Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

Allow end user authentication during automatic MDM enrollment to be enabled on a per-team basis (#11566)

Browse Source
This commit is contained in:
gillespi314
2023-05-10 15:22:08 -05:00
committed by GitHub
parent d367b8862a
commit a9584dc32f
29 changed files with 922 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/fleetctl/apply_test.go
+109
View File
@@ -1258,6 +1258,14 @@ kind: config
spec:
mdm:
macos_setup:
`
appConfigSpecEnableEndUserAuth = `
apiVersion: v1
kind: config
spec:
mdm:
macos_setup:
enable_end_user_authentication: %s
`
team1Spec = `
apiVersion: v1
@@ -1299,6 +1307,16 @@ spec:
macos_setup:
bootstrap_package: %s
macos_setup_assistant: %s
`
team1SpecEnableEndUserAuth = `
apiVersion: v1
kind: team
spec:
team:
name: tm1
mdm:
macos_setup:
enable_end_user_authentication: %s
`
)
@@ -1338,6 +1356,23 @@ spec:
assert.False(t, ds.InsertMDMAppleBootstrapPackageFuncInvoked)
assert.False(t, ds.DeleteMDMAppleBootstrapPackageFuncInvoked)
assert.False(t, ds.SaveTeamFuncInvoked)
// enable_end_user_authentication is premium only
name = writeTmpYml(t, fmt.Sprintf(appConfigSpecEnableEndUserAuth, "true"))
runAppCheckErr(t, []string{"apply", "-f", name}, `applying fleet config: PATCH /api/latest/fleet/config received status 422 Validation Failed: missing or invalid license`)
assert.False(t, ds.SetOrUpdateMDMAppleSetupAssistantFuncInvoked)
assert.False(t, ds.GetMDMAppleBootstrapPackageMetaFuncInvoked)
assert.False(t, ds.InsertMDMAppleBootstrapPackageFuncInvoked)
assert.False(t, ds.DeleteMDMAppleBootstrapPackageFuncInvoked)
assert.False(t, ds.SaveTeamFuncInvoked)
name = writeTmpYml(t, fmt.Sprintf(team1SpecEnableEndUserAuth, "true"))
runAppCheckErr(t, []string{"apply", "-f", name}, `applying teams: missing or invalid license`)
assert.False(t, ds.SetOrUpdateMDMAppleSetupAssistantFuncInvoked)
assert.False(t, ds.GetMDMAppleBootstrapPackageMetaFuncInvoked)
assert.False(t, ds.InsertMDMAppleBootstrapPackageFuncInvoked)
assert.False(t, ds.DeleteMDMAppleBootstrapPackageFuncInvoked)
assert.False(t, ds.SaveTeamFuncInvoked)
})
t.Run("setup assistant invalid file, not json, invalid json", func(t *testing.T) {
@@ -1711,6 +1746,80 @@ spec:
assert.Equal(t, "", mockStore.appConfig.MDM.MacOSSetup.BootstrapPackage.Value)
mockStore.Unlock()
})
// // TODO: restore this test when we have a way to mock the Apple Business Manager API in
// // fleetctl tests
// t.Run("enable end user authentication", func(t *testing.T) {
// ds := setupServer(t, true)
// // setup app config
// b, err := os.ReadFile(filepath.Join("testdata", "macosSetupExpectedAppConfigEmpty.yml"))
// require.NoError(t, err)
// expectedNotSetAppConfg := string(b)
// assert.YAMLEq(t, expectedNotSetAppConfg, runAppForTest(t, []string{"get", "config", "--yaml"}))
// // enable end user auth in app config
// name := writeTmpYml(t, fmt.Sprintf(appConfigSpecEnableEndUserAuth, "true"))
// _, err = runAppNoChecks([]string{"apply", "-f", name})
// require.NoError(t, err)
// assert.False(t, ds.SetOrUpdateMDMAppleSetupAssistantFuncInvoked)
// assert.False(t, ds.GetMDMAppleBootstrapPackageMetaFuncInvoked)
// assert.False(t, ds.InsertMDMAppleBootstrapPackageFuncInvoked)
// assert.False(t, ds.DeleteMDMAppleBootstrapPackageFuncInvoked)
// assert.True(t, ds.SaveAppConfigFuncInvoked)
// expectedSetAppCfg := strings.ReplaceAll(expectedNotSetAppConfg, "enable_end_user_authentication: false", "enable_end_user_authentication: true")
// assert.YAMLEq(t, expectedSetAppCfg, runAppForTest(t, []string{"get", "config", "--yaml"}))
// ds.SaveAppConfigFuncInvoked = false
// // disable end user auth in app config
// name = writeTmpYml(t, fmt.Sprintf(appConfigSpecEnableEndUserAuth, "false"))
// _, err = runAppNoChecks([]string{"apply", "-f", name})
// require.NoError(t, err)
// assert.False(t, ds.SetOrUpdateMDMAppleSetupAssistantFuncInvoked)
// assert.False(t, ds.GetMDMAppleBootstrapPackageMetaFuncInvoked)
// assert.False(t, ds.InsertMDMAppleBootstrapPackageFuncInvoked)
// assert.False(t, ds.DeleteMDMAppleBootstrapPackageFuncInvoked)
// assert.True(t, ds.SaveAppConfigFuncInvoked)
// assert.YAMLEq(t, expectedNotSetAppConfg, runAppForTest(t, []string{"get", "config", "--yaml"}))
// ds.SaveAppConfigFuncInvoked = false
// // setup team config
// assert.False(t, ds.SaveTeamFuncInvoked)
// b, err = os.ReadFile(filepath.Join("testdata", "macosSetupExpectedTeam1Empty.yml"))
// require.NoError(t, err)
// expectedNotSetTeam1 := string(b)
// assert.YAMLEq(t, expectedNotSetTeam1, runAppForTest(t, []string{"get", "teams", "--yaml"}))
// // enable end user auth in team config
// name = writeTmpYml(t, fmt.Sprintf(team1SpecEnableEndUserAuth, "true"))
// _, err = runAppNoChecks([]string{"apply", "-f", name})
// require.NoError(t, err)
// assert.False(t, ds.SetOrUpdateMDMAppleSetupAssistantFuncInvoked)
// assert.False(t, ds.GetMDMAppleBootstrapPackageMetaFuncInvoked)
// assert.False(t, ds.InsertMDMAppleBootstrapPackageFuncInvoked)
// assert.False(t, ds.DeleteMDMAppleBootstrapPackageFuncInvoked)
// assert.False(t, ds.SaveAppConfigFuncInvoked)
// assert.True(t, ds.SaveTeamFuncInvoked)
// expectedSetTeam1 := strings.ReplaceAll(expectedNotSetTeam1, "enable_end_user_authentication: false", "enable_end_user_authentication: true")
// expectedSetTeam1 = strings.ReplaceAll(expectedSetTeam1, "enable_host_users: false", "enable_host_users: true")
// expectedSetTeam1 = strings.ReplaceAll(expectedSetTeam1, "enable_software_inventory: false", "enable_software_inventory: true")
// assert.YAMLEq(t, expectedSetTeam1, runAppForTest(t, []string{"get", "teams", "--yaml"}))
// ds.SaveTeamFuncInvoked = false
// // disable end user auth in team config
// name = writeTmpYml(t, fmt.Sprintf(team1SpecEnableEndUserAuth, "false"))
// _, err = runAppNoChecks([]string{"apply", "-f", name})
// require.NoError(t, err)
// assert.False(t, ds.SetOrUpdateMDMAppleSetupAssistantFuncInvoked)
// assert.False(t, ds.GetMDMAppleBootstrapPackageMetaFuncInvoked)
// assert.False(t, ds.InsertMDMAppleBootstrapPackageFuncInvoked)
// assert.False(t, ds.DeleteMDMAppleBootstrapPackageFuncInvoked)
// assert.False(t, ds.SaveAppConfigFuncInvoked)
// assert.True(t, ds.SaveTeamFuncInvoked)
// expectedSetTeam1 = strings.ReplaceAll(expectedSetTeam1, "enable_end_user_authentication: true", "enable_end_user_authentication: false")
// assert.YAMLEq(t, expectedSetTeam1, runAppForTest(t, []string{"get", "teams", "--yaml"}))
// ds.SaveTeamFuncInvoked = false
// })
}
func TestApplySpecs(t *testing.T) {
cmd/fleetctl/testdata/expectedGetConfigAppConfigJson.json
Vendored
+1
View File
@@ -92,6 +92,7 @@
},
"macos_setup": {
"bootstrap_package": null,
"enable_end_user_authentication": false,
"macos_setup_assistant": null
},
"end_user_authentication": {
cmd/fleetctl/testdata/expectedGetConfigAppConfigYaml.yml
Vendored
+1
View File
@@ -26,6 +26,7 @@ spec:
enable_disk_encryption: false
macos_setup:
bootstrap_package:
enable_end_user_authentication: false
macos_setup_assistant:
end_user_authentication:
idp_name: ""
cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.json
Vendored
+1
View File
@@ -50,6 +50,7 @@
},
"macos_setup": {
"bootstrap_package": null,
"enable_end_user_authentication": false,
"macos_setup_assistant": null
},
"end_user_authentication": {
cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.yml
Vendored
+1
View File
@@ -26,6 +26,7 @@ spec:
enable_disk_encryption: false
macos_setup:
bootstrap_package:
enable_end_user_authentication: false
macos_setup_assistant:
end_user_authentication:
idp_name: ""
cmd/fleetctl/testdata/expectedGetTeamsJson.json
Vendored
+2
View File
@@ -34,6 +34,7 @@
},
"macos_setup": {
"bootstrap_package": null,
"enable_end_user_authentication": false,
"macos_setup_assistant": null
}
},
@@ -93,6 +94,7 @@
},
"macos_setup": {
"bootstrap_package": null,
"enable_end_user_authentication": false,
"macos_setup_assistant": null
}
},
cmd/fleetctl/testdata/expectedGetTeamsYaml.yml
Vendored
+2
View File
@@ -15,6 +15,7 @@ spec:
enable_disk_encryption: false
macos_setup:
bootstrap_package:
enable_end_user_authentication: false
macos_setup_assistant:
name: team1
---
@@ -43,5 +44,6 @@ spec:
enable_disk_encryption: false
macos_setup:
bootstrap_package:
enable_end_user_authentication: false
macos_setup_assistant:
name: team2
cmd/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.yml
Vendored
+1
View File
@@ -23,6 +23,7 @@ spec:
enable_disk_encryption: false
macos_setup:
bootstrap_package: null
enable_end_user_authentication: false
macos_setup_assistant: null
macos_updates:
deadline: ""
cmd/fleetctl/testdata/macosSetupExpectedAppConfigSet.yml
Vendored
+1
View File
@@ -23,6 +23,7 @@ spec:
enable_disk_encryption: false
macos_setup:
bootstrap_package: %s
enable_end_user_authentication: false
macos_setup_assistant: %s
macos_updates:
deadline: ""
cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Empty.yml
Vendored
+1
View File
@@ -12,6 +12,7 @@ spec:
enable_disk_encryption: false
macos_setup:
bootstrap_package: null
enable_end_user_authentication: false
macos_setup_assistant: null
macos_updates:
deadline: ""
cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Set.yml
Vendored
+1
View File
@@ -12,6 +12,7 @@ spec:
enable_disk_encryption: false
macos_setup:
bootstrap_package: %s
enable_end_user_authentication: false
macos_setup_assistant: %s
macos_updates:
deadline: ""
cmd/fleetctl/testdata/macosSetupExpectedTeam1Empty.yml
Vendored
+1
View File
@@ -12,6 +12,7 @@ spec:
enable_disk_encryption: false
macos_setup:
bootstrap_package: null
enable_end_user_authentication: false
macos_setup_assistant: null
macos_updates:
deadline: ""