remove unused logic specific to DEP+Okta+ROP (#11261)

In #10338 we introduced logic to gate DEP profiles behind Okta auth
using the ROP flow.

We're not going to use that, and instead we're going to gate profiles
behind SSO, which can be used from multiple providers and supports SSO
(the initial motivation behind the ROP flow was to create a local user
account.)

This removes some of the old code, which was never used in
production/documented for the public to use.

At the moment I'm leaving the `mdm_idp_accounts` table and related
methods untouched, as it's unclear yet if we're going to need a similar
auxiliar table, and I would rather deal with the migrations all at once.

ee/server/service/mdm.go

@@ -7,14 +7,12 @@ import (
 	"encoding/base64"
 	"errors"
 	"io"
-	"net/url"
 
 	"github.com/fleetdm/fleet/v4/pkg/file"
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
 	"github.com/fleetdm/fleet/v4/server/mdm/apple/mobileconfig"
-	"github.com/fleetdm/fleet/v4/server/service/externalsvc"
 	kitlog "github.com/go-kit/kit/log"
 	"github.com/google/uuid"
 	"github.com/micromdm/nanodep/storage"
@@ -150,52 +148,6 @@ func (svc *Service) MDMAppleDisableFileVaultAndEscrow(ctx context.Context, teamI
 	return ctxerr.Wrap(ctx, err, "disabling FileVault")
 }
 
-func (svc *Service) MDMAppleOktaLogin(ctx context.Context, username, password string) ([]byte, error) {
-	// skipauth: No user context available yet to authorize against.
-	svc.authz.SkipAuthorization(ctx)
-
-	okta := externalsvc.Okta{
-		BaseURL:      svc.config.MDM.OktaServerURL,
-		ClientID:     svc.config.MDM.OktaClientID,
-		ClientSecret: svc.config.MDM.OktaClientSecret,
-	}
-
-	if err := okta.ROPLogin(ctx, username, password); err != nil {
-		if errors.Is(err, externalsvc.ErrInvalidGrant) {
-			return nil, fleet.NewAuthFailedError(err.Error())
-		}
-		return nil, err
-	}
-
-	dict, err := apple_mdm.SaltedSHA512PBKDF2(password)
-	if err != nil {
-		return nil, err
-	}
-
-	uuid := uuid.New().String()
-	err = svc.ds.InsertMDMIdPAccount(ctx, &fleet.MDMIdPAccount{
-		SaltedSHA512PBKDF2Dictionary: dict,
-		UUID:                         uuid,
-		Username:                     username,
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	appConfig, err := svc.ds.AppConfig(ctx)
-	if err != nil {
-		return nil, err
-	}
-
-	query := url.Values{"ref": []string{uuid}}
-	return apple_mdm.GenerateEnrollmentProfileMobileconfig(
-		appConfig.OrgInfo.OrgName,
-		appConfig.ServerSettings.ServerURL+"?"+query.Encode(),
-		svc.config.MDM.AppleSCEPChallenge,
-		svc.mdmPushCertTopic,
-	)
-}
-
 func (svc *Service) MDMAppleUploadBootstrapPackage(ctx context.Context, name string, pkg io.Reader, teamID uint) error {
 	if err := svc.authz.Authorize(ctx, &fleet.MDMAppleBootstrapPackage{TeamID: teamID}, fleet.ActionWrite); err != nil {
 		return err

ee/server/service/mdm_test.go

@@ -11,12 +11,10 @@ import (
 	"github.com/fleetdm/fleet/v4/server/mdm/apple/mobileconfig"
 	"github.com/fleetdm/fleet/v4/server/mock"
 	"github.com/fleetdm/fleet/v4/server/ptr"
-	"github.com/fleetdm/fleet/v4/server/service/externalsvc"
 	"github.com/stretchr/testify/require"
 )
 
-func setup(t *testing.T) (*mock.Store, *Service, *externalsvc.MockOktaServer) {
-	oktaMock := externalsvc.RunMockOktaServer(t)
+func setup(t *testing.T) (*mock.Store, *Service) {
 	ds := new(mock.Store)
 	svc := &Service{
 		ds: ds,
@@ -24,67 +22,10 @@ func setup(t *testing.T) (*mock.Store, *Service, *externalsvc.MockOktaServer) {
 			MDM: config.MDMConfig{
 				AppleSCEPCertBytes: testCert,
 				AppleSCEPKeyBytes:  testKey,
-				OktaServerURL:      oktaMock.Srv.URL,
-				OktaClientID:       oktaMock.ClientID,
-				OktaClientSecret:   oktaMock.ClientSecret(),
 			},
 		},
 	}
-	return ds, svc, oktaMock
-}
-
-func TestMDMAppleOktaLogin(t *testing.T) {
-	ctx := context.Background()
-	ds, svc, oktaMock := setup(t)
-
-	ds.AppConfigFunc = func(ctx context.Context) (*fleet.AppConfig, error) {
-		return &fleet.AppConfig{
-			OrgInfo:        fleet.OrgInfo{OrgName: "Acme Inc."},
-			ServerSettings: fleet.ServerSettings{ServerURL: "https://example.com"},
-		}, nil
-	}
-
-	var uuid string
-	ds.InsertMDMIdPAccountFunc = func(ctx context.Context, account *fleet.MDMIdPAccount) error {
-		uuid = account.UUID
-		require.NotEmpty(t, account.UUID)
-		require.NotEmpty(t, account.SaltedSHA512PBKDF2Dictionary.Entropy)
-		require.NotEmpty(t, account.SaltedSHA512PBKDF2Dictionary.Iterations)
-		require.NotEmpty(t, account.SaltedSHA512PBKDF2Dictionary.Salt)
-		return nil
-	}
-
-	profile, err := svc.MDMAppleOktaLogin(ctx, "bad", "bad")
-	var authFailedError *fleet.AuthFailedError
-	require.ErrorAs(t, err, &authFailedError)
-	require.Nil(t, profile)
-	require.False(t, ds.InsertMDMIdPAccountFuncInvoked)
-
-	profile, err = svc.MDMAppleOktaLogin(ctx, oktaMock.Username, oktaMock.UserPassword)
-	require.NoError(t, err)
-	// enrollment profile contains necessary data
-	require.Contains(t, string(profile), "https://example.com/mdm/apple/mdm?ref="+uuid)
-	require.True(t, ds.AppConfigFuncInvoked)
-	require.True(t, ds.InsertMDMIdPAccountFuncInvoked)
-
-	// error handling
-	appCfgErr := errors.New("appconfig err")
-	ds.AppConfigFunc = func(ctx context.Context) (*fleet.AppConfig, error) {
-		return nil, appCfgErr
-	}
-
-	profile, err = svc.MDMAppleOktaLogin(ctx, oktaMock.Username, oktaMock.UserPassword)
-	require.ErrorIs(t, err, appCfgErr)
-	require.Nil(t, profile)
-
-	idpErr := errors.New("idp err")
-	ds.InsertMDMIdPAccountFunc = func(ctx context.Context, account *fleet.MDMIdPAccount) error {
-		return idpErr
-	}
-	profile, err = svc.MDMAppleOktaLogin(ctx, oktaMock.Username, oktaMock.UserPassword)
-	require.ErrorIs(t, err, idpErr)
-	require.Nil(t, profile)
-
+	return ds, svc
 }
 
 func TestMDMAppleEnableFileVaultAndEscrow(t *testing.T) {
@@ -98,7 +39,7 @@ func TestMDMAppleEnableFileVaultAndEscrow(t *testing.T) {
 	})
 
 	t.Run("fails if the profile can't be saved in the db", func(t *testing.T) {
-		ds, svc, _ := setup(t)
+		ds, svc := setup(t)
 		testErr := errors.New("test")
 		ds.NewMDMAppleConfigProfileFunc = func(ctx context.Context, p fleet.MDMAppleConfigProfile) (*fleet.MDMAppleConfigProfile, error) {
 			return nil, testErr
@@ -110,7 +51,7 @@ func TestMDMAppleEnableFileVaultAndEscrow(t *testing.T) {
 
 	t.Run("happy path", func(t *testing.T) {
 		var teamID uint = 4
-		ds, svc, _ := setup(t)
+		ds, svc := setup(t)
 		ds.NewMDMAppleConfigProfileFunc = func(ctx context.Context, p fleet.MDMAppleConfigProfile) (*fleet.MDMAppleConfigProfile, error) {
 			require.Equal(t, &teamID, p.TeamID)
 			require.Equal(t, p.Identifier, mobileconfig.FleetFileVaultPayloadIdentifier)
@@ -127,7 +68,7 @@ func TestMDMAppleEnableFileVaultAndEscrow(t *testing.T) {
 
 func TestMDMAppleDisableFileVaultAndEscrow(t *testing.T) {
 	var wantTeamID uint
-	ds, svc, _ := setup(t)
+	ds, svc := setup(t)
 	ds.DeleteMDMAppleConfigProfileByTeamAndIdentifierFunc = func(ctx context.Context, teamID *uint, profileIdentifier string) error {
 		require.NotNil(t, teamID)
 		require.Equal(t, wantTeamID, *teamID)