean | null; + lock_end_user_info: boolean | null; }; macos_migration: IMacOsMigrationSettings; windows_updates: { diff --git a/frontend/interfaces/team.ts b/frontend/interfaces/team.ts index d4118dabf1..75c74343f6 100644 --- a/frontend/interfaces/team.ts +++ b/frontend/interfaces/team.ts @@ -64,6 +64,7 @@ export interface ITeam extends ITeamSummary { enable_release_device_manually: boolean | null; manual_agent_install: boolean | null; require_all_software_macos: boolean | null; + lock_end_user_info: boolean | null; }; windows_updates: { deadline_days: number | null; diff --git a/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/EndUserAuthentication.tsx b/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/EndUserAuthentication.tsx index cddbe6612f..34d4698f0f 100644 --- a/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/EndUserAuthentication.tsx +++ b/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/EndUserAuthentication.tsx @@ -38,6 +38,23 @@ const getEnabledEndUserAuth = ( return teamConfig?.mdm?.macos_setup.enable_end_user_authentication ?? false; }; +const getLockEndUserInfo = ( + currentTeamId: number, + globalConfig?: IConfig, + teamConfig?: ITeamConfig +) => { + if (globalConfig === undefined && teamConfig === undefined) { + return false; + } + + // team is "No team" when currentTeamId === 0 + if (currentTeamId === 0) { + return globalConfig?.mdm?.macos_setup.lock_end_user_info ?? false; + } + + return teamConfig?.mdm?.macos_setup.lock_end_user_info ?? false; +}; + const isIdPConfigured = ({ end_user_authentication: idp, }: Pick) => { @@ -75,6 +92,12 @@ const EndUserAuthentication = ({ teamConfig ); + const defaultLockEndUserInfo = getLockEndUserInfo( + currentTeamId, + globalConfig, + teamConfig + ); + const renderContent = () => { if (!globalConfig || isLoadingGlobalConfig || isLoadingTeamConfig) { return ; @@ -94,6 +117,7 @@ const EndUserAuthentication = ({ )} diff --git a/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/components/EndUserAuthForm/EndUserAuthForm.tsx b/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/components/EndUserAuthForm/EndUserAuthForm.tsx index 2c883f26a4..d8a2367edd 100644 --- a/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/components/EndUserAuthForm/EndUserAuthForm.tsx +++ b/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/components/EndUserAuthForm/EndUserAuthForm.tsx @@ -1,16 +1,17 @@ import React, { useContext, useState } from "react"; +import classnames from "classnames"; import PATHS from "router/paths"; import mdmAPI from "services/entities/mdm"; -import classnames from "classnames"; +import { NotificationContext } from "context/notification"; +import { AppContext } from "context/app"; import Button from "components/buttons/Button"; import Checkbox from "components/forms/fields/Checkbox"; import CustomLink from "components/CustomLink"; import GitOpsModeTooltipWrapper from "components/GitOpsModeTooltipWrapper"; -import { NotificationContext } from "context/notification"; -import { AppContext } from "context/app"; import TooltipWrapper from "components/TooltipWrapper"; +import RevealButton from "components/buttons/RevealButton"; const baseClass = "end-user-auth-form"; @@ -26,11 +27,13 @@ const getTooltipCopy = (android = false) => { interface IEndUserAuthFormProps { currentTeamId: number; defaultIsEndUserAuthEnabled: boolean; + defaultLockEndUserInfo: boolean; } const EndUserAuthForm = ({ currentTeamId, defaultIsEndUserAuthEnabled, + defaultLockEndUserInfo, }: IEndUserAuthFormProps) => { const { renderFlash } = useContext(NotificationContext); const gitOpsModeEnabled = useContext(AppContext).config?.gitops @@ -39,24 +42,35 @@ const EndUserAuthForm = ({ const [isEndUserAuthEnabled, setEndUserAuthEnabled] = useState( defaultIsEndUserAuthEnabled ); + const [lockEndUserInfo, setLockEndUserInfo] = useState( + defaultLockEndUserInfo + ); const [isUpdating, setIsUpdating] = useState(false); + const [showAdvancedOptions, setShowAdvancedOptions] = useState(false); const onToggleEndUserAuth = (newCheckVal: boolean) => { setEndUserAuthEnabled(newCheckVal); }; + const onChangeLockEndUserInfo = (newCheckVal: boolean) => { + setLockEndUserInfo(newCheckVal); + }; + const onClickSave = async () => { setIsUpdating(true); + const canLockEndUserInfo = isEndUserAuthEnabled && lockEndUserInfo; try { await mdmAPI.updateEndUserAuthentication( currentTeamId, - isEndUserAuthEnabled + isEndUserAuthEnabled, + canLockEndUserInfo ); renderFlash("success", "Successfully updated."); } catch { renderFlash("error", "Couldn’t update. Please try again."); } finally { setIsUpdating(false); + setLockEndUserInfo(canLockEndUserInfo); } }; @@ -86,6 +100,37 @@ const EndUserAuthForm = ({ > Turn on + setShowAdvancedOptions(!showAdvancedOptions)} + /> + {showAdvancedOptions && ( + + + End user can't edit the local account's{" "} + Account Name and +
+ Full Name in macOS Setup Assistant. These fields will + be +
+ locked to values from your IdP. + + } + > + Lock end user info + + + )} + (