Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 6 Packages Projects Releases Wiki Activity

Add activity details for BYOD MDM enrollments (#31191)

Browse Source
This commit is contained in:
Sarah Gillespie
2025-07-24 10:28:50 -05:00
committed by GitHub
parent 06428bd767
commit b0f47725fd
10 changed files with 35 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/fleet/activities.go
+10 -5
View File
@@ -895,10 +895,12 @@ func (a ActivityTypeFleetEnrolled) Documentation() (activity string, details str
}
type ActivityTypeMDMEnrolled struct {
HostSerial string `json:"host_serial"`
HostDisplayName string `json:"host_display_name"`
InstalledFromDEP bool `json:"installed_from_dep"`
MDMPlatform string `json:"mdm_platform"`
HostSerial *string `json:"host_serial"`
HostDisplayName string `json:"host_display_name"`
InstalledFromDEP bool `json:"installed_from_dep"`
MDMPlatform string `json:"mdm_platform"`
// EnrollmentID is the unique identifier for the MDM BYOD enrollments. It is nil for other enrollments.
EnrollmentID *string `json:"enrollment_id"`
}
func (a ActivityTypeMDMEnrolled) ActivityName() string {
@@ -911,14 +913,17 @@ func (a ActivityTypeMDMEnrolled) Documentation() (activity string, details strin
- "host_serial": Serial number of the host (Apple enrollments only, always empty for Microsoft).
- "host_display_name": Display name of the host.
- "installed_from_dep": Whether the host was enrolled via DEP (Apple enrollments only, always false for Microsoft).
- "mdm_platform": Used to distinguish between Apple and Microsoft enrollments. Can be "apple", "microsoft" or not present. If missing, this value is treated as "apple" for backwards compatibility.`, `{
- "mdm_platform": Used to distinguish between Apple and Microsoft enrollments. Can be "apple", "microsoft" or not present. If missing, this value is treated as "apple" for backwards compatibility.
- "enrollment_id": The unique identifier for MDM BYOD enrollments; null for other enrollments.`, `{
"host_serial": "C08VQ2AXHT96",
"host_display_name": "MacBookPro16,1 (C08VQ2AXHT96)",
"installed_from_dep": true,
"mdm_platform": "apple"
"enrollment_id": null
}`
}
// TODO(BMAA): Should we add enrollment_id for BYOD unenrollments?
type ActivityTypeMDMUnenrolled struct {
HostSerial string `json:"host_serial"`
HostDisplayName string `json:"host_display_name"`
server/service/apple_mdm.go
+5 -2
View File
@@ -3408,12 +3408,15 @@ func (svc *MDMAppleCheckinAndCommandService) Authenticate(r *mdm.Request, m *mdm
if err != nil {
return ctxerr.Wrap(r.Context, err, "getting checkin info in Authenticate message")
}
// TODO BMAA Update for activity changes
mdmEnrolledActivity := &fleet.ActivityTypeMDMEnrolled{
HostDisplayName: updatedInfo.DisplayName,
InstalledFromDEP: updatedInfo.DEPAssignedToFleet,
MDMPlatform: fleet.MDMPlatformApple,
HostSerial: updatedInfo.HardwareSerial,
}
if r.Type == mdm.UserEnrollmentDevice {
mdmEnrolledActivity.EnrollmentID = ptr.String(m.EnrollmentID)
} else {
mdmEnrolledActivity.HostSerial = ptr.String(updatedInfo.HardwareSerial)
}
return newActivity(
r.Context, nil, mdmEnrolledActivity, svc.ds, svc.logger,
server/service/apple_mdm_test.go
+4 -2
View File
@@ -1175,7 +1175,8 @@ func TestMDMAuthenticateManualEnrollment(t *testing.T) {
require.Nil(t, user)
require.Equal(t, "mdm_enrolled", activity.ActivityName())
require.NotNil(t, a.HostSerial)
require.Equal(t, serial, a.HostSerial)
require.Equal(t, serial, *a.HostSerial)
require.Nil(t, a.EnrollmentID)
require.Equal(t, a.HostDisplayName, fmt.Sprintf("%s (%s)", model, serial))
require.False(t, a.InstalledFromDEP)
require.Equal(t, fleet.MDMPlatformApple, a.MDMPlatform)
@@ -1242,7 +1243,8 @@ func TestMDMAuthenticateADE(t *testing.T) {
require.Nil(t, user)
require.Equal(t, "mdm_enrolled", activity.ActivityName())
require.NotNil(t, a.HostSerial)
require.Equal(t, serial, a.HostSerial)
require.Equal(t, serial, *a.HostSerial)
require.Nil(t, a.EnrollmentID)
require.Equal(t, a.HostDisplayName, fmt.Sprintf("%s (%s)", model, serial))
require.True(t, a.InstalledFromDEP)
require.Equal(t, fleet.MDMPlatformApple, a.MDMPlatform)
server/service/integration_mdm_dep_test.go
+2 -2
View File
@@ -1062,7 +1062,7 @@ func (s *integrationMDMTestSuite) TestDEPProfileAssignment() {
require.JSONEq(
t,
fmt.Sprintf(
`{"host_serial": "%s", "host_display_name": "%s (%s)", "installed_from_dep": true, "mdm_platform": "apple"}`,
`{"host_serial": "%s", "enrollment_id": null, "host_display_name": "%s (%s)", "installed_from_dep": true, "mdm_platform": "apple"}`,
devices[0].SerialNumber, devices[0].Model, devices[0].SerialNumber,
),
string(*activity.Details),
@@ -1294,7 +1294,7 @@ func (s *integrationMDMTestSuite) TestDEPProfileAssignment() {
s.lastActivityMatches(
"mdm_enrolled",
fmt.Sprintf(
`{"host_serial": "%s", "host_display_name": "%s (%s)", "installed_from_dep": true, "mdm_platform": "apple"}`,
`{"host_serial": "%s", "enrollment_id": null, "host_display_name": "%s (%s)", "installed_from_dep": true, "mdm_platform": "apple"}`,
mdmDevice.SerialNumber, mdmDevice.Model, mdmDevice.SerialNumber,
),
0,
server/service/integration_mdm_test.go
+8 -12
View File
@@ -1278,14 +1278,12 @@ func (s *integrationMDMTestSuite) TestAppleMDMDeviceEnrollment() {
err := mdmDeviceA.Enroll()
require.NoError(t, err)
s.lastActivityOfTypeMatches(fleet.ActivityTypeMDMEnrolled{}.ActivityName(),
fmt.Sprintf(`{"host_serial": "%s", "host_display_name": "%s (%s)", "installed_from_dep": false, "mdm_platform": "apple"}`, mdmDeviceA.SerialNumber, mdmDeviceA.Model, mdmDeviceA.SerialNumber), 0)
fmt.Sprintf(`{"host_serial": "%s", "enrollment_id": null, "host_display_name": "%s (%s)", "installed_from_dep": false, "mdm_platform": "apple"}`, mdmDeviceA.SerialNumber, mdmDeviceA.Model, mdmDeviceA.SerialNumber), 0)
mdmDeviceB := mdmtest.NewTestMDMClientAppleDirect(mdmEnrollInfo, "MacBookPro16,1")
err = mdmDeviceB.Enroll()
require.NoError(t, err)
s.lastActivityOfTypeMatches(fleet.ActivityTypeMDMEnrolled{}.ActivityName(),
fmt.Sprintf(`{"host_serial": "%s", "host_display_name": "%s (%s)", "installed_from_dep": false, "mdm_platform": "apple"}`, mdmDeviceB.SerialNumber, mdmDeviceB.Model, mdmDeviceB.SerialNumber), 0)
fmt.Sprintf(`{"host_serial": "%s", "enrollment_id": null, "host_display_name": "%s (%s)", "installed_from_dep": false, "mdm_platform": "apple"}`, mdmDeviceB.SerialNumber, mdmDeviceB.Model, mdmDeviceB.SerialNumber), 0)
// Find the ID of Fleet's MDM solution
var mdmID uint
mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
@@ -7368,7 +7366,8 @@ func (s *integrationMDMTestSuite) TestValidRequestSecurityTokenRequestWithDevice
"mdm_platform": "microsoft",
"host_serial": "%s",
"installed_from_dep": false,
"host_display_name": "%s"
"host_display_name": "%s",
"enrollment_id": null
}`, windowsHost.HardwareSerial, windowsHost.DisplayName()),
0)
@@ -7418,7 +7417,8 @@ func (s *integrationMDMTestSuite) TestValidRequestSecurityTokenRequestWithAzureT
"mdm_platform": "microsoft",
"host_serial": "",
"installed_from_dep": false,
"host_display_name": "DESKTOP-0C89RC0"
"host_display_name": "DESKTOP-0C89RC0",
"enrollment_id": null
}`,
0)
@@ -13873,10 +13873,8 @@ func (s *integrationMDMTestSuite) TestAppleMDMAccountDrivenUserEnrollment() {
require.NoError(t, iPhoneMdmDevice.Enroll())
assert.Equal(t, iPhoneMdmDevice.EnrollInfo.AssignedManagedAppleID, "sso_user@example.com")
// TODO BMAA Update for activity changes
s.lastActivityOfTypeMatches(fleet.ActivityTypeMDMEnrolled{}.ActivityName(),
fmt.Sprintf(`{"host_serial": "%s", "host_display_name": "%s (%s)", "installed_from_dep": false, "mdm_platform": "apple"}`, iPhoneMdmDevice.EnrollmentID(), iPhoneMdmDevice.Model, iPhoneMdmDevice.EnrollmentID()), 0)
fmt.Sprintf(`{"host_serial": null, "enrollment_id": "%s", "host_display_name": "%s (%s)", "installed_from_dep": false, "mdm_platform": "apple"}`, iPhoneMdmDevice.EnrollmentID(), iPhoneMdmDevice.Model, iPhoneMdmDevice.EnrollmentID()), 0)
linkedIDPAccount, err := s.ds.GetMDMIdPAccountByHostUUID(context.Background(), iPhoneMdmDevice.EnrollmentID())
require.NoError(t, err)
require.NotNil(t, linkedIDPAccount)
@@ -13898,10 +13896,8 @@ func (s *integrationMDMTestSuite) TestAppleMDMAccountDrivenUserEnrollment() {
require.NoError(t, iPadMdmDevice.Enroll())
assert.Equal(t, iPadMdmDevice.EnrollInfo.AssignedManagedAppleID, "sso_user2@example.com")
// TODO BMAA Update for activity changes
s.lastActivityOfTypeMatches(fleet.ActivityTypeMDMEnrolled{}.ActivityName(),
fmt.Sprintf(`{"host_serial": "%s", "host_display_name": "%s (%s)", "installed_from_dep": false, "mdm_platform": "apple"}`, iPadMdmDevice.EnrollmentID(), iPadMdmDevice.Model, iPadMdmDevice.EnrollmentID()), 0)
fmt.Sprintf(`{"host_serial": null, "enrollment_id": "%s", "host_display_name": "%s (%s)", "installed_from_dep": false, "mdm_platform": "apple"}`, iPadMdmDevice.EnrollmentID(), iPadMdmDevice.Model, iPadMdmDevice.EnrollmentID()), 0)
linkedIDPAccount, err = s.ds.GetMDMIdPAccountByHostUUID(context.Background(), iPadMdmDevice.EnrollmentID())
require.NoError(t, err)
require.NotNil(t, linkedIDPAccount)
server/service/microsoft_mdm.go
+1 -1
View File
@@ -1848,7 +1848,7 @@ func (svc *Service) storeWindowsMDMEnrolledDevice(ctx context.Context, userID st
ctx, nil, &fleet.ActivityTypeMDMEnrolled{
HostDisplayName: displayName,
MDMPlatform: fleet.MDMPlatformMicrosoft,
HostSerial: serial,
HostSerial: &serial,
})
if err != nil {
// only logging, the device is enrolled at this point, and we